last executing test programs: 7.178911121s ago: executing program 1 (id=5521): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000004c0)=@bpf_lsm={0x18, 0x5, &(0x7f0000000000)=@raw=[@jmp={0x5, 0x0, 0x7, 0x2, 0x6, 0xffffffffffffffff}, @initr0, @exit, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffc}], &(0x7f00000000c0)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1000}, 0x94) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bridge0\x00', 0x0}) syz_emit_ethernet(0x2a, &(0x7f0000000140)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x67, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, @address_reply={0x12, 0x0, 0x0, 0x400}}}}}, 0x0) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="38000000540001002bbd70000200000007000000", @ANYRES32=r1, @ANYBLOB="20000100", @ANYRES32=r1, @ANYBLOB="010200007f00000100000000000000000000000000000000826c652bf4c2431ad235d4c581018b5f704d2ef972570567243b92f7e56a61e5d4aab37cba1afc84e1bd5dc0b178004bb234477114dbe99b33dbecadcc91b4744d5ac0d34e027dc29234095d8fb33172dcda7d0ec759f2bb4f6253fdc1ec1337c66d4321ea88d1b63f84d09e7fdec396208d1442d814221e3ce9c688df8821"], 0x38}, 0x1, 0x0, 0x0, 0x22004804}, 0x40080c0) (rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', r1, @fallback=0x4, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 4.809562857s ago: executing program 1 (id=5526): openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) (async) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$TUNSETIFF(r0, 0x5452, &(0x7f0000000080)={'veth1_to_bridge\x00', 0x400}) 4.612431443s ago: executing program 1 (id=5532): ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x10000800, 0x4) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r2, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r3, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000010c0)={0x64, 0x2c, 0x107, 0x70bd2c, 0x25dfdbfd, {0x2, 0x7c}, [@nested={0x40, 0x1, 0x0, 0x1, [@nested={0x3c, 0x61, 0x0, 0x1, [@generic="1ef037b5aa1427f3f7c87fdeea1ce63be6702d0fcfb301905325d7e6a7997a2b18320b246c98f0f9fbe15e7e447b86ff663f271dd0bb283d"]}]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x1, 0x0, 0x1, [@nested={0x8, 0x8e, 0x0, 0x1, [@nested={0x4, 0xe9}]}]}]}]}, 0x64}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) bind$llc(r3, 0x0, 0x0) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r3) socket(0x1, 0x6, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r6) recvmmsg(r6, &(0x7f0000005a00)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000240)=""/23, 0x17}, {&(0x7f0000000740)=""/147, 0x93}, {&(0x7f00000008c0)=""/237, 0xed}, {&(0x7f00000009c0)=""/73, 0x49}, {&(0x7f0000000a40)=""/227, 0xe3}, {&(0x7f0000001800)=""/4096, 0x1000}, {&(0x7f0000000040)=""/128, 0x80}, {&(0x7f00000000c0)=""/19, 0x13}], 0x8}, 0xfffffffd}], 0x1, 0x2000, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a28000000000a01040000000000000000010080030900010073797a300000000008000240000000012c000000030a010100000000e4000000010002000900010073797a30000000000900030073797a320a05000000000000000000010000050c00024000"], 0xa8}}, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r7, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r7, 0xfffffffc) socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) 2.923846463s ago: executing program 1 (id=5552): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002680)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000040)="18", 0x1}], 0x1}}, {{&(0x7f0000000140)={0xa, 0x4e20, 0x0, @private0, 0x80000001}, 0x1c, &(0x7f0000000800)=[{&(0x7f0000000180)="ed", 0x1}], 0x1}}], 0x2, 0x0) close(0x3) r1 = socket$igmp(0x2, 0x3, 0x2) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 2.81116632s ago: executing program 3 (id=5555): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0xd, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x61}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000013c0)=0xc) sendmmsg$unix(r3, &(0x7f0000000240)=[{{0x0, 0xfffffffffffffe40, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r6, @ANYBLOB="0000000014000000000000000100000001"], 0x38, 0x400c0}}], 0x1, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x18, 0x2e, 0x9, 0x70bd27, 0x25dfdbff, {0x4}, [@nested={0x4, 0x37}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x440d4) socket$inet(0x2, 0x6, 0x5) socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0xd, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x61}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x5}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x35, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), &(0x7f00000013c0)=0xc) (async) sendmmsg$unix(r3, &(0x7f0000000240)=[{{0x0, 0xfffffffffffffe40, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r6, @ANYBLOB="0000000014000000000000000100000001"], 0x38, 0x400c0}}], 0x1, 0x0) (async) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={0x18, 0x2e, 0x9, 0x70bd27, 0x25dfdbff, {0x4}, [@nested={0x4, 0x37}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x440d4) (async) socket$inet(0x2, 0x6, 0x5) (async) 2.184256589s ago: executing program 1 (id=5559): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r0, 0x400, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x1a}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x36}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0xb}, @NL80211_ATTR_REASON_CODE={0x6, 0x36, 0x37}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008040}, 0x4000000) r1 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000180)={[{0x2b, 'cpuset'}, {0x2d, 'cpuacct'}, {0x2d, 'net_prio'}, {0x2d, 'blkio'}, {0x2d, 'cpu'}, {0x2d, 'io'}, {0x2b, 'cpu'}]}, 0x30) r2 = socket$netlink(0x10, 0x3, 0x13) (async) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_CONFIG(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x20, r3, 0x10, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}]}]}, 0x20}}, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_SET_DEST(r4, &(0x7f00000003c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x30, 0x0, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x70}, @IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000050}, 0x0) (async) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400), 0x80, 0x0) ioctl$XFS_IOC_SET_RESBLKS(r5, 0xc0105872, &(0x7f0000000440)={0x4, 0x77e}) (async) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), r2) sendmsg$ETHTOOL_MSG_FEATURES_GET(r2, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x58, r6, 0x200, 0x70bd27, 0x25dfdbff, {}, [@HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x800}, 0x804) (async) ioctl$XFS_IOC_FD_TO_HANDLE(r4, 0xc038586a, &(0x7f0000000700)={r4, &(0x7f0000000600)='@\x00', 0x48800, &(0x7f0000000640)={@_ha_fsid={[0x5, 0x60c]}, {0x2, 0x6e, 0x5, 0x40}}, 0x6, &(0x7f0000000680)={@_ha_fsid}, &(0x7f00000006c0)=0x7fff}) setsockopt$packet_int(r7, 0x107, 0x14, &(0x7f0000000740)=0x1, 0x4) (async) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000780)={0x67, @multicast1, 0x4e21, 0x3, 'lc\x00', 0x2, 0x200, 0x1a}, 0x2c) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r7, 0x89f2, &(0x7f00000008c0)={'syztnl1\x00', &(0x7f00000007c0)={'ip_vti0\x00', 0x0, 0x7800, 0x1, 0x8, 0x7, {{0x2e, 0x4, 0x1, 0x4, 0xb8, 0x64, 0x0, 0x2, 0x4, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, {[@end, @timestamp_prespec={0x44, 0x1c, 0xb6, 0x3, 0x5, [{@dev={0xac, 0x14, 0x14, 0x3a}, 0x5caa}, {@multicast1, 0x2}, {@remote, 0xe37}]}, @rr={0x7, 0x2b, 0x98, [@rand_addr=0x64010100, @local, @multicast1, @local, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @multicast2, @empty, @local, @multicast2]}, @cipso={0x86, 0xa, 0x0, [{0x2, 0x4, "6686"}]}, @timestamp_addr={0x44, 0x4c, 0x97, 0x1, 0x9, [{@broadcast, 0x2}, {@local, 0x61e}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xfff}, {@loopback, 0x1}, {@remote, 0x5}, {@multicast1, 0x3184}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}, {@broadcast, 0x522}, {@local, 0x4}]}, @ra={0x94, 0x4, 0x1}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000980)={'syztnl0\x00', &(0x7f0000000900)={'ip6tnl0\x00', r8, 0x29, 0x0, 0x2e, 0x400, 0x24, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x20, 0x20, 0x21f, 0x6}}) socket$kcm(0x29, 0x5, 0x0) (async) sendmsg$inet(r2, &(0x7f0000000e00)={&(0x7f00000009c0)={0x2, 0x4e21, @empty}, 0x10, &(0x7f0000000c40)=[{&(0x7f0000000a00)="112f80d4a0aeecbbea5d484fee246e1dc1bf1a520635984489a899b50e11fee83fc3eb4ebdf43653639b2eaf05ff41ba1996a6d2e31014d882d99b81cb7a0a960eca", 0x42}, {&(0x7f0000000a80)="c9228b0a901a6a79b2c28b47601ec59687a224332b529ab1c7941d970f809c67a472c17545005c7fcd658ebc3828f88a60229e2659463337c3527cd516d4bf7ea4cac758158c0edbff98d6389594174a", 0x50}, {&(0x7f0000000b00)="9bb7f23718bd203bf526620962982910e7a9de632d781e5eaf24ae2e224d9ee99d995a4707990d0d8f55db6fdc76231494696db626abc02b047d9269af42910ff5321904965bb8a88367a1ca32b184b8b4825171d0f541daf53cabcbc495f4717bb98da933", 0x65}, {&(0x7f0000000b80)="ed4c3583144ee41bf382a98e3582ed9a5e253708355eef337f519a08556154deaf85a698db423ed6a1a5453bd236b6b2e0b94039eabc91c5f90a27cec5603b5e4fa1914c5d4aac41", 0x48}, {&(0x7f0000000c00)="bcd70005b332f38ec926a1ae256aedc36662a700e86b6d2bc39eaee0f355caafa6bca731277524", 0x27}], 0x5, &(0x7f0000000cc0)=[@ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xc0}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x5}}, @ip_retopts={{0x74, 0x0, 0x7, {[@noop, @end, @noop, @end, @lsrr={0x83, 0x1b, 0x76, [@loopback, @dev={0xac, 0x14, 0x14, 0x12}, @dev={0xac, 0x14, 0x14, 0x23}, @empty, @loopback, @rand_addr=0x64010101]}, @noop, @timestamp_addr={0x44, 0x44, 0xaa, 0x1, 0x9, [{@broadcast, 0xfffffff9}, {@multicast2, 0x6}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0xfffffeff}, {@multicast1, 0x1}, {@broadcast, 0x4d1}, {@rand_addr=0x64010100, 0x1}, {@private=0xa010100, 0xa}, {@empty, 0xa4d}]}]}}}, @ip_retopts={{0x54, 0x0, 0x7, {[@timestamp_prespec={0x44, 0x14, 0x17, 0x3, 0x2, [{@local, 0x2}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x8}]}, @generic={0x83, 0xc, "e7e08455e4dde7728c78"}, @cipso={0x86, 0x21, 0xffffffffffffffff, [{0x7, 0x11, "311d9151b5a4f6ca32034316e3b3c7"}, {0x2, 0xa, "3db18ad1c5c1a786"}]}]}}}], 0x118}, 0x20000000) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) r9 = syz_genetlink_get_family_id$devlink(&(0x7f0000000e80), r2) sendmsg$DEVLINK_CMD_TRAP_SET(r7, &(0x7f0000001000)={&(0x7f0000000e40)={0x10, 0x0, 0x0, 0x40940000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xdc, r9, 0x100, 0x70bd2b, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4040}, 0x10) (async) sendmsg$RDMA_NLDEV_CMD_SET(r2, &(0x7f0000001140)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001100)={&(0x7f0000001080)={0x44, 0x1402, 0xc, 0x70bd2c, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz0\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0xb3}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r7}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x41) (async) bind$rxrpc(r7, &(0x7f0000001180)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x10001}}, 