last executing test programs: 5m20.575256979s ago: executing program 1 (id=8165): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$IMGETCOUNT(r3, 0x80044943, &(0x7f0000000000)) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x8c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0xfff1, 0xe}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x1, 0xc, 0x9], 0x0, [0x8, 0x4, 0x2, 0x0, 0x8, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff]}}]}}]}, 0x8c}}, 0x0) 5m20.365819345s ago: executing program 1 (id=8170): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x43, &(0x7f0000000340)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x2}}, {{@in=@loopback}, 0x0, @in6=@private1={0xfc, 0x1, '\x00', 0x4}}}, 0xe8) r1 = socket$kcm(0x2, 0x1, 0x84) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000100)={'filter\x00', 0x4, [{}, {}, {}, {}]}, 0x68) sendmsg$inet(r1, &(0x7f0000000600)={&(0x7f00000001c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000640)="80", 0x26892}], 0x1}, 0xfc) sendmsg$inet(r1, &(0x7f0000000680)={&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000240)="f9", 0x1}], 0x1}, 0x24000004) sendmsg$inet(r1, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000200)="cd", 0x1}], 0x1}, 0x240448c4) 5m19.418162197s ago: executing program 1 (id=8195): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000001400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x34, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x8, 0x3, 0x0, 0x1, [{0x4}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) close(r0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) recvfrom(r1, 0x0, 0x0, 0x40002062, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000340)={'vlan0\x00', &(0x7f0000000000)=@ethtool_drvinfo={0x3, "ffe1f013337d4204d96dfe1f11d1c8787749e3f7324d65500381af154df1f57e", "ab0632bee387e06a405323455ca641ba4b5844c9e4b3c2329bf2708f2874dce8", "15bd0d5b6ad3c88c8f6c2e714eae2f914bc31e59492a6a882d7a4b9fd39a4ca7", "9082f20656a6dd65e4f71dcf75db27233224553d46135a2d0363c0571321102b", "b86d853d3d8afdad41878e1ad1325095ef21e5c550f1ab6efd744e9e23f60528", "c01738e55deea891cbba16e5", 0x0, 0x2a89, 0x0, 0x10000, 0x1fe}}) 5m19.204777184s ago: executing program 1 (id=8199): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x0, 0xcd) r2 = getuid() ioctl$SIOCAX25GETUID(r1, 0x89e0, &(0x7f00000000c0)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, r2}) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) (async) ioctl$TUNSETOWNER(r3, 0x400454cc, 0xee01) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x102}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8, 0x3, 0xffffffe1}]}}}]}, 0x3c}}, 0x0) 5m18.86965716s ago: executing program 1 (id=8203): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, 0x0, 0x26}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xf, &(0x7f00000002c0)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x3}, 0x90) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000f80)={0x18, 0x43, 0x107, 0xfffffffa, 0x25dfdbfc, {0x3, 0x7c}, [@nested={0x4, 0x1}]}, 0x18}}, 0x2000c000) (async) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000f80)={0x18, 0x43, 0x107, 0xfffffffa, 0x25dfdbfc, {0x3, 0x7c}, [@nested={0x4, 0x1}]}, 0x18}}, 0x2000c000) 5m18.76801204s ago: executing program 1 (id=8204): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000001c0), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) socket$key(0xf, 0x3, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz0\x00', 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f00000000c0), 0x40) 5m3.727961476s ago: executing program 32 (id=8204): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000300), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f00000001c0), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000200)=0x1, 0x12) socket$key(0xf, 0x3, 0x2) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz0\x00', 0x200002, 0x0) r6 = openat$cgroup_procs(r5, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f00000000c0), 0x40) 12.554522654s ago: executing program 5 (id=11264): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r2, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f0000000040)={0x89, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e23, 0x0, 'lc\x00', 0xb, 0x9, 0x2d}, 0x2c) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x23, &(0x7f0000000340)={0x0, 0x5}, 0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="a7263046", @ANYRES16=r0, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r4, @ANYBLOB="080026006c09000008002700000000000800a100000000000500180101000000"], 0x3c}}, 0x884) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) socket$inet_mptcp(0x2, 0x1, 0x106) (async) setsockopt$IP_VS_SO_SET_DELDEST(r1, 0x0, 0x488, 0x0, 0x0) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) setsockopt(r2, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) (async) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f0000000040)={0x89, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e23, 0x0, 'lc\x00', 0xb, 0x9, 0x2d}, 0x2c) (async) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x23, &(0x7f0000000340)={0x0, 0x5}, 0x8) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="a7263046", @ANYRES16=r0, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r4, @ANYBLOB="080026006c09000008002700000000000800a100000000000500180101000000"], 0x3c}}, 0x884) (async) 12.312462015s ago: executing program 5 (id=11267): r0 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r0, &(0x7f0000000880)={0x28, 0x0, 0x0, @local}, 0x10) shutdown(r0, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)={0x5c, r2, 0x1, 0x70bd26, 0x1, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3f, 0x4, {'gcm(aes)\x00', 0x1c, "a45ba7b17c0d1d615ef89e29052938778f8668c7f76477"}}]}, @TIPC_NLA_BEARER={0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x0) poll(&(0x7f0000000040)=[{r0, 0x82}], 0x1, 0x800) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000080)=0x2, 0x4) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) shutdown(r3, 0x1) r4 = socket$inet(0x2, 0x3, 0xa) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000480)=@raw={'raw\x00', 0x8, 0x3, 0x338, 0x0, 0xe138, 0x198, 0x1c0, 0x198, 0x2a0, 0x358, 0x358, 0x2a0, 0x358, 0x3, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, '\x00', 'veth0_to_bond\x00', {}, {}, 0x21}, 0x0, 0x158, 0x1c0, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'fsm\x00', "0d000400000000000e000004fff0cf81dfd28c89544e14cd3e01dd24289831867846c88621039b284c3ff45c42995560a99952bed40cf5a8c1df6cdbdb7e2378d5afd35f4c16827f55b3af494e39e8fb330200000000000032b6a99a8d87298e88a94cb519f5c17631af916a0002000000000000000000000000000000000049", 0x8}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x4, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz0\x00', {0xfffffffffffffffc}}}}, {{@uncond, 0x0, 0x98, 0xe0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x398) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newtaction={0x48, 0x30, 0x9e54f29ff072a93b, 0x0, 0x0, {}, [{0x34, 0x1, [@m_csum={0x30, 0x1, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}]}]}, 0x48}}, 0x0) 11.992689941s ago: executing program 5 (id=11271): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000100)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295b5, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, r2}, [@IFA_CACHEINFO={0x14, 0x6, {0x40000000, 0xfffff001, 0x100000}}, @IFA_LOCAL={0x14, 0x2, @local}]}, 0x40}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'team0\x00', &(0x7f0000000140)=@ethtool_drvinfo={0x3, "c494ab8f9e8b3f3a9872c4161da8ed47166ee37b897327e93cb2d9d367373008", "40d484747764ea8a744f25944c084fbf2261d317b25d61c4d7ee0412aef194e4", "5ee939a1739449d26d2776a5a3d94325442d33f83df21029f719858a51b00564", "d1f5a99d3e9ae478320997abab2031deced86ca52c76122cb2b5d0732529d1f3", "f1d3608604f905bc4572e8d8d2e74dc8d21e4e3fb450b58fd745ef48ec8e9ca3", "96f321a4f4303e172b584de7", 0x0, 0x343d2c68, 0x0, 0x2}}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f0000000000)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000040)=0x14) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000080)={r3, 0x3, 0x270a}, 0x8) 11.78264406s ago: executing program 5 (id=11275): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000003039d3d70010950000007ab00000000000"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005002100000000080500010004"], 0x4c}}, 0x0) (async) r2 = socket$nl_rdma(0x10, 0x3, 0x14) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x2, 0x3, 0x401, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x4) write(r5, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) (async) sendmsg$IPSET_CMD_GET_BYINDEX(r5, &(0x7f00000004c0)={&(0x7f0000000400), 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, 0xf, 0x6, 0x401, 0x0, 0x0, {0x4, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x44044) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f00000001c0)={r4}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)={0x20, r8, 0x1, 0x470bd28, 0x4, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_TID_CONFIG={0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x20000094}, 0x80) sendmsg$NL80211_CMD_SET_MPATH(r6, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x5c, r8, 0x800, 0x1000, 0x7f, {{}, {@void, @val={0xc, 0x99, {0x80000000, 0x59}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24004880}, 0x2048814) (async, rerun: 64) sendmsg$NFQNL_MSG_CONFIG(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x2}}]}, 0x1c}}, 0x0) (rerun: 64) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x18, 0x1411, 0x828949ab3fe143d7, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x18}}, 0x0) 11.508342147s ago: executing program 5 (id=11281): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) setsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, &(0x7f0000000080)=0xffffffff, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000300)='syzkaller\x00', 0x5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 11.331220986s ago: executing program 5 (id=11287): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x3, 0x2}}, @ptr={0x0, 0x0, 0x0, 0x2, 0x3}, @func={0x9}]}}, 0x0, 0x4a}, 0x28) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r1, @ANYBLOB="0c00990000000000000000000800a102ffff0000080026008d03000008009f"], 0x40}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=@newlink={0x40, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x4, 0x0, 0x300}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x40}, 0x1, 0x0, 0x0, 0x4}, 0x8044) socket$kcm(0xa, 0x922000000003, 0x11) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), r4) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32, @ANYBLOB="08000100", @ANYRES32, @ANYBLOB="0800030002000000080007006401010108000700ac1414bb0800020003"], 0x78}}, 0x0) r6 = socket(0x22, 0x2, 0x2) getsockopt$inet_sctp_SCTP_ASSOCINFO(r6, 0x84, 0x1, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000001480)={@local, @multicast, @void, {@ipv4={0x800, @udp={{0x8, 0x4, 0x0, 0x3, 0x30, 0x67, 0x0, 0x5, 0x11, 0x0, @private=0xa010101, @local, {[@generic={0x44, 0x5, "ff6852"}, @ra={0x94, 0x4}]}}, {0x4e23, 0x4e22, 0x10, 0x0, @gue={{0x2, 0x0, 0x0, 0x6, 0x0, @val=0x80}}}}}}}, 0x0) 5.556692448s ago: executing program 3 (id=11341): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMK(r1, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029cf7000fcdbdf257b00000008000300", @ANYRES32=r3, @ANYBLOB="0a00060008021100000000001400fe00a146dc2ebdd83c76e5b6b9240efa16e6"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x40000) 5.391660613s ago: executing program 3 (id=11343): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000005000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af0ff00000000bfa200000000000007020000d5ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000c00)=@bpf_tracing={0x1a, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@call]}, &(0x7f0000000a00)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x1c, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x13b02, r1, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000c00)=@bpf_tracing={0x1a, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4}, [@call]}, &(0x7f0000000a00)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, 0x1c, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x13b02, r1, 0x0, 0x0, 0x0, 0x10, 0xd}, 0x94) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x20, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f0000000140)=@gcm_256={{0x304}, "480ca6eda49ed6a6", "3a2cc8b276a753b0e23e2a8436b0e1d53d11b70c57abe2e932240e766d3aebfd", "a0eb068e", "e96e232f2004a832"}, 0x38) recvfrom$inet6(r3, &(0x7f0000000240)=""/169, 0xa9, 0x40010002, 0x0, 0x0) pipe(&(0x7f0000000000)) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r3, 0x0, r4, 0x0, 0x7ffd, 0xe) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="010004000000fbdbdf2501000000080000000500030006000000080002000200"/50], 0x38}, 0x1, 0x0, 0x0, 0x24008000}, 0x0) (async) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="010004000000fbdbdf2501000000080000000500030006000000080002000200"/50], 0x38}, 0x1, 0x0, 0x0, 0x24008000}, 0x0) r5 = socket$kcm(0x29, 0x5, 0x0) sendmsg(r5, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000580)}, {&(0x7f0000000ac0)="07d98d396058a855921d034d0fb8034a5317ce586c382c8d41f8212309f82dd261e5f9263338a10244d7b49f8608f304ee79d951cd4ca8c44b84d8b2da6feb009a0d53224f69c7a037105aa12b36d0f2fa926dad5b4a129773ae0025ee2dccc42c4cc23ddd896f77e5b427f7950212eaeb0dd9c789f8def4d9fbf6274bbf72f31c5a548464395d9a68564fc12ef2196d7eac2b93ba137c89c360011aa0c15d2a0db9dfc760b6e069968685b051123d404ba4e94ccfdfebeaa7a30c8de388e00edff56b0c6968ec98e00ad8decf9dec77295a37e60510e906474b55034f7f6594c92e49dd422bb4346631b852e64add94f0ee30da8e199a89d8969df24601639c324ea084f8b00dbb3322aa7b1759fde71e4279841257c589725c12070d0cd41423d566d8b73b2936119519e31f4c8243e9207e688e77550867081b9b685d277a4800", 0xfffffd6b}, {&(0x7f0000000640)="74a892e6122d0e9da29a40f6060049f3ab51554d", 0x14}], 0x3, &(0x7f00000005c0)=ANY=[], 0x158}, 0x0) sendmmsg(r5, &(0x7f0000003dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x200048c1) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000300)={0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x4623, 0x13d3, @mcast1}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r6, 0x84, 0x0, &(0x7f0000000100)={r7}, 0x10) (async) setsockopt$inet_sctp6_SCTP_RTOINFO(r6, 0x84, 0x0, &(0x7f0000000100)={r7}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_emit_ethernet(0xdb, &(0x7f00000004c0)={@local, @broadcast, @void, {@mpls_mc={0x8848, {[{0x9490}, {0x1ff, 0x0, 0x1}, {0x7}, {0x6}, {0x43, 0x0, 0x1}], @llc={@snap={0x0, 0xab, "ca", '+R-', 0x18, "d47bf52cfe6b0f1e396a12eb85a0fe5a79b8b2edcff25b17481fccdd87025615be84c618113601d11d79ec046f0d2e4d0803e9c4f9ac26defef54d3a2b3202310c4ff4833b4e2240a9afb386849db3ff6eefa6c3456e82e5722b7c6ad8844ca0c0c1b96de889de9597942c9bd8fdae0754994f1e66394310eff74d92e8eda65e6732ba1d79006fbe9a399f5d2db1a3f409ffcf429e9ab37f7ab73b8fb434b285caa0cd1626fc96a4fbd526dd77809dab6f"}}}}}}, &(0x7f0000000240)={0x1, 0x2, [0x53d, 0x54, 0xd75, 0xe4d]}) setsockopt(r9, 0x84, 0x80, &(0x7f0000000000)='\x00\x00\x00\x00\t\x00\x00\x00', 0x8) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) (async) r10 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADDDEF(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x80, r10, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@NLBL_MGMT_A_CLPDOI={0x8, 0xc, 0x1}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x28}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x2}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @empty}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @private0}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @remote}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x80}}, 0x8000) 4.894829475s ago: executing program 3 (id=11347): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) socketpair(0x28, 0x2, 0x28, 0x0) r0 = socket(0x8, 0x3, 0x0) ioctl$IMGETCOUNT(r0, 0x40106183, &(0x7f0000000000)) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x2, 0x18, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @dev}}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @mcast2}}]}, 0x50}}, 0x0) r2 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000680), 0x2000, 0x0) ioctl$int_out(r2, 0x5462, &(0x7f00000007c0)) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$ARPT_SO_GET_INFO(r4, 0x0, 0x60, &(0x7f0000007c40)={'filter\x00', 0x0, [0x5, 0xfffff801, 0x7f]}, &(0x7f0000007cc0)=0x44) r5 = socket(0x9, 0x3, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r7, 0x107, 0x5, &(0x7f0000000000)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) setsockopt$packet_int(r7, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendmsg$nl_route_sched(r6, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x31, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) r8 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$VFAT_IOCTL_READDIR_SHORT(r8, 0x82307202, &(0x7f0000000800)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) write(r5, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000000000000000000800040001000000", 0x24) recvmsg$unix(r5, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000000c0)=""/69, 0x45}, {&(0x7f0000000380)=""/230, 0xe6}, {&(0x7f00000001c0)=""/24, 0x18}, {&(0x7f0000000240)}, {&(0x7f0000000480)=""/226, 0xe2}, {&(0x7f0000000580)=""/224, 0xe0}], 0x6, &(0x7f00000006c0)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xb0}, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r3, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x4, 0x4, 0x3a8, 0xffffffff, 0x1b0, 0x0, 0xe0, 0xfeffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@mcast1, @ipv4={'\x00', '\xff\xff', @multicast1}, [0xff, 0x0, 0xff000000, 0xffffff00], [0xffffffff, 0xffffff00, 0xffffffff, 0xff000000], 'ip6erspan0\x00', 'batadv_slave_1\x00', {}, {}, 0x0, 0x23, 0x3, 0x2}, 0x2f2, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0xffffffffffffffff, 0x4, 0x3}, {0xffffffffffffffff, 0x1, 0x1}, {0x3, 0x5, 0x6}, 0x10000}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x4}}}, {{@ipv6={@private0, @rand_addr=' \x01\x00', [0xff, 0x0, 0xff000000], [0x0, 0xffffffff, 0xff000000, 0xffffff00], 'macvtap0\x00', 'batadv_slave_0\x00', {0xff}, {0xff}, 0x2c, 0x79, 0x4, 0x44}, 0x0, 0x100, 0x128, 0x0, {}, [@common=@icmp6={{0x28}, {0xc, "eac3", 0x1}}, @common=@frag={{0x30}, {[0x2, 0x7], 0xfff, 0x4, 0x3}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) ioctl$SIOCGSTAMPNS(r7, 0x8907, &(0x7f0000000a40)) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYRES64=r3], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f0000000200)=""/195, 0x41000, 0x0, '\x00', 0x0, @sk_msg}, 0x94) 2.638986211s ago: executing program 2 (id=11356): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) r0 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$bt_hci(r0, 0x84, 0x84, &(0x7f00000010c0)=""/4111, &(0x7f0000000000)=0x100f) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001880), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_DELETE(r6, &(0x7f0000000400)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x34, 0x2, 0x1, 0x5, 0x0, 0x0, {0x0, 0x0, 0x4}, [@CTA_HELP={0xc, 0x5, 0x0, 0x1, {0x8, 0x1, 'RAS\x00'}}, @CTA_MARK={0x8, 0x8, 0x1, 0x0, 0x80}, @CTA_SEQ_ADJ_REPLY={0xc, 0x10, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x320}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x8004}, 0x20008080) sendmsg$inet(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000a80)='Z8', 0x2}], 0x1}, 0x1) setsockopt$sock_attach_bpf(r4, 0x1, 0x10, &(0x7f0000000100), 0x4) setsockopt$sock_attach_bpf(r4, 0x1, 0xa, &(0x7f0000000180), 0x4) recvmsg$unix(r4, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x2) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000d00)=ANY=[@ANYBLOB='t\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="a18fb83e6233830000000000000000050000000c009900020000006c00000052000e0088000900080211000001ffffffffffffec7304b81dd3b000a1ffffffffffffff64000000000601010101010103010004060a0108000000060243832a010072060303030303037606000000"], 0x74}, 0x1, 0x0, 0x0, 0x8810}, 0x0) sendmsg$NL80211_CMD_UPDATE_OWE_INFO(r1, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x11c, r3, 0x300, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x9, 0x3b}}}}, [@NL80211_ATTR_IE={0xfa, 0x2a, [@tim={0x5, 0x75, {0x0, 0x15, 0xd, "7ad1b7125a3dc98f4079aefbf5e79a53ca5d0419aeb84383f41fc8001fe6821b34d44bae6394f2dd744c0fac0c299ca7c1acd4611e637da350ebb8788aca55f7fd2f5529306836704ab70017af4783460d569bea5e918faa10d7c9f9df56888f3a19b9375a13f5baf8c15a2cf817357396e6"}}, @ssid={0x0, 0x6, @default_ibss_ssid}, @dsss={0x3, 0x1, 0xb6}, @rann={0x7e, 0x15, {{0x0, 0x63}, 0x6, 0x80, @broadcast, 0x5, 0xff, 0x1000}}, @gcr_ga={0xbd, 0x6, @broadcast}, @challenge={0x10, 0x1, 0x95}, @perr={0x84, 0x48, {0xfb, 0x4, [{{0x0, 0x1}, @device_a, 0x3, @value=@broadcast, 0x3c}, {{0x0, 0x1}, @device_b, 0x3, @value=@device_b, 0x22}, {{}, @device_b, 0x5, @void, 0x33}, {{0x0, 0x1}, @device_b, 0x6, @value, 0x39}]}}, @cf={0x4, 0x6, {0x4, 0x5, 0x1, 0xa47}}]}]}, 0x11c}, 0x1, 0x0, 0x0, 0x20000890}, 0x4008000) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500010004002000080020"], 0x4c}}, 0x0) 1.83473889s ago: executing program 0 (id=11360): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000fb02df64657673696d0000000f0002006e657464657673696d300000"], 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001800)={0x6, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000008e6c56237ac4ea1517d6de9f91c69c41cc55a1dc422b0e89f307c65a8d594c4dd1f0cf56dd"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r5}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r6, r5, 0x25, 0x8, @val=@iter={0x0}}, 0x20) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x4c, &(0x7f0000000080)=0xcdb, 0x4) bind$unix(r1, &(0x7f0000000440)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e21}, 0x6e) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f00000000c0)={'bridge_slave_0\x00', {0x2, 0x0, @remote}}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r8, 0x89f2, &(0x7f00000001c0)={'ip_vti0\x00', &(0x7f00000004c0)={'ip_vti0\x00', r5, 0x8, 0x1, 0x7d1b, 0xffffffff, {{0x29, 0x4, 0x0, 0x3d, 0xa4, 0x65, 0x0, 0x7, 0x2f, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0x41}, {[@ssrr={0x89, 0xf, 0xee, [@multicast1, @multicast2, @rand_addr=0x64010101]}, @timestamp_prespec={0x44, 0x24, 0xaf, 0x3, 0x0, [{@private=0xa010102, 0xffffffff}, {@loopback, 0x8}, {@private=0xa010100}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x5}]}, @noop, @generic={0x0, 0x10, "ab92e5d931dbdda2bfea1abd782d"}, @timestamp_addr={0x44, 0x14, 0xca, 0x1, 0x0, [{@multicast1, 0xfffffff2}, {@loopback, 0x7fff}]}, @cipso={0x86, 0x37, 0x2, [{0x4, 0xe, "3b0eb9d922699a09888c3794"}, {0x2, 0x11, "93e8ad981dae0e90ab54090782d880"}, {0x7, 0x3, "18"}, {0x5, 0xf, "8785402fa43c750ea40cae4825"}]}]}}}}}) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r10, {0x0, 0x7}, {0xffff, 0xffff}, {0x1, 0x9}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0xed, 0x2, 0xe}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040000}, 0x4094) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x16, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYRESDEC=r7, @ANYRES32=0x0, @ANYBLOB="0000000000000000a00321800e0001006970366772657461700000e031000280140007001502000000004000000000000000000108000a0025caf190718867", @ANYRES32=0x0, @ANYRESHEX=0x0], 0x54}}, 0x0) 1.311095388s ago: executing program 0 (id=11363): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000000), 0x8) r2 = socket$packet(0x11, 0x2, 0x300) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet_mtu(r3, 0x0, 0xa, 0x0, 0x0) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f0000000080), &(0x7f00000000c0)=0x14) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000), 0x8) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYRES64=r1, @ANYRESOCT=r2, @ANYRES16, @ANYRES64=r2, @ANYRES32=r3], 0x38}, 0x1, 0x0, 0x0, 0x20008891}, 0xc000) 1.307556931s ago: executing program 4 (id=11364): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_PMK(r1, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029cf7000fcdbdf257b00000008000300", @ANYRES32, @ANYBLOB="0a00060008021100000000001400fe00a146dc2ebdd83c76e5b6b9240efa16e6"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x40000) 1.29827253s ago: executing program 3 (id=11365): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_int(r1, 0x29, 0x50, 0x0, &(0x7f0000000040)) ioctl$FIOCLEX(r0, 0x5451) (async) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="ffffffffffff1780c206050086dd601823250000000000000000000000000000bbfe8000000000000000000000000000aa0400000000000000"], 0x0) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ipvlan1\x00', 0x0}) (rerun: 32) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0305000003040100140012800b0001006970766c616e00000400028008000500", @ANYRES32=r2, @ANYBLOB="615ee19205c68511a0865e575e3d466070ed71c0aac3a5b9eb28aab09d12e55b1fa91bf3c1fb3de4324471135d9fd02cab668e8820fee8b43aeac73cad125cf73ac727ef5200e543e44dc8da1a1e2100fcae407c99adee"], 0x3c}, 0x1, 0x0, 0x0, 0x20004840}, 0x0) 1.199283741s ago: executing program 2 (id=11366): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="c4000000", @ANYRES16=r2, @ANYBLOB="010000000000000000000100000004000180ac000280"], 0xc4}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB="240000004a00010000000000000000000a00", @ANYRES32=0x0, @ANYBLOB="654d98"], 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) (async) sendmsg$ETHTOOL_MSG_STRSET_GET(r1, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000880)=ANY=[@ANYBLOB="c4000000", @ANYRES16=r2, @ANYBLOB="010000000000000000000100000004000180ac000280"], 0xc4}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB="240000004a00010000000000000000000a00", @ANYRES32=0x0, @ANYBLOB="654d98"], 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) 1.182523908s ago: executing program 0 (id=11367): bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x4, 0x5, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002900000085000000500000009500060000000000e4660f2fd5934fe33a21216439dc6c1f383b0648c17284"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c00)=@getqdisc={0x30, 0x26, 0x200, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x8, 0xc}, {0x4, 0xa}, {0xe, 0x3}}, [{0x4}, {0x4}, {0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=@newtclass={0x24, 0x28, 0x5ea11b84c59b353c, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x4, 0x1}, {0xa, 0x10}, {0x7, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) (async, rerun: 64) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007e40)=[{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f00000000c0)="4789d3aefc1a4d03345aed327be33c", 0xf}], 0x1, 0x0, 0x0, 0x20000000}], 0x1, 0x20040894) r2 = socket$kcm(0x10, 0x2, 0x10) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20010840) sendmsg$kcm(r2, 0xfffffffffffffffc, 0x840) (async, rerun: 64) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000b80)=ANY=[@ANYRESOCT=r0, @ANYRESHEX=r1], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a6c000000060a0104000000000000000002000000400004803c0001800a0001006d617463680000002c0002801400030004b57c12c0108db4727ffe384d89f8f4f03b0200000000000000116b61979e090001006c3274700000000008000240000000000900010073797a31000000000900020073797a32000000001400000011"], 0x94}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) sendmmsg$unix(r1, &(0x7f0000000ac0)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000740)="c08e954334a019fcfa58d0cb8ce00e45a634f7dd7e76e178e367f8c7f5234454f540cd638f91b9f5866a8164475c834d73a3b56932b3f3522ee90ce42b55f42260cf27b6560a1658d541659f1e1a337a05352c7044434fe821bb476cbf8fa5d1c11d08d41540e82e9a9a744463570ebe46afa0e33f9dbd03cd0638e5fda091a2faa3ef215de9573af967190d2740", 0x8e}, {&(0x7f0000000800)="d50c76ace7d0542f2de90acd749ed16d4b599676aef930b055a59b4333ca2d5e876d89591b487e493b1ac6bc0b3679f35c2efe30552b76d13513d67c4b26e147098ae2776addf650a770e4a1d6fbc363b71b3811aee5ef444216309dc90667f4ad7a302edd1c5fdf5eaa56bd0cac02afc8275a695666098c9d9b72ddd86f29535e4519d751ba83f03dcfdd54fd77f9af49344ac74c95399aa6f80141a02a9d71411f807e87d3c56db34a9bfc7e06e58d31a03bfb962a5a9efc849f80ac183872fe50641d74683e4bacdf3538fdcc32d8e4706c934b9e26111b8f06ef202806", 0xdf}, {&(0x7f0000000900)="6f1e494368ed978a03d6d278841f37436582f8dacad9d34672df71dbd8e026088ff919504f66d6f7b5b97a559b5e6cc9ff61fceb8a296d378a862413eecb9fe3d290181e5ce53fab636cd16e863b6617e5228416fb2ed62bc32659fa336858d6cc7aaf741b90a69775748cd51787ae869d1f7cb6d0be3a10aba607250fe089e507bfbd6d443ead2e1fda11129997eaf429bcdd3ffceb26ef3c5011a4952989628079fe084ef9419e17034d26b8146365ee425469ddea53936783c7b4af5fd1b65eba2e6bb13d50230bc2512ddf10f04058cd077fa43072be3241c6b922e631b0384269e307f84da0b407c53ad9c707428405367163", 0xf5}, {&(0x7f0000000240)="6b1547437266d0c1eee274c3828d09e3842a34741d460d0d8500d73ec9d36efcd15f591fec28d4a07619754a08b3e5b772c7d3933ca707dd5e9a0f712691cb7516d0edf45bd08adc0d43b0e40d4571d9f71a2cf6d40bd374f9137847b9f75a830fba7b8fb535db4a5782e087e30266bc2863b8fcf4d757", 0x77}, {&(0x7f0000000a00)="d1e96e82aab3beb55f23b5ed94253284f0d1e6fea845dd2044d9935b3a1f5bb6b8ee1e99e3497253a53f702005744e44055c883806ecac48878b98f1578892d6a575da840d171b632a2e6ec29f45dd59204aba855a38353e7f8b18677a09c80d9f1daff35480c0d4c8b9228c8b206e35ea675f03dbc97b3feec968ea0e8b198ea8736fa594c07d8c77ee8d370c2119d6c0ba61a066f8cc698d41f3bb9b1b893b78ae5e29860b242455d1e55e658d8b0cd49dac7d1d", 0xb5}, {&(0x7f0000000340)="663fac1ec9109c0c44cfe8053885381ee00c053bf86cfad3034ebdd27001ae139c1fcd3f40f76f59e1d6f629d577c8174232357e0142924256e13551815d5ae13300aeec7941cc4f5dab60b748d99b9a", 0x50}], 0x6, 0x0, 0x0, 0x50}}], 0x1, 0x200000c0) close(0x3) sendmsg$inet(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0) (async, rerun: 32) r4 = socket(0x10, 0x803, 0x0) (rerun: 32) r5 = socket$unix(0x1, 0x5, 0x0) (async, rerun: 32) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) (rerun: 32) mmap(&(0x7f00004f1000/0x3000)=nil, 0x3000, 0x2000006, 0x12, r6, 0x913e0000) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00004f1000/0x2000)=nil, 0x2000, 0x2000000, 0x11, r7, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$FS_IOC_RESVSP(r8, 0x40305829, &(0x7f0000000540)={0x1100, 0x0, 0x52, 0x10000}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=ANY=[@ANYBLOB="821af73a99e59f944982ed4ccf3dca62ca5d258d562be3aa933fd380d35af35b9c957cf2d964d395a4d4745803af781137897e4f9cdf119a408ab12786b4f019f4dd741df9837958214053ac386369db0c4dbcd7cf71551aa63047121df5840ec54c3488e50b2d488c5254e5686572bdd2715be28fde1ed51f685890f0961b584cb341fd39661c3cd233aee8c01c92a8"], 0x1c}, 0x1, 0x0, 0x0, 0x24000000}, 0x10) (async, rerun: 32) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x1, {0x0, 0x0, 0x0, r9, {0x0, 0x9}, {0xffff, 0xe}, {0xa}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x4, 0xc00}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x50}, 0x0) (async, rerun: 32) sendmsg$nl_route_sched(r4, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newtfilter={0x2c, 0x2c, 0xd27, 0x70bd27, 0x25dfdbfc, {0x0, 0x0, 0x0, r9, {0xc, 0xfff1}, {}, {0x5, 0xf}}, [@TCA_RATE={0x6, 0x5, {0x40, 0x3}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40040}, 0x20040054) (async) bind$ax25(r4, &(0x7f0000000040)={{0x3, @bcast, 0x2}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @null, @default, @bcast]}, 0x48) 1.130585261s ago: executing program 4 (id=11368): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r1 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r3 = socket(0x2, 0x80805, 0x0) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000080)={0x634c, 0x4, 0x3, 0x0, r2}, 0x10) bpf$TOKEN_CREATE(0x24, &(0x7f00000000c0)={0x0, r1}, 0x8) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xc, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000050000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c7d376238975d43a4505f80fc88943c4f0cf08e467b592f868ee30a0e8c1bf176db2a6b2feb4b6fd3d5707bfd2d84aaa3b1d4e984c46ea7e2a447a36f5662403e1b2be4cc7c2683908a0d411a9872061ce618117c56f0979bd10b97163c953ab1abda4589e9cbe8d0d26b5069f8a98f7dc8f76b74635fc9f9de9ca3c00cb9bf4e418d07fa22f0610a70f2bdf4000000000000b0c2940dd8e263aa743f7555193161f45346d2014006000000e1ffff8816326d7d35c32aac1c7d5b5be399f6609876b5887437a172751151b633fbc02a74067529194e533583412dff048f0000000000000000b2728a04816cfb851cd364ff19ffcafe3e64be033c9d2f002cc93c1c13ceec04a347383420336bec88c24a9fb6a6991ddb737d527d6acb15426415b6e8b14fdfa2c6e94bd0339454c13ad30000000000170022626165866c156a25148972700000b515a1000000000000000eb2e9c15b6c8f6198282d0000000000c2ccf3f69cfcf1e15ea7a9e57aee78e12a2caebaada42811754e19a7e9b531636794a718b4766d2c7c61c3dba128c7fcd1f97989ccf1d55de496eae46c590c2d0225f9cd07005ac7f76d9d560a08c9fd0caafd9d095cb9db0099014cd0d4df62af52b088b01adeadc4c5225a6cd8486b03f83805dffe90dbf7ad042012b7213a2b03e3b1634ddfc9d6f570c4990fbbc7306871d9a52a157fb1a10fa2868df06faf83a8420e9ce62567043ce7e56d1ebe81"], &(0x7f0000000340)='GPL\x00'}, 0x94) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r5, 0x8970, &(0x7f0000000900)={'wlan1\x00', @random='\x00\x00\x00 \x00'}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0xffff0000, 0x40f, 0xfffffffffffffe4a, &(0x7f0000001a40)="2b206d074843b397737ea49da2aa", 0x0, 0xf000, 0x720e, 0x0, 0x0, 0x0, 0x0}, 0x48) 935.651072ms ago: executing program 4 (id=11369): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x10}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x20}, @NFTA_SET_EXPR={0x28, 0x11, 0x0, 0x1, @quota={{0xa}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0xe4e}]}}}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xac}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x10}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x20}, @NFTA_SET_EXPR={0x28, 0x11, 0x0, 0x1, @quota={{0xa}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0xe4e}]}}}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xac}}, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) syz_emit_ethernet(0x406, &(0x7f0000000640)={@broadcast, @remote, @void, {@ipv6={0x86dd, @gre_packet={0x2, 0x6, "c9a214", 0x3d0, 0x2f, 0x1, @remote, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x880b, 0xdd, 0x2, [0x5e05, 0x101], "41007acc0118977a830309e0f27142f18b39208d85f3ce44f9df4612199101557fe86218bdb248fa7cc39b03381f3205472822ff65963a07eeae4e142ea048e5d908c035310f0804585d5b8fcfd42951ff74b94e54bf51b2b277992d060e3901dd673a9567942d1bd9e0ad808651afc92774ce05d93eef089ed943cbab6dcfaf489844b927b2af93265749a3f70a45bd2f0c15c49c050c2df184edee600a429d55473e55b9b68a8640345b57772381a35e07655b3558188b27ce3bd0765f53f6103032786d2a1d0db767c5959da6ca81bf8192edbcd3a16c1b4efa9901"}, {0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x800, [0x4, 0xfffe], "6fbce949d5a8e2c729eecc93fcbb74c29b9712b81e7f537b796c9757fac384d73460adf79d5a7e28fcbc33bbc4fc2c60ecda528aa547f1e479ab7ceb0ee72ca55d0b1802562018e52a1d5f59cb52fea18cfdb1290144ad6cd5e01239ad7efd3362723077c265406ebb9fd3e886f506b019b530eb5893707eee5205abfe59d9c563402965d0337ff82351d65792e9737db69b99c9b871e7a8146b7603cfb2ece736e9507858452059bc3e6d2eab69402bcdb77a40deac7f4dd802f540327f9f1a63efc2e54c4d067a91ead7d6a09591486f29c32a9455507293ba10ba27a36c9421e4253ce8932364e0e1415f6503893d5cc4f2979858b5a2b53d23"}, {0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x86dd, [0x9], "1437623c8f6dd1f212f3e38377865fe924252bb327cdb28c3c4b20bd41b4dceffe6565fa385a2bf1a2b6ff370824d6c60340222f26c3e6b10a352a98563613c9ebed9f9ee38dc30e06a93d4926fc362dc5daf22a7b10ae846d5a953db65ef0a5a464bbb0e2f2c5628ae4ccc7cc0820421a0aafd3baab2d31374c816f995c11e59545718ef332e48e5e59c506e1fea11eff8073d179a618b81c6fce602b41bcbc5f3b50ed119475190ef120a64496463906b858a71842e6e2051ece21df00266c12b8ea591a53e0b981f376afe3603cb53ed90bc2d80f7825434d36127146639f67"}, {0x8, 0x88be, 0x3, {{0x8, 0x1, 0x97, 0x1, 0x0, 0x3, 0x7, 0x4b}, 0x1, {0x7087}}}, {0x8, 0x22eb, 0x3, {{0x7, 0x2, 0xc, 0x1, 0x1, 0x3, 0x6, 0x9}, 0x2, {0x0, 0x1, 0x1, 0xd, 0x1, 0x0, 0x2, 0x1, 0x1}}}, {0x8, 0x6558, 0x4, "f32cf5fb94a4aff7c49f25d8ad225b689b3fb91dfd989c92a7d85c02edb8241705838a9fcf2881b87ee57cf8ca561d4c5e5fa42fedd6fdb62d7f4f15ecf77715acf5affb6af111eb17973038e7b11c27faa563669678891dd812763190d9865f236116d84e07917caa8123e39b461de9fe597d4df0dffa99695814fed71bb99c247ebea1c2df40f45e2485724d7ff6e389283cadba0132e86ce6476faf1da72feffa52702f5e9f9de3e19b950bcb484db7de2e082cf18e79d0aaf56bc78d0e69f8f4377a379786b4eb"}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb08004500003c000000000806907864010101ac1414aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="be1c1dcc36cc01f42b31ac0800cad3d6baab502f0dd8bbb29faf9078104013052007a91e0c130606"], 0x0) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="200000001a14010000000000000000000800030000000000080003"], 0x20}}, 0x0) 883.933612ms ago: executing program 2 (id=11370): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x2, 0x0, &(0x7f0000000080), &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, 0x38, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x101}, 0x94) 744.271086ms ago: executing program 2 (id=11371): r0 = socket$kcm(0x10, 0x2, 0x0) (async) socket(0x10, 0x3, 0x0) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r1, &(0x7f0000000100)="ca", &(0x7f00000000c0)=""/8, 0x2}, 0x20) (async) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r1, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) (async) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) (async) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) 721.289249ms ago: executing program 4 (id=11372): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000000)={0x3, 0x80, 0x6, 0x0, 0x8, 0x80, 0x7}, 0xc) (async, rerun: 32) bind$bt_l2cap(r0, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfffa}, 0xe) (async, rerun: 32) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async, rerun: 32) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) (rerun: 32) listen(r1, 0xc) setsockopt$sock_timeval(r1, 0x1, 0x42, &(0x7f0000000000)={0x0, 0xea60}, 0x10) accept(r1, 0x0, 0x0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) (async) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r2, 0x11a, 0x1, &(0x7f0000000140)=@gcm_256={{0x303}, "0eec7847e6b5e024", "f09c044c9dffd7b0290fec79375496e1228ee3cae2149177685e1b43ba3bd5a9", "6326c3c2", "6631ba3fbc927278"}, 0x1) (async) listen(r0, 0x18) (async) sendmmsg(r0, &(0x7f0000000280)=[{{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000000300)="25792a54b9b767921ab24f858411177062bc2fc7d3cc18832116d2a1f6177125608cac254a8762e4b3907098a74e975f29c3cac15bd29b753111aa2388bc06854f11422fbf39162e6e8addd19cee365caddf316182e13ce18b0527ef40024649fb33480628d896a63c2f7c7283ac5357169bcb70b5cad1671fb2c98d9eac2a714965963bd77c1c6a38a7df79ac1b9a702abb98a159f652c8d8b4019af0a5ebb20f49d878373613a06d62b81909cf3e8092cdf7bbe63345a6db9e995a43434a24840e0353d3d9b542f023ea95c495cfbf6da96404475d3bd80728df0eb51f92c0183c4f5864bf4e75cd2f5ff9a66e51fd0a094ed26686973dfa474b98a41ce9c0edd62b15fb9da479ded4911b357795cb4205c9cb1d512fc19e1961437383eac490b78fcc344e7b655c52f91a0e0049ed1a8d37eacff5d5bba2f833decd651087d5ef4af81c226431179f165045036330e1e56c635c8b15bf46a308ab2f0761d9bfea0cf0fc0dfb30beed739d09df93df0f569c4424af15e737df3f65eb7da75a9111e58d9adfc914f7437ed86b60b15a80a14b18a64d0d84440942a95f75ab597018e643a7098ff89fcc9c718c0a7ea36385000a40a524d7196c3e9d7fee4be5951cadf4d1d20356a50a1a0a66ef19b474e387ac861cc86102aafc6f26c03d71359e353aa114b83465e0221016d9c7955f32669495949b5cbd3ea38a817587b0e624b26fcd7aa840785bd3162a5965270d819ea6d348c569b647810c32fc3d47d92ff65548653f8b1484635033baf07df1b0c2f969decc7ba031f2624bbcfd4c63e1802737bb8e42e478885ed7cb04e8cbd0c21a30b397c2b37b7010fa9a9689a90b39261bc41e307196298dbc4778c496eeb1dfbc15901c46908f6ab47a05f36bbc7ce7cc8793c977a878e7b382ddd11e5cd240603554fa25a267079571e6016cc3", 0x2a2}], 0x1}}], 0x1, 0x30040044) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[], 0x32600) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) (async) r4 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) recvmsg(r4, &(0x7f0000000180)={&(0x7f0000000100)=@caif=@rfm, 0x80, &(0x7f0000000880)=[{&(0x7f0000001580)=""/4096, 0x1000}, {&(0x7f0000000040)=""/45, 0x2d}, {&(0x7f0000000200)=""/89, 0x59}, {&(0x7f00000005c0)=""/169, 0xa9}, {&(0x7f0000000680)=""/202, 0xca}, {&(0x7f0000000780)=""/218, 0xda}], 0x6, &(0x7f0000000900)=""/121, 0x79}, 0x2000) (async) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r4, 0x800442d2, &(0x7f00000000c0)={0x0, 0x0}) 502.888072ms ago: executing program 0 (id=11373): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x16, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="7a0a00ff00000028711051000000000095"], &(0x7f0000000480)='syzkaller\x00'}, 0x90) ioctl$sock_SIOCDELRT(r0, 0x890c, &(0x7f00000002c0)={0x0, @ethernet={0x6, @random="a657e70982d6"}, @ax25={0x3, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x7}, @can, 0x3, 0x0, 0x0, 0x0, 0x8ac1, &(0x7f0000000180)='veth0_to_batadv\x00', 0x6, 0x5, 0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x30, 0x40, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x8, 0x16, 0x0, 0x0, @uid}]}, @nested={0x4, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000a80)=ANY=[@ANYBLOB="b702000014000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000001007d60b7030000000000006a0a00fe00000100850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465cbf188ef10871b81ac7553358380b3a1f59916ffc9bf0bdf81524f07fb2819bf5774fedda52e39c90af27db5b56024df96b4673b4e8d5467e114604ea09b290a248a120c9c6cd87cef9000000a39c15a7ef365cc27dfeac7b9b0e9048517354b0ca4f9cf8b59ee6fa003fe1f2c4c15f20a07db4583a462d8be6602186fd68ee14a19ea2eb42122b8635a66ce6b5b92356081bc0f18a0ca83dbc089a9813c1efa26001b3f486ebfaae85c4d0b96778478ae5355e6f923b11056969f486f80a35f7f2339704fa93fa915ab8e1e0d7f31ebd19455e6827cd493907bf9d0000000000000000000000004e1fa60acabcf0553910ca2e5ea499fd5889dde9261f0848a5b8af657bfc96049308e8953431b269053627a1523551c160c813969925a892d266792352ec0204596a37ce8d6d260b32239bddbce2e79f93cb5a0ad897adb53b397d07c50f84b74f2605a565ee149016aa75ea31c0087dcd821b47c8b36efc6da4fb2ea7f1f36c85856b73ac9872babc62149699b6b8c796a79d833eb4b5ca668d430db5653a2b3c5b87e17ca1"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x2ca}, 0x48) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000380), 0xffffffffffffffff) r4 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000700)=@o_path={&(0x7f00000006c0)='./file0\x00', 0x0, 0x8, r0}, 0x18) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000003c0)={r4, 0x58, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000cc0)={0x820, r3, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@WGDEVICE_A_IFINDEX={0x8, 0x1, r5}, @WGDEVICE_A_FWMARK={0x8, 0x7, 0x5}, @WGDEVICE_A_PRIVATE_KEY={0x24, 0x3, @a}, @WGDEVICE_A_PEERS={0x4}, @WGDEVICE_A_PEERS={0x7d4, 0x8, 0x0, 0x1, [{0x5c, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "d82769039671cea9c55386261c5291a83188cf9843b442e3aa0e4a7fa028d9eb"}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "83b00e26646604855b5bb88522f305cfdfd9ef53b93372c1ff33781cbcbef491"}]}, {0x5f8, 0x0, 0x0, 0x1, [@WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_ALLOWEDIPS={0x54c, 0x9, 0x0, 0x1, [{0xe8, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x5, 0x3, 0x2}}]}, {0x40, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x25}}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @remote}, {0x5, 0x3, 0x3}}]}, {0x28, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, {0x5}}]}, {0x4c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010100}, {0x5, 0x3, 0x2}}]}, {0x94, 0x0, 0x0, 0x1, [@ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @remote}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private0}, {0x5, 0x3, 0x2}}]}, {0xc4, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010100}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @local}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x24}}, {0x5, 0x3, 0x2}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x41}}, {0x5, 0x3, 0x2}}]}, {0x13c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @private1}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @empty}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @empty}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @dev={0xfe, 0x80, '\x00', 0x10}}, {0x5, 0x3, 0x2}}, @ipv6={{0x6}, {0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010101}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010102}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @loopback}, {0x5, 0x3, 0x3}}]}, {0x118, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x3f}}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010101}, {0x5}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x5, 0x3, 0x3}}, @ipv4={{0x6}, {0x8, 0x2, @multicast2}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @broadcast}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @local}, {0x5, 0x3, 0x1}}, @ipv4={{0x6}, {0x8, 0x2, @private=0xa010102}, {0x5}}, @ipv4={{0x6}, {0x8, 0x2, @rand_addr=0x64010102}, {0x5, 0x3, 0x3}}]}]}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @neg}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_PROTOCOL_VERSION={0x8}, @WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL={0x6, 0x5, 0x9}]}, {0x38, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x4e23, @multicast1}}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e23, 0xd51, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xfffffff2}}]}, {0xac, 0x0, 0x0, 0x1, [@WGPEER_A_ALLOWEDIPS={0x84, 0x9, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @multicast1}, {0x5, 0x3, 0x2}}]}, {0x64, 0x0, 0x0, 0x1, [@ipv4={{0x6}, {0x8, 0x2, @loopback}, {0x5, 0x3, 0x1}}, @ipv6={{0x6}, {0x14, 0x2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}, {0x5, 0x3, 0x3}}, @ipv6={{0x6}, {0x14, 0x2, @mcast1}, {0x5}}]}]}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "5b5a584fad65972cf4c1a4471112b97ecba3c87d5c82414082f7aeabd046c0bb"}]}, {0x98, 0x0, 0x0, 0x1, [@WGPEER_A_PRESHARED_KEY={0x24, 0x2, "4b7132301ea14e20752cad58d895fadb29ac36b965d38fe83dfc5a2d39ba4794"}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "7611fccd8bda96113a45dc7307e99169ad3ef1f05a5d149f4d60d4a46d398d6e"}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}, @WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x4e20, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x5}}, @WGPEER_A_FLAGS={0x8, 0x3, 0x4}]}]}]}, 0x820}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r2, 0x18000000000002a0, 0x29, 0x0, &(0x7f0000000040)="b90103606989068c3c270040f0832f9e0ff008001fffffe1ffff86dd632f080686dd00017f020001be", 0x0, 0x104, 0x6000000000000000, 0x10c, 0x0, &(0x7f0000000400)="9209558f0c5fb25cd57f98113135c3171b8b331fbc04f0e6955a796ff8e3aae3cac46cec3030dfc999058aea01f0e6dcf2f9d480d328655aca003927bd50ed49d4843c8a0a2a4b26ceb747947200bd644c85e7a8a7d7cfce840c02a7d69c9e0bca410f64d43290abbbf3131e1fa8bd8c3e5f19d5a491d3d4c1a0fe47de9eebaf073ac3da6256bdb681d18fbd607c9b0d710442bcf78bc36fd3c035812bde582a262bff0e4d6181c818fccf542868c6e602d97bea23a101955dc76bcc984142ab305387aa348566d688edd291a3e9d08952adbdf60462bb7f7faebcdfccf17115708b0d73d0f3a469ce7d8374219b3f92c92bcec4958d474bb281c26691949d054b784a5866f081e53eb9cfd7", &(0x7f0000000000), 0x0, 0x0, 0x3da7ff40}, 0x50) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000002c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7be", 0x10) r8 = accept4(r7, 0x0, 0x0, 0x80800) sendmsg$IPCTNL_MSG_EXP_GET(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)={0x14, 0x1, 0x2, 0x801, 0x0, 0x0, {0xa, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x24008000) sendmmsg$alg(r8, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) setsockopt$inet6_int(r0, 0x29, 0x10, &(0x7f0000000140)=0x4, 0x4) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000000c0)=@ipv6_newaddrlabel={0x44, 0x18, 0x1, 0x0, 0x0, {0xa, 0x37}, [@IFAL_ADDRESS={0x14, 0x5, @remote}, @IFAL_ADDRESS={0x4, 0x1, @remote}]}, 0x44}}, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x400ad80, &(0x7f0000000080)={0xa, 0x4621, 0x0, @local}, 0x1c) getsockopt$sock_int(r6, 0x1, 0x1e, &(0x7f0000000640), &(0x7f0000000680)=0x4) 501.772768ms ago: executing program 4 (id=11374): r0 = socket$l2tp(0x2, 0x2, 0x73) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x3c, r2, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}]}, 0x3c}}, 0x20000000) syz_emit_ethernet(0x7a, &(0x7f0000000280)={@random="856b934629fa", @local, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "381f34", 