0x24) (async) syz_genetlink_get_family_id$tipc2(&(0x7f00000011c0), r2) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$FOU_CMD_DEL(r10, &(0x7f0000001300)={&(0x7f0000001200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000012c0)={&(0x7f0000001240)={0x50, 0x0, 0x2, 0x70bd2d, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V6={0x14, 0x9, @mcast1}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}, @FOU_ATTR_IPPROTO={0x5, 0x3, 0x21}, @FOU_ATTR_TYPE={0x5}, @FOU_ATTR_AF={0x5, 0x2, 0x2}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}]}, 0x50}, 0x1, 0x0, 0x0, 0x40040}, 0x40000) sendmsg$IPVS_CMD_NEW_DAEMON(r10, &(0x7f0000001480)={&(0x7f0000001340)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000001440)={&(0x7f0000001380)={0xbc, r3, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xbae9}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x28, 0x2b}}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6f}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0x9}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x20008804}, 0x20000810) ioctl$sock_SIOCETHTOOL(r10, 0x8946, &(0x7f0000001580)={'team0\x00', &(0x7f00000014c0)=@ethtool_dump={0x3e, 0x7f, 0x8, 0x74, "e7624b7ab2a2312db413b27bbec8cde84e35490b12da05c85cb283dfbc1d97e232db6eeb4b1e47371d569173ed1f002f26549079f156569d79dcf9dd7c8b516c9c02e64a99b6807a33a14ec25862d91f8f789447172c9ce2c4fae5cc46e1e3c5bdff764bf8543ee61867a2415e734909e288f375"}}) 2.183601815s ago: executing program 3 (id=5560): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000300)={0x0, r0}, 0x8) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYRES8=r0, @ANYRES32=0x1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r0, @ANYRES32, @ANYBLOB='\x00'/12], 0x50) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000005000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r2, &(0x7f00000000c0), &(0x7f0000000000)=""/3, 0x2}, 0x20) (async) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000500)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb25026a747e0114370595e4bb0b0489b1dc73229c52bbea23870200000079d3c7a519afc7d2dff1cc9fe1b9bd41c5d0b4f2d04979d68cc3471637e69740313dd0f31448193bd26131968d5f790e1429b24ba01f24670353dc73659f4a40f9972fa07c53e4c92d84f3394d5ead33881c01ec616a7a5d6f7ef1c6565b655891a8d903e08c626954a616dd009a67e4f11b8f38101bccfb", 0xb1}], 0x1}, 0x20048820) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x13, &(0x7f0000000080)=ANY=[@ANYRESHEX=r1, @ANYRES32, @ANYBLOB="00000000000000000d08000000000000180000000000000000000000000000009500000000000000360a020000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x9, 0xde, &(0x7f00000001c0)=""/222, 0x40f00, 0x8}, 0x94) (async) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000740), 0xffffffffffffffff) (async) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r5, 0x0, 0x80, &(0x7f0000000100)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000040], 0x0, 0x0, 0x0}, 0x78) (async) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000840)=ANY=[@ANYRES64=r4, @ANYRES16=r4, @ANYRES8], 0x5f}, 0x1, 0x0, 0x0, 0x404c041}, 0x24004885) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r6 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r6, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r8], 0x1c}}, 0x840) syz_emit_ethernet(0x5a, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaac7533137cd4e1eaaaaaaaaaaaa0008004e00004c00000000000690780a010102ac1414aa070f04a976bc4b4c9e3e260cbfad990444140b01e000000100000000e00000010000", @ANYRES32=0x41424344, @ANYRES32=r0], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000063060000bca30000000000002403000020fef6ff720af0fff8ffffff71a4f0ff000000001f030000000000002e100200000000002604f8ffffff"], 0x0, 0xa, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000003c0)={&(0x7f0000000000)=""/5, 0x300000, 0x1000, 0x86d}, 0x20) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f00000001c0)=0x2, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400f7ff02010000"], 0x14}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) (async) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r10 = accept4(r9, 0x0, 0x0, 0x800) sendmmsg$alg(r10, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000400)="f7969ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f00000006c0)="ebe376fdba128280c672219d205e81f4a7a8e96cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0e84e0e9587304800"/82, 0x52}, {&(0x7f0000000880)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r10, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) write$nci(r6, &(0x7f0000000280)=ANY=[@ANYBLOB="400404"], 0x7) 2.174533809s ago: executing program 1 (id=5563): socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0xfdcd, &(0x7f0000000440)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x1}, 0x10) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x80) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x15, 0x8, 0x2, 0x0, 0x0, 0x1, 0xe07, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x5, 0x1}, 0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f0000001b00)=[{{&(0x7f00000004c0)=@rc, 0x80, &(0x7f0000001a80)}, 0x9}], 0x1, 0x100, &(0x7f0000001b40)) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x40f00}, 0x94) socketpair$unix(0x1, 0x1, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="140100002f00011b00000000ecdbdf2501"], 0x114}], 0x1, 0x0, 0x0, 0x4}, 0x20000000) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x42, 0x0, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) bind$tipc(0xffffffffffffffff, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x0, {0x41, 0x4, 0x2}}, 0x1a) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r1, 0xf504, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000140000006c07010033d484"], 0x340a) r5 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r5) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) unshare(0x20000400) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x8bc, 0x10000, @value=r5}, 0x28) 2.112487864s ago: executing program 3 (id=5566): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) r2 = accept$alg(r1, 0x0, 0x0) sendmmsg$alg(r2, &(0x7f0000001900)=[{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000000c0)="5bdbd57a0e656889964df9937f561de9b944d1e381fed329742e239cb13cf2af711d48d2f15b3118abd8fd087f117830209a631f9dfbec5cbbbb2216a2d87dfb0d7dd906c594125a10053c8e288ac4445ff0e999d423cc250e31e8650d248e49ba5fb3be8db01db38acf5a4455630ecb10f753530ada6598a1ff4805370a5cebf05e199368871b2751c242633419d13a6b05a390d21ab1d44be1254385b3d882c646f9762bf3480e05e98c9cc655adb7caa279e66709794e3b93cda0b9a14794e6d020cc68ea70e71a083e1a2b375591203ce218e8d244cf32f5dd7af0ee1ed032d3b59e4d57136639d68b7577553393a9", 0xf1}, {&(0x7f0000000000)="ef7791000dc7777cb951ca638ea0e1b5d280548c882aa59a68cd17c0e7f23d6d", 0x20}], 0x2, &(0x7f00000006c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x2}], 0x1, 0x0) (async) recvmmsg(r0, &(0x7f0000003f40)=[{{0x0, 0x0, 0x0}, 0xeb8}, {{0x0, 0x0, &(0x7f0000003480)=[{&(0x7f0000000440)=""/28, 0x1c}, {&(0x7f00000022c0)=""/4096, 0x1000}], 0x2}, 0x2d}], 0x2, 0x2120, 0x0) (async) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r4, 0x107, 0xd, &(0x7f00000001c0)=@req={0x3, 0x3, 0x101, 0x81}, 0x10) (async) socketpair(0x1, 0x3, 0x0, 0x0) (async) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendto$packet(r4, 0x0, 0x0, 0x4004800, &(0x7f0000000080)={0x11, 0xf6, r5, 0x1, 0x7f, 0x6, @local}, 0x14) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) (async) listen(r3, 0x0) (async) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) (async) r7 = accept(r3, 0x0, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000080)) (async) sendmsg$nl_route(r8, 0x0, 0x40000) (async) sendmsg$TEAM_CMD_OPTIONS_SET(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x800}, 0x10) 1.940640221s ago: executing program 3 (id=5569): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0x48, 0x30, 0x1, 0x0, 0x0, {}, [{0x34, 0x1, [@m_mpls={0x30, 0x1, 0x0, 0x0, {{0x9}, {0x4}, {0x4, 0x2}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x48}}, 0x48000) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=ANY=[@ANYBLOB="480000001000390440a97000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="0198000000000000180012800e00010077697265677561726400000004000280080029001615070008001b00"], 0x48}, 0x1, 0x0, 0x0, 0x24000007}, 0x0) 1.810964386s ago: executing program 3 (id=5572): r0 = socket$alg(0x26, 0x5, 0x0) accept$alg(r0, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac00000000000000000000000000000000000000000000000400000000000000000002000000000a00100001"], 0xc4}}, 0x4c050) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) setsockopt$CAN_RAW_ERR_FILTER(0xffffffffffffffff, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'veth0_to_batadv\x00', 0x0}) sendmsg$can_raw(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000880)={0x1d, r3}, 0x10, &(0x7f00000005c0)={&(0x7f0000000100)=@can={{0x0, 0x1, 0x0, 0x1}, 0x8, 0x3, 0x0, 0x0, "4c1ea5382b20f15c"}, 0x66}, 0x1, 0x0, 0x0, 0x2004c880}, 0x20000041) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x88, 0xc, 0xa, 0x301, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x5c, 0x3, 0x0, 0x1, [{0x58, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x4c, 0xb, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x6fbc}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}, {0x14, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x4}}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x10c}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$kcm(0x2a, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000001f80)={&(0x7f0000001d00)=@qipcrtr={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0x80, 0x0}, 0x0) close(0x3) sendmsg$nl_xfrm(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newpolicy={0x13c, 0x13, 0x1, 0x70bd2b, 0x25dfdbfb, {{@in6=@loopback, @in=@broadcast, 0x0, 0xd, 0x400, 0x6, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0x0, 0x1, 0xffffffffffffffff, 0xfffffffffffffffe, 0x101, 0x0, 0x2}, {0x0, 0x1765, 0x4000000000}, 0x2, 0x1000000, 0x0, 0x0, 0x0, 0x2}, [@tmpl={0x84, 0x5, [{{@in=@private=0xa010101, 0x0, 0x2b}, 0x2, @in=@local, 0x0, 0x4, 0x0, 0x0, 0x4, 0x7f}, {{@in6=@private2, 0x4d3, 0x2b}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x0, 0x3, 0x0, 0x1, 0xbffffffe}]}]}, 0x13c}}, 0x10) clock_gettime(0x0, &(0x7f0000000500)={0x0, 0x0}) pselect6(0x40, &(0x7f0000000140)={0xc4, 0x7fffffffffffffff, 0x54c0975b, 0x8000, 0x10000, 0x8000000000000001, 0x100, 0x9}, &(0x7f0000000480)={0x51d6, 0x7ff, 0x6, 0x6, 0x4d8, 0x7, 0x100000001, 0x100}, &(0x7f00000004c0)={0x7, 0x8, 0x8, 0x80, 0x1ff, 0x7fff, 0x100, 0xc99}, &(0x7f0000000540)={r7, r8+60000000}, &(0x7f0000000600)={&(0x7f0000000580)={[0x2]}, 0x8}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 1.565601168s ago: executing program 4 (id=5575): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$inet(r0, 0x0, 0x0) socket(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x15, 0x0, 0x0}, 0x94) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000100)={0x1, &(0x7f00000001c0)=[{0x6, 0x4, 0x6, 0x6}]}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000fdfdfff67a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040000010000400404000001000000b7050000050000006a0a00fe00000000850000000a000000b70000000000000095000000000000009cc6b3fcd62c061c6238975d43a4505f80e39c9f3c530cf08e467b592f868ee3b0a435df0a0e8c1bf176db2a6b2feb4b77d3d5707bfd2d84aaa3b1d4e984c46ea7e2b347a36f5662403e1b2be4284322a4908a0d411a9872971c7c46f0979bd10b97163c066d0e196bf02f46c7953ab1abdaf9de9ca3c00cb9bf4e418d076feafa22f0610a70f2bdf4000200000066b60d00b0c2c1254f0963f63223b7b80197aa3161f45346b100000000000000000089e399f6609876b5887437a172ebc02a740694298b79dc194e533583412dff048fc21f28bdd3e26a1a8a0481e9f0da43bb6ca66e2f55a9ff19ffcafe3e64be033c9d2f972cc93c1c13caec04a367c24a9fb6a6991ddb737d527d6acb15426415b6e8b14f822e86067a5e991c3b404984dfa2c6e94bd0339454c13ad3c328a182c15dc760a3000000005dc2ed0e0b29e98fa883c71949a34d84030323e3d54f45b29d27643453ad9211e3550ee5520211d9370175133f260c6882a146880b9387f1beb5418618bc83a3becf9bb57da7ba8b913c685fc6700848dc6665d73248c1f74e08ad04ce905faf32706e0000249a028044ede964362cfb7830a246c3b2f60000fc4deb8eda1368b0960b8d69bd99c64893d44f962524429dc058528e7e541c903869d96989b9a986620cb2c95c83f2a082c52764f49e51188f9418b01bcd8ae164acdac95318ec8b2c6feacdcf4b528e5e582160ed048c46e1dccca05bfa1d67c83795eae2d31968c055d325a9c794ef88b30c2de4a274878b73c05ffa88b7033be648b12bb1fee58958d6a6f31bfe568215dfbde59dad00008a73b40f09cf018cd496b36050d70c28f76749262e33e16429a6da35ceb1a989de81c3f8b8bc3a4763948a1cbc10348ef2ac3781b847611fcb0a26acafdd6d9ab05865fcf7c493d8f8cd344a1d470ca0d6f16ab0293774b5509fb0e7113936d59d5a60dbd84a938476adeebab9ff44f531bb81c53f16d80f51006cbc71570a5e272b223425e09dc6b6cc1fbc455a64fd449284f71761092a0302000000000000008a05d36fd9b814b4292745418c92d944763a4bf5e138d810e29a31f08f7dea7762d28484e15dc4320e4f85c16a8fbffadf8214d6d24cabe17ad4135d8872935ce0e6a468fd20fa4461d1d600234feac6eb4f046f2acc1b0efb4438abddcabb4e4e72a450aab72b589bec83bbb688e659fb426cb43d0ee993516fd4e867232cde69b6ffad447dcd92e0ef8234ff850ec3948dd1fa7afb77d951fe4abf618121b7894c1044ef221973432ccc7e62b151eb898a01010a7ec5acd0a5dcb2de443880c8a682515d1da9a3048744acb44384d1591df789883c0560495cb0cb32283529926d25e5c7f4815237c3aa356217738898a16ba603439f6eaad8e70b"], 0x0}, 0x90) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xa, 0x4, 0x6, 0xff, 0x46, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000080), 0x619, r1}, 0x38) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000004c0)={0xffffffffffffffff}) sendmsg$unix(r2, 0x0, 0xc800) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$SIOCX25GCAUSEDIAG(0xffffffffffffffff, 0x89e6, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x80000003) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, 0x0, 0xc000) socket$netlink(0x10, 0x3, 0x4) socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$inet_tcp(0x2, 0x1, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001000010400000000000000ffff000000", @ANYRES32=0x0, @ANYBLOB="0380000000000000240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r5, @ANYBLOB='\b\x00\n\x00', @ANYRES8=r6], 0x54}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x20) 1.470535662s ago: executing program 3 (id=5576): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'dvmrp0\x00', &(0x7f0000000480)=@ethtool_eeprom={0x7, 0x1, 0xac}}) (async) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000340)={0xfffbfffc, 0x2000003, 0x5, 0x6}, 0x10) (async) socket$can_raw(0x1d, 0x3, 0x1) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) sendmsg$nl_route_sched(r0, 0x0, 0x20000041) unshare(0x6e020200) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x102}) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) (async) socket$netlink(0x10, 0x3, 0x0) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$nl_route_sched(r2, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@dev={0xfe, 0x80, '\x00', 0x2f}, 0x1, 0x2, 0x0, 0x4, 0x40ff}, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$NILFS_IOCTL_CHANGE_CPMODE(r2, 0x40106e80, &(0x7f0000000240)={0x15, 0x1}) writev(0xffffffffffffffff, 0x0, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) (async) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x18, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="180200007ff7ffff000000000000001f9500000018b10000"], 0x0, 0x5, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) (async) ioctl$TUNSETOFFLOAD(r5, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r1, 0x4010744d, &(0x7f0000000040)) ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c8, &(0x7f0000000100)) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000580)={'veth1_to_bond\x00'}) 1.356287769s ago: executing program 4 (id=5578): ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000300)={{0xffffffffffffffff, &(0x7f0000000140)='batadv0\x00', 0x28202, &(0x7f0000000180)={@_ha_fsid={[0x9, 0x3]}, {0x80, 0x8, 0x42b48122, 0x7}}, 0x1ff, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000240)=0xf313}, {[0xfffffff9, 0x558d, 0x40, 0xf5f5]}, 0x0, 0x5a, &(0x7f0000000280)=""/90}) (async) r1 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32) r2 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r4, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0xd, 0x8b, 0xd, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xe, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x4, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) (async) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000000c0), 0x4) (async) setsockopt$inet6_tcp_TLS_TX(r5, 0x11a, 0x1, &(0x7f0000000540)=@gcm_128={{0x303}, "ffffffffffffffe2", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9", "12772541f8eb02bb"}, 0x28) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) accept4$vsock_stream(r6, &(0x7f0000000100)={0x28, 0x0, 0xffffffff, @local}, 0x10, 0x80800) write$cgroup_int(r6, &(0x7f0000000000), 0xffffff6a) (async) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) (async) sendfile(r5, r6, 0x0, 0xffffffff004) (async, rerun: 32) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x6, 0x12, &(0x7f0000000380)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xab, 0x0, 0x0, 0x0, 0x5}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@jmp={0x5, 0x1, 0x2, 0x3, 0x6, 0xc, 0x4}, @cb_func={0x18, 0x2, 0x4, 0x0, 0x6}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000440)='GPL\x00', 0xe, 0x74, &(0x7f0000000480)=""/116, 0x0, 0x15, '\x00', r4, 0x25, r6, 0x8, &(0x7f0000000500)={0x8, 0x2}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000540)=[{0x2, 0x2, 0x9, 0x6}, {0x1, 0x1, 0xa, 0x3}, {0x0, 0x4, 0x7, 0x5}, {0x3, 0x3, 0xf, 0x2}], 0x10, 0x5}, 0x94) (rerun: 32) r7 = socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x27, &(0x7f0000000000)=0x4, 0x4) recvfrom(r7, 0x0, 0x0, 0x110, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000040)) (async) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="00369432", @ANYRES16=r8, @ANYBLOB="01072cbd7000fcdbdf250600000008002c00c90b0000"], 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x20040880) ioctl$F2FS_IOC_GET_COMPRESS_OPTION(r7, 0x8002f515, &(0x7f0000000080)) 1.171471065s ago: executing program 4 (id=5581): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x8080, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000005c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x4}, @NFTA_SET_ELEM_DATA={0x4}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async, rerun: 64) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000840)={&(0x7f0000000700)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x7, [@float={0x6}]}, {0x0, [0x5f, 0x5f, 0x2e, 0x0, 0x0]}}, 0x0, 0x2b, 0x0, 0x1, 0xb}, 0x28) (async, rerun: 64) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async, rerun: 32) socket$unix(0x1, 0x2, 0x0) (async, rerun: 32) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x9, 0x6, 0x4, 0x9, 0x6, 0x9, 0x3, 0x5, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) (async) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56441, 0x70b925, 0x80000, {0x0, 0x0, 0x0, r7, {}, {0x2, 0xb}, {0x5, 0x6}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000001}, 0x2200c0c4) (async, rerun: 64) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) (rerun: 64) 873.862621ms ago: executing program 4 (id=5585): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd25, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0xd, 0xfff1}, {}, {0xfff1, 0x9}}, [@filter_kind_options=@f_flow={{0x9}, {0x5c, 0x2, [@TCA_FLOW_EMATCHES={0x58, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x4c, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x1, 0x0, 0x0, {{0x7, 0x3, 0x67e6}, {0x9, 0x3, 0x5, 0x9}}}, @TCF_EM_NBYTE={0x10, 0x2, 0x0, 0x0, {{0x24, 0x2, 0x1}, {0x8, 0x0, 0x2}}}, @TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0x2, 0x3, 0x300}, {0x10001, 0xc1, 0x6, 0x3}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x3}}]}]}}]}, 0x8c}}, 0x20004000) r4 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r4, 0x10f, 0x87, &(0x7f0000000100)={0x4000042, 0x82, 0x1}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f00000001c0)={0x8000042, 0x3}, 0x10) r6 = socket$tipc(0x1e, 0x2, 0x0) sendmsg$tipc(r6, &(0x7f0000002340)={&(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x42, 0x4}}}, 0x10, 0x0}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r7) r8 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r8, 0x89f1, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @empty, @private2={0xfc, 0x2, '\x00', 0x1}, 0x7800, 0x8, 0xfffffffc, 0xdc64}}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r8, 0x89f1, &(0x7f0000000140)={'syztnl1\x00', &(0x7f0000000240)={'syztnl0\x00', r9, 0x29, 0x0, 0x6, 0x7f, 0xb, @ipv4={'\x00', '\xff\xff', @multicast1}, @mcast1, 0x0, 0x80, 0x6, 0x41}}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r11) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r12, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000000500010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc140000681f9c630000000000000000000100000a"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r11, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYRES32=r7, @ANYRES64=r10, @ANYRES32=r6, @ANYRESDEC=r4], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r13 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r13, 0x0, 0x15, 0x0, &(0x7f00000000c0)) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000002c0)=ANY=[], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r14 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1000000004000000040000000200000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00001e0000000000040000000000000000000000007801c71a5928753900f44de6fa07524d570c8546391e4e94c0739d0a622b2563e35eb3e25c000000060000"], 