0x14, 0x2f, 0x0, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8100, 0x2, 0x892f}, {}, {}, {0xa888}}}}}}}, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000440)=@mangle={'mangle\x00', 0x44, 0x6, 0x3c8, 0x1c8, 0x1c8, 0x260, 0x0, 0x0, 0x330, 0x330, 0x330, 0x330, 0x330, 0x6, 0x0, {[{{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x13}, 0xff, 0xff000000, 'pim6reg1\x00', 'bridge_slave_0\x00', {}, {0xff}, 0x88, 0x3}, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x1, 0x9}}}, {{@ip={@private=0xa010100, @local, 0x7fffff80, 0x0, 'vcan0\x00', 'veth0_virt_wifi\x00', {}, {0xff}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x10, 0x0, 0x2}}}, {{@uncond, 0x0, 0x70, 0x98}, @TTL={0x28, 'TTL\x00', 0x0, {0x2}}}, {{@ip={@private=0xa010101, @multicast1, 0x0, 0xffffff00, 'syzkaller0\x00', 'bond0\x00', {}, {}, 0x0, 0x2}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, 0xff, 0x2, [0x4, 0x36, 0x1d, 0x1c, 0x23, 0x21, 0x2c, 0x7, 0x1e, 0x7, 0x2e, 0x37, 0x30, 0x9, 0x3b, 0x16], 0x0, 0x6, 0x2}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x451) accept4(r4, &(0x7f0000000080)=@isdn, &(0x7f0000000180)=0x80, 0x9cee2390b2f70fb1) 381.714192ms ago: executing program 0 (id=11375): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x2, 0x2, &(0x7f0000000080)=@raw=[@call={0x85, 0x0, 0x0, 0xae}, @exit], &(0x7f0000000840)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) (async) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xffffff9b}], 0x1, 0x1) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wg0\x00', 0x0}) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) (async) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="9feb010002000000000000000c0000000c00eeff010000000000000000000021000000000000"], 0x0, 0x26, 0x0, 0x1}, 0x28) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r5, 0x20, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=r6, 0x4) (async) pipe(&(0x7f0000000300)={0xffffffffffffffff}) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) close(r8) close(r8) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000340)={0x1, 0xffffffffffffffff}, 0x4) (async) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x294, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x3}, 0x50) r11 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={&(0x7f0000000400)='./file0\x00'}, 0x18) r12 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000480)={0x1b, 0x0, 0x0, 0xe9, 0x0, 0x1, 0x8ad5, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x0, 0x3}, 0x50) (async) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000500)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xc3e, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x4}, 0x50) (async) r14 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r14, &(0x7f0000000000)={0x23, 0x80, 0x2}, 0x10) (async) r15 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000580)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3, 0x2}, 0x50) (async) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x10, 0x13, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0xffff0161}, [@jmp={0x5, 0x0, 0xb, 0x6, 0x7, 0xfffffffffffffff0, 0xfffffffffffffff0}, @btf_id={0x18, 0x6, 0x3, 0x0, 0x5}, @map_idx={0x18, 0x2, 0x5, 0x0, 0x10}, @call={0x85, 0x0, 0x0, 0x7b}, @exit, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}, @generic={0x2, 0x4, 0x1, 0x3, 0x3}]}, &(0x7f0000000040)='syzkaller\x00', 0x4, 0xc5, &(0x7f0000000180)=""/197, 0x41100, 0x3, '\x00', r3, @fallback=0x27, r4, 0x8, &(0x7f00000002c0)={0x9, 0x3}, 0x8, 0x10, 0x0, 0x0, r6, r0, 0x5, &(0x7f0000000640)=[r7, r8, r9, r10, r11, r12, r13, r15, 0x1, r16], &(0x7f0000000680)=[{0x3, 0x4, 0x3, 0x2}, {0x4, 0x2, 0xf, 0xa}, {0x5, 0x3, 0x10, 0x3}, {0x0, 0x5, 0x2, 0xa}, {0x0, 0x5, 0x4, 0xd}], 0x10, 0x8}, 0x94) 327.378382ms ago: executing program 3 (id=11376): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0xc, &(0x7f0000000000)=0x8, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x34, 0x64, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x9}, {0x10, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}}, 0x4040004) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000001840)=@raw={'raw\x00', 0x3c1, 0x3, 0x1298, 0x1100, 0x18c, 0x203, 0x1100, 0x19030000, 0x11c8, 0x2e0, 0x2e0, 0x11c8, 0x2e0, 0x7fffffe, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, [0x0, 0x0, 0xff, 0xff], [0x7fffffff, 0xff000000, 0xff000000, 0xff000000], 'bond_slave_1\x00', 'bond0\x00', {}, {}, 0x84, 0x7, 0x2, 0x55}, 0x300, 0x10d8, 0x1100, 0x0, {0x1000000}, [@common=@unspec=@cgroup1={{0x1030}, {0x1, 0x1, 0x21, 0x1, './cgroup.cpu/syz1\x00', 0xfffffffc, {0x29f}}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa8, 0xc8}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x12f8) r7 = socket(0x10, 0x803, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), r7) getsockname$packet(r7, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@delchain={0x38, 0x2c, 0xf31, 0x1, 0x2000, {0x0, 0x0, 0x0, r8, {}, {0xfff2, 0xffff}, {0xffff, 0x1}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008854}, 0x4010) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000004dc0)={0x14, 0x1a, 0x229, 0x70bd2d, 0x0, {0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x4000884}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000009feffff720a00fef8ffffff71a400fe000000007110100000000000e5000200000000004704000001ed030407000000c00000001d440000000000006b0a00fe0000000072030000000a0000e500f9ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616276fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a26048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdec86f9b1eb93d491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b583cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f806694d461b76a58d88cf0f520310a1e80dc18cde9ad662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a090f3b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f577ea7159b7f3025b3d977ff7c91024cf71126233cb8791c3c"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) 159.231442ms ago: executing program 2 (id=11377): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_PMK(r1, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010029cf7000fcdbdf257b00000008000300", @ANYRES32, @ANYBLOB="0a00060008021100000000001400fe00a146dc2ebdd83c76e5b6b9240efa16e6"], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x40000) 158.244262ms ago: executing program 0 (id=11378): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$AUTOFS_IOC_EXPIRE(r1, 0x810c9365, &(0x7f00000001c0)={{0x6, 0x8}, 0x100, './file0\x00'}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'geneve0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000180)="0b0312002e0064000200475400f6a13bb1000000086086dd4803", 0x100a6, 0x88a8ffff, &(0x7f0000000140)={0x11, 0x88a8, r2}, 0x14) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DREG={0x98}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x0) socketpair(0x28, 0x2, 0x2, &(0x7f0000000080)={0xffffffffffffffff}) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="0100de27bd7000fbdbdf250e00000050000280080009000700000006000f000a000000080009000900000006000e004e20000008000600090000000800040001000000060002004e22400014000100ffffffff0066000000000000000000"], 0x64}}, 0x20000810) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0552e552359c71517cadfe2b3f1c0600000000000000490000ff", @ANYRES64=r0], 0x50) 77.006739ms ago: executing program 4 (id=11379): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000100)=@name={0x1e, 0x2, 0x3, {{0x42}}}, 0x10) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r2, 0x84, 0x24, 0x0, &(0x7f0000000040)) bind$tipc(r1, &(0x7f00000000c0)=@name={0x1e, 0x2, 0x1, {{0x43, 0x3}, 0x1}}, 0x10) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000280)=[@in6={0xa, 0x4e20, 0x9, @mcast2}]}, &(0x7f0000000240)=0x10) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x7d, &(0x7f00000000c0)=@assoc_value={r3}, 0x8) socket$inet6(0xa, 0x2, 0x0) syz_init_net_socket$llc(0x1a, 0x801, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) epoll_create1(0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1, 0x6, &(0x7f0000000600)=ANY=[@ANYBLOB="05000000000000001c30c469000000002d080c0001000000850000000900000095000300000000009500a505000000003d5a5dceec8afea5b14d1a061183481a736d8b51a714c6d6baf539baf68b4851f5209ffee86fa5527c81a417d29f8965e65907cb660d2940150749ab0b754942a4da9715e07f53df5b05512e932f2d6f0b2f9b37e46660df8d0764ed1a55558ff3a7406f45c6ab404326a0108b61d35b014ca92b08eb1fd7a04eda3272b49f9d07497acd0fe7a77482275a245f8e9a2296919c75e177f025b4c6d3834c763f862c4e13505d7d8a200e9a7a5e3343e1ca5bc13ea93b11c6b13cc6fb36b68ae2194412f0891e77ae652f7c20045b643a99bd46c57903ea423e844838650f507e29e817925858ffd61c118d23d4e03521effb60ba6bfe6ef66730a59b09de"], &(0x7f0000000080)='GPL\x00', 0x1, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000100)={0xffffffffffffffff, 0xe0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000009c0)=[0x0, 0x0], 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900030073797a30000000002c000000030a010200000000000000000100000009000373797a300000000034000000080a010100000000000000000100000008000940000000000900020073797a32000000000900010073797a3000000000140000001100010000000000000000000000000a00000000000000000000000000571b7d1482c46f172000a642c61f46bbe59b68b38fb73278a69e1c9aec7d08f27840c4f6f25e6fd9e643f3efff70743500264e1c5f479e6ada73ac3713d92b514220dc38835da93bb06952d247b13c09"], 0xa8}}, 0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[], 0x48) syz_emit_ethernet(0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa308808ce538c68d647e5a1fa5ef611648de01c87b188db160a573ce395aabf"], 0x0) ppoll(&(0x7f0000000500)=[{r5}], 0x1, 0x0, 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000d, 0x12, r6, 0xbf34e000) syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r6, &(0x7f00000002c0), 0x12) r7 = socket$inet(0xa, 0x801, 0x84) ioctl$sock_inet_SIOCDELRT(r7, 0x890c, &(0x7f0000000180)={0x0, {0x2, 0x4e20, @rand_addr=0x64010102}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x34}}, {0x2, 0x4e20, @empty}, 0xa8, 0x0, 0x0, 0x0, 0x7f5, &(0x7f0000000140)='veth1_to_team\x00', 0x100000000, 0x7d, 0x115b}) 18.917878ms ago: executing program 3 (id=11380): r0 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001280), 0x0) recvmsg(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)}, 0x40) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000240)='GPL\x00', 0x80040005, 0x0, 0x0, 0x41100, 0x18}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r1 = accept4$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @private}, &(0x7f00000001c0)=0x10, 0x80000) getsockopt$IPT_SO_GET_ENTRIES(r1, 0x0, 0x41, &(0x7f0000000300)={'raw\x00', 0x95, "7da0583940c31533eb995672c34d7822c05f353074c594471fda7bfbf5a673b5282d44744c1991cdcda32158ffd7eaefbf5284cb3b446cd09fc459c79e4cb713faedd56bbbbdd260694838056ba9e5e146fd9c81f37dfdb5589eab865bb30521d24cc1ea00760a700ba5875cee3c299b928db9fb2d81e13c1c2120ac779189e69fc5e1d0c7794e5203bcab12b94e71f8e0ae1de4ef"}, &(0x7f0000000200)=0xb9) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r2, 0x8b1a, &(0x7f0000000040)) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="07000000040000000001000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x10, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000004000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000002850000001b000000b70000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000009000000850000000600000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 0s ago: executing program 2 (id=11381): r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000000)={0x0, 0x2}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000080)={r1, 0x1, 0x0, 0x7ba800, 0x1}, &(0x7f00000000c0)=0x18) setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000100)={r2, 0xc, 0xf, "fcf4904ee09ed5987834cc0ee2aeb7"}, 0x17) r3 = accept4(r0, &(0x7f0000000140)=@tipc, &(0x7f00000001c0)=0x80, 0x0) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f0000000200)={r2, 0x17}, 0x8) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f0000000240)={r2, @in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x0, 0xe, 0x3, 0x2d4d020c, 0x4, 0x90, 0x5}, &(0x7f0000000300)=0x9c) sendmsg$NFT_MSG_GETSET(r3, &(0x7f0000000540)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000500)={&(0x7f0000000380)={0x14c, 0xa, 0xa, 0x401, 0x0, 0x0, {0xd, 0x0, 0x6}, [@NFTA_SET_USERDATA={0x3e, 0xd, 0x1, 0x0, "9efc65e021b9035a2d51ac9678a99d013d6001bf7b6baba64a6cf238c566c97e0cb18240a2ee8d3121675a0b25a46924f87ed5bd56d2a7d1688e"}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x142}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_USERDATA={0xce, 0xd, 0x1, 0x0, "0c264637ceee0ad5c06a46ca89d76badeac7bb87bf2ed922b35f7afb349e7079b479ade73cd5bf706218aea1a5a904e10ba567dfff2459433561cfcadc7bf923d6a27907ca4f49eaa6f4adbbbc8a54a2b590c296bea0a9ef0f69b968956014562d2c26b702cc9c91c8469094e45242ed943b7c6ca6dcd3b9ea282e8f5e5e5769448808722381b720e6b7a7e513929a03850a99e3deeadd1cbce883f37c4dde1fcfc6bfbad44baa7205c203768b71f1ca940f7235e9f8e6ff5588883b9f2aec8d71daaeee88a87f7916a6"}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x3a}, @NFTA_SET_HANDLE={0xc, 0x10, 0x1, 0x0, 0x3}]}, 0x14c}}, 0x40) socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000580)={0x0, 0x3, 0x20}, &(0x7f00000005c0)=0xc) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000600), 0x4) syz_init_net_socket$ax25(0x3, 0x2, 0x6) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GCALLUSERDATA(r6, 0x89e4, &(0x7f0000000640)={0x36, "8ff953acce211a6bc869c1f85c8d23007d9ad04ec9add0058b88faa3dac413181972d6717afcac7be95f45df37438e599122ccd6819fa54575482f7ef2552beeab07d91df3518f9c89f4da20aaf084c8ba8f7425f12312bcd8bc4531746852f9dcaa7d9a534e4fcfac9a402b7820c87ce65aa8664d3b61cfc0cef747e8217591"}) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(r7, 0x84, 0x77, &(0x7f0000000700)={r5, 0x4, 0x4, [0x9, 0x0, 0x1e, 0xb237]}, &(0x7f0000000740)=0x10) r8 = syz_genetlink_get_family_id$ipvs(&(0x7f00000007c0), r3) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x5c, r8, 0x200, 0x70bd25, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x800}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}]}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x400}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) sendmsg$NFT_MSG_GETTABLE(r3, &(0x7f0000000a80)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000940)={0xf0, 0x1, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_TABLE_USERDATA={0x92, 0x6, "35d933dc53d089103828e3f90178b0dd610151b7d6a68f39ec4568f958cfacd0909949dc5a5426ee6e4266c1aec62da608e76566613ef77d4f14db57213eb2c79390780f2df270fbce961bc7317fd983baf08ffb670cc76ebaf434a87efb39da79d97a16a9904bc710ed402feeab4ead37b888bdb9fa2d1871a739c183851ba574882b0f2ca03849f604ae3496cd"}, @NFTA_TABLE_USERDATA={0x3c, 0x6, "6e00f7993785012b4acf9d0c4848c76b24388d6f4626da8af96ad2173158d549e15bad5da6994ade74e1f5a3c04da6e1c66ef8cc22c443d4"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}]}, 0xf0}}, 0x40) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000b00), r3) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r3, &(0x7f0000000bc0)={&(0x7f0000000ac0), 0xc, &(0x7f0000000b80)={&(0x7f0000000b40)={0x28, r9, 0x800, 0x70bd26, 0x25dfdbfd, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x40080) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r3, 0x800442d2, &(0x7f0000000c40)={0x1, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, @remote}]}) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r7, 0x84, 0x13, &(0x7f0000000c80)={r4, 0x94f}, &(0x7f0000000cc0)=0x8) r10 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_sco_SCO_CONNINFO(r10, 0x11, 0x2, &(0x7f0000000d00)=""/165, &(0x7f0000000dc0)=0xa5) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000e00)={r5, 0x200}, 0x8) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r11, 0x84, 0x14, &(0x7f0000000e40)=@assoc_value, &(0x7f0000000e80)=0x8) ioctl$sock_ifreq(r3, 0x8916, &(0x7f0000000ec0)={'veth1_to_bridge\x00', @ifru_addrs=@nl=@unspec}) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000f00)={r4, 0x6}, &(0x7f0000000f40)=0x8) kernel console output (not intermixed with test programs): 99.194814][ T7956] netlink: 'syz.5.9347': attribute type 2 has an invalid length. [ 999.440868][ T7967] netlink: 'syz.5.9349': attribute type 4 has an invalid length. [ 999.449096][ T60] bridge_slave_1: left allmulticast mode [ 999.449167][ T60] bridge_slave_1: left promiscuous mode [ 999.449372][ T60] bridge0: port 2(bridge_slave_1) entered disabled state [ 999.518734][ T60] ¾x9ÿ: left allmulticast mode [ 999.523844][ T60] ¾x9ÿ: left promiscuous mode [ 999.529552][ T60] bridge0: port 1(1¾x9ÿ) entered disabled state [ 999.574433][ T60] veth0_to_bond: left promiscuous mode [ 999.587055][ T60] bridge3: port 2(veth0_to_bond) entered disabled state [ 999.630260][ T60] veth3: left allmulticast mode [ 999.635195][ T60] veth3: left promiscuous mode [ 999.657260][ T60] bridge3: port 1(veth3) entered disabled state [ 1000.136376][ T52] Bluetooth: hci3: command tx timeout [ 1001.677896][ T60] bond2 (unregistering): (slave gretap1): Releasing active interface [ 1002.226585][ T52] Bluetooth: hci3: command tx timeout [ 1002.348460][ T60]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 1002.359782][ T60]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 1002.371793][ T60]  (unregistering): Released all slaves [ 1002.485500][ T60] bond1 (unregistering): Released all slaves [ 1002.500106][ T60] bond2 (unregistering): Released all slaves [ 1002.514865][ T60] bond3 (unregistering): (slave bond4): Releasing backup interface [ 1002.527173][ T60] bond3 (unregistering): Released all slaves [ 1002.652059][ T60] bond4 (unregistering): Released all slaves [ 1002.667149][ T60] bond5 (unregistering): Released all slaves [ 1002.803708][ T60] bond6 (unregistering): Released all slaves [ 1002.877684][ T7791] bridge0: port 1(bridge_slave_0) entered blocking state [ 1002.897404][ T7791] bridge0: port 1(bridge_slave_0) entered disabled state [ 1002.910959][ T7791] bridge_slave_0: entered allmulticast mode [ 1002.939196][ T7791] bridge_slave_0: entered promiscuous mode [ 1002.965286][ T7791] bridge0: port 2(bridge_slave_1) entered blocking state [ 1003.000475][ T7791] bridge0: port 2(bridge_slave_1) entered disabled state [ 1003.019997][ T7791] bridge_slave_1: entered allmulticast mode [ 1003.041673][ T7791] bridge_slave_1: entered promiscuous mode [ 1003.132339][ T60] : left promiscuous mode [ 1003.148582][ T8029] __nla_validate_parse: 4 callbacks suppressed [ 1003.148603][ T8029] netlink: 32 bytes leftover after parsing attributes in process `syz.2.9360'. [ 1003.214096][ T8026] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9358'. [ 1003.225794][ T8027] netlink: 212340 bytes leftover after parsing attributes in process `syz.0.9359'. [ 1003.252987][ T8034] tipc: Enabled bearer , priority 10 [ 1003.293305][ T7791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1003.328528][ T8034] tipc: Enabling of bearer rejected, already enabled [ 1003.337678][ T60] tipc: Left network mode [ 1003.345599][ T7791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1003.419558][ T8042] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9362'. [ 1003.592858][ T7791] team0: Port device team_slave_0 added [ 1003.610183][ T8046] netlink: 'syz.2.9363': attribute type 29 has an invalid length. [ 1003.710030][ T7791] team0: Port device team_slave_1 added [ 1003.770893][ T8067] netlink: 232 bytes leftover after parsing attributes in process `syz.3.9366'. [ 1003.770893][ T8066] netlink: 232 bytes leftover after parsing attributes in process `syz.3.9366'. [ 1003.775235][ T8065] sctp: [Deprecated]: syz.0.9367 (pid 8065) Use of int in max_burst socket option. [ 1003.775235][ T8065] Use struct sctp_assoc_value instead [ 1003.833714][ T8074] netlink: 7064 bytes leftover after parsing attributes in process `syz.2.9369'. [ 1003.849758][ T8074] openvswitch: netlink: Missing key (keys=40, expected=100) [ 1004.023016][ T7791] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1004.066507][ T7791] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1004.116249][ T7791] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1004.137726][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5750 ms [ 1004.145836][ C0] lec:lec_tx_timeout: lec0 [ 1004.244297][ T7791] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1004.263463][ T7791] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1004.309404][ T52] Bluetooth: hci3: command tx timeout [ 1004.347479][ T7791] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1004.450031][ T8097] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9374'. [ 1004.481802][T20685] tipc: Node number set to 2886655562 [ 1004.495336][ T8097] netlink: 'syz.0.9374': attribute type 7 has an invalid length. [ 1004.541268][ T8097] netlink: 'syz.0.9374': attribute type 8 has an invalid length. [ 1004.551182][ T8109] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9375'. [ 1004.567649][ T8097] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9374'. [ 1004.628765][ T8112] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1004.774829][ T7791] hsr_slave_0: entered promiscuous mode [ 1004.816545][ T8123] netlink: 'syz.5.9379': attribute type 1 has an invalid length. [ 1004.828238][ T7791] hsr_slave_1: entered promiscuous mode [ 1004.913893][ T8123] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1005.323561][ T8157] bond2: option packets_per_slave: invalid value (18446744073709551615) [ 1005.334366][ T8157] bond2: option packets_per_slave: allowed values 0 - 65535 [ 1005.347017][ T8157] bond2 (unregistering): Released all slaves [ 1005.673213][ T60] hsr_slave_0: left promiscuous mode [ 1005.687820][ T60] hsr_slave_1: left promiscuous mode [ 1005.694299][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1005.702789][ T60] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1005.724223][ T60] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1005.732122][ T60] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1005.770401][ T60] º: left allmulticast mode [ 1005.775286][ T60] : left allmulticast mode [ 1005.780610][ T60] veth1_macvtap: left promiscuous mode [ 1005.787470][ T60] º: left promiscuous mode [ 1005.793350][ T60] veth0_vlan: left promiscuous mode [ 1007.389053][ T60] IPVS: stop unused estimator thread 0... [ 1007.869372][ T8129] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1007.990755][ T7791] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1008.030663][ T7791] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1008.075341][ T7791] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1008.112608][ T7791] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1008.318729][ T8187] syzkaller0: entered promiscuous mode [ 1008.325000][ T8187] syzkaller0: entered allmulticast mode [ 1008.390325][ T8205] netlink: 'syz.3.9394': attribute type 2 has an invalid length. [ 1008.400484][ T8187] __nla_validate_parse: 2 callbacks suppressed [ 1008.400505][ T8187] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9390'. [ 1008.432406][ T8187] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9390'. [ 1008.449431][ T8187] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9390'. [ 1008.541316][ T8205] 9: entered promiscuous mode [ 1008.794239][ T7791] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1008.889612][ T8227] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9398'. [ 1008.921862][ T8228] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9400'. [ 1009.009405][ T8228] netlink: 'syz.2.9400': attribute type 1 has an invalid length. [ 1009.034044][ T8228] netlink: 'syz.2.9400': attribute type 2 has an invalid length. [ 1009.053939][ T8228] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9400'. [ 1009.201088][ T7791] 8021q: adding VLAN 0 to HW filter on device team0 [ 1009.247268][ T8242] netlink: 'syz.0.9402': attribute type 1 has an invalid length. [ 1009.318951][T29563] bridge0: port 1(bridge_slave_0) entered blocking state [ 1009.326326][T29563] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1009.366531][ T8248] netlink: 212360 bytes leftover after parsing attributes in process `syz.5.9403'. [ 1009.407936][ T8243] bond2: (slave gretap1): making interface the new active one [ 1009.420715][ T8243] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 1009.448243][T29563] bridge0: port 2(bridge_slave_1) entered blocking state [ 1009.455711][T29563] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1009.624213][ T7791] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1009.698788][ T8260] pim6reg: entered allmulticast mode [ 1009.992719][ T8273] bond1: Unable to set peer notification delay as MII monitoring is disabled [ 1010.021543][ T8273] bond1 (unregistering): Released all slaves [ 1010.411989][ T7791] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1010.427757][ T8300] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 1010.900409][ T8329] netlink: 'syz.3.9424': attribute type 1 has an invalid length. [ 1010.910296][ T8328] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1010.927561][ T8329] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9424'. [ 1010.938699][ T8328] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9423'. [ 1011.101525][ T8342] netlink: 16215 bytes leftover after parsing attributes in process `syz.5.9427'. [ 1011.275009][ T7791] veth0_vlan: entered promiscuous mode [ 1011.297440][ T7791] veth1_vlan: entered promiscuous mode [ 1011.399264][ T7791] veth0_macvtap: entered promiscuous mode [ 1011.432659][ T7791] veth1_macvtap: entered promiscuous mode [ 1011.462705][ T7791] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1011.533759][ T7791] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1011.574340][ T50] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1011.640182][ T50] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1011.659602][ T8364] veth0: entered promiscuous mode [ 1011.675617][ T50] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1011.700773][ T50] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1012.022379][ T8384] tc_dump_action: action bad kind [ 1012.084035][ T8423] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1012.122257][ T8423] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1012.203624][T13892] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1012.235119][T13892] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1012.791758][ T8416] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not filter [ 1013.297878][ T8457] bond0: Caught tx_queue_len zero misconfig [ 1013.415994][ T8466] __nla_validate_parse: 9 callbacks suppressed [ 1013.416018][ T8466] netlink: 388 bytes leftover after parsing attributes in process `syz.2.9456'. [ 1013.459791][ T8467] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1013.510371][ T8467] netlink: 'syz.4.9457': attribute type 13 has an invalid length. [ 1013.519106][ T8467] netlink: 'syz.4.9457': attribute type 58 has an invalid length. [ 1013.530605][ T8467] netlink: 152 bytes leftover after parsing attributes in process `syz.4.9457'. [ 1013.565427][ T8471] netlink: 'syz.4.9457': attribute type 13 has an invalid length. [ 1013.575941][ T8471] netlink: 'syz.4.9457': attribute type 58 has an invalid length. [ 1013.589046][ T8471] netlink: 152 bytes leftover after parsing attributes in process `syz.4.9457'. [ 1013.689319][ T8479] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9461'. [ 1013.709397][ T8481] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9461'. [ 1013.874641][ T8490] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9464'. [ 1013.889356][ T8490] netlink: 16 bytes leftover after parsing attributes in process `syz.5.9464'. [ 1013.900478][ T8490] netlink: 'syz.5.9464': attribute type 11 has an invalid length. [ 1013.909321][ T8490] netlink: 132 bytes leftover after parsing attributes in process `syz.5.9464'. [ 1014.279034][ T8505] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9469'. [ 1014.569124][ T5145] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1014.579757][ T5145] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1014.590349][T13892] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x82 [ 1014.591221][ T5145] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1014.609388][ T5145] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1014.618126][ T5145] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1014.896321][ T8533] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9475'. [ 1015.035816][ T8523] lo speed is unknown, defaulting to 1000 [ 1015.215832][ T8542] netlink: 'syz.0.9477': attribute type 1 has an invalid length. [ 1015.356025][ T8549] rdma_op ffff888052b941f0 conn xmit_rdma 0000000000000000 [ 1015.379324][ T50] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1015.391385][ T50] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1015.402362][ T50] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 1015.441326][ T8523] chnl_net:caif_netlink_parms(): no params data found [ 1015.525944][ T50] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1015.538178][ T50] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1015.548995][ T50] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 1015.623611][ T50] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1015.634744][ T50] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1015.645557][ T50] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 1015.694003][ T8523] bridge0: port 1(bridge_slave_0) entered blocking state [ 1015.701315][ T8523] bridge0: port 1(bridge_slave_0) entered disabled state [ 1015.708938][ T8523] bridge_slave_0: entered allmulticast mode [ 1015.717021][ T8523] bridge_slave_0: entered promiscuous mode [ 1015.725596][ T8523] bridge0: port 2(bridge_slave_1) entered blocking state [ 1015.733191][ T8523] bridge0: port 2(bridge_slave_1) entered disabled state [ 1015.745121][ T8523] bridge_slave_1: entered allmulticast mode [ 1015.752959][ T8523] bridge_slave_1: entered promiscuous mode [ 1015.780974][ T50] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1015.792187][ T50] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1015.803287][ T50] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 2] type 2 family 0 port 19999 - 0 [ 1015.852318][ T8523] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1015.868080][ T8523] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1015.907154][ T8523] team0: Port device team_slave_0 added [ 1015.917592][ T8523] team0: Port device team_slave_1 added [ 1015.950140][ T8523] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1015.957456][ T8523] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1015.985723][ T8523] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1016.023667][ T8523] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1016.031782][ T8523] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1016.059895][ T8523] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1016.131729][ T8523] hsr_slave_0: entered promiscuous mode [ 1016.142048][ T8523] hsr_slave_1: entered promiscuous mode [ 1016.148620][ T8523] debugfs: 'hsr0' already exists in 'hsr' [ 1016.154648][ T8523] Cannot create hsr debugfs directory [ 1016.706792][ T52] Bluetooth: hci2: command tx timeout [ 1017.460273][ T8513] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1017.649852][ T8581] nbd: must specify a device to reconfigure [ 1017.963005][ T8602] tipc: Failed to remove unknown binding: 66,0,0/0:3914064513/3914064514 [ 1017.986985][ T8602] tipc: Failed to remove unknown binding: 66,0,0/0:3914064513/3914064514 [ 1018.109080][ T50] bond3 (unregistering): (slave gretap1): Releasing backup interface [ 1018.148291][ T50] bond4 (unregistering): (slave gretap2): Releasing active interface [ 1018.262928][ T50] dvmrp0 (unregistering): left allmulticast mode [ 1018.776347][ T52] Bluetooth: hci2: command tx timeout [ 1018.819329][ T50] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1018.828637][ T50] bond_slave_0: left allmulticast mode [ 1018.839564][ T50] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1018.851050][ T50] bond_slave_1: left allmulticast mode [ 1018.867181][ T50] bond0 (unregistering): Released all slaves [ 1018.993086][ T50] bond1 (unregistering): Released all slaves [ 1019.159355][ T50] bond2 (unregistering): Released all slaves [ 1019.174427][ T50] bond3 (unregistering): Released all slaves [ 1019.189395][ T50] bond4 (unregistering): Released all slaves [ 1019.322410][ T50] bond5 (unregistering): Released all slaves [ 1019.337219][ T50] bond6 (unregistering): Released all slaves [ 1019.469624][ T50] bond7 (unregistering): Released all slaves [ 1019.597820][ T50] bond8 (unregistering): Released all slaves [ 1019.734274][ T50] bond9 (unregistering): (slave bond10): Releasing active interface [ 1019.743799][ T50] bond9 (unregistering): Released all slaves [ 1019.864607][ T50] bond10 (unregistering): Released all slaves [ 1019.990503][ T50] bond11 (unregistering): (slave veth0_to_bond): Releasing active interface [ 1019.999677][ T50] veth0_to_bond: left promiscuous mode [ 1020.005305][ T50] veth0_to_bond: left allmulticast mode [ 1020.013331][ T50] bond11 (unregistering): Released all slaves [ 1020.027852][ T50] bond12 (unregistering): Released all slaves [ 1020.058367][ T8573] __nla_validate_parse: 3 callbacks suppressed [ 1020.058391][ T8573] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9483'. [ 1020.079407][ T8594] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9489'. [ 1020.096533][ T8594] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9489'. [ 1020.124028][ T8594] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9489'. [ 1020.248011][ T8619] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9494'. [ 1020.271020][ T50] : left promiscuous mode [ 1020.276545][ T8619] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9494'. [ 1020.356597][ T8622] netlink: 'syz.0.9495': attribute type 1 has an invalid length. [ 1020.396365][ T8626] netlink: 40 bytes leftover after parsing attributes in process `syz.0.9495'. [ 1020.410226][ T50] 9: left promiscuous mode [ 1020.539304][ T8625] bridge0: port 2(bridge_slave_1) entered disabled state [ 1020.605299][ T50] tipc: Disabling bearer [ 1020.626510][ T50] tipc: Left network mode [ 1020.818435][ T50] IPVS: stopping master sync thread 4168 ... [ 1020.848367][ T50] IPVS: stopping backup sync thread 3312 ... [ 1020.858689][ T52] Bluetooth: hci2: command tx timeout [ 1020.907802][ T8659] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9504'. [ 1021.024209][ T8659] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 1021.057728][ T8659] gretap1: entered promiscuous mode [ 1021.088321][ T8659] gretap1: entered allmulticast mode [ 1021.252949][ T8423] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x82 [ 1021.951202][ T8707] xt_socket: unknown flags 0xe4 [ 1021.983741][ T8707] netlink: 'syz.4.9513': attribute type 3 has an invalid length. [ 1022.133467][ T50] hsr_slave_0: left promiscuous mode [ 1022.158952][ T50] hsr_slave_1: left promiscuous mode [ 1022.181225][ T50] veth1_macvtap: left promiscuous mode [ 1022.187665][ T50] veth0_macvtap: left promiscuous mode [ 1022.193911][ T50] veth1_vlan: left promiscuous mode [ 1022.200190][ T50] veth0_vlan: left promiscuous mode [ 1022.496347][ T8721] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9516'. [ 1022.505552][ T8721] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9516'. [ 1022.946250][ T52] Bluetooth: hci2: command tx timeout [ 1023.512965][ T50] IPVS: stop unused estimator thread 0... [ 1024.102446][ T8669] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1024.123902][ T8523] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1024.173207][ T8523] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1024.211549][ T8523] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1024.265678][ T8523] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1024.570805][ T8523] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1024.629298][ T8523] 8021q: adding VLAN 0 to HW filter on device team0 [ 1024.647944][ T8769] netlink: 'syz.2.9526': attribute type 5 has an invalid length. [ 1024.674629][ T8422] bridge0: port 1(bridge_slave_0) entered blocking state [ 1024.681896][ T8422] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1024.705614][ T8422] bridge0: port 2(bridge_slave_1) entered blocking state [ 1024.712866][ T8422] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1024.889135][ T8782] : entered promiscuous mode [ 1025.188271][ T8801] lo: Caught tx_queue_len zero misconfig [ 1025.295165][ T8523] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1025.381215][ T8523] veth0_vlan: entered promiscuous mode [ 1025.393959][ T8523] veth1_vlan: entered promiscuous mode [ 1025.429159][ T8523] veth0_macvtap: entered promiscuous mode [ 1025.449480][ T8523] veth1_macvtap: entered promiscuous mode [ 1025.510842][ T8523] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1025.528270][ T8523] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1025.542902][ T8422] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1025.553650][ T8422] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1025.564310][ T8422] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1025.574118][ T8422] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1027.930764][ T8785] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1028.115745][T13892] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1028.129768][T13892] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1028.180161][ T8837] __nla_validate_parse: 4 callbacks suppressed [ 1028.180181][ T8837] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9540'. [ 1028.204109][ T8837] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9540'. [ 1028.233984][ T8836] ip6gre1: entered promiscuous mode [ 1028.239800][ T8836] ip6gre1: entered allmulticast mode [ 1028.252773][T13892] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1028.272800][T13892] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1028.283195][ T8837] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1028.393739][T12579] lec:lec_start_xmit: lec0:No lecd attached [ 1028.410346][ T8847] netlink: 108 bytes leftover after parsing attributes in process `syz.2.9541'. [ 1028.437531][ T8847] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9541'. [ 1028.468864][ T8850] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9470'. [ 1028.478517][ T8850] netlink: 40 bytes leftover after parsing attributes in process `syz.3.9470'. [ 1028.508875][ T8853] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9541'. [ 1028.524612][ T8853] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9541'. [ 1028.623428][ T8862] netlink: 104 bytes leftover after parsing attributes in process `syz.4.9545'. [ 1029.055667][ T8882] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9551'. [ 1029.274173][ T8892] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 1029.320006][ T8894] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 1029.332398][ T8894] bond1 (unregistering): Released all slaves [ 1031.735317][ T8870] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1034.136325][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5740 ms [ 1034.144628][ C0] lec:lec_tx_timeout: lec0 [ 1035.356572][ T8965] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1035.662130][ T9012] __nla_validate_parse: 5 callbacks suppressed [ 1035.662152][ T9012] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9581'. [ 1035.771377][ T9018] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9583'. [ 1035.816411][ T9018] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9583'. [ 1036.106822][ T9043] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9591'. [ 1036.193852][ T9047] netlink: 36 bytes leftover after parsing attributes in process `syz.4.9591'. [ 1036.332208][ T9057] netlink: 104 bytes leftover after parsing attributes in process `syz.2.9594'. [ 1036.384206][ T9050] syzkaller0: entered promiscuous mode [ 1036.436410][ T9050] syzkaller0: entered allmulticast mode [ 1036.619962][ T9077] x_tables: duplicate underflow at hook 2 [ 1036.689362][ T9077] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1036.714644][ T9077] netlink: 'syz.3.9597': attribute type 6 has an invalid length. [ 1036.837254][ T9086] netlink: 'syz.3.9597': attribute type 16 has an invalid length. [ 1036.845351][ T9086] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9597'. [ 1039.117475][ T9121] netlink: 44 bytes leftover after parsing attributes in process `syz.0.9606'. [ 1039.146255][ T9121] netlink: 35 bytes leftover after parsing attributes in process `syz.0.9606'. [ 1039.158386][ T9121] netlink: 'syz.0.9606': attribute type 5 has an invalid length. [ 1039.194943][ T9121] netlink: 'syz.0.9606': attribute type 6 has an invalid length. [ 1039.236712][ T9120] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9607'. [ 1039.247604][ T9129] IPVS: set_ctl: invalid protocol: 58 127.0.0.1:20003 [ 1039.372703][ T9139] netlink: 'syz.2.9611': attribute type 1 has an invalid length. [ 1039.467033][ T9143] netlink: 'syz.4.9613': attribute type 1 has an invalid length. [ 1039.604770][ T9147] netlink: 'syz.5.9612': attribute type 29 has an invalid length. [ 1042.913460][ T9172] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1042.936031][ T9204] netlink: 'syz.3.9628': attribute type 1 has an invalid length. [ 1042.949736][ T9204] netlink: 'syz.3.9628': attribute type 7 has an invalid length. [ 1042.959802][ T9204] netlink: 'syz.3.9628': attribute type 8 has an invalid length. [ 1042.968440][ T9204] __nla_validate_parse: 6 callbacks suppressed [ 1042.968462][ T9204] netlink: 208 bytes leftover after parsing attributes in process `syz.3.9628'. [ 1042.984557][ T9204] NCSI netlink: No device for ifindex 65584 [ 1043.189811][ T9217] netlink: 1 bytes leftover after parsing attributes in process `syz.2.9632'. [ 1043.255049][ T9222] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1043.375522][ T9228] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 1043.410308][ T9233] netlink: 56 bytes leftover after parsing attributes in process `syz.2.9640'. [ 1043.520424][ T9245] netdevsim netdevsim5 netdevsim0: entered promiscuous mode [ 1043.541454][ T9233] netlink: 44 bytes leftover after parsing attributes in process `syz.2.9640'. [ 1043.577283][ T9249] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9643'. [ 1043.598851][T29563] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.617603][T29563] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.627220][ T9249] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9643'. [ 1043.640126][ T8423] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.663935][ T8423] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1043.757493][ T9258] netlink: 76 bytes leftover after parsing attributes in process `syz.2.9646'. [ 1043.775616][ T9258] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9646'. [ 1043.858609][ T9267] 8021q: VLANs not supported on sit0 [ 1044.010559][ T9277] netlink: 207952 bytes leftover after parsing attributes in process `syz.4.9649'. [ 1046.369479][ T9232] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1046.569736][ T9285] netlink: 44 bytes leftover after parsing attributes in process `syz.4.9651'. [ 1046.723063][ T9301] openvswitch: netlink: IP tunnel attribute has 6 unknown bytes. [ 1046.926561][ T9315] ipt_ECN: cannot use operation on non-tcp rule [ 1047.113135][ T9331] IPVS: set_ctl: invalid protocol: 44 172.20.20.187:20003 [ 1047.526042][ T9356] lo speed is unknown, defaulting to 1000 [ 1048.304281][ T9374] mac80211_hwsim hwsim108 wlan0: entered promiscuous mode [ 1049.883714][ T9316] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1050.072499][ T9392] __nla_validate_parse: 33 callbacks suppressed [ 1050.072522][ T9392] netlink: 52 bytes leftover after parsing attributes in process `syz.5.9679'. [ 1050.098220][ T9392] bridge0: port 2(bridge_slave_1) entered disabled state [ 1050.119700][ T9392] netlink: 52 bytes leftover after parsing attributes in process `syz.5.9679'. [ 1050.234173][ T9408] netlink: 1 bytes leftover after parsing attributes in process `syz.4.9684'. [ 1050.460346][ T9431] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9687'. [ 1052.275529][ T9463] vlan2: entered allmulticast mode [ 1052.280836][ T9463] geneve1: entered allmulticast mode [ 1052.365387][ T9466] netlink: 212360 bytes leftover after parsing attributes in process `syz.3.9698'. [ 1052.382106][ T9466] erspan0: entered allmulticast mode [ 1053.409489][ T9422] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1053.446255][ T9431] netlink: 'syz.5.9687': attribute type 1 has an invalid length. [ 1053.454516][ T9431] netlink: 'syz.5.9687': attribute type 1 has an invalid length. [ 1053.465482][ T9431] netlink: 9172 bytes leftover after parsing attributes in process `syz.5.9687'. [ 1053.670106][ T9485] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9705'. [ 1053.710892][ T9487] syzkaller1: entered allmulticast mode [ 1053.759194][ T9492] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9707'. [ 1053.768947][ T9492] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9707'. [ 1053.779320][ T9492] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9707'. [ 1053.799662][ T50] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1053.816762][ T8422] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1053.827650][ T8422] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1053.848663][ T8422] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1053.880978][ T9494] dvmrp0: entered allmulticast mode [ 1053.917989][ T9496] delete_channel: no stack [ 1053.933233][ T9496] xt_hashlimit: size too large, truncated to 1048576 [ 1054.053237][ T9502] netlink: 'syz.0.9709': attribute type 10 has an invalid length. [ 1054.122596][ T9495] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1054.914693][ T9533] netlink: 'syz.0.9719': attribute type 10 has an invalid length. [ 1054.939560][ T9533] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1055.307829][ T9545] __nla_validate_parse: 5 callbacks suppressed [ 1055.307844][ T9545] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9724'. [ 1055.337946][ T9545] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9724'. [ 1057.038735][ T9503] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1057.240646][ T9564] netlink: 44 bytes leftover after parsing attributes in process `syz.3.9730'. [ 1057.810622][ T9599] netlink: 12 bytes leftover after parsing attributes in process `syz.5.9739'. [ 1057.995564][ T9612] tipc: Enabling of bearer rejected, failed to enable media [ 1058.460749][ T9638] netdevsim0: mtu greater than device maximum [ 1058.658826][ T9649] netlink: 'syz.0.9752': attribute type 83 has an invalid length. [ 1058.932244][ T9661] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9755'. [ 1058.943914][ T9661] block nbd2: Unsupported socket: should be TCP or UNIX. [ 1058.990032][ T9666] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9758'. [ 1059.170905][ T9677] netlink: 'syz.4.9759': attribute type 13 has an invalid length. [ 1059.605148][ T9689] tipc: Started in network mode [ 1059.610241][ T9689] tipc: Node identity , cluster identity 4711 [ 1059.616550][ T9689] tipc: Failed to obtain node identity [ 1059.623130][ T9689] tipc: Enabling of bearer rejected, failed to enable media [ 1059.752394][ T9704] syzkaller0: entered promiscuous mode [ 1059.760973][ T9704] syzkaller0: entered allmulticast mode [ 1059.773065][ T9674] tap0: tun_chr_ioctl cmd 1074025676 [ 1059.778786][ T9674] tap0: owner set to 0 [ 1059.832590][ T1303] lec:lec_start_xmit: lec0:No lecd attached [ 1060.507661][ T9727] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 1060.514539][ T9727] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 1063.531556][ T9740] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9775'. [ 1063.770814][ T9759] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9779'. [ 1063.904730][ T9769] netlink: 'syz.4.9783': attribute type 1 has an invalid length. [ 1063.932323][ T9769] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1063.947083][ T9775] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9781'. [ 1064.023306][ T9781] netlink: 'syz.0.9781': attribute type 1 has an invalid length. [ 