0x50) r15 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000000000000ee9c3895e5d0db522a00000018110000", @ANYRES32=r14, @ANYBLOB="0000000000000000b7080000060000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b70400000000000085000000330000009500000000000000"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r15, 0x2000012, 0xe, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 848.994275ms ago: executing program 2 (id=5586): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000380)={0x2, 0x4e22, @multicast1}, 0x10) setsockopt$sock_int(r0, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0xce22, 0x7f, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xffffffff}, 0x1c) (async) listen(r0, 0x0) (async) listen(r1, 0x2) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22, 0x7f, @ipv4={'\x00', '\xff\xff', @multicast1}, 0xffffffff}, 0x20) listen(r2, 0x2) (async) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x5, 0x2, 0x1, 0x5}, 0x50) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f00000022c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe000000008500000009000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989425f5d0b79f6584d0416d7c4bb9f547b328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f01000000010000006e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b98d2de10c21d3ea02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d000000200008000000000000001abc11c800000000000000000000000928ee53595a779d243a48cea769470424d20a04c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2d04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005472b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92fe8bad99ca332af00f191b66b6a6f732a91f0e2e9190e4b448da7de018c58e950767f9b320be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c52573d9308a13d115b43f8b1894c8fa8845bc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e495f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e4a48dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f00000021f8547d393dabe616fbbde21c90be00b5a22671395c7a69c6dd4d022ffc97ddb6aa025131652d409da1d8cfc3d219d4b1c1b7b8170d7c33d91db2b73f7ae02485a209a2474b5d0790d05c01bec623056e4d3f4d3149373a28b26a15a1fcce73d57e6eaf7e6f315fe275ebc9ef7aeca277dde01dde724f419803a2172a7833ceab38d21ca4f1dea5e1f4d8824167b21dd289dd4e6ecfba9e163bdbc48e1e758ecde05c10809c9edfa6d77c652fd742e6dad13d2a397bebe3ea8bc087d3720e2202f36c7719ae34f042e19dc08a3323a3d94098a7ec171469352bab1662c3e4d4803c565cfcce32dad628fade43a4844abb230ce608726fd87e93c405a96cf638c41510f26e9da5f316"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18020000faffbfff00000000400000008500e121566dbcd140d1d66fabbae0f8e28b1121cc4fd5594939d19dd15f6d37c0d3cf38020b17346cf01541c25ee47f74655c72b2328863c78f2c73da1a2a91e6c475abd480008670"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r3, 0x0, 0x62, 0xfe, &(0x7f0000000140)="cb74445b7d4c0b24676c6c71ae37efcedaf40242309766deb4e793f90000000000000000dbc856cbc664650634231454ca2d8034c4ca29e0d99c3b6615e91835a600c08f989af45438a54981be310aad92ae545b1c961e5f3762a51fe4c736edec6f", &(0x7f0000000440)=""/254, 0x0, 0x0, 0xff, 0x194, &(0x7f0000000980)="ffc4438e5c3081d0e133e812196ec0ed923733aa8b5aba32c8650e7a66d6136853773dfbc6226be13039e230d511f1ac50cc7811aac0400e4c833fedf842ae2918e6fddb550729246fcf4c0a01bc64989ea3985fb362751a83991bd56e761379caa64f6148893ff25f38d5cd6dd695bbf9ca709a9960e0e6b054d5e2239bcb7c0fb2ac66dc4c8f534e439ff20ccaf0d48a98c19c92a3b437a699350f49606d21a403f8c112c46fea5486bf367a854b0f6c1e563b656e4794f6793a08bb3656c391643f6df71d0255054368a938d38503d064da82d5dbf395ad47ed3932669168d324ed0f6de8360d499042ddc7d02b6c0772128257702bfe6d0971f00fea85da062cdc", &(0x7f00000007c0)="4c87fe555ceb79157b1e507ff4d3cc053321e42ae89f596427188b4877ab8f1776c0685784f1174c6401ecc1dd6e2a77bc79238f87ad9215a92ff203a30099e77c543e702b4a4438d358616381745f24f74e585498af129c4b173b242f445b08135f7fa40eb7ba78160ff4f0c80e1b324d0c234cb7f43a3ff9e9535dc16000c797113a039f4508a09144090000009f38a90a24f173b3e68377e4272950a80cfcd3aa6850e917bc7e57370060f5e6db941d67fc98a1e98103830b821657438325578d2af822dd4fc13ea7a7eef8d9be4e715aec8fd6cadc41c8da5ce9da2b9e1559d92a1936fc2b3a00000000000000000072200e10ba6269b634f10f7098c65ba67ba65c0e2687637e131fb8d5ba6c12c09c8356853c434a44ff0878e496dcf9a4f5ca02c293279948f37ebb28843f92c87c057a3b410e04418557d5deda7ddd3bd1d384d64ec980187e8b64a0696571a49e847db79349c9b3c3fab5f1f977bde4d802d9026ae0c11744eb1525c5195fd215d7a432497f35c2f2cfcd2b6336b26dfef0cb968c910ea2af5cdd4d58cc08535d5514", 0x2, 0x0, 0x10000}, 0x24) 773.150534ms ago: executing program 0 (id=5587): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000640)={'wpan0\x00'}) r2 = socket(0x40000000015, 0x5, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x1, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYRES16=r0, @ANYRES16, @ANYRES16=r2], 0x48}, 0x1, 0x0, 0x0, 0x10801}, 0xc004) 691.82221ms ago: executing program 2 (id=5588): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSACTIVE(r2, 0x40107446, &(0x7f0000000240)={0x2, &(0x7f0000000140)=[{0x48, 0xfe, 0x0, 0x46}, {0x6, 0x1, 0xfb, 0x2}]}) write(r2, &(0x7f0000000280)="73a3901297b394457d9ec9b395c0de25e4ce3095c6869d8db0a86077d284a3c1058bb47a260cc5b4fc0a93c0f8faf42ced54b1c510a286c65bf70edfe4f647e08b0b24df0010", 0x46) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000180)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0xfffffffffffffd2a, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x3, 0x2}}, @ptr={0x0, 0x0, 0x0, 0x2, 0x3}, @restrict={0xb}]}}, 0x0, 0x4a}, 0x28) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r3, @ANYBLOB="0c00990000000000000000000800a102ffff0000080026008d03000008009f"], 0x40}}, 0x0) 678.041003ms ago: executing program 0 (id=5589): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000002a80)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000380)={0x30, 0x13, 0x1, 0x70bd2b, 0x25dfdbf8, "", [@nested={0x4, 0x4f}, @typed={0x8, 0x33, 0x0, 0x0, @pid}, @nested={0x14, 0x125, 0x0, 0x1, [@nested={0x8, 0x2e, 0x0, 0x1, [@typed={0x4, 0x92, 0x0, 0x0, @binary}]}, @typed={0x8, 0x1c, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x43}}]}]}, 0x30}], 0x1, 0x0, 0x0, 0x8000}, 0x8880) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000980)=@ipv4_newroute={0x24, 0x18, 0x1, 0x60bd2d, 0x25dfdbf9, {0x2, 0x20, 0x30, 0xc, 0xff, 0x4, 0xfd, 0x1, 0x7c00}, [@RTA_GATEWAY={0x8, 0x5, @loopback}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004005}, 0x80) 620.822884ms ago: executing program 4 (id=5590): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') (async) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f0000000200)={@val={0xa, 0x1b}, @void, @eth={@multicast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x29}, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \b', 0x18, 0x11, 0xff, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[], {0x4f19, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x3, 0xe}}}}}}}}, 0x52) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000000)={'batadv0\x00', 0x1}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYRES16=r0, @ANYRESDEC=r0, @ANYRESHEX=r0], 0xd0}, 0x1, 0x0, 0x0, 0x41}, 0x20000002) 564.594914ms ago: executing program 0 (id=5591): syz_emit_ethernet(0x3a, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010100, @local}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x9, {[@eol]}}}}}}}, 0x0) (async) syz_emit_ethernet(0x3a, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010100, @local}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x9, {[@eol]}}}}}}}, 0x0) ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f0000000000)={0xffffffffffffffff}) write$cgroup_subtree(r0, &(0x7f0000000080)={[{0x2d, 'hugetlb'}, {0x2b, 'net_prio'}]}, 0x13) 538.340785ms ago: executing program 2 (id=5592): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) (async) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x7, @rand_addr=' \x01\x00', 0x5}, 0x1c) (async) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) (async, rerun: 32) sendmsg$L2TP_CMD_NOOP(0xffffffffffffffff, 0x0, 0x0) (async, rerun: 32) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r1, &(0x7f0000000240)={0x0, 0x4f, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYRESHEX=r0, @ANYRES32=r1, @ANYRESDEC, @ANYRES8=r0, @ANYRES32=r1], 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x20040844) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd844", 0x4d}], 0x1}, 0x0) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="af50fa011604a15ce4a1c6cdaea3850df7a1f2a22d5f5f3b329c9b868ae4666a62483d131b7c7430616c377e3c1f57f457d211bcf805174799a03ab195fd279a7502c57be3cec1c862c4e51d4e8c0a8a2e1fdf3417f9092ffc1e3db1b21b8f73e37792b86c6f70abd7eb4dbbb932e58635af226d61c888711fb3fdf40e3746dc31e2ea314423715bc102c00849c8716542c5d724ca668c246256dd2b2e7b54135cfae9de3b50d5143f82cf7f7280e145c80ade1e470dc29dc3427312bb77f3589f7fc0de618d519b8e3db0d5fbf6af6ccdd8242c9623aaf963899fb3da543b44a30e08da2c8db2d47aa6ea63e5320b46b01337122ce2af", @ANYRES32=0x1, @ANYBLOB="0100000000000000000097000057faf3ad425184edfcfed461620800000026e1d36cd236140d3e9a2aa8f0307e0200c831fe298701914167312df13e8670c7ed5cfadf5e5aa28374d56d8ab833466806a4bc1f195c03745c45520d71259f01a5decb9ffe9f96e7078534caba3e5fc8bfc705d1e73a8df8eb2a55868d9fb2a23db40172fa8bea9ebc994600000000000000", @ANYRESOCT=r3, @ANYRESOCT=r1, @ANYBLOB="00000000000000000000000000000000000000010001000000000000"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c3a00000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000080000850000002d00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async, rerun: 64) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="d7191a34401825bd7000fbdbdf25000000000000", @ANYRES32=0x0, @ANYBLOB="4200000021200000140012800c0001006d6163766c616e000400028008000500", @ANYRES32=r7, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000002) (async) sendmsg(r1, 0x0, 0x54) (async, rerun: 32) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x4004090) (async, rerun: 32) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r8, 0x6, 0x9, &(0x7f0000000440)={{0x67, @multicast2, 0xdffd, 0xffffffff, 'nq\x00', 0xd, 0x2, 0x36}, {@private=0xa010300, 0xfffd, 0x2, 0x85, 0x1008, 0x2000052}}, 0x44) (async) getsockopt$inet_tcp_int(r8, 0x6, 0x9, 0x0, &(0x7f0000000040)) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) (async) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r10, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000200070601030000000000000000010000400500010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20004880}, 0x20040041) r11 = socket$inet6(0xa, 0xcde9244b578dfdfb, 0x80000001) bind$inet6(r11, &(0x7f0000000040)={0xa, 0x4e20, 0xffffff86, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x2}, 0x1c) (async) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r11, 0x29, 0x20, &(0x7f0000000180)={@loopback={0x200000000000000}, 0x800, 0x0, 0xff}, 0x20) (async) setsockopt$inet6_int(r11, 0x29, 0x1000000000021, 0x0, 0x0) (async) ioctl$sock_inet_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000180)={0x0, {0x2, 0x4e23, @rand_addr=0x64010102}, {0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x29}}, {0x2, 0x4e24, @rand_addr=0x64010101}, 0x100, 0x0, 0x0, 0x0, 0x6, 0x0, 0x800000000402, 0x3, 0xda4d}) 472.905646ms ago: executing program 0 (id=5593): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r0, 0x0, 0x1, 0x0, 0x29) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0e000000040000000800000007"], 0x50) close(0x3) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000bc0)=ANY=[@ANYBLOB="090000000400000006000000ff"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000400008500000001000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r5}, &(0x7f0000000080), &(0x7f0000000100)=r6}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000000c0)={r6, 0xffffffffffffffff, 0x60000000}, 0xc) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0xfffffffffffffeee, &(0x7f0000000580)={&(0x7f0000000180)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r10 = socket$alg(0x26, 0x5, 0x0) bind$alg(r10, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r10, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r11 = accept(r10, 0x0, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)={0x60, 0x0, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}]}, @TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x90}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x101}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2fb}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3d}]}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x80c4}, 0x24004004) recvmsg(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b4c0)=""/5, 0x5}, {&(0x7f0000000040)=""/155, 0x5b}], 0x2}, 0x22) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r11, 0x89f1, &(0x7f0000000280)={'syztnl0\x00', &(0x7f0000000200)={'ip6gre0\x00', r9, 0x2f, 0x1, 0x3, 0x4961, 0x4, @private2={0xfc, 0x2, '\x00', 0x1}, @loopback, 0x7800, 0x40, 0x5}}) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b924, 0x25dfdbff, {0x0, 0x0, 0x0, r9, {0x0, 0x1}, {0xffff, 0xb}, {0x6, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_TARGET={0x8, 0x1, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x200040e0}, 0x4890) r12 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r12, 0x107, 0xf, &(0x7f0000000100)=0x4207, 0x4) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000040)={'syzkaller0\x00'}) 331.841587ms ago: executing program 4 (id=5594): socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, 0x0) socket(0x2, 0x80805, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0xd031, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r1, @in={{0x2, 0x4e21, @rand_addr=0x64010102}}}, &(0x7f0000000040)=0x84) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000100)={0x1, 0x58, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x1e, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', r2, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x32}, 0x94) 330.808402ms ago: executing program 0 (id=5595): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000880)={0xffffffffffffffff, 0x2f, 0xe, 0x0, &(0x7f00000002c0)="41dfb080ca21db08098e002f86dd", 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x5, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x61}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r0, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x16, 0x0, 0x0, 0x0}, 0x4c) r1 = socket$key(0xf, 0x3, 0x2) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) bind$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000001c0)=0x0, &(0x7f0000000380)=0x4) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000005c0)={'syztnl0\x00', &(0x7f0000000540)={'syztnl2\x00', 0x0, 0x7800, 0x10, 0x2b31, 0x8, {{0x5, 0x4, 0x1, 0x7, 0x14, 0x64, 0x0, 0x4, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x13}, @dev={0xac, 0x14, 0x14, 0x9}}}}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000006c0)={'gretap0\x00', &(0x7f0000000600)={'gre0\x00', 0x0, 0x20, 0x1, 0xec800000, 0x9, {{0x24, 0x4, 0x0, 0x7, 0x90, 0x65, 0x0, 0x0, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x18}, @local, {[@rr={0x7, 0x7, 0x40, [@empty]}, @timestamp={0x44, 0x14, 0xbf, 0x0, 0x7, [0x5, 0x2d5, 0x80000000, 0x1]}, @ssrr={0x89, 0x2b, 0x7a, [@remote, @rand_addr=0x64010102, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @loopback, @dev={0xac, 0x14, 0x14, 0x3a}, @local, @empty, @local, @broadcast]}, @ra={0x94, 0x4}, @timestamp={0x44, 0x1c, 0xe7, 0x0, 0x2, [0x5, 0xf, 0x6, 0x5, 0xfffffffe, 0xfff]}, @timestamp={0x44, 0x8, 0xc0, 0x0, 0x6, [0x3bf2]}, @generic={0x43, 0xb, "7741575d9e0995f3cb"}]}}}}}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001280)=ANY=[@ANYBLOB="4c0000001000ffff25bd7000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="1720000021200000240012800c0001006d6163766c616e0014000000000000ea0001001000000008008500", @ANYRES32=r8, @ANYBLOB], 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000300)={'virt_wifi0\x00', 0x0}) setsockopt$inet6_mreq(r10, 0x29, 0x1b, &(0x7f0000000000)={@remote, r11}, 0x14) sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=@newtfilter={0x24, 0x11, 0xd27, 0x2000, 0x0, {0x0, 0x0, 0x74, r11, {}, {0xafabc05531515610, 0xfff3}, {0xd, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x4008054) setsockopt$inet6_mreq(r10, 0x29, 0x1c, &(0x7f0000000040)={@remote, r11}, 0x14) r12 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3400000011000100000000000000000007000000", @ANYRES32=r14, @ANYBLOB="000700000000040014001a8010000480"], 0x34}, 0x1, 0x0, 0x0, 0x60}, 0x0) r15 = socket(0x2a, 0x2, 0x0) getsockname$packet(r15, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r16, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3ff, 0x1, 0xfffffff8, 0x0, 0x7, 0x7f, 0x8, 0x5, 0x1}}}}]}, 0x58}}, 0x44884) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=@newtfilter={0x104, 0x2c, 0xd27, 0x70bd2d, 0x25dfdffd, {0x0, 0x0, 0x0, r16, {0x6}, {0x0, 0x7}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0xd4, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x2, 0xc}}, @TCA_BASIC_CLASSID={0x8, 0x1, {0xf, 0xc}}, @TCA_BASIC_EMATCHES={0x4}, @TCA_BASIC_EMATCHES={0xbc, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0xb0, 0x2, 0x0, 0x1, [@TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0x8000, 0x7, 0x8}, {{0x1, 0x0, 0x1}, {0x3, 0x0, 0x1}}}}, @TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0x3, 0x0, 0x7}}}, @TCF_EM_U32={0x1c, 0x2, 0x0, 0x0, {{0x401, 0x3, 0x8001}, {0x4, 0x4, 0x8, 0x81}}}, @TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x1577, 0x1, 0xfffc}, {0x4e3b238, 0x7, 0xf566, 0x4, 0x5, 0x1, 0x1}}}, @TCF_EM_CANID={0x14, 0x3, 0x0, 0x0, {{0x4, 0x7, 0x1}, {{0x2, 0x1, 0x0, 0x1}, {0x1, 0x0, 0x1}}}}, @TCF_EM_IPSET={0x10, 0x3, 0x0, 0x0, {{0x6, 0x8, 0x7fff}, {0x4, 0x5, 0x1}}}, @TCF_EM_CMP={0x18, 0x2, 0x0, 0x0, {{0x4, 0x1, 0x7}, {0xe1d, 0xd, 0x0, 0x1, 0x9, 0x1, 0x2}}}, @TCF_EM_NBYTE={0x1c, 0x3, 0x0, 0x0, {{0x6, 0x2, 0xa}, {0x5, 0x9, 0x1, "abc00e12181f79fbda"}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x8a}}]}]}}]}, 0x104}}, 0x2000c800) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f0000000800)={'gre0\x00', &(0x7f0000000700)={'syztnl1\x00', 0x0, 0x1, 0x10, 0x7, 0x9, {{0x24, 0x4, 0x0, 0x1, 0x90, 0x64, 0x0, 0xcb, 0x2f, 0x0, @local, @empty, {[@end, @rr={0x7, 0x23, 0xbc, [@dev={0xac, 0x14, 0x14, 0x1a}, @local, @rand_addr=0x64010100, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @ssrr={0x89, 0x13, 0x63, [@empty, @multicast2, @private=0xa010101, @local]}, @timestamp_prespec={0x44, 0x24, 0x8e, 0x3, 0x2, [{@remote, 0x4}, {@empty, 0xc}, {@empty, 0xa}, {@remote, 0x2754}]}, @rr={0x7, 0xf, 0x92, [@loopback, @multicast1, @empty]}, @timestamp_addr={0x44, 0xc, 0x6, 0x1, 0x6, [{@remote, 0x7}]}, @timestamp_prespec={0x44, 0x4, 0xd9}]}}}}}) sendmsg$ETHTOOL_MSG_PAUSE_GET(0xffffffffffffffff, &(0x7f0000000b40)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000b00)={&(0x7f0000000b80)={0x194, 0x0, 0x8, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0x5c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}]}, @HEADER={0x4}, @HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r17}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x40000c0}, 0x800) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000004c0)=ANY=[@ANYBLOB="020200090d0000000000000000000000030006000000000002000000ac1414bb000000000000000002000100000000000000000200000000030005000000000002000000ac1414aa000000000000000001001500000000000100140000000000010016"], 0x68}, 0x1, 0x7}, 0x0) 281.551923ms ago: executing program 2 (id=5596): r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_int(r0, 0x1, 0x28, 0x0, &(0x7f0000000100)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000c00)={'filter\x00', 0x6002, 0x4, 0x410, 0x0, 0x218, 0x0, 0x328, 0x328, 0x328, 0x4, 0x0, {[{{@arp={@remote, @dev={0xac, 0x14, 0x14, 0xa}, 0xffffff00, 0x0, 0xb, 0xf, {@mac=@remote, {[0x0, 0xff, 0x0, 0x181, 0xff]}}, {@empty, {[0x0, 0x0, 0x0, 0x0, 0xff, 0xff]}}, 0x19, 0x3ff, 0x1, 0x4, 0x1, 0x8, 'syzkaller1\x00', 'veth0_to_bond\x00', {}, {}, 0x0, 0x37c}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="f06c22e1a111", @empty, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x1b}, 0x1}}}, {{@uncond, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb4, 'syz1\x00', {0x93bf}}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @mac=@multicast, @local, @local, 0xf, 0xffffffff}}}], {{'\x00', 0xc0, 0xe8}, {0x28, '\x00', 0x0, 0xfffffffb}}}}, 0x460) 169.781394ms ago: executing program 2 (id=5597): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000740)=@newtfilter={0x844, 0x2c, 0xd2f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {}, {0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0x818, 0x2, [@TCA_FW_POLICE={0x814, 0x2, [@TCA_POLICE_AVRATE={0x8, 0x4, 0x5}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x401, 0xe, 0x80000001, 0x8, 0x200, 0x6, 0x8, 0x4, 0x10200000, 0x4, 0x3, 0x9, 0x3, 0xffffffff, 0xb, 0x9, 0x4, 0xd4ae, 0x5, 0x300000, 0xe1b5, 0xc5b, 0x6, 0x4, 0x9, 0x6, 0x9, 0x8, 0x3, 0x9, 0xd, 0x7f, 0x7, 0xce0, 0x1ff, 0x6, 0x8006, 0x41, 0xff, 0x800, 0xfff, 0x7, 0x9, 0xd, 0x4, 0xffffff1f, 0xa, 0xc, 0x8, 0xfffffffa, 0x155, 0x7, 0x0, 0x18000, 0xc, 0x9, 0x40000, 0x101, 0x6, 0x3ff, 0x1, 0x3, 0x7554, 0x2, 0x4, 0x1, 0x4, 0xd, 0x8000, 0xff, 0x0, 0xeac2, 0x87, 0x3, 0xfe000000, 0x3, 0x8001, 0xff, 0xffff1cac, 0x2892, 0x6, 0x8c5e, 0x1, 0x5, 0xffffffff, 0x80, 0xffffffac, 0x3, 0xff1, 0x2, 0x2, 0x8, 0x2, 0x1, 0x8, 0x8, 0xfff, 0x80000001, 0x9, 0x8, 0x0, 0x8, 0x487, 0x6, 0x8, 0x1000, 0x1ff800, 0x6, 0xfffffffe, 0x3c78, 0xfa1, 0x3, 0x6, 0x9, 0xffffffff, 0x80000002, 0x2, 0xda, 0x9, 0x401, 0x6, 0x7, 0x2, 0x2, 0xe, 0x835, 0x4, 0x3, 0x6cc7, 0x6, 0x8, 0x8, 0x400, 0x8, 0x4, 0x3, 0x5, 0x5, 0x0, 0x9, 0x400, 0x3, 0x0, 0x4cc, 0xb, 0x0, 