1064.068721][ T9775] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9781'. [ 1064.090897][ T9785] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9787'. [ 1064.118119][ T9781] netlink: 228 bytes leftover after parsing attributes in process `syz.0.9781'. [ 1064.129358][ T9785] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9787'. [ 1064.366754][ T9808] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9792'. [ 1065.176223][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5340 ms [ 1065.184342][ C0] lec:lec_tx_timeout: lec0 [ 1065.199048][ T9846] netlink: 7064 bytes leftover after parsing attributes in process `syz.5.9803'. [ 1065.208534][ T9846] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1067.293353][ T9800] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1067.579057][ T9867] netlink: 'syz.5.9809': attribute type 83 has an invalid length. [ 1067.914672][ T30] audit: type=1107 audit(1770464466.642:13): pid=9885 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='–C#4I:' [ 1068.090133][ T9903] netlink: 'syz.4.9820': attribute type 39 has an invalid length. [ 1068.386798][ T9923] netlink: 'syz.4.9825': attribute type 1 has an invalid length. [ 1068.490606][ T9931] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9826'. [ 1068.608825][ T9935] __nla_validate_parse: 1 callbacks suppressed [ 1068.608847][ T9935] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9828'. [ 1068.828034][ T9951] netlink: 'syz.3.9831': attribute type 10 has an invalid length. [ 1068.839785][ T9952] netlink: 'syz.3.9831': attribute type 10 has an invalid length. [ 1068.863861][ T9951] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 1069.180450][ T9968] C: renamed from lo (while UP) [ 1069.191099][ T9968] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1069.484635][ T9986] netlink: 24 bytes leftover after parsing attributes in process `syz.0.9838'. [ 1070.793039][T10017] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9845'. [ 1071.015294][ T9896] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1071.177863][T10023] netlink: 'syz.2.9846': attribute type 1 has an invalid length. [ 1071.442844][T10040] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 1071.553630][T10049] netlink: 'syz.2.9856': attribute type 5 has an invalid length. [ 1071.679810][T10059] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9859'. [ 1071.698406][T10059] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1071.708956][T10061] netlink: 36 bytes leftover after parsing attributes in process `syz.5.9857'. [ 1071.877235][T10070] sctp: [Deprecated]: syz.0.9861 (pid 10070) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1071.877235][T10070] Use struct sctp_sack_info instead [ 1072.479447][T10059] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1072.550145][T10065] tipc: Started in network mode [ 1072.558606][T10065] tipc: Node identity ac14140f, cluster identity 4711 [ 1072.588993][T10065] tipc: New replicast peer: 255.255.255.255 [ 1072.595772][T10065] tipc: Enabled bearer , priority 10 [ 1072.634565][T10077] lo: Caught tx_queue_len zero misconfig [ 1072.834230][T10087] bridge_slave_0: left allmulticast mode [ 1072.842500][T10087] bridge_slave_0: left promiscuous mode [ 1072.859700][T10089] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9868'. [ 1072.868359][T10087] bridge0: port 1(bridge_slave_0) entered disabled state [ 1072.885669][T10091] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9868'. [ 1072.926967][T10087] bridge_slave_1: left allmulticast mode [ 1072.940545][T10087] bridge_slave_1: left promiscuous mode [ 1072.947521][T10087] bridge0: port 2(bridge_slave_1) entered disabled state [ 1072.957734][T10093] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9871'. [ 1073.009866][T10087] bond0: (slave bond_slave_0): Releasing backup interface [ 1073.033443][T10099] netlink: 16 bytes leftover after parsing attributes in process `syz.5.9872'. [ 1073.050180][T10087] bond0: (slave bond_slave_1): Releasing backup interface [ 1073.071703][T10087] team0: Port device team_slave_0 removed [ 1073.088264][T10087] team0: Port device team_slave_1 removed [ 1073.095458][T10087] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1073.104737][T10087] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1073.116739][T10087] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1073.125452][T10087] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1073.136652][T10087] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1073.168111][T10099] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9872'. [ 1073.343326][T10112] netlink: 'syz.5.9875': attribute type 5 has an invalid length. [ 1076.170004][T10112] macvtap1: entered allmulticast mode [ 1076.176416][T10112] veth0_macvtap: entered allmulticast mode [ 1076.251712][T20684] tipc: Node number set to 2886997007 [ 1076.858278][T10138] __nla_validate_parse: 4 callbacks suppressed [ 1076.858299][T10138] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9882'. [ 1076.942381][T10143] netlink: 256 bytes leftover after parsing attributes in process `syz.4.9884'. [ 1076.952826][T10144] netlink: 16 bytes leftover after parsing attributes in process `syz.5.9883'. [ 1077.011111][T10147] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9885'. [ 1077.083478][T10147] vlan2: entered allmulticast mode [ 1077.095807][T10147] bridge6: entered allmulticast mode [ 1077.109525][T10152] netlink: 'syz.0.9887': attribute type 11 has an invalid length. [ 1077.153957][T10152] netlink: 224 bytes leftover after parsing attributes in process `syz.0.9887'. [ 1077.235457][T10160] netlink: 108 bytes leftover after parsing attributes in process `syz.5.9889'. [ 1077.263097][T10157] bridge0: the hash_elasticity option has been deprecated and is always 16 [ 1077.295964][T10157] bridge0: port 2(bridge_slave_1) entered disabled state [ 1077.303811][T10157] bridge0: port 1(bridge_slave_0) entered disabled state [ 1077.534370][T10181] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.9894'. [ 1077.548377][T10181] netlink: 'syz.3.9894': attribute type 58 has an invalid length. [ 1077.568253][T10181] netlink: 20 bytes leftover after parsing attributes in process `syz.3.9894'. [ 1077.608128][T10185] net veth1_virt_wifi virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1077.933067][T10204] netlink: 'syz.3.9901': attribute type 10 has an invalid length. [ 1077.985219][T10204] team0: Port device dummy0 added [ 1077.991132][T10208] netlink: 'syz.5.9903': attribute type 5 has an invalid length. [ 1078.101425][T10214] netlink: 'syz.3.9906': attribute type 2 has an invalid length. [ 1078.152814][T10214] 9: entered promiscuous mode [ 1078.447036][T10235] netlink: 28 bytes leftover after parsing attributes in process `syz.5.9911'. [ 1078.577917][T10240] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1078.658910][T10248] netlink: 'syz.0.9916': attribute type 9 has an invalid length. [ 1078.677925][T10248] netlink: 'syz.0.9916': attribute type 11 has an invalid length. [ 1078.685912][T10248] netlink: 'syz.0.9916': attribute type 12 has an invalid length. [ 1078.702262][T10248] netlink: 210020 bytes leftover after parsing attributes in process `syz.0.9916'. [ 1078.742221][T10253] gretap0: entered promiscuous mode [ 1078.788096][T10253] gretap0: left promiscuous mode [ 1078.843008][T10253] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1078.881825][T10253] gretap0: entered promiscuous mode [ 1078.899328][T10258] gretap0: left promiscuous mode [ 1078.960345][T10258] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1079.176733][T10262] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1079.295085][T10262] bond_slave_0: entered promiscuous mode [ 1079.301542][T10262] bond_slave_1: entered promiscuous mode [ 1079.307400][T10262] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 1079.352344][T10262] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1079.376687][T10262] bond3: (slave macvlan2): making interface the new active one [ 1079.439408][T10262] bond3: (slave macvlan2): Enslaving as an active interface with an up link [ 1080.044566][T10311] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 1080.070666][T10311] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1080.264584][T10326] netlink: 'syz.4.9937': attribute type 1 has an invalid length. [ 1080.507781][T10332] C: entered promiscuous mode [ 1080.530394][T10332] netlink: 'syz.0.9940': attribute type 2 has an invalid length. [ 1080.563598][T10332] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1080.667870][T10334] openvswitch: netlink: Missing key (keys=40, expected=80) [ 1080.759401][T10343] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1082.833039][T10303] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1082.975319][T10348] ip6gre1: entered allmulticast mode [ 1083.069360][T10352] sctp: [Deprecated]: syz.4.9946 (pid 10352) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1083.069360][T10352] Use struct sctp_sack_info instead [ 1083.910121][T10405] syzkaller0: entered promiscuous mode [ 1083.915855][T10405] syzkaller0: entered allmulticast mode [ 1083.935754][T10405] 0: reclassify loop, rule prio 0, protocol 800 [ 1083.945821][T10413] __nla_validate_parse: 58 callbacks suppressed [ 1083.945841][T10413] netlink: 240 bytes leftover after parsing attributes in process `syz.3.9968'. [ 1083.986830][T10413] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9968'. [ 1084.023555][T10417] netlink: 'syz.5.9969': attribute type 2 has an invalid length. [ 1084.148082][T10423] netlink: 'syz.3.9973': attribute type 10 has an invalid length. [ 1084.158839][T10423] netlink: 228 bytes leftover after parsing attributes in process `syz.3.9973'. [ 1084.190861][T10423] netlink: 'syz.3.9973': attribute type 1 has an invalid length. [ 1084.208301][T10423] netlink: 136 bytes leftover after parsing attributes in process `syz.3.9973'. [ 1084.226313][T10423] netlink: 'syz.3.9973': attribute type 1 has an invalid length. [ 1084.245253][T10423] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9973'. [ 1084.312137][T10435] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9972'. [ 1084.436905][T10449] netlink: 'syz.3.9978': attribute type 1 has an invalid length. [ 1084.452807][T10441] can: request_module (can-proto-5) failed. [ 1084.613989][T10461] geneve2: entered promiscuous mode [ 1084.647378][T10452] vlan2: entered promiscuous mode [ 1084.652702][T10452] bridge0: entered promiscuous mode [ 1084.820151][T10476] netlink: 'syz.4.9984': attribute type 4 has an invalid length. [ 1085.014299][T10485] syzkaller1: entered promiscuous mode [ 1085.035623][T10485] syzkaller1: entered allmulticast mode [ 1085.064088][T10485] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.9989'. [ 1085.183223][T10498] netlink: 16 bytes leftover after parsing attributes in process `syz.2.9992'. [ 1085.278541][T10506] ip_tunnel: non-ECT from 1.255.255.252 with TOS=0x3 [ 1085.637538][T10519] vlan0: entered promiscuous mode [ 1085.642979][T10519] vlan0: entered allmulticast mode [ 1085.650437][T10519] veth0_vlan: entered allmulticast mode [ 1085.667620][T10522] netlink: 64 bytes leftover after parsing attributes in process `syz.4.9999'. [ 1086.003636][T10539] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10004'. [ 1086.304075][ C1] vxcan1: j1939_tp_rxtimer: 0xffff888051aecc00: rx timeout, send abort [ 1086.530110][T10578] IPVS: set_ctl: invalid protocol: 135 224.0.0.1:20003 [ 1086.804187][ C1] vxcan1: j1939_tp_rxtimer: 0xffff888051aec400: rx timeout, send abort [ 1086.814757][ C1] vxcan1: j1939_tp_rxtimer: 0xffff888051aecc00: abort rx timeout. Force session deactivation [ 1086.983110][T10603] tipc: Started in network mode [ 1087.010676][T10603] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 1087.052688][T10603] tipc: Enabled bearer , priority 10 [ 1087.288966][T10615] : entered promiscuous mode [ 1087.312587][ C1] vxcan1: j1939_tp_rxtimer: 0xffff888051aec400: abort rx timeout. Force session deactivation [ 1087.405792][T10618] syzkaller0: entered promiscuous mode [ 1087.411525][T10618] syzkaller0: entered allmulticast mode [ 1087.499025][ T5145] Bluetooth: hci6: command 0x0406 tx timeout [ 1088.166652][ T9] tipc: Node number set to 10005162 [ 1088.513563][T10692] tipc: Enabling of bearer rejected, failed to enable media [ 1088.597128][T10661] lo speed is unknown, defaulting to 1000 [ 1088.631066][T10698] bridge_slave_1: left allmulticast mode [ 1088.637764][T10698] bridge_slave_1: left promiscuous mode [ 1088.654844][T10698] bridge0: port 2(bridge_slave_1) entered disabled state [ 1088.697950][T10698] bridge_slave_0: left allmulticast mode [ 1088.706177][T10698] bridge_slave_0: left promiscuous mode [ 1088.712210][T10698] bridge0: port 1(bridge_slave_0) entered disabled state [ 1089.405629][T10741] openvswitch: netlink: IP tunnel TTL not specified. [ 1089.452354][T10737] tipc: Enabled bearer , priority 0 [ 1089.523714][T10736] tipc: Disabling bearer [ 1089.733968][T10761] netlink: 'syz.0.10071': attribute type 1 has an invalid length. [ 1089.788956][T10761] netlink: 'syz.0.10071': attribute type 1 has an invalid length. [ 1089.900123][T10777] __nla_validate_parse: 12 callbacks suppressed [ 1089.900144][T10777] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10072'. [ 1089.968369][T10781] syzkaller1: entered promiscuous mode [ 1089.974324][T10781] syzkaller1: entered allmulticast mode [ 1090.102199][T10787] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10076'. [ 1090.116684][T10788] netlink: 112 bytes leftover after parsing attributes in process `syz.0.10076'. [ 1090.200871][T10791] netlink: 'syz.0.10077': attribute type 25 has an invalid length. [ 1090.209829][T10791] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10077'. [ 1090.254920][T10794] bpq0: left promiscuous mode [ 1092.018220][T12579] lec:lec_start_xmit: lec0:No lecd attached [ 1092.678278][T10762] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1092.985763][T10846] netlink: 'syz.3.10088': attribute type 19 has an invalid length. [ 1093.026972][T10846] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10088'. [ 1093.071611][T10848] netlink: 48 bytes leftover after parsing attributes in process `syz.4.10090'. [ 1093.093311][T10851] netlink: 'syz.2.10091': attribute type 10 has an invalid length. [ 1093.093720][T10846] netlink: 'syz.3.10088': attribute type 19 has an invalid length. [ 1093.119561][T13894] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1093.150136][T13894] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1093.165623][T10846] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10088'. [ 1093.190689][T13894] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1093.191099][T10857] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1093.228679][T13894] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1093.381809][T10865] netlink: 52 bytes leftover after parsing attributes in process `syz.4.10094'. [ 1093.394300][T10867] netlink: 16 bytes leftover after parsing attributes in process `syz.5.10095'. [ 1093.404934][T10868] sch_fq: defrate 0 ignored. [ 1093.718091][T10894] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1093.755289][T10895] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10104'. [ 1093.791285][T10895] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1093.875489][T10905] netlink: 'syz.5.10107': attribute type 32 has an invalid length. [ 1093.958042][T10905] bond2: option coupled_control: invalid value (10) [ 1093.994293][T10905] bond2 (unregistering): Released all slaves [ 1094.535168][T10951] bridge0: port 3(ipvlan2) entered blocking state [ 1094.557959][T10951] bridge0: port 3(ipvlan2) entered disabled state [ 1094.574441][T10951] ipvlan2: entered allmulticast mode [ 1094.589864][T10951] bridge0: entered allmulticast mode [ 1094.611207][T10951] ipvlan2: left allmulticast mode [ 1094.624970][T10951] bridge0: left allmulticast mode [ 1094.632362][T10954] can: request_module (can-proto-4) failed. [ 1094.655283][T10952] C: left promiscuous mode [ 1094.713403][T10952] ip6gre1: left promiscuous mode [ 1094.721731][T10952] ip6gre1: left allmulticast mode [ 1094.735876][T10952] vlan2: left promiscuous mode [ 1094.741767][T10952] bridge0: left promiscuous mode [ 1094.758361][ T3274] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1094.896570][ T3274] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1094.904536][T10968] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1095.220806][T10987] netem: change failed [ 1095.352250][T11006] __nla_validate_parse: 17 callbacks suppressed [ 1095.352272][T11006] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10133'. [ 1095.472955][T11030] netlink: 'syz.5.10134': attribute type 23 has an invalid length. [ 1095.675145][T11043] openvswitch: netlink: Key 23 has unexpected len 16 expected 2 [ 1095.723494][T11043] netlink: 'syz.0.10137': attribute type 9 has an invalid length. [ 1095.746511][T11043] netlink: 'syz.0.10137': attribute type 11 has an invalid length. [ 1095.775157][T11043] netlink: 'syz.0.10137': attribute type 12 has an invalid length. [ 1095.787382][T11047] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10139'. [ 1095.815585][T11043] netlink: 210020 bytes leftover after parsing attributes in process `syz.0.10137'. [ 1095.853188][T11043] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10137'. [ 1095.875298][T11050] xt_hashlimit: size too large, truncated to 1048576 [ 1095.943484][T11059] netlink: 'syz.3.10142': attribute type 1 has an invalid length. [ 1095.965614][T11056] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10140'. [ 1095.986270][T11059] netlink: 96 bytes leftover after parsing attributes in process `syz.3.10142'. [ 1095.995899][T11059] netlink: 1 bytes leftover after parsing attributes in process `syz.3.10142'. [ 1096.021159][T11059] netlink: 'syz.3.10142': attribute type 1 has an invalid length. [ 1096.047475][T11059] netlink: 'syz.3.10142': attribute type 8 has an invalid length. [ 1096.083344][T11059] netlink: 582 bytes leftover after parsing attributes in process `syz.3.10142'. [ 1096.219276][T11080] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1096.313237][T11087] netlink: 1 bytes leftover after parsing attributes in process `syz.0.10147'. [ 1096.750570][T11118] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10157'. [ 1096.805226][T11114] netlink: 'syz.3.10155': attribute type 32 has an invalid length. [ 1096.880511][T11114] bond2: Setting coupled_control to off (0) [ 1096.913263][T11114] netlink: 'syz.3.10155': attribute type 1 has an invalid length. [ 1097.176132][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5160 ms [ 1097.184256][ C0] lec:lec_tx_timeout: lec0 [ 1097.367197][T11149] netlink: 'syz.5.10165': attribute type 2 has an invalid length. [ 1097.379698][T11137] syzkaller1: entered promiscuous mode [ 1097.385242][T11137] syzkaller1: entered allmulticast mode [ 1097.468743][T11153] tc_dump_action: action bad kind [ 1097.633693][T11157] macvtap1: entered promiscuous mode [ 1097.658670][T11157] macvtap1: entered allmulticast mode [ 1097.664229][T11157] veth1_vlan: entered allmulticast mode [ 1097.695920][T11161] macvtap2: entered promiscuous mode [ 1097.709789][T11161] macvtap2: entered allmulticast mode [ 1097.733321][T11170] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 1097.865666][T11174] bridge2: entered promiscuous mode [ 1097.882065][T11174] bridge2: entered allmulticast mode [ 1097.908147][T11174] team0: Port device bridge2 added [ 1097.913596][T11179] bridge0: port 3(team0) entered blocking state [ 1097.921655][T11179] bridge0: port 3(team0) entered disabled state [ 1097.928673][T11179] team0: entered allmulticast mode [ 1097.933916][T11179] team_slave_0: entered allmulticast mode [ 1097.985163][T11179] team_slave_1: entered allmulticast mode [ 1098.068749][T11179] team0: entered promiscuous mode [ 1098.074005][T11179] team_slave_0: entered promiscuous mode [ 1098.083785][T11179] team_slave_1: entered promiscuous mode [ 1098.094033][T11179] bridge0: port 3(team0) entered blocking state [ 1098.100513][T11179] bridge0: port 3(team0) entered forwarding state [ 1098.160671][T11192] x_tables: duplicate entry at hook 1 [ 1098.267950][T11197] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1098.379438][T11202] tls_set_device_offload: netdev not found [ 1099.050208][T11238] syzkaller0: entered promiscuous mode [ 1099.055748][T11238] syzkaller0: entered allmulticast mode [ 1101.426500][T11264] syzkaller0: entered promiscuous mode [ 1101.432047][T11264] syzkaller0: entered allmulticast mode [ 1101.447202][T11272] tipc: Started in network mode [ 1101.452177][T11272] tipc: Node identity ce0c187972cb, cluster identity 4711 [ 1101.461376][T11272] tipc: Enabled bearer , priority 0 [ 1101.582064][T11292] openvswitch: netlink: IPv4 tunnel dst address is zero [ 1101.623021][T11272] tipc: Resetting bearer [ 1101.703527][T11272] tipc: Disabling bearer [ 1101.864007][T11299] __nla_validate_parse: 15 callbacks suppressed [ 1101.864028][T11299] netlink: 112 bytes leftover after parsing attributes in process `syz.3.10201'. [ 1101.937437][T11311] validate_nla: 3 callbacks suppressed [ 1101.937461][T11311] netlink: 'syz.0.10203': attribute type 4 has an invalid length. [ 1102.012384][T11311] netlink: 17 bytes leftover after parsing attributes in process `syz.0.10203'. [ 1102.155807][T11323] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10206'. [ 1102.198644][T11323] netlink: 'syz.3.10206': attribute type 6 has an invalid length. [ 1102.226268][T11323] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10206'. [ 1102.280621][T11323] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10206'. [ 1102.297961][T11323] netlink: 'syz.3.10206': attribute type 6 has an invalid length. [ 1102.317656][T11323] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10206'. [ 1102.382714][T11336] netlink: 44 bytes leftover after parsing attributes in process `syz.0.10211'. [ 1102.449395][T11338] netlink: 'syz.5.10212': attribute type 4 has an invalid length. [ 1102.483795][T11338] netlink: 'syz.5.10212': attribute type 4 has an invalid length. [ 1102.631462][T11350] bridge3: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1102.694456][T11357] syzkaller1: entered promiscuous mode [ 1102.707068][T11351] ipt_rpfilter: unknown options [ 1102.722606][T11357] syzkaller1: entered allmulticast mode [ 1102.753420][T11350] netlink: 'syz.0.10214': attribute type 3 has an invalid length. [ 1103.070546][T11384] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10225'. [ 1103.080956][T11384] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10225'. [ 1103.112672][T11384] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10225'. [ 1103.170409][T11388] tap0: tun_chr_ioctl cmd 1074025672 [ 1103.175784][T11388] tap0: ignored: set checksum disabled [ 1103.286572][T11390] tun0: tun_chr_ioctl cmd 1074025675 [ 1103.292119][T11390] tun0: persist disabled [ 1103.684164][T11430] netlink: 'syz.3.10239': attribute type 9 has an invalid length. [ 1105.058305][T11518] netlink: 'syz.4.10264': attribute type 1 has an invalid length. [ 1105.067933][T11518] netlink: 'syz.4.10264': attribute type 2 has an invalid length. [ 1105.075932][T11518] netlink: 'syz.4.10264': attribute type 2 has an invalid length. [ 1105.767991][T11535] delete_channel: no stack [ 1106.072831][T11553] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1106.084906][T11553] bridge0: port 3(team0) entered disabled state [ 1106.091812][T11553] bridge0: port 1(bridge_slave_0) entered disabled state [ 1106.424655][T11565] syzkaller0: entered allmulticast mode [ 1106.437207][T11564] syzkaller0: left allmulticast mode [ 1106.600117][T11577] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1106.832401][T11592] 8021q: VLANs not supported on dvmrp0 [ 1106.860328][T11562] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1106.880686][T11562] sit2: entered promiscuous mode [ 1106.887505][T11562] sit2: entered allmulticast mode [ 1107.000431][T11600] __nla_validate_parse: 11 callbacks suppressed [ 1107.000454][T11600] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10289'. [ 1107.045475][T11600] netlink: 28 bytes leftover after parsing attributes in process `syz.2.10289'. [ 1107.091105][T11604] netlink: 5 bytes leftover after parsing attributes in process `syz.2.10289'. [ 1107.101490][T11603] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10291'. [ 1107.150541][T11604] 0ªî{X¹¦: renamed from gretap0 [ 1107.208056][T11611] netlink: 4552 bytes leftover after parsing attributes in process `syz.4.10293'. [ 1107.223581][T11611] netlink: 4552 bytes leftover after parsing attributes in process `syz.4.10293'. [ 1107.379727][T11604] 0ªî{X¹¦: entered allmulticast mode [ 1107.416187][T11604] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 1107.436674][ T5145] Bluetooth: hci2: command 0x0405 tx timeout [ 1107.570333][T11616] tipc: Enabling of bearer rejected, failed to enable media [ 1107.622109][T11625] x_tables: duplicate entry at hook 1 [ 1107.689587][T11628] validate_nla: 2 callbacks suppressed [ 1107.689608][T11628] netlink: 'syz.4.10298': attribute type 2 has an invalid length. [ 1107.756730][T11622] syzkaller0: entered promiscuous mode [ 1107.762284][T11622] syzkaller0: entered allmulticast mode [ 1108.005354][T11650] x_tables: unsorted underflow at hook 3 [ 1108.667040][T11667] netlink: 4 bytes leftover after parsing attributes in process `syz.5.10305'. [ 1110.398292][T11698] netlink: 16 bytes leftover after parsing attributes in process `syz.4.10312'. [ 1110.408860][T11698] netlink: 200 bytes leftover after parsing attributes in process `syz.4.10312'. [ 1110.433184][T11698] netlink: 1660 bytes leftover after parsing attributes in process `syz.4.10312'. [ 1110.521313][T11704] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1111.150856][T11739] netlink: 'syz.4.10327': attribute type 1 has an invalid length. [ 1111.394048][T11764] netlink: 'syz.3.10336': attribute type 3 has an invalid length. [ 1112.027441][T11790] netlink: 'syz.4.10345': attribute type 3 has an invalid length. [ 1112.051084][T11790] __nla_validate_parse: 9 callbacks suppressed [ 1112.051104][T11790] netlink: 766 bytes leftover after parsing attributes in process `syz.4.10345'. [ 1112.108773][T11792] netlink: 12 bytes leftover after parsing attributes in process `syz.5.10348'. [ 1112.196431][T11805] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10349'. [ 1112.223112][T11792] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1112.234293][T11792] netlink: 'syz.5.10348': attribute type 13 has an invalid length. [ 1112.291489][T11803] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1112.305167][T11803] bond2: (slave vxcan1): The slave device specified does not support setting the MAC address [ 1112.323794][T11803] bond2: (slave vxcan1): Error -95 calling set_mac_address [ 1112.555844][T11829] IPVS: set_ctl: invalid protocol: 3 172.20.20.45:20000 [ 1112.672174][T11837] netlink: 32 bytes leftover after parsing attributes in process `syz.2.10354'. [ 1112.753979][T11842] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10356'. [ 1112.769999][T11842] netlink: 148 bytes leftover after parsing attributes in process `syz.0.10356'. [ 1112.841625][T11837] pim6reg1: entered promiscuous mode [ 1112.848721][T11837] pim6reg1: entered allmulticast mode [ 1112.865370][T11846] netlink: 96 bytes leftover after parsing attributes in process `syz.0.10358'. [ 1112.951920][T11849] netlink: 4 bytes leftover after parsing attributes in process `syz.5.10359'. [ 1112.969533][T11851] bond0: entered allmulticast mode [ 1113.096935][ T5145] Bluetooth: hci4: command 0x0406 tx timeout [ 1113.231031][T11867] netlink: 220 bytes leftover after parsing attributes in process `syz.4.10365'. [ 1113.249196][T11867] netlink: 220 bytes leftover after parsing attributes in process `syz.4.10365'. [ 1113.515759][T11886] IPv6: sit1: Disabled Multicast RS [ 1113.642829][T11898] netlink: 'syz.2.10375': attribute type 13 has an invalid length. [ 1113.652707][T11880] ipt_REJECT: TCP_RESET invalid for non-tcp [ 1113.666964][T11898] erspan0: refused to change device tx_queue_len [ 1113.675003][T11898] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 1113.901294][T11915] x_tables: duplicate underflow at hook 2 [ 1113.927048][T11914] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1113.934379][T11914] IPv6: NLM_F_CREATE should be set when creating new route [ 1113.942005][T11914] IPv6: NLM_F_CREATE should be set when creating new route [ 1113.949322][T11914] IPv6: NLM_F_CREATE should be set when creating new route [ 1113.959487][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1113.968261][T11904] netlink: 'syz.0.10379': attribute type 13 has an invalid length. [ 1113.977207][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.000671][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.013162][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.057425][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.065102][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.086604][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.094411][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.105709][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.119582][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.130926][T11904] lec:lec_start_xmit: lec0:No lecd attached [ 1114.144735][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.160790][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.172869][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.181540][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.191965][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.199921][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.208884][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.214674][T11919] IPv6: sit1: Disabled Multicast RS [ 1114.217981][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.294121][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.326884][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.335344][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.365123][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.396989][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.415055][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.429242][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.462611][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.482304][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.512651][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.538800][T11935] netlink: 'syz.2.10387': attribute type 21 has an invalid length. [ 1114.554910][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.576577][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.598170][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.608314][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.615970][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.646554][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.669487][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.699550][T11915] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1114.871501][T11946] tipc: Enabling of bearer rejected, failed to enable media [ 1114.968516][T11959] netlink: 'syz.5.10396': attribute type 2 has an invalid length. [ 1115.000193][T11958] netlink: 'syz.0.10395': attribute type 29 has an invalid length. [ 1115.040813][T11958] netlink: 'syz.0.10395': attribute type 29 has an invalid length. [ 1115.167735][T11934] netlink: 'syz.3.10388': attribute type 1 has an invalid length. [ 1115.175886][T11934] netlink: 'syz.3.10388': attribute type 7 has an invalid length. [ 1115.205961][T11934] netlink: 'syz.3.10388': attribute type 8 has an invalid length. [ 1115.214891][T11934] NCSI netlink: No device for ifindex 65584 [ 1115.983987][T12013] 0ªî{X¹¦: left allmulticast mode [ 1116.209349][T12031] tipc: Invalid UDP bearer configuration [ 1116.209410][T12031] tipc: Enabling of bearer rejected, failed to enable media [ 1116.279420][T12035] netlink: 'syz.4.10417': attribute type 1 has an invalid length. [ 1116.309800][T12035] NCSI netlink: No device for ifindex 0 [ 1116.502122][T12045] xt_limit: Overflow, try lower: 271964/0 [ 1116.698312][T12056] lo: Caught tx_queue_len zero misconfig [ 1116.767600][T12062] ip6tnl0: Caught tx_queue_len zero misconfig [ 1117.298268][T12096] __nla_validate_parse: 26 callbacks suppressed [ 1117.298290][T12096] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10434'. [ 1117.341922][T12096] netlink: 20 bytes leftover after parsing attributes in process `syz.2.10434'. [ 1117.828857][T12125] netlink: 20 bytes leftover after parsing attributes in process `syz.4.10448'. [ 1117.947415][T12134] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1118.091877][T12135] bond3: option packets_per_slave: invalid value (18446744073709551615) [ 1118.141665][T12135] bond3: option packets_per_slave: allowed values 0 - 65535 [ 1118.160867][T12135] bond3 (unregistering): Released all slaves [ 1118.398913][T12162] netlink: 12 bytes leftover after parsing attributes in process `syz.2.10460'. [ 1118.422908][T12166] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10463'. [ 1118.434427][T12166] netlink: 43 bytes leftover after parsing attributes in process `syz.0.10463'. [ 1118.445089][T12166] netlink: 43 bytes leftover after parsing attributes in process `syz.0.10463'. [ 1119.177720][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5040 ms [ 1119.185837][ C0] lec:lec_tx_timeout: lec0 [ 1119.191307][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1119.405395][T12208] bond3: Unable to set up delay as MII monitoring is disabled [ 1119.444478][T12208] bond3 (unregistering): Released all slaves [ 1119.492053][T12218] netlink: 16 bytes leftover after parsing attributes in process `syz.2.10474'. [ 1119.510644][T12179] tunl0: entered promiscuous mode [ 1119.529418][T12179] validate_nla: 1 callbacks suppressed [ 1119.529440][T12179] netlink: 'syz.0.10466': attribute type 3 has an invalid length. [ 1119.551321][T12179] netlink: 9 bytes leftover after parsing attributes in process `syz.0.10466'. [ 1119.914659][T12225] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10477'. [ 1119.983406][T12229] netlink: 'syz.3.10477': attribute type 7 has an invalid length. [ 1120.065221][T12238] netlink: 'syz.5.10480': attribute type 1 has an invalid length. [ 1120.298088][ T52] Bluetooth: hci2: link tx timeout [ 1120.305092][ T52] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 1120.758165][T12283] netlink: 'syz.4.10492': attribute type 2 has an invalid length. [ 1120.811298][T12283] netlink: 'syz.4.10492': attribute type 1 has an invalid length. [ 1120.850219][T12281] netlink: 'syz.4.10492': attribute type 2 has an invalid length. [ 1120.883366][T12281] netlink: 'syz.4.10492': attribute type 1 has an invalid length. [ 1121.042954][T12299] netlink: 'syz.0.10496': attribute type 10 has an invalid length. [ 1121.052801][ T52] Bluetooth: hci2: link tx timeout [ 1121.061212][ T52] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 1121.140739][T12299] team0: Device veth0_macvtap failed to register rx_handler [ 1121.289129][ T1303] aoe: packet could not be sent on lec0. consider increasing tx_queue_len [ 1121.462964][T12318] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 1121.761757][ T52] Bluetooth: hci2: link tx timeout [ 1121.768837][ T52] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 1121.936740][T12344] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 1121.965583][T12347] netlink: 'syz.0.10513': attribute type 32 has an invalid length. [ 1122.025277][T12347] bond4: Setting coupled_control to off (0) [ 1122.178045][T12354] netlink: 'syz.3.10516': attribute type 1 has an invalid length. [ 1122.304649][T12361] batadv_slave_0: mtu less than device minimum [ 1122.350267][T12364] __nla_validate_parse: 6 callbacks suppressed [ 1122.350288][T12364] netlink: 24 bytes leftover after parsing attributes in process `syz.5.10520'. [ 1122.379919][ T52] Bluetooth: hci2: command 0x0405 tx timeout [ 1122.427669][T12367] sch_tbf: peakrate 5 is lower than or equals to rate 16783679728848008391 ! [ 1122.518813][T12374] tipc: Enabled bearer , priority 10 [ 1122.559898][T12379] xt_hashlimit: size too large, truncated to 1048576 [ 1122.611000][T12382] –: renamed from vxcan1 (while UP) [ 1122.873395][T12393] netlink: 64985 bytes leftover after parsing attributes in process `syz.0.10528'. [ 1122.898878][T12392] netlink: 100 bytes leftover after parsing attributes in process `syz.4.10530'. [ 1122.925095][T12392] netlink: 100 bytes leftover after parsing attributes in process `syz.4.10530'. [ 1122.940929][T12389] team0: Device gtp0 is up. Set it down before adding it as a team port [ 1122.961963][T12392] netlink: 100 bytes leftover after parsing attributes in process `syz.4.10530'. [ 1123.088008][T12395] netlink: 60 bytes leftover after parsing attributes in process `syz.4.10530'. [ 1123.146930][T12407] netlink: 28 bytes leftover after parsing attributes in process `syz.4.10530'. [ 1123.199702][T12392] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1123.219786][T12411] SET target dimension over the limit! [ 1123.239302][T12392] bond1: (slave bond2): making interface the new active one [ 1123.256832][T12392] bond1: (slave bond2): Enslaving as an active interface with an up link [ 1123.293981][T12405] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10532'. [ 1123.316549][T12405] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10532'. [ 1123.333736][T12407] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1123.578636][T12426] netlink: 52 bytes leftover after parsing attributes in process `syz.3.10541'. [ 1123.685313][ T9] tipc: Node number set to 3167164537 [ 1123.982136][T12450] bridge4: entered promiscuous mode [ 1123.998559][T12450] bridge4: entered allmulticast mode [ 1124.164535][T12465] syzkaller0: entered promiscuous mode [ 1124.186235][T12465] syzkaller0: entered allmulticast mode [ 1124.216083][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 1124.224195][ C0] lec:lec_tx_timeout: lec0 [ 1124.466028][T11020] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1124.477659][T11020] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1124.488636][T11020] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1124.499028][T11020] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1124.742961][T12488] validate_nla: 11 callbacks suppressed [ 1124.742979][T12488] netlink: 'syz.2.10559': attribute type 1 has an invalid length. [ 1124.771494][T12488] netlink: 'syz.2.10559': attribute type 1 has an invalid length. [ 1124.781662][T12488] netlink: 'syz.2.10559': attribute type 1 has an invalid length. [ 1124.790599][T12488] netlink: 'syz.2.10559': attribute type 2 has an invalid length. [ 1124.842557][T12491] openvswitch: netlink: IPv4 tunnel dst address is zero [ 1124.950753][T12498] xt_hashlimit: overflow, try lower: 3/0 [ 1125.162676][T12500] syzkaller1: entered promiscuous mode [ 1125.171627][T12500] syzkaller1: entered allmulticast mode [ 1125.941785][T12534] syzkaller0: entered promiscuous mode [ 1125.953198][T12534] syzkaller0: entered allmulticast mode [ 1125.974396][T12536] syzkaller0: entered promiscuous mode [ 1126.006209][T12536] syzkaller0: entered allmulticast mode [ 1126.622877][T12572] netlink: 'syz.4.10586': attribute type 7 has an invalid length. [ 1126.724087][T12572] erspan0: entered promiscuous mode [ 1126.755006][T12572] gretap0: entered promiscuous mode [ 1127.013360][T12596] sctp: [Deprecated]: syz.4.10592 (pid 12596) Use of int in max_burst socket option. [ 1127.013360][T12596] Use struct sctp_assoc_value instead [ 1127.421734][T12636] netlink: 'syz.5.10601': attribute type 32 has an invalid length. [ 1127.449283][T12636] __nla_validate_parse: 21 callbacks suppressed [ 1127.449305][T12636] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10601'. [ 1127.543765][T12636] bond4: option coupled_control: invalid value (52) [ 1127.562223][T12636] bond4 (unregistering): Released all slaves [ 1127.619510][T12647] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1128.047177][T12646] bond5: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1128.348950][T12646] bond5 (unregistering): Released all slaves [ 1128.574825][T12674] lo: entered allmulticast mode [ 1128.649024][T12685] bond3: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 1128.686359][T12672] lo: left allmulticast mode [ 1128.741293][T12692] syzkaller0: entered promiscuous mode [ 1128.747674][T12692] syzkaller0: entered allmulticast mode [ 1128.990950][T12704] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10619'. [ 1129.039087][T12711] openvswitch: netlink: IP tunnel dst address not specified [ 1129.174030][T12718] ip6tnl0: Caught tx_queue_len zero misconfig [ 1129.262989][T12722] netlink: 20 bytes leftover after parsing attributes in process `syz.2.10625'. [ 1129.269403][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1129.344381][T12722] netlink: 'syz.2.10625': attribute type 16 has an invalid length. [ 1129.363222][T12722] netlink: 'syz.2.10625': attribute type 17 has an invalid length. [ 1129.374836][T12722] netlink: 'syz.2.10625': attribute type 27 has an invalid length. [ 1129.513855][T12734] syzkaller0: create flow: hash 2267344478 index 1 [ 1129.742706][T12720] lo speed is unknown, defaulting to 1000 [ 1129.743994][T11020] syzkaller0: tun_net_xmit 76 [ 1129.755671][T11020] syzkaller0: tun_net_xmit 48 [ 1129.774799][T12726] syzkaller0: delete flow: hash 2267344478 index 1 [ 1131.971924][T12749] veth1_macvtap: left promiscuous mode [ 1132.147736][T12790] netlink: 24 bytes leftover after parsing attributes in process `syz.0.10642'. [ 1132.213565][T12790] netlink: 48 bytes leftover after parsing attributes in process `syz.0.10642'. [ 1132.257283][T12800] netlink: 36 bytes leftover after parsing attributes in process `syz.4.10644'. [ 1132.644459][T12825] netlink: 88 bytes leftover after parsing attributes in process `syz.2.10651'. [ 1132.664101][T12825] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10651'. [ 1132.675821][T12826] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10652'. [ 1132.685430][T12826] netlink: 44 bytes leftover after parsing attributes in process `syz.0.10652'. [ 1132.694845][T12825] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10651'. [ 1132.820146][T12825] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1133.059533][T12854] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10657'. [ 1133.173858][T12845] netlink: 'syz.3.10654': attribute type 39 has an invalid length. [ 1133.313734][T12868] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10659'. [ 1133.807770][T12895] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1133.926870][T12900] bpq0: entered allmulticast mode [ 1134.227392][T12918] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.10676'. [ 1134.296188][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 1134.304482][ C0] lec:lec_tx_timeout: lec0 [ 1134.309423][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1134.475850][T12940] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10683'. [ 1134.520588][T12942] ksmbd: Unknown IPC event: 3, ignore. [ 1134.557566][T12945] netlink: 16 bytes leftover after parsing attributes in process `syz.5.10686'. [ 1134.618126][T12949] 8021q: VLANs not supported on ip_vti0 [ 1134.835913][T12961] syzkaller0: entered promiscuous mode [ 1134.843981][T12961] syzkaller0: entered allmulticast mode [ 1135.011601][T12974] netlink: 'syz.0.10694': attribute type 1 has an invalid length. [ 1135.063437][T12977] netlink: 'syz.2.10695': attribute type 3 has an invalid length. [ 1135.313074][T12995] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1135.356627][T12997] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip_vti0, syncid = 7, id = 0 [ 1135.481272][T13000] tipc: Started in network mode [ 1135.512863][T13000] tipc: Node identity 867f052b5586, cluster identity 4711 [ 1135.532323][T13000] tipc: Enabled bearer , priority 0 [ 1135.533961][T13002] netlink: 'syz.5.10703': attribute type 3 has an invalid length. [ 1135.557853][T13000] syzkaller0: entered promiscuous mode [ 1135.566202][T13000] syzkaller0: entered allmulticast mode [ 1135.600925][T13000] tipc: Resetting bearer [ 1135.733823][T13002] netdevsim netdevsim5 netdevsim0: IPsec offload requires 128 bit authentication [ 1136.394840][T13055] macsec1: entered promiscuous mode [ 1136.484488][T13064] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1136.621800][T13072] FAULT_INJECTION: forcing a failure. [ 1136.621800][T13072] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1136.639950][T13072] CPU: 0 UID: 0 PID: 13072 Comm: syz.2.10726 Not tainted syzkaller #0 PREEMPT(full) [ 1136.639980][T13072] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1136.639994][T13072] Call Trace: [ 1136.640002][T13072] [ 1136.640012][T13072] dump_stack_lvl+0xe8/0x150 [ 1136.640046][T13072] should_fail_ex+0x412/0x560 [ 1136.640080][T13072] _copy_from_user+0x2d/0xb0 [ 1136.640113][T13072] ___sys_sendmsg+0x1c6/0x360 [ 1136.640141][T13072] ? __lock_acquire+0x6b5/0x2cf0 [ 1136.640177][T13072] ? __pfx____sys_sendmsg+0x10/0x10 [ 1136.640218][T13072] ? kstrtouint+0x6e/0xe0 [ 1136.640268][T13072] ? __fget_files+0x2a/0x420 [ 1136.640291][T13072] ? __fget_files+0x3a0/0x420 [ 1136.640323][T13072] __sys_sendmmsg+0x27c/0x4e0 [ 1136.640356][T13072] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1136.640380][T13072] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1136.640434][T13072] ? rcu_is_watching+0x15/0xb0 [ 1136.640461][T13072] __x64_sys_sendmmsg+0xa0/0xc0 [ 1136.640491][T13072] do_syscall_64+0xe2/0xf80 [ 1136.640515][T13072] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1136.640534][T13072] ? trace_irq_disable+0x37/0x100 [ 1136.640555][T13072] ? clear_bhb_loop+0x60/0xb0 [ 1136.640580][T13072] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1136.640601][T13072] RIP: 0033:0x7f0ba479aeb9 [ 1136.640621][T13072] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1136.640640][T13072] RSP: 002b:00007f0ba5742028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1136.640663][T13072] RAX: ffffffffffffffda RBX: 00007f0ba4a15fa0 RCX: 00007f0ba479aeb9 [ 1136.640679][T13072] RDX: 0000000000000001 RSI: 00002000000024c0 RDI: 0000000000000004 [ 1136.640692][T13072] RBP: 00007f0ba5742090 R08: 0000000000000000 R09: 0000000000000000 [ 1136.640704][T13072] R10: 0000000030040040 R11: 0000000000000246 R12: 0000000000000001 [ 1136.640718][T13072] R13: 00007f0ba4a16038 R14: 00007f0ba4a15fa0 R15: 00007ffd9da3cef8 [ 1136.640752][T13072] [ 1136.641473][T13064] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1136.909253][T12019] tipc: Node number set to 3556312363 [ 1136.917557][T13077] bond0: entered allmulticast mode [ 1136.926953][T13077] bond_slave_0: entered allmulticast mode [ 1136.946334][T13077] bond_slave_1: entered allmulticast mode [ 1137.307560][T13099] block nbd2: not configured, cannot reconfigure [ 1137.585035][T13115] syzkaller0: entered promiscuous mode [ 1137.592133][T13115] syzkaller0: entered allmulticast mode [ 1139.326125][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1139.334254][ C0] lec:lec_tx_timeout: lec0 [ 1140.012004][T13143] __nla_validate_parse: 14 callbacks suppressed [ 1140.012026][T13143] netlink: 766 bytes leftover after parsing attributes in process `syz.5.10749'. [ 1140.049472][T13143] netlink: 24 bytes leftover after parsing attributes in process `syz.5.10749'. [ 1140.325961][T13164] netlink: 'syz.5.10753': attribute type 1 has an invalid length. [ 1140.406635][T13164] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1140.417053][T13168] netlink: 48 bytes leftover after parsing attributes in process `syz.0.10754'. [ 1140.434142][T13168] netlink: 48 bytes leftover after parsing attributes in process `syz.0.10754'. [ 1140.470649][T13171] vlan2: entered promiscuous mode [ 1140.475806][T13171] bond4: entered promiscuous mode [ 1140.481731][T13171] vlan2: entered allmulticast mode [ 1140.490031][T13171] bond4: entered allmulticast mode [ 1140.541147][T13164] bond4: (slave bridge3): making interface the new active one [ 1140.554137][T13164] bridge3: entered promiscuous mode [ 1140.560614][T13164] bridge3: entered allmulticast mode [ 1140.572861][T13164] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 1140.591389][T13137] lo speed is unknown, defaulting to 1000 [ 1140.910150][T13187] syzkaller0: entered