0xce, 0x6, 0x0, 0xc8, 0x4, 0x5, 0xc38, 0x1ff, 0x0, 0x968, 0x5, 0x68cff086, 0x2, 0xfff, 0x2, 0x7ff, 0x1000, 0x80000001, 0x9, 0x9, 0x0, 0x8001, 0x1000, 0x8b7f, 0xfe, 0x56, 0x8, 0x7, 0x8000000, 0x0, 0x7fff, 0xfffffffd, 0x5, 0x815d, 0x5, 0x44, 0x4, 0x6, 0x3, 0x1, 0x8, 0x0, 0x7ff, 0x3, 0x8, 0x1, 0x2, 0x800, 0x7, 0x5, 0x10, 0xfffffff7, 0x8, 0x40, 0x1, 0x10001, 0x1000, 0xe42c, 0x1, 0x101, 0x6, 0x8, 0x4, 0x9a14, 0x4, 0x81, 0x7, 0x0, 0x8, 0x8, 0xfffffffa, 0x0, 0x30000, 0x7ff, 0x4, 0x3, 0xd, 0x5, 0x0, 0xfff, 0x3, 0x7b0, 0x7, 0x9, 0xffff, 0x5, 0xff, 0x4, 0x0, 0x4, 0x9, 0x6, 0x100, 0x81, 0x0, 0x7fc, 0x2, 0x5, 0x80, 0x2, 0xe, 0x1, 0x40, 0x1ff, 0x3, 0x380, 0x6, 0x7, 0x8, 0xfffffffb]}, @TCA_POLICE_RATE={0x404, 0x2, [0x4, 0x7, 0x8, 0x7, 0xffff, 0x2, 0x3, 0x7fff, 0x8, 0x0, 0x401, 0x4, 0x0, 0xf7b1, 0xa, 0x40, 0x200, 0x0, 0x1, 0x9, 0x9, 0x8, 0xbf2, 0x1, 0xffff9374, 0x9, 0x1, 0x5, 0x3ff, 0x3, 0x6, 0x5, 0x2, 0x7, 0xe, 0x5, 0x4, 0x9, 0x8, 0xf0, 0x5, 0x8000, 0x0, 0x7, 0xff, 0x2, 0x2, 0x400, 0x0, 0x5, 0x2, 0x401, 0x100, 0xf30, 0x8001, 0x9, 0x370, 0x3, 0x1, 0xfffffff9, 0x9, 0x3, 0x5, 0xb9b, 0x1, 0x5, 0x0, 0x4, 0x7, 0x6, 0x3ff, 0x3, 0x6, 0x76, 0x9, 0xffff, 0x8, 0xd, 0x80, 0x4, 0x9, 0x7ff, 0x7, 0x9, 0x6, 0x7f, 0x9, 0x7ff, 0x3, 0x8, 0x31, 0x1, 0x2d, 0x0, 0xf02, 0x15200, 0xa, 0x1, 0xe148, 0x7, 0x1, 0x3, 0x9, 0x6, 0xb, 0xfffffffa, 0x4, 0xdf, 0x80000000, 0x8001, 0x2, 0x3, 0x2971010e, 0x3b655406, 0x1, 0x8, 0x6, 0x6, 0x4, 0x4, 0x8, 0x80000001, 0x5dd, 0x2d3, 0x7, 0x8, 0x5, 0x79d5, 0x2, 0x800, 0x8d, 0x1, 0x2, 0x1, 0x5, 0x6, 0x338, 0x6, 0x2, 0x4, 0x1, 0x3, 0x0, 0x0, 0x8, 0x1, 0x3ff, 0x8, 0x56, 0x7, 0x401, 0x7, 0x0, 0x0, 0x0, 0xda, 0x5, 0x42, 0x18, 0xfffffff7, 0x5, 0xed2, 0x7, 0x211, 0x0, 0x2, 0xc9, 0x3, 0x8, 0x1, 0x9, 0x58, 0x8, 0x5e5, 0x5, 0x3, 0xfffffffb, 0x3, 0xff, 0x6, 0x10, 0xf7ee907a, 0xff, 0xc9, 0x9, 0x0, 0x400, 0x0, 0x7, 0x6, 0x9, 0x8, 0x8, 0x0, 0x0, 0x7, 0x0, 0x4, 0x7, 0x2, 0x3, 0x9, 0x9, 0x0, 0x7, 0x4, 0x0, 0x4, 0x4, 0x4, 0x6f3, 0x6, 0x10, 0x0, 0x7, 0xfffffff9, 0xfffffffa, 0x9, 0x53a, 0x8, 0x1, 0x4, 0xb, 0x8, 0xfffffff9, 0x400, 0x461, 0x81, 0x8, 0x101, 0x7ff, 0x2, 0x8000, 0x7, 0x4, 0xba95, 0x4, 0x4706, 0x7ff, 0x4, 0xffffffff, 0xf7b1, 0x3, 0x2, 0x5, 0x9, 0x1fffc, 0x80000000, 0x2008001, 0x9, 0x4, 0x3, 0x3, 0x6, 0xce, 0x8]}]}]}}]}, 0x844}, 0x1, 0x0, 0x0, 0x20000001}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000240)=ANY=[@ANYBLOB="180300000005000000000000000000001801000011af000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000d5030000020000838500000071000000180100002020752500000000806020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000400000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x2b, 0x1, 0x1) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000080)=ANY=[], 0x3261e) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r1, 0x8983, &(0x7f0000000000)={0x2, 'syzkaller0\x00', {0x1}, 0x89}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) unshare(0x10000000) setsockopt$IPT_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000e00)=@raw={'raw\x00', 0x9, 0x3, 0x1c8, 0x0, 0xffffffff, 0xffffffff, 0x98, 0xffffffff, 0x130, 0xffffffff, 0xffffffff, 0x130, 0xffffffff, 0x3, 0x0, {[{{@ip={@broadcast, @multicast2, 0xffffff00, 0x0, 'vcan0\x00', 'vlan0\x00', {}, {0xff}, 0x8, 0x2bbe86e5b28b8fc5, 0x30}, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0x4081}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x15, 0xa1, 0xfff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x228) socket$nl_route(0x10, 0x3, 0x0) 4.310101ms ago: executing program 0 (id=5598): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x1e, 0x4, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_GET_ADDR(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)={0x30, r3, 0x1, 0x70bd2a, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @broadcast}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x24040001}, 0x40000) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) r6 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000300)={'rose0\x00', 0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2000000011000100000002000006000000000000", @ANYRES32=r7], 0x20}}, 0x4000) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000480)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x94, r3, 0xf0c, 0x70bd29, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x14, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}]}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r5}]}, @MPTCP_PM_ATTR_ADDR={0x40, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e20}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r7}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x800}, 0x1) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x18, &(0x7f0000000080)={&(0x7f00000003c0)=@newlink={0x54, 0x10, 0x401, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x9}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x7, @loopback={0xff00}}]}}}, @IFLA_TXQLEN={0x8, 0xd, 0x20000006}]}, 0x54}}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000800)={'bridge0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="3000000070000100000000000000000007000000", @ANYRES32=r11, @ANYBLOB="0c00018008000100000001000c0002"], 0x30}, 0x1, 0x0, 0x0, 0x44}, 0x0) r12 = socket(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000500)="513cfac6d9d898d593724f1eb6374e56523f31a9f65d8dbf4b59aea02a4917452aec13e503c8cf2f8687444a99c2c75f96b8a93523161362c43e58b56df376323d2c2f42bb603396ceabb0d5e5e85780e3d02dc813d272323e292bdb90d8ae56e7255603c81feba56a0732673a3ba0514e31ac9d37c10c837e24b08866e7a79568a88afbf0a62dce87fe891b684140d1ce80e98e530f817bb49776b5cd4ede7b0249cf52cb08ee843e1c567807c8daf1d8247370589f4e6058b1a08ec40ca86fc1613f82796f2e57313c5e392aad33ee74e74ddcac3dadf756f70a4ce939", 0xde}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000c00)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf20000000000000070000000f0000003d030100000000009500ffb1000000006926000000000000bf67000000000000150002000fff52e84407000009300000240600000ee60000bf050000000000001c63000000000000650700000200000007070000fbffffff1f75000000000000bf54000000000000070400000410f900bd430100000000009500000000000000050000000000000095000000000000001c15a3ce747c693a74b62fd0758b15f09429c09074bc4b2bd2dc480dd7a064b8673e2060162cc43bcba1060999eef9d60bb39d0af449deaa27ea949e8f9000d885deea2783835e29eba8546fc020c1966f8b5f32b095f566edf66b7751828da9dbd5b996b9e8d897e461c01c697671d100000000400036c17fb01dde179c1f2686ee970d6482a2e71a55d6ebe700b3be005e47ef55e0dd81244b18590e000000000000356d82e43407a6d7fa94b21002f06cd247b126b6349ab62d7b07ba0a71a72145edade9941f49f300a8c8913e0e4ea9e4c77740ab3312edee62a4dc2fc85755d387bfa1bc9b49da28724ba9cd79fbee8f97af876d0e30c19555ffdd7d73815b459f4763c6222175c974be2f76fb5f330b015a68587a75c013000000000000000000000003000000000000d6ddc46e58eff8f4fbadfc6a3af8123b7f42407107000cdc9d7820c4eb67cc0f8b5fe9258eeacb5776aebbab3d5c55020000006082778366dadfc36029633e0514cbcee1f3928970bde148c940434f33acd377cbad17673b2d30b6339255c98eba97efb4e9ac1f11be815dd6045592edcbee7f253ec74c7c1313505bd7ff8fd58b3a6569c91dbdef1df585aeaea7346a2a65caee5c85f9eddeeeee3c8a2e523c864ac430eb47cb4d0c8767b9d4125661b5a1a170c04b64da3a99ddb93bf14fae3ca2d1e882375b8dbac83978e136c34f90b33cc0eeb57debcfe26589efc08124d5d62a7e593c9738a50171adf051ea4f07e7e7e770c2016eeacbe8511afffffbea75759a1ea5404f5453c0b5c46c9700808c096cf8cf5223f341cb003841b5cd224c1b381d56afebe9f99a00e3cd94dc0bb7af9e8709db487cc4d9b3b96723d69d512ddd57b0dee9b9f6ae80a502cce352098603e75414c91fce6c86287945bd8d258442760000ff010000000000000000000000300807f2f3906c1d45d05ba9df828d35376fed399fa311ff63a34f0c0b82b4f2825e729eb9b7f4c9ab3be5bc011ff29904bbc424880247fabe7325a6e8d139e99d2b2fbf7e84fca3b21c78840b858ce900a4eb9c2b8b9b7fb664d2aeac991ca09b1afc0ef7aed4541a2f7275130a9fa3853481c81e919c000000000000000000000000b1e0e4b55e0d5d8c657b4853fc18ec43be33e5f971cceda04d95c87489910ce692ee55c536d1671bffd4c9b98efb741b13f0ab26ac191c74"], &(0x7f0000000100)='GPL\x00'}, 0x48) setsockopt$netlink_NETLINK_TX_RING(r12, 0x10e, 0xc, &(0x7f0000000380)={0x29e9c931, 0x3, 0x0, 0x4}, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000010c0)=ANY=[@ANYBLOB="200000001600010a00000000000000000a0000000c0000800800", @ANYRES16=r12], 0x20}, 0x1, 0x0, 0x0, 0x200c0801}, 0x0) 0s ago: executing program 2 (id=5599): r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x8, 0x4000, 0x8000}, 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, r3, 0x1, 0x0, 0x0, {0x7}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_FD={0x8}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) write(r0, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0xfdef) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="9feb0100180000000000000024000000240000000a0000000000000000000002000000000040000001000084080000000600000001000000030000000000000000002e000000"], &(0x7f0000000380)=""/3, 0x46, 0x3, 0x1}, 0x20) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="1c0000005e000100000000000000000002000000", @ANYRES32=r6, @ANYRES32=r5], 0x1c}}, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x1c, 0x25, 0x301, 0x670bd28, 0x25dfdbfe, {0x11}, [@nested={0x8, 0x131, 0x0, 0x1, [@typed={0x4, 0xa0, 0x0, 0x0, @binary}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x5}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x14, 0x3, 0x1, 0x301, 0x0, 0x0, {0x0, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x840) bind$alg(r4, &(0x7f0000000040)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(generic-gcm-aesni)\x00'}, 0x58) kernel console output (not intermixed with test programs): 0 [ 535.561638][T20448] ? ksys_write+0x1e6/0x270 [ 535.561659][T20448] ? __pfx_sk_setsockopt+0x10/0x10 [ 535.561680][T20448] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 535.561703][T20448] ? __pfx_vfs_write+0x10/0x10 [ 535.561725][T20448] ? __fget_files+0x2a/0x420 [ 535.561751][T20448] ? __fget_files+0x2a/0x420 [ 535.561766][T20448] ? aa_sock_opt_perm+0xd4/0x1a0 [ 535.561788][T20448] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 535.561811][T20448] do_sock_setsockopt+0x11b/0x1b0 [ 535.561838][T20448] __x64_sys_setsockopt+0x13d/0x1b0 [ 535.561862][T20448] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.561879][T20448] do_syscall_64+0x15f/0xf80 [ 535.561900][T20448] ? trace_irq_disable+0x3b/0x140 [ 535.561929][T20448] ? clear_bhb_loop+0x40/0x90 [ 535.561947][T20448] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 535.561963][T20448] RIP: 0033:0x7f437d79ce59 [ 535.561979][T20448] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 535.561992][T20448] RSP: 002b:00007f437e5ad028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 535.562010][T20448] RAX: ffffffffffffffda RBX: 00007f437da15fa0 RCX: 00007f437d79ce59 [ 535.562020][T20448] RDX: 000000000000001a RSI: 0000000000000001 RDI: 0000000000000003 [ 535.562030][T20448] RBP: 00007f437e5ad090 R08: 0000000000000010 R09: 0000000000000000 [ 535.562039][T20448] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 