promiscuous mode [ 1140.925155][T13187] syzkaller0: entered allmulticast mode [ 1140.961956][T13201] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10762'. [ 1141.097942][T13209] netlink: 104 bytes leftover after parsing attributes in process `syz.3.10764'. [ 1141.110296][T13201] x_tables: duplicate underflow at hook 2 [ 1141.238873][T13214] netlink: 1712 bytes leftover after parsing attributes in process `syz.2.10765'. [ 1141.341678][T13219] nbd: must specify at least one socket [ 1141.361441][T13220] netlink: 108 bytes leftover after parsing attributes in process `syz.5.10768'. [ 1141.379294][T13220] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10768'. [ 1141.416469][T13224] netlink: 'syz.3.10769': attribute type 15 has an invalid length. [ 1141.456484][T13224] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10769'. [ 1141.465806][T13224] netlink: 'syz.3.10769': attribute type 15 has an invalid length. [ 1141.736305][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1142.068118][T13260] can: request_module (can-proto-3) failed. [ 1142.147116][T13265] netlink: 'syz.4.10781': attribute type 5 has an invalid length. [ 1142.307154][T13285] netlink: 'syz.0.10787': attribute type 1 has an invalid length. [ 1142.379049][T13285] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1142.418319][T13290] veth5: entered promiscuous mode [ 1142.438478][T13290] bond5: (slave veth5): Enslaving as an active interface with a down link [ 1142.484643][T13285] bond5: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1142.806815][T13314] bond5: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 1142.843996][T13314] bond5 (unregistering): Released all slaves [ 1143.077017][T13321] syzkaller0: entered promiscuous mode [ 1143.082572][T13321] syzkaller0: entered allmulticast mode [ 1143.164369][T13330] netlink: 'syz.3.10799': attribute type 15 has an invalid length. [ 1143.185594][T13330] netlink: 'syz.3.10799': attribute type 15 has an invalid length. [ 1143.414922][T13344] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 1143.418160][T13338] syzkaller0: entered promiscuous mode [ 1143.432508][T13338] syzkaller0: entered allmulticast mode [ 1143.563853][T13346] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 1143.809885][T13361] bridge0: port 4(ipvlan2) entered blocking state [ 1143.817766][T13361] bridge0: port 4(ipvlan2) entered disabled state [ 1143.825817][T13361] ipvlan2: entered allmulticast mode [ 1143.841167][T13361] bridge0: entered allmulticast mode [ 1143.853491][T13361] ipvlan2: left allmulticast mode [ 1143.859452][T13370] netlink: 'syz.5.10811': attribute type 11 has an invalid length. [ 1143.867551][T13361] bridge0: left allmulticast mode [ 1143.888922][T13370] netlink: 'syz.5.10811': attribute type 1 has an invalid length. [ 1143.897836][T13370] netlink: 'syz.5.10811': attribute type 2 has an invalid length. [ 1144.259648][T13392] tipc: Failed to remove unknown binding: 66,0,0/0:3048549128/3048549129 [ 1144.343711][T13397] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 1144.376664][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1144.657734][T13415] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 1144.742424][T13420] macvtap0: entered promiscuous mode [ 1144.959722][T13440] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 1145.246725][T13454] openvswitch: netlink: IPv4 tunnel dst address is zero [ 1145.431780][T13472] syzkaller0: entered promiscuous mode [ 1145.453319][T13472] syzkaller0: entered allmulticast mode [ 1145.487448][T13472] __nla_validate_parse: 80 callbacks suppressed [ 1145.487472][T13472] netlink: 80 bytes leftover after parsing attributes in process `syz.2.10837'. [ 1145.682330][T13478] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 1145.987196][T13494] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10843'. [ 1146.056444][T13496] openvswitch: netlink: IP tunnel attribute has 6 unknown bytes. [ 1146.073728][T13494] bond0: entered promiscuous mode [ 1146.096445][T13494] bond_slave_0: entered promiscuous mode [ 1146.102465][T13494] bond_slave_1: entered promiscuous mode [ 1146.127712][T13494] bond0: left promiscuous mode [ 1146.164869][T13501] netlink: 4096 bytes leftover after parsing attributes in process `syz.3.10846'. [ 1146.172204][T13494] bond_slave_0: left promiscuous mode [ 1146.198949][T13494] bond_slave_1: left promiscuous mode [ 1146.374543][T13511] bond4: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 1146.387822][T13517] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10851'. [ 1146.403377][T13511] bond4 (unregistering): Released all slaves [ 1146.642501][T13530] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 1146.699053][T13530] netlink: 596 bytes leftover after parsing attributes in process `syz.0.10854'. [ 1146.821600][T13541] netlink: 188 bytes leftover after parsing attributes in process `syz.3.10857'. [ 1147.061394][T13555] netlink: 'syz.2.10862': attribute type 1 has an invalid length. [ 1147.183781][T13555] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1147.325101][T13565] bond2: (slave veth7): Enslaving as an active interface with a down link [ 1147.342202][T13565] netlink: 'syz.2.10862': attribute type 1 has an invalid length. [ 1147.364422][T13565] netlink: 'syz.2.10862': attribute type 2 has an invalid length. [ 1147.387543][T13555] bond2: (slave veth0_to_bond): making interface the new active one [ 1147.397748][T13555] veth0_to_bond: entered promiscuous mode [ 1147.404040][T13555] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1147.418509][T13573] lo: entered promiscuous mode [ 1147.429309][T13573] tunl0: entered promiscuous mode [ 1147.439566][T13573] gre0: entered promiscuous mode [ 1147.459542][T13573] ip_vti0: entered promiscuous mode [ 1147.614173][T13582] siw: device registration error -23 [ 1147.686988][T13590] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10868'. [ 1147.698069][T13590] openvswitch: netlink: Flow actions attr not present in new flow. [ 1147.930400][T13606] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10875'. [ 1148.113475][T13612] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap0 [ 1148.124706][T13612] gretap0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 1148.133037][T13612] gretap0: entered promiscuous mode [ 1148.140118][T13612] gretap0: entered allmulticast mode [ 1148.155692][T13611] syzkaller0: entered promiscuous mode [ 1148.161616][T13611] syzkaller0: entered allmulticast mode [ 1148.172165][T13611] TC_ACT_REPEAT abuse ? [ 1148.259513][T13618] bond3: option downdelay: invalid value (18446744073709548956) [ 1148.267664][T13618] bond3: option downdelay: allowed values 0 - 2147483647 [ 1148.297343][T13618] bond3 (unregistering): Released all slaves [ 1148.885161][T13639] netlink: 'syz.4.10886': attribute type 1 has an invalid length. [ 1148.893528][T13639] netlink: 224 bytes leftover after parsing attributes in process `syz.4.10886'. [ 1148.920152][T13639] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10886'. [ 1149.049146][T13655] bond6: Invalid ad_actor_system MAC address. [ 1149.055419][T13655] bond6: option ad_actor_system: invalid value (1) [ 1149.089823][T13655] bond6 (unregistering): Released all slaves [ 1149.280910][T13671] netlink: 'syz.0.10897': attribute type 10 has an invalid length. [ 1149.296342][T13672] netlink: 'syz.0.10897': attribute type 10 has an invalid length. [ 1149.674180][T13700] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input6 [ 1149.908728][T13714] netlink: 'syz.0.10905': attribute type 1 has an invalid length. [ 1150.136095][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5760 ms [ 1150.144189][ C0] lec:lec_tx_timeout: lec0 [ 1150.150470][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1150.251220][T13729] ip6t_srh: unknown srh invflags 4000 [ 1150.473722][T13758] chnl_net:caif_netlink_parms(): no params data found [ 1150.680458][T13775] __nla_validate_parse: 9 callbacks suppressed [ 1150.680480][T13775] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.10921'. [ 1150.980374][T13793] netlink: 'syz.4.10926': attribute type 1 has an invalid length. [ 1151.054557][T13793] bond3: entered promiscuous mode [ 1151.072946][T13793] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1151.166761][T13797] netlink: 'syz.3.10927': attribute type 10 has an invalid length. [ 1151.373683][T13803] netlink: 'syz.3.10929': attribute type 1 has an invalid length. [ 1151.411491][T13805] netlink: 212 bytes leftover after parsing attributes in process `syz.4.10930'. [ 1151.500726][T13807] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10931'. [ 1152.422468][T13869] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10948'. [ 1152.431734][T13869] netlink: 16 bytes leftover after parsing attributes in process `syz.5.10948'. [ 1152.556385][T13872] syzkaller0: entered allmulticast mode [ 1152.599649][T13872] syzkaller0 (unregistering): left allmulticast mode [ 1152.734065][T13883] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10953'. [ 1153.048098][T13913] validate_nla: 1 callbacks suppressed [ 1153.048119][T13913] netlink: 'syz.5.10958': attribute type 1 has an invalid length. [ 1153.184015][T13918] tipc: Started in network mode [ 1153.199816][T13918] tipc: Node identity 5a1eceedb683, cluster identity 4711 [ 1153.216617][T13918] tipc: Enabled bearer , priority 0 [ 1153.224537][T13918] syzkaller0: entered promiscuous mode [ 1153.241568][T13918] syzkaller0: entered allmulticast mode [ 1153.280000][T13918] tipc: Resetting bearer [ 1153.332870][T13918] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1153.339656][T13921] netlink: 48 bytes leftover after parsing attributes in process `syz.2.10960'. [ 1153.384041][ T3285] IPVS: starting estimator thread 0... [ 1153.390094][T13916] tipc: Resetting bearer [ 1153.453014][T13916] tipc: Disabling bearer [ 1153.486200][T13925] IPVS: using max 27 ests per chain, 64800 per kthread [ 1153.562405][T13885] erspan0: entered promiscuous mode [ 1153.579310][T13885] erspan0: entered allmulticast mode [ 1153.785314][T13938] netlink: 24 bytes leftover after parsing attributes in process `syz.5.10966'. [ 1153.855519][T13943] syzkaller0: entered promiscuous mode [ 1153.904402][T13943] syzkaller0: entered allmulticast mode [ 1153.954223][T13943] netlink: 1028 bytes leftover after parsing attributes in process `syz.2.10967'. [ 1153.988195][T13955] netlink: 8 bytes leftover after parsing attributes in process `syz.5.10969'. [ 1154.265258][T13966] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 1154.943999][T13987] bond5: option arp_all_targets: invalid value (18446744073709551613) [ 1154.966585][T13987] bond5 (unregistering): Released all slaves [ 1155.186608][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 1155.194721][ C0] lec:lec_tx_timeout: lec0 [ 1155.260309][T14003] veth9: entered promiscuous mode [ 1155.850615][T12579] lec:lec_start_xmit: lec0:No lecd attached [ 1155.911170][T14049] ip6erspan0: entered allmulticast mode [ 1156.098750][T14061] Bluetooth: MGMT ver 1.23 [ 1156.103923][T14060] delete_channel: no stack [ 1156.181188][T14063] __nla_validate_parse: 27 callbacks suppressed [ 1156.181210][T14063] netlink: 48 bytes leftover after parsing attributes in process `syz.2.11002'. [ 1156.209659][T14063] netlink: 48 bytes leftover after parsing attributes in process `syz.2.11002'. [ 1156.222244][T14063] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11002'. [ 1156.348133][T14073] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.11006'. [ 1156.348617][T14069] netlink: 36 bytes leftover after parsing attributes in process `syz.3.11005'. [ 1156.433056][T14069] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11005'. [ 1156.677121][T14097] netlink: 212348 bytes leftover after parsing attributes in process `syz.5.11014'. [ 1156.761843][T14093] sctp: [Deprecated]: syz.2.11013 (pid 14093) Use of int in max_burst socket option deprecated. [ 1156.761843][T14093] Use struct sctp_assoc_value instead [ 1156.968601][T14114] netlink: 'syz.4.11022': attribute type 2 has an invalid length. [ 1156.969171][T14116] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 1156.998504][T14114] macvlan0: entered promiscuous mode [ 1157.023400][T14117] wireguard0: entered promiscuous mode [ 1157.031456][T14117] wireguard0: entered allmulticast mode [ 1157.053726][T14117] team0: Device wireguard0 is of different type [ 1157.598166][T14151] netlink: 'syz.3.11035': attribute type 1 has an invalid length. [ 1157.708292][T14151] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1157.797265][T14166] netlink: 72 bytes leftover after parsing attributes in process `syz.0.11036'. [ 1157.879003][T14167] xt_socket: unknown flags 0x50 [ 1157.910097][T14151] bond4: (slave bridge3): making interface the new active one [ 1157.919585][T14151] bond4: (slave bridge3): Enslaving as an active interface with an up link [ 1158.034090][T14170] tipc: Enabling of bearer rejected, failed to enable media [ 1158.043687][T14169] tipc: Enabling of bearer rejected, failed to enable media [ 1158.313659][T14180] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11039'. [ 1158.374552][T14180] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11039'. [ 1160.470460][T14198] C: entered promiscuous mode [ 1160.496324][T14198] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 1160.570260][T11016] veth0_to_bond: left promiscuous mode [ 1160.680189][T14202] netlink: 'syz.3.11047': attribute type 1 has an invalid length. [ 1160.694850][T14209] netlink: 'syz.0.11048': attribute type 1 has an invalid length. [ 1160.797463][T14209] bond8: entered promiscuous mode [ 1160.803890][T14209] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1160.915321][T14218] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1160.951238][T14218] bond8: (slave vti0): The slave device specified does not support setting the MAC address [ 1160.995241][T14218] bond8: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 1161.047614][T14218] bond8: (slave vti0): making interface the new active one [ 1161.059866][T14218] vti0: entered promiscuous mode [ 1161.067189][T14218] bond8: (slave vti0): Enslaving as an active interface with an up link [ 1161.123495][T14232] syzkaller1: entered promiscuous mode [ 1161.138609][T14232] syzkaller1: entered allmulticast mode [ 1161.186133][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5330 ms [ 1161.194254][ C0] lec:lec_tx_timeout: lec0 [ 1161.199471][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1161.279292][T14227] netlink: 'syz.2.11054': attribute type 29 has an invalid length. [ 1161.297398][T14245] __nla_validate_parse: 5 callbacks suppressed [ 1161.297417][T14245] netlink: 104 bytes leftover after parsing attributes in process `syz.5.11060'. [ 1161.435974][T14251] tipc: Enabled bearer , priority 0 [ 1161.457044][T14251] syzkaller0: entered promiscuous mode [ 1161.472907][T14251] syzkaller0: entered allmulticast mode [ 1161.492005][T14251] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1161.515519][T14262] netlink: 16 bytes leftover after parsing attributes in process `syz.5.11065'. [ 1161.563441][T14251] tipc: Resetting bearer [ 1161.646548][T14250] tipc: Resetting bearer [ 1161.736854][T14250] tipc: Disabling bearer [ 1161.768851][T14254] netlink: 60 bytes leftover after parsing attributes in process `syz.2.11063'. [ 1161.875407][T14275] bond4: entered promiscuous mode [ 1161.883078][T14275] bond4: entered allmulticast mode [ 1161.891809][T14275] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1161.931806][T14287] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11069'. [ 1161.955696][T14282] bond5: option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 1161.971245][T14282] bond5 (unregistering): Released all slaves [ 1162.155543][T14288] syzkaller0: entered promiscuous mode [ 1162.172111][T14288] syzkaller0: entered allmulticast mode [ 1163.418498][ T5145] Bluetooth: hci3: command 0x0000 tx timeout [ 1164.427868][T14268] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1164.629141][T14311] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11075'. [ 1164.752929][T14315] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11077'. [ 1164.978504][T14323] x_tables: duplicate underflow at hook 3 [ 1165.063592][T14331] tipc: Enabled bearer , priority 2 [ 1165.270623][T14342] netlink: 88 bytes leftover after parsing attributes in process `syz.2.11085'. [ 1165.289220][T14342] netem: invalid attributes len -24 [ 1165.299701][T14342] netem: change failed [ 1165.507289][ T5145] Bluetooth: hci3: command 0x0000 tx timeout [ 1165.533634][T14359] netlink: 4 bytes leftover after parsing attributes in process `syz.5.11092'. [ 1165.554842][T14361] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11091'. [ 1165.760267][T14373] x_tables: duplicate underflow at hook 2 [ 1166.054412][T14398] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11101'. [ 1166.068712][T29023] tipc: Node number set to 3969765101 [ 1166.206072][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1166.214176][ C0] lec:lec_tx_timeout: lec0 [ 1166.228970][T14398] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1166.311680][T14413] netlink: 40 bytes leftover after parsing attributes in process `syz.5.11102'. [ 1166.501194][T14419] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11105'. [ 1166.511877][T14419] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11105'. [ 1166.577051][T14422] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11105'. [ 1166.587595][T14422] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11105'. [ 1166.850788][T14436] netlink: 212360 bytes leftover after parsing attributes in process `syz.5.11109'. [ 1167.098803][T14449] netlink: 'syz.0.11117': attribute type 11 has an invalid length. [ 1167.121445][T14449] netlink: 224 bytes leftover after parsing attributes in process `syz.0.11117'. [ 1167.188946][T14453] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1167.207196][T14454] netlink: 112 bytes leftover after parsing attributes in process `syz.5.11116'. [ 1167.226496][T14453] netlink: 20 bytes leftover after parsing attributes in process `syz.0.11117'. [ 1167.604186][T14469] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11120'. [ 1167.691454][T14474] xt_hashlimit: size too large, truncated to 1048576 [ 1168.261158][T14504] syzkaller0: entered promiscuous mode [ 1168.270960][T14504] syzkaller0: entered allmulticast mode [ 1168.547571][T14524] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 1168.592652][T14532] syzkaller0: entered promiscuous mode [ 1168.618706][T14532] syzkaller0: entered allmulticast mode [ 1168.631204][T14536] netlink: 'syz.3.11140': attribute type 6 has an invalid length. [ 1168.639214][T14536] netlink: 'syz.3.11140': attribute type 5 has an invalid length. [ 1168.658215][T14532] tipc: Enabled bearer , priority 0 [ 1168.699396][T14530] tipc: Resetting bearer [ 1168.759860][T14530] tipc: Disabling bearer [ 1168.970898][T14556] IPv6: NLM_F_CREATE should be specified when creating new route [ 1169.034949][T14562] bond6: entered promiscuous mode [ 1169.056611][T14562] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1169.093956][T14565] bond6: (slave xfrm1): refused to change device type [ 1169.348723][T14584] geneve1: Caught tx_queue_len zero misconfig [ 1169.490175][T14592] netlink: 'syz.0.11159': attribute type 13 has an invalid length. [ 1169.577067][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1169.588456][T14580] udevd[14580]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1169.617204][T14580] udevd[14580]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 1169.719032][ T9] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1170.271201][T14645] netlink: 'syz.5.11174': attribute type 7 has an invalid length. [ 1170.279964][T14645] netlink: 'syz.5.11174': attribute type 8 has an invalid length. [ 1170.292077][T14639] bond7 (unregistering): Released all slaves [ 1170.451433][T14651] netlink: 'syz.0.11176': attribute type 1 has an invalid length. [ 1170.521611][T14651] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1170.610895][T14661] bond9: (slave veth9): Enslaving as an active interface with a down link [ 1170.628616][ T9] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 1170.665215][T14651] bond9: (slave veth0_to_bond): making interface the new active one [ 1170.685221][T14651] veth0_to_bond: entered promiscuous mode [ 1170.714092][T14651] bond9: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 1170.787867][T14666] bond9: (slave veth11): Enslaving as an active interface with a down link [ 1170.844925][T14666] netlink: 'syz.0.11176': attribute type 1 has an invalid length. [ 1170.868151][T14666] netlink: 'syz.0.11176': attribute type 2 has an invalid length. [ 1171.286832][T14688] veth1_vlan (unregistering): left allmulticast mode [ 1171.522544][T14679] lo speed is unknown, defaulting to 1000 [ 1172.062681][T14720] syzkaller0: entered promiscuous mode [ 1172.098570][T14730] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 1172.113110][T14720] syzkaller0: entered allmulticast mode [ 1172.131689][T14732] netlink: 'syz.3.11198': attribute type 1 has an invalid length. [ 1172.223734][T14737] xt_cluster: node mask cannot exceed total number of nodes [ 1172.263083][T14742] openvswitch: netlink: IPv4 tun info is not correct [ 1172.714461][T14756] gre2: entered promiscuous mode [ 1172.761988][T14758] bond0: Caught tx_queue_len zero misconfig [ 1173.095052][T14783] __nla_validate_parse: 20 callbacks suppressed [ 1173.095079][T14783] netlink: 32 bytes leftover after parsing attributes in process `syz.5.11209'. [ 1173.698446][T14767] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1174.201713][T14767] tipc: Resetting bearer [ 1174.442399][T13894] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1174.504829][T13894] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1174.520302][T13894] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1174.538029][T13894] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1174.550610][T14808] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1174.580989][T13894] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1174.630247][T13894] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1174.671084][T13894] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1174.719085][T13894] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1174.789330][T14815] syzkaller0: entered promiscuous mode [ 1174.794881][T14815] syzkaller0: entered allmulticast mode [ 1174.817255][T14815] netlink: 696 bytes leftover after parsing attributes in process `syz.2.11217'. [ 1174.854272][T14825] syzkaller1: entered promiscuous mode [ 1174.868752][T14825] syzkaller1: entered allmulticast mode [ 1174.935142][T14828] netlink: 220 bytes leftover after parsing attributes in process `syz.0.11221'. [ 1174.947426][T14828] netlink: 'syz.0.11221': attribute type 2 has an invalid length. [ 1175.176116][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5600 ms [ 1175.184247][ C0] lec:lec_tx_timeout: lec0 [ 1175.189530][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1175.391355][T14795] IPVS: starting estimator thread 0... [ 1175.491821][T14813] lo speed is unknown, defaulting to 1000 [ 1175.509884][T14844] IPVS: using max 33 ests per chain, 79200 per kthread [ 1175.521863][T10997] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1175.901718][T14873] tipc: Enabled bearer , priority 0 [ 1176.050365][T14873] syzkaller0: entered promiscuous mode [ 1176.055928][T14873] syzkaller0: entered allmulticast mode [ 1176.078693][T14873] tipc: Resetting bearer [ 1176.142020][T14873] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1176.169232][T12019] syzkaller1: tun_net_xmit 90 [ 1176.192636][T14873] syzkaller1: Linktype set failed because interface is up [ 1176.260937][T14867] tipc: Resetting bearer [ 1176.396479][T12019] syzkaller1: tun_net_xmit 90 [ 1178.280350][T14925] netlink: 'syz.3.11248': attribute type 1 has an invalid length. [ 1178.796835][T14867] tipc: Disabling bearer [ 1178.847129][ T8910] syzkaller1: tun_net_xmit 86 [ 1178.853349][T14925] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 1178.973688][T14934] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11249'. [ 1179.007129][T14939] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11249'. [ 1179.027666][T14934] netlink: 8 bytes leftover after parsing attributes in process `syz.5.11249'. [ 1179.081996][T14937] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11252'. [ 1179.103924][T14937] openvswitch: netlink: Flow key attr not present in new flow. [ 1179.121040][T14942] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.11253'. [ 1179.134780][T14943] netlink: 40 bytes leftover after parsing attributes in process `syz.3.11252'. [ 1179.148935][T14943] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11252'. [ 1179.162695][T14942] netlink: 'syz.4.11253': attribute type 58 has an invalid length. [ 1179.188830][T14942] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11253'. [ 1179.385724][T14963] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11259'. [ 1179.394359][T14955] nbd5: detected capacity change from 0 to 63 [ 1179.412521][T14964] netlink: 100 bytes leftover after parsing attributes in process `syz.5.11256'. [ 1179.426942][T14963] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 1179.470673][T14955] block nbd5: NBD_DISCONNECT [ 1179.480807][T14955] block nbd5: Disconnected due to user request. [ 1179.514945][T14955] block nbd5: shutting down sockets [ 1179.575039][ C1] blk_print_req_error: 136 callbacks suppressed [ 1179.575063][ C1] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1179.591265][ C1] buffer_io_error: 138 callbacks suppressed [ 1179.591285][ C1] Buffer I/O error on dev nbd5, logical block 0, async page read [ 1179.621396][ C0] I/O error, dev nbd5, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1179.631031][ C0] Buffer I/O error on dev nbd5, logical block 1, async page read [ 1179.638939][ C0] I/O error, dev nbd5, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1179.648579][ C0] Buffer I/O error on dev nbd5, logical block 2, async page read [ 1179.656445][ C0] I/O error, dev nbd5, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1179.666161][ C0] Buffer I/O error on dev nbd5, logical block 3, async page read [ 1179.706766][T14940] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1179.759249][T14940] Buffer I/O error on dev nbd5, logical block 0, async page read [ 1179.768217][T14940] I/O error, dev nbd5, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1179.810704][T14940] Buffer I/O error on dev nbd5, logical block 1, async page read [ 1179.839769][T14940] I/O error, dev nbd5, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1179.889135][T14940] Buffer I/O error on dev nbd5, logical block 2, async page read [ 1179.897907][T14940] I/O error, dev nbd5, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1179.908561][T14940] Buffer I/O error on dev nbd5, logical block 3, async page read [ 1179.931088][T14940] I/O error, dev nbd5, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1179.955763][T14940] Buffer I/O error on dev nbd5, logical block 0, async page read [ 1179.979170][T14940] I/O error, dev nbd5, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1180.008498][T14940] Buffer I/O error on dev nbd5, logical block 1, async page read [ 1180.024251][T14940] ldm_validate_partition_table(): Disk read failed. [ 1180.039943][T14940] Dev nbd5: unable to read RDB block 0 [ 1180.048190][T14940] nbd5: unable to read partition table [ 1180.075633][T14940] ldm_validate_partition_table(): Disk read failed. [ 1180.093173][T14940] Dev nbd5: unable to read RDB block 0 [ 1180.103487][T14940] nbd5: unable to read partition table [ 1180.206102][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 1180.214538][ C0] lec:lec_tx_timeout: lec0 [ 1180.356756][T14997] tipc: Enabling of bearer rejected, already enabled [ 1180.400439][T15004] batadv_slave_0: Caught tx_queue_len zero misconfig [ 1180.513093][T15003] xt_CT: No such helper "snmp_trap" [ 1181.312901][T15071] wireguard0: entered promiscuous mode [ 1181.336234][T15071] wireguard0: entered allmulticast mode [ 1181.353829][T15071] team0: Device wireguard0 is of different type [ 1182.143985][T15114] syzkaller0: entered promiscuous mode [ 1182.155949][T15114] syzkaller0: entered allmulticast mode [ 1182.167508][T13894] veth0_to_bond: left promiscuous mode [ 1182.245908][ T52] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1182.261103][ T52] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1182.269426][ T52] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1182.290021][ T52] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1182.304457][ T52] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1182.714017][ T1303] lec:lec_start_xmit: lec0:No lecd attached [ 1183.091916][ T8910] netdevsim netdevsim5 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1183.104104][ T8910] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.134552][T15119] lo speed is unknown, defaulting to 1000 [ 1183.199630][T15161] netlink: 'syz.4.11308': attribute type 4 has an invalid length. [ 1183.239031][ T8910] netdevsim netdevsim5 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1183.251013][ T8910] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.266474][T15164] netlink: 'syz.4.11308': attribute type 4 has an invalid length. [ 1183.347539][T13891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1183.356550][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1183.410972][ T8910] netdevsim netdevsim5 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1183.456103][ T8910] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.504342][T15176] team0: No ports can be present during mode change [ 1183.579780][ T8910] netdevsim netdevsim5 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1183.616129][ T8910] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.787602][T15193] netlink: 'syz.0.11318': attribute type 12 has an invalid length. [ 1183.810685][T15193] netlink: 'syz.0.11318': attribute type 29 has an invalid length. [ 1183.978456][T11024] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1184.009953][T15203] netlink: 'syz.3.11320': attribute type 23 has an invalid length. [ 1184.038920][T15207] __nla_validate_parse: 17 callbacks suppressed [ 1184.038939][T15207] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11322'. [ 1184.062555][T15201] veth3: entered allmulticast mode [ 1184.088440][T10997] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1184.107027][T15212] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11322'. [ 1184.134313][T10997] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1184.227460][ T8910] bridge_slave_1: left promiscuous mode [ 1184.233390][ T8910] bridge0: port 2(bridge_slave_1) entered disabled state [ 1184.248799][ T8910] bridge_slave_0: left promiscuous mode [ 1184.254647][ T8910] bridge0: port 1(bridge_slave_0) entered disabled state [ 1184.386454][ T52] Bluetooth: hci5: command tx timeout [ 1185.191958][ T8910] bond4 (unregistering): (slave bridge3): Releasing active interface [ 1185.200350][ T8910] bridge3 (unregistering): left promiscuous mode [ 1185.207388][ T8910] bridge3 (unregistering): left allmulticast mode [ 1185.289611][ T8910] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1185.304157][ T8910] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1185.321867][ T8910] bond0 (unregistering): Released all slaves [ 1185.443859][ T8910] bond1 (unregistering): Released all slaves [ 1185.563676][ T8910] bond2 (unregistering): Released all slaves [ 1185.578318][ T8910] bond3 (unregistering): Released all slaves [ 1185.712245][ T8910] bond4 (unregistering): Released all slaves [ 1185.727148][ T8910] bond5 (unregistering): Released all slaves [ 1185.742763][T15212] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1185.840864][T15212] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1185.928520][ T8910] tipc: Disabling bearer [ 1186.004392][ T8910] tipc: Left network mode [ 1186.014083][T15119] chnl_net:caif_netlink_parms(): no params data found [ 1186.135211][ T8910] IPVS: stopping backup sync thread 12997 ... [ 1186.313289][T15119] bridge0: port 1(bridge_slave_0) entered blocking state [ 1186.348442][T15119] bridge0: port 1(bridge_slave_0) entered disabled state [ 1186.356483][T15119] bridge_slave_0: entered allmulticast mode [ 1186.370542][T15119] bridge_slave_0: entered promiscuous mode [ 1186.456686][ T52] Bluetooth: hci5: command tx timeout [ 1186.494792][T15119] bridge0: port 2(bridge_slave_1) entered blocking state [ 1186.505947][T15119] bridge0: port 2(bridge_slave_1) entered disabled state [ 1186.514460][T15119] bridge_slave_1: entered allmulticast mode [ 1186.523141][T15119] bridge_slave_1: entered promiscuous mode [ 1186.654552][T15119] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1186.754412][T15119] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1187.052385][T15305] netlink: 9 bytes leftover after parsing attributes in process `syz.2.11340'. [ 1187.071482][T15119] team0: Port device team_slave_0 added [ 1187.089879][T15303] netlink: 'syz.0.11339': attribute type 3 has an invalid length. [ 1187.110389][T15303] netlink: 766 bytes leftover after parsing attributes in process `syz.0.11339'. [ 1187.198018][T15310] netlink: 'syz.2.11340': attribute type 39 has an invalid length. [ 1187.279177][T15119] team0: Port device team_slave_1 added [ 1187.606345][T15119] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1187.613378][T15119] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1187.663093][T15334] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11345'. [ 1187.678043][T15119] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1187.768406][T15119] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1187.775522][T15119] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1187.821715][T15340] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11345'. [ 1187.876943][T15119] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1188.146138][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5430 ms [ 1188.154373][ C0] lec:lec_tx_timeout: lec0 [ 1188.160855][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1188.367160][T15119] hsr_slave_0: entered promiscuous mode [ 1188.387602][T15119] hsr_slave_1: entered promiscuous mode [ 1188.394345][T15119] debugfs: 'hsr0' already exists in 'hsr' [ 1188.434054][T15119] Cannot create hsr debugfs directory [ 1188.529975][ T8910] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1188.539384][ T52] Bluetooth: hci5: command tx timeout [ 1188.548516][T15363] netlink: 'syz.0.11351': attribute type 4 has an invalid length. [ 1188.557607][ T8910] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1188.576730][T15363] netlink: 152 bytes leftover after parsing attributes in process `syz.0.11351'. [ 1188.595863][ T8910] veth0_macvtap: left allmulticast mode [ 1188.602800][ T8910] veth0_macvtap: left promiscuous mode [ 1188.608989][ T8910] veth1_vlan: left promiscuous mode [ 1189.099745][T11024] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1189.109416][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1189.324733][ T8910] team0 (unregistering): Port device team_slave_1 removed [ 1189.377153][ T8910] team0 (unregistering): Port device team_slave_0 removed [ 1189.739321][T11024] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1189.816146][T15363] `: renamed from bond0 (while UP) [ 1189.838600][T15363] bond_slave_0: left promiscuous mode [ 1189.861544][T15363] bond_slave_1: left promiscuous mode [ 1189.870343][T15345] lo speed is unknown, defaulting to 1000 [ 1190.020941][T15382] netlink: 1196 bytes leftover after parsing attributes in process `syz.0.11357'. [ 1190.086838][T15382] veth0_to_bridge: entered promiscuous mode [ 1190.135734][T15382] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11357'. [ 1190.178315][T15382] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11357'. [ 1190.354323][T15381] veth0_to_bridge: left promiscuous mode [ 1190.553109][ T8910] IPVS: stop unused estimator thread 0... [ 1190.588442][T15380] netlink: 'syz.2.11356': attribute type 32 has an invalid length. [ 1190.596811][T15380] netlink: 8 bytes leftover after parsing attributes in process `syz.2.11356'. [ 1190.627931][ T52] Bluetooth: hci5: command tx timeout [ 1190.804616][T15380] bond3: option coupled_control: invalid value (16) [ 1190.862045][T15380] bond3 (unregistering): Released all slaves [ 1191.442827][T15431] netlink: 168 bytes leftover after parsing attributes in process `syz.2.11366'. [ 1191.472282][T15433] netlink: 168 bytes leftover after parsing attributes in process `syz.2.11366'. [ 1191.611771][T15442] netlink: 24 bytes leftover after parsing attributes in process `syz.0.11367'. [ 1191.805406][T15119] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1191.860288][T15119] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1191.943602][T15119] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1191.975599][T15119] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1191.998306][T15461] netlink: 'syz.2.11371': attribute type 39 has an invalid length. [ 1192.158632][T15472] netlink: 16 bytes leftover after parsing attributes in process `syz.0.11373'. [ 1192.385661][T15476] block nbd2: server does not support multiple connections per device. [ 1192.407848][T15487] netlink: 24 bytes leftover after parsing attributes in process `syz.3.11376'. [ 1192.417492][T15476] block nbd2: shutting down sockets [ 1192.520343][T15493] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11378'. [ 1192.620406][T15119] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1192.662441][T15119] 8021q: adding VLAN 0 to HW filter on device team0 [ 1192.682809][T11024] bridge0: port 1(bridge_slave_0) entered blocking state [ 1192.690097][T11024] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1192.701184][T15499] ================================================================== [ 1192.709413][T15499] BUG: KASAN: slab-out-of-bounds in ieee80211_ie_split_ric+0x8fa/0x950 [ 1192.717822][T15499] Read of size 1 at addr ffff88802946afa1 by task syz.3.11380/15499 [ 1192.725829][T15499] [ 1192.728188][T15499] CPU: 0 UID: 0 PID: 15499 Comm: syz.3.11380 Not tainted syzkaller #0 PREEMPT(full) [ 1192.728220][T15499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1192.728237][T15499] Call Trace: [ 1192.728244][T15499] [ 1192.728254][T15499] dump_stack_lvl+0xe8/0x150 [ 1192.728281][T15499] print_report+0xba/0x230 [ 1192.728301][T15499] ? ieee80211_ie_split_ric+0x8fa/0x950 [ 1192.728333][T15499] kasan_report+0x117/0x150 [ 1192.728354][T15499] ? ieee80211_ie_split_ric+0x8fa/0x950 [ 1192.728383][T15499] ieee80211_ie_split_ric+0x8fa/0x950 [ 1192.728416][T15499] cfg80211_connect+0x11f8/0x2140 [ 1192.728443][T15499] ? __might_fault+0xaf/0x130 [ 1192.728471][T15499] cfg80211_mgd_wext_connect+0x4a0/0x5f0 [ 1192.728495][T15499] cfg80211_wext_siwessid+0xc4/0x160 [ 1192.728515][T15499] ioctl_standard_iw_point+0x6cd/0xd90 [ 1192.728542][T15499] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1192.728561][T15499] ? __pfx_ioctl_standard_iw_point+0x10/0x10 [ 1192.728589][T15499] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1192.728607][T15499] ioctl_standard_call+0xaf/0x1b0 [ 1192.728629][T15499] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1192.728645][T15499] wext_ioctl_dispatch+0xee/0x410 [ 1192.728664][T15499] ? __pfx_ioctl_standard_call+0x10/0x10 [ 1192.728686][T15499] wext_handle_ioctl+0x10f/0x1d0 [ 1192.728708][T15499] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 1192.728727][T15499] ? do_futex+0x333/0x420 [ 1192.728759][T15499] sock_ioctl+0x159/0x7f0 [ 1192.728786][T15499] ? __pfx_sock_ioctl+0x10/0x10 [ 1192.728811][T15499] ? __fget_files+0x2a/0x420 [ 1192.728830][T15499] ? __fget_files+0x3a0/0x420 [ 1192.728848][T15499] ? __fget_files+0x2a/0x420 [ 1192.728867][T15499] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1192.728888][T15499] ? __pfx_sock_ioctl+0x10/0x10 [ 1192.728913][T15499] __se_sys_ioctl+0xfc/0x170 [ 1192.728938][T15499] do_syscall_64+0xe2/0xf80 [ 1192.728956][T15499] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1192.728973][T15499] ? trace_irq_disable+0x37/0x100 [ 1192.728990][T15499] ? clear_bhb_loop+0x60/0xb0 [ 1192.729009][T15499] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1192.729027][T15499] RIP: 0033:0x7fa2c219aeb9 [ 1192.729044][T15499] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1192.729059][T15499] RSP: 002b:00007fa2c307b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1192.729079][T15499] RAX: ffffffffffffffda RBX: 00007fa2c2415fa0 RCX: 00007fa2c219aeb9 [ 1192.729093][T15499] RDX: 0000200000000040 RSI: 0000000000008b1a RDI: 0000000000000005 [ 1192.729104][T15499] RBP: 00007fa2c2208c1f R08: 0000000000000000 R09: 0000000000000000 [ 1192.729116][T15499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1192.729127][T15499] R13: 00007fa2c2416038 R14: 00007fa2c2415fa0 R15: 00007ffd00308408 [ 1192.729149][T15499] [ 1192.729156][T15499] [ 1193.008460][T15499] Allocated by task 5139: [ 1193.012813][T15499] kasan_save_track+0x3e/0x80 [ 1193.017555][T15499] __kasan_kmalloc+0x93/0xb0 [ 1193.022180][T15499] __kmalloc_node_track_caller_noprof+0x558/0x7f0 [ 1193.028624][T15499] kmemdup_noprof+0x2b/0x70 [ 1193.033212][T15499] cfg80211_wext_siwgenie+0x1ad/0x320 [ 1193.038634][T15499] ioctl_standard_iw_point+0x6cd/0xd90 [ 1193.044207][T15499] ioctl_standard_call+0xaf/0x1b0 [ 1193.049255][T15499] wext_ioctl_dispatch+0xee/0x410 [ 1193.054304][T15499] wext_handle_ioctl+0x10f/0x1d0 [ 1193.059266][T15499] sock_ioctl+0x159/0x7f0 [ 1193.063635][T15499] __se_sys_ioctl+0xfc/0x170 [ 1193.068258][T15499] do_syscall_64+0xe2/0xf80 [ 1193.072789][T15499] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1193.078711][T15499] [ 1193.081062][T15499] The buggy address belongs to the object at ffff88802946afa0 [ 1193.081062][T15499] which belongs to the cache kmalloc-8 of size 8 [ 1193.094810][T15499] The buggy address is located 0 bytes to the right of [ 1193.094810][T15499] allocated 1-byte region [ffff88802946afa0, ffff88802946afa1) [ 1193.109190][T15499] [ 1193.111578][T15499] The buggy address belongs to the physical page: [ 1193.118016][T15499] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802946a1c0 pfn:0x2946a [ 1193.128387][T15499] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 1193.136598][T15499] page_type: f5(slab) [ 1193.140645][T15499] raw: 00fff00000000200 ffff88813fe26500 ffffea00015f0210 ffffea0002018250 [ 1193.149257][T15499] raw: ffff88802946a1c0 0000000000800079 00000000f5000000 0000000000000000 [ 1193.157857][T15499] page dumped because: kasan: bad access detected [ 1193.164311][T15499] page_owner tracks the page as allocated [ 1193.170065][T15499] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 4276, tgid 4272 (syz.2.8413), ts 893909570156, free_ts 893627728021 [ 1193.189369][T15499] post_alloc_hook+0x228/0x280 [ 1193.194180][T15499] get_page_from_freelist+0x24dc/0x2580 [ 1193.199755][T15499] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1193.205771][T15499] alloc_pages_mpol+0x232/0x4a0 [ 1193.210665][T15499] allocate_slab+0x86/0x3a0 [ 1193.215294][T15499] ___slab_alloc+0xd82/0x1760 [ 1193.220100][T15499] __slab_alloc+0x65/0x100 [ 1193.224544][T15499] __kmalloc_node_track_caller_noprof+0x5b7/0x7f0 [ 1193.230979][T15499] kstrdup+0x42/0x100 [ 1193.234981][T15499] __kernfs_new_node+0xa9/0x8e0 [ 1193.239865][T15499] kernfs_new_node+0x102/0x210 [ 1193.244656][T15499] __kernfs_create_file+0x4b/0x2e0 [ 1193.249794][T15499] sysfs_add_file_mode_ns+0x238/0x300 [ 1193.255189][T15499] internal_create_group+0x673/0x1180 [ 1193.260608][T15499] sysfs_create_groups+0x59/0x120 [ 1193.265659][T15499] ib_setup_port_attrs+0xe1b/0x2140 [ 1193.270878][T15499] page last free pid 23 tgid 23 stack trace: [ 1193.276880][T15499] __free_frozen_pages+0xbf8/0xd70 [ 1193.282103][T15499] tlb_remove_table_rcu+0x85/0x100 [ 1193.287231][T15499] rcu_core+0xc9e/0x1750 [ 1193.291501][T15499] handle_softirqs+0x22a/0x7c0 [ 1193.296285][T15499] run_ksoftirqd+0x36/0x60 [ 1193.300723][T15499] smpboot_thread_fn+0x541/0xa50 [ 1193.305680][T15499] kthread+0x726/0x8b0 [ 1193.309773][T15499] ret_from_fork+0x51b/0xa40 [ 1193.314376][T15499] ret_from_fork_asm+0x1a/0x30 [ 1193.319260][T15499] [ 1193.321600][T15499] Memory state around the buggy address: [ 1193.327248][T15499] ffff88802946ae80: fa fc fc fc 04 fc fc fc 04 fc fc fc fa fc fc fc [ 1193.335333][T15499] ffff88802946af00: 04 fc fc fc 04 fc fc fc 04 fc fc fc 04 fc fc fc [ 1193.343678][T15499] >ffff88802946af80: 04 fc fc fc 01 fc fc fc 04 fc fc fc 04 fc fc fc [ 1193.351929][T15499] ^ [ 1193.357058][T15499] ffff88802946b000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1193.365223][T15499] ffff88802946b080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 1193.373387][T15499] ================================================================== [ 1193.384809][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5210 ms [ 1193.392917][ C0] lec:lec_tx_timeout: lec0 [ 1193.686231][T15499] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1193.693695][T15499] CPU: 1 UID: 0 PID: 15499 Comm: syz.3.11380 Not tainted syzkaller #0 PREEMPT(full) [ 1193.703460][T15499] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1193.713757][T15499] Call Trace: [ 1193.717119][T15499] [ 1193.720179][T15499] vpanic+0x1e0/0x670 [ 1193.724216][T15499] panic+0xc5/0xd0 [ 1193.727994][T15499] ? __pfx_panic+0x10/0x10 [ 1193.732464][T15499] ? preempt_schedule_thunk+0x16/0x30 [ 1193.737908][T15499] ? preempt_schedule_thunk+0x16/0x30 [ 1193.743352][T15499] ? ieee80211_ie_split_ric+0x8fa/0x950 [ 1193.748967][T15499] check_panic_on_warn+0x89/0xb0 [ 1193.753972][T15499] ? ieee80211_ie_split_ric+0x8fa/0x950 [ 1193.759589][T15499] end_report+0x6f/0x140 [ 1193.763991][T15499] kasan_report+0x128/0x150 [ 1193.768557][T15499] ? ieee80211_ie_split_ric+0x8fa/0x950 [ 1193.774160][T15499] ieee80211_ie_split_ric+0x8fa/0x950 [ 1193.779672][T15499] cfg80211_connect+0x11f8/0x2140 [ 1193.784750][T15499] ? __might_fault+0xaf/0x130 [ 1193.789475][T15499] cfg80211_mgd_wext_connect+0x4a0/0x5f0 [ 1193.795227][T15499] cfg80211_wext_siwessid+0xc4/0x160 [ 1193.800584][T15499] ioctl_standard_iw_point+0x6cd/0xd90 [ 1193.806136][T15499] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1193.812060][T15499] ? __pfx_ioctl_standard_iw_point+0x10/0x10 [ 1193.818082][T15499] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1193.824007][T15499] ioctl_standard_call+0xaf/0x1b0 [ 1193.829101][T15499] ? __pfx_cfg80211_wext_siwessid+0x10/0x10 [ 1193.835015][T15499] wext_ioctl_dispatch+0xee/0x410 [ 1193.840064][T15499] ? __pfx_ioctl_standard_call+0x10/0x10 [ 1193.845720][T15499] wext_handle_ioctl+0x10f/0x1d0 [ 1193.850696][T15499] ? __pfx_wext_handle_ioctl+0x10/0x10 [ 1193.856185][T15499] ? do_futex+0x333/0x420 [ 1193.860576][T15499] sock_ioctl+0x159/0x7f0 [ 1193.865025][T15499] ? __pfx_sock_ioctl+0x10/0x10 [ 1193.870003][T15499] ? __fget_files+0x2a/0x420 [ 1193.874706][T15499] ? __fget_files+0x3a0/0x420 [ 1193.879415][T15499] ? __fget_files+0x2a/0x420 [ 1193.884045][T15499] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1193.889006][T15499] ? __pfx_sock_ioctl+0x10/0x10 [ 1193.893898][T15499] __se_sys_ioctl+0xfc/0x170 [ 1193.898529][T15499] do_syscall_64+0xe2/0xf80 [ 1193.903100][T15499] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1193.909282][T15499] ? trace_irq_disable+0x37/0x100 [ 1193.914341][T15499] ? clear_bhb_loop+0x60/0xb0 [ 1193.919221][T15499] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1193.925139][T15499] RIP: 0033:0x7fa2c219aeb9 [ 1193.929588][T15499] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1193.949307][T15499] RSP: 002b:00007fa2c307b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1193.957935][T15499] RAX: ffffffffffffffda RBX: 00007fa2c2415fa0 RCX: 00007fa2c219aeb9 [ 1193.965935][T15499] RDX: 0000200000000040 RSI: 0000000000008b1a RDI: 0000000000000005 [ 1193.973931][T15499] RBP: 00007fa2c2208c1f R08: 0000000000000000 R09: 0000000000000000 [ 1193.981916][T15499] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1193.989997][T15499] R13: 00007fa2c2416038 R14: 00007fa2c2415fa0 R15: 00007ffd00308408 [ 1193.998093][T15499] [ 1194.001821][T15499] Kernel Offset: disabled [ 1194.006152][T15499] Rebooting in 86400 seconds..