535.562048][T20448] R13: 00007f437da16038 R14: 00007f437da15fa0 R15: 00007ffe687b3418 [ 535.562073][T20448] [ 535.879067][T20454] netlink: 4560 bytes leftover after parsing attributes in process `syz.0.3736'. [ 535.931587][T20465] vxcan0: tx address claim with different name [ 536.112900][T20474] netlink: 'syz.3.3743': attribute type 61 has an invalid length. [ 536.188075][T20477] syzkaller1: entered promiscuous mode [ 536.200723][T20477] syzkaller1: entered allmulticast mode [ 536.225076][T20475] lo speed is unknown, defaulting to 1000 [ 536.479925][T20498] tc_dump_action: action bad kind [ 536.505116][T20498] ip6gre1: entered promiscuous mode [ 536.884768][T20481] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3741'. [ 537.026624][T20529] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3759'. [ 537.217331][T20542] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 537.652472][T20568] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3769'. [ 537.753124][T20573] netlink: 'syz.1.3771': attribute type 1 has an invalid length. [ 537.787204][T20573] netlink: 'syz.1.3771': attribute type 2 has an invalid length. [ 537.818381][T20573] netlink: 'syz.1.3771': attribute type 1 has an invalid length. [ 537.859986][T20578] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 537.889034][T20573] netlink: 'syz.1.3771': attribute type 3 has an invalid length. [ 537.916887][T20573] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3771'. [ 537.980799][T20585] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3770'. [ 538.140518][T20590] sctp: [Deprecated]: syz.2.3774 (pid 20590) Use of int in max_burst socket option. [ 538.140518][T20590] Use struct sctp_assoc_value instead [ 538.856493][T20585] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 538.912892][T20585] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 538.940706][T20607] syz_tun: entered allmulticast mode [ 539.207139][T20618] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3781'. [ 539.301449][ T6482] IPVS: starting estimator thread 0... [ 539.318529][T20631] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3781'. [ 539.394309][T20630] IPVS: using max 28 ests per chain, 67200 per kthread [ 539.509230][T20642] netlink: 248 bytes leftover after parsing attributes in process `syz.3.3789'. [ 539.694675][T20651] netlink: 'syz.3.3792': attribute type 1 has an invalid length. [ 539.774031][T20651] 8021q: adding VLAN 0 to HW filter on device bond8 [ 539.784972][T20651] bond7: (slave bond8): making interface the new active one [ 539.809471][T20651] bond7: (slave bond8): Enslaving as an active interface with an up link [ 539.852936][T20658] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3793'. [ 539.879167][T20658] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3793'. [ 539.913675][T20658] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3793'. [ 539.923140][T20658] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3793'. [ 540.115559][T20654] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3793'. [ 540.138196][T20672] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3796'. [ 540.154491][T20654] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3793'. [ 540.331788][T20681] syzkaller1: entered promiscuous mode [ 540.358799][T20681] syzkaller1: entered allmulticast mode [ 562.744204][ C0] ip6_tunnel: ip6tnl4 xmit: Local address not yet configured! [ 562.754139][ T1314] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 566.459988][T20737] __nla_validate_parse: 2 callbacks suppressed [ 566.460005][T20737] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3813'. [ 566.529707][T20744] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3814'. [ 566.636043][T20749] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3818'. [ 566.772270][T20761] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3823'. [ 566.800886][T20761] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3823'. [ 566.995594][T20783] netlink: 240 bytes leftover after parsing attributes in process `syz.3.3823'. [ 567.191538][T20789] geneve3: entered promiscuous mode [ 567.198780][ T6084] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 35306 - 0 [ 567.221228][ T6084] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 35306 - 0 [ 567.235975][ T6084] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 35306 - 0 [ 567.248244][T20791] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3831'. [ 567.261233][ T6084] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 35306 - 0 [ 567.342311][T20791] lo speed is unknown, defaulting to 1000 [ 567.365983][T20798] netlink: 'syz.1.3832': attribute type 1 has an invalid length. [ 567.391492][T20801] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3833'. [ 567.400712][T20801] netlink: 'syz.3.3833': attribute type 5 has an invalid length. [ 567.408910][T20801] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3833'. [ 567.410974][T20798] 8021q: adding VLAN 0 to HW filter on device bond3 [ 567.435253][T20801] geneve4: entered promiscuous mode [ 567.445622][T20801] geneve4: entered allmulticast mode [ 567.455450][ T6084] netdevsim netdevsim3 eth0: set [1, 2] type 2 family 0 port 256 - 0 [ 567.476266][ T6084] netdevsim netdevsim3 eth1: set [1, 2] type 2 family 0 port 256 - 0 [ 567.492225][ T6084] netdevsim netdevsim3 eth2: set [1, 2] type 2 family 0 port 256 - 0 [ 567.505078][ T6084] netdevsim netdevsim3 eth3: set [1, 2] type 2 family 0 port 256 - 0 [ 567.561234][T20804] netlink: 'syz.3.3834': attribute type 3 has an invalid length. [ 567.569849][T20804] netlink: 'syz.3.3834': attribute type 3 has an invalid length. [ 567.581936][T20804] netlink: 'syz.3.3834': attribute type 3 has an invalid length. [ 567.600549][T20804] netlink: 'syz.3.3834': attribute type 3 has an invalid length. [ 567.614107][T20806] netlink: 'syz.2.3835': attribute type 1 has an invalid length. [ 567.762026][T20814] netlink: 156 bytes leftover after parsing attributes in process `syz.2.3838'. [ 567.779705][T20809] lo speed is unknown, defaulting to 1000 [ 567.858673][T20822] netlink: 'syz.1.3839': attribute type 1 has an invalid length. [ 568.627212][T20853] 8021q: adding VLAN 0 to HW filter on device bond9 [ 568.749568][T20864] veth1_to_hsr: entered allmulticast mode [ 571.409171][T20986] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 64993 [ 571.557815][T20988] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 571.568133][T20988] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.580636][T20988] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 35306 - 0 [ 571.591093][T20988] netdevsim netdevsim3 eth3 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 571.734442][T20988] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 571.779749][T20988] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 571.817137][T20988] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 35306 - 0 [ 571.834492][T20988] netdevsim netdevsim3 eth2 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 571.937328][T21000] netlink: 'syz.2.3888': attribute type 2 has an invalid length. [ 571.981529][T21000] netlink: 'syz.2.3888': attribute type 1 has an invalid length. [ 572.011860][T21000] __nla_validate_parse: 10 callbacks suppressed [ 572.011875][T21000] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3888'. [ 572.056057][T21003] FAULT_INJECTION: forcing a failure. [ 572.056057][T21003] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 572.108303][T21003] CPU: 1 UID: 0 PID: 21003 Comm: syz.1.3889 Not tainted syzkaller #0 PREEMPT(full) [ 572.108326][T21003] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 572.108338][T21003] Call Trace: [ 572.108345][T21003] [ 572.108352][T21003] dump_stack_lvl+0xe8/0x150 [ 572.108376][T21003] should_fail_ex+0x412/0x560 [ 572.108401][T21003] _copy_from_user+0x2d/0xb0 [ 572.108425][T21003] __copy_msghdr+0x3c5/0x5b0 [ 572.108444][T21003] ___sys_sendmsg+0x213/0x360 [ 572.108459][T21003] ? __lock_acquire+0x6b5/0x2cf0 [ 572.108480][T21003] ? __pfx____sys_sendmsg+0x10/0x10 [ 572.108528][T21003] ? __fget_files+0x2a/0x420 [ 572.108546][T21003] ? __fget_files+0x3a0/0x420 [ 572.108572][T21003] __x64_sys_sendmsg+0x1bd/0x2a0 [ 572.108591][T21003] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 572.108614][T21003] ? __pfx_ksys_write+0x10/0x10 [ 572.108644][T21003] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 572.108661][T21003] do_syscall_64+0x15f/0xf80 [ 572.108682][T21003] ? trace_irq_disable+0x3b/0x140 [ 572.108704][T21003] ? clear_bhb_loop+0x40/0x90 [ 572.108723][T21003] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 572.108739][T21003] RIP: 0033:0x7fa0dd79ce59 [ 572.108753][T21003] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 572.108766][T21003] RSP: 002b:00007fa0de5bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 572.108783][T21003] RAX: ffffffffffffffda RBX: 00007fa0dda15fa0 RCX: 00007fa0dd79ce59 [ 572.108794][T21003] RDX: 0000000000000080 RSI: 0000200000003000 RDI: 0000000000000003 [ 572.108804][T21003] RBP: 00007fa0de5bf090 R08: 0000000000000000 R09: 0000000000000000 [ 572.108814][T21003] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 572.108823][T21003] R13: 00007fa0dda16038 R14: 00007fa0dda15fa0 R15: 00007ffd1e3e7968 [ 572.108850][T21003] [ 572.395300][T20988] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 572.420678][T20988] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.456983][T20988] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 35306 - 0 [ 572.475083][T21009] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3890'. [ 572.502563][T20988] netdevsim netdevsim3 eth1 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 572.811017][T20988] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 572.835226][T21025] netlink: 'syz.4.3893': attribute type 11 has an invalid length. [ 572.841655][T20988] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 572.876390][T20988] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 35306 - 0 [ 572.886371][T20988] netdevsim netdevsim3 eth0 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 572.954977][T21002] syzkaller0: entered promiscuous mode [ 572.960552][T21002] syzkaller0: entered allmulticast mode [ 573.927973][T20952] Set syz1 is full, maxelem 65536 reached [ 574.171244][T21037] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3895'. [ 575.585463][ T48] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 575.606764][ T48] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 575.628687][ T48] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 35306 - 0 [ 575.637948][ T48] netdevsim netdevsim3 eth0: set [1, 2] type 2 family 0 port 6081 - 0 [ 575.658118][ T48] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 575.667409][ T48] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 575.676199][ T48] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 35306 - 0 [ 575.685682][ T48] netdevsim netdevsim3 eth1: set [1, 2] type 2 family 0 port 6081 - 0 [ 575.718434][ T48] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 575.733391][ T48] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 575.737402][T21041] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3897'. [ 575.750332][ T48] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 35306 - 0 [ 575.765365][ T48] netdevsim netdevsim3 eth2: set [1, 2] type 2 family 0 port 6081 - 0 [ 575.851044][T21060] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3897'. [ 575.879006][T21061] netlink: 'syz.4.3901': attribute type 25 has an invalid length. [ 575.890026][ T12] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 575.905940][T21061] netlink: 'syz.4.3901': attribute type 3 has an invalid length. [ 575.911257][T21041] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3897'. [ 575.924001][ T12] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 575.933844][ T12] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 35306 - 0 [ 575.941318][T21061] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3901'. [ 575.942202][ T12] netdevsim netdevsim3 eth3: set [1, 2] type 2 family 0 port 6081 - 0 [ 576.158657][T21081] netlink: 'syz.2.3907': attribute type 10 has an invalid length. [ 576.199076][T21081] team0: Port device dummy0 added [ 576.242219][T21087] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3908'. [ 576.312411][T21098] netlink: 212360 bytes leftover after parsing attributes in process `syz.1.3909'. [ 576.590080][T21113] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3916'. [ 576.927706][T21140] ipip0: entered promiscuous mode [ 577.086158][T21156] __nla_validate_parse: 1 callbacks suppressed [ 577.086176][T21156] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3927'. [ 577.157434][T21162] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3928'. [ 577.219977][T21166] syzkaller1: entered promiscuous mode [ 577.248187][T21166] syzkaller1: entered allmulticast mode [ 577.618723][T21189] dvmrp0: entered allmulticast mode [ 577.720998][T21175] lo speed is unknown, defaulting to 1000 [ 577.828353][T21202] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3937'. [ 577.838928][T21198] sctp: [Deprecated]: syz.4.3936 (pid 21198) Use of int in maxseg socket option. [ 577.838928][T21198] Use struct sctp_assoc_value instead [ 577.968191][T21206] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 577.990753][ T6482] team_slave_0: entered promiscuous mode [ 577.998296][ T6482] team_slave_1: entered promiscuous mode [ 578.060321][T21207] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 578.151489][T21209] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3939'. [ 578.290832][T21214] FAULT_INJECTION: forcing a failure. [ 578.290832][T21214] name failslab, interval 1, probability 0, space 0, times 0 [ 578.313920][T21214] CPU: 1 UID: 0 PID: 21214 Comm: syz.0.3941 Not tainted syzkaller #0 PREEMPT(full) [ 578.313952][T21214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 578.313961][T21214] Call Trace: [ 578.313968][T21214] [ 578.313974][T21214] dump_stack_lvl+0xe8/0x150 [ 578.313999][T21214] should_fail_ex+0x412/0x560 [ 578.314024][T21214] should_failslab+0xa8/0x100 [ 578.314047][T21214] ? skb_clone+0x212/0x3a0 [ 578.314063][T21214] kmem_cache_alloc_noprof+0x87/0x650 [ 578.314091][T21214] skb_clone+0x212/0x3a0 [ 578.314111][T21214] __netlink_deliver_tap+0x404/0x850 [ 578.314139][T21214] ? netlink_deliver_tap+0x2e/0x1b0 [ 578.314157][T21214] netlink_deliver_tap+0x19c/0x1b0 [ 578.314174][T21214] netlink_sendskb+0x68/0x140 [ 578.314199][T21214] netlink_rcv_skb+0x2b6/0x4b0 [ 578.314215][T21214] ? __pfx_genl_rcv_msg+0x10/0x10 [ 578.314236][T21214] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 578.314267][T21214] ? down_read+0x270/0x2e0 [ 578.314281][T21214] ? genl_rcv+0xd/0x40 [ 578.314301][T21214] genl_rcv+0x28/0x40 [ 578.314318][T21214] netlink_unicast+0x75c/0x8e0 [ 578.314350][T21214] netlink_sendmsg+0x813/0xb40 [ 578.314376][T21214] ? __pfx_netlink_sendmsg+0x10/0x10 [ 578.314395][T21214] ? aa_sock_msg_perm+0xf1/0x1b0 [ 578.314417][T21214] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 578.314441][T21214] ____sys_sendmsg+0x972/0x9f0 [ 578.314466][T21214] ? __pfx_____sys_sendmsg+0x10/0x10 [ 578.314490][T21214] ? import_iovec+0x73/0xa0 [ 578.314516][T21214] ___sys_sendmsg+0x2a5/0x360 [ 578.314528][T21214] ? __lock_acquire+0x6b5/0x2cf0 [ 578.314548][T21214] ? __pfx____sys_sendmsg+0x10/0x10 [ 578.314596][T21214] ? __fget_files+0x2a/0x420 [ 578.314615][T21214] ? __fget_files+0x3a0/0x420 [ 578.314642][T21214] __x64_sys_sendmsg+0x1bd/0x2a0 [ 578.314661][T21214] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 578.314685][T21214] ? __pfx_ksys_write+0x10/0x10 [ 578.314715][T21214] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.314732][T21214] do_syscall_64+0x15f/0xf80 [ 578.314754][T21214] ? trace_irq_disable+0x3b/0x140 [ 578.314776][T21214] ? clear_bhb_loop+0x40/0x90 [ 578.314798][T21214] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.314813][T21214] RIP: 0033:0x7f0c8f79ce59 [ 578.314829][T21214] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 578.314842][T21214] RSP: 002b:00007f0c90666028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 578.314859][T21214] RAX: ffffffffffffffda RBX: 00007f0c8fa15fa0 RCX: 00007f0c8f79ce59 [ 578.314870][T21214] RDX: 0000000000000080 RSI: 0000200000003000 RDI: 0000000000000003 [ 578.314879][T21214] RBP: 00007f0c90666090 R08: 0000000000000000 R09: 0000000000000000 [ 578.314889][T21214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 578.314898][T21214] R13: 00007f0c8fa16038 R14: 00007f0c8fa15fa0 R15: 00007ffca1822318 [ 578.314933][T21214] [ 578.343586][T21218] netlink: 'syz.1.3942': attribute type 1 has an invalid length. [ 578.548686][T21226] netlink: 6024 bytes leftover after parsing attributes in process `syz.0.3944'. [ 578.630607][T21218] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3942'. [ 578.667739][T21230] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3943'. [ 578.940973][T21234] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3945'. [ 578.998521][T21240] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3945'. [ 579.045793][T21237] lo speed is unknown, defaulting to 1000 [ 579.301894][T21246] syzkaller1: entered promiscuous mode [ 579.326059][T21246] syzkaller1: entered allmulticast mode [ 579.332158][T21250] netlink: 'syz.0.3950': attribute type 8 has an invalid length. [ 579.569161][T21264] netlink: 180 bytes leftover after parsing attributes in process `syz.3.3952'. [ 579.737753][T21280] netlink: zone id is out of range [ 579.743058][T21280] netlink: zone id is out of range [ 579.750048][T21280] netlink: zone id is out of range [ 579.755387][T21280] netlink: zone id is out of range [ 579.761001][T21280] netlink: zone id is out of range [ 579.767382][T21280] netlink: zone id is out of range [ 579.779163][T21280] netlink: zone id is out of range [ 579.797927][T21280] netlink: zone id is out of range [ 579.815026][T21280] netlink: zone id is out of range [ 579.825426][T21280] netlink: zone id is out of range [ 579.921743][T21293] netlink: 'syz.2.3961': attribute type 13 has an invalid length. [ 579.940769][ T6084] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 579.942478][T21293] netlink: 'syz.2.3961': attribute type 13 has an invalid length. [ 579.979398][ T6084] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 580.011687][T21294] gretap0: entered allmulticast mode [ 580.029094][ T6084] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 580.061150][ T6084] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 580.152460][T21292] vti0: entered promiscuous mode [ 580.487456][T21308] 8021q: adding VLAN 0 to HW filter on device bond2 [ 580.581291][T21320] Bluetooth: MGMT ver 1.23 [ 580.588521][T21315] lo speed is unknown, defaulting to 1000 [ 580.820488][T21325] syz_tun: entered allmulticast mode [ 580.853868][T21328] netlink: 'syz.1.3971': attribute type 1 has an invalid length. [ 580.916776][T21328] bond4: entered promiscuous mode [ 580.922329][T21328] 8021q: adding VLAN 0 to HW filter on device bond4 [ 580.997023][T21333] xt_hashlimit: size too large, truncated to 1048576 [ 581.582798][T21367] netlink: 'syz.3.3981': attribute type 25 has an invalid length. [ 581.612465][T21367] netlink: 'syz.3.3981': attribute type 3 has an invalid length. [ 582.094038][T21392] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 582.109438][T21394] __nla_validate_parse: 11 callbacks suppressed [ 582.109454][T21394] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3990'. [ 582.333913][T21408] syzkaller0: left promiscuous mode [ 582.341389][T21408] syzkaller0: left allmulticast mode [ 582.354844][T21406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3995'. [ 582.407124][T21406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3995'. [ 582.430602][T21406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3995'. [ 582.457862][T21410] ipt_REJECT: TCP_RESET invalid for non-tcp [ 582.489518][T21406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3995'. [ 582.499856][T21418] netlink: 100 bytes leftover after parsing attributes in process `syz.0.3998'. [ 582.510315][T21406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3995'. [ 582.537823][T21420] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3999'. [ 582.575250][T21420] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 582.585958][T21420] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3999'. [ 582.711708][T21430] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 582.732468][T21430] syzkaller1: linktype set to 825 [ 583.336184][T21440] lo speed is unknown, defaulting to 1000 [ 583.636535][T21459] syz_tun: entered promiscuous mode [ 583.652314][T21459] macvtap1: entered promiscuous mode [ 583.681613][T21459] syz_tun: left promiscuous mode [ 584.538630][T21495] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4021'. [ 584.561998][T21496] bridge0: port 1(bridge_slave_0) entered disabled state [ 584.643492][T21496] bridge_slave_0 (unregistering): left allmulticast mode [ 584.653512][T21496] bridge_slave_0 (unregistering): left promiscuous mode [ 584.660638][T21496] bridge0: port 1(bridge_slave_0) entered disabled state [ 584.905433][T21501] geneve3: entered promiscuous mode [ 584.910781][T21501] geneve3: entered allmulticast mode [ 586.131617][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b57d000: rx timeout, send abort [ 586.428422][T21556] bond4: (slave bond_slave_1): Device is not our slave [ 586.435638][T21556] bond4: option active_slave: invalid value (bond_slave_1) [ 586.445512][T21556] bond4 (unregistering): Released all slaves [ 586.501651][T21551] syzkaller1: entered promiscuous mode [ 586.514436][T21551] syzkaller1: entered allmulticast mode [ 586.631834][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b57d400: rx timeout, send abort [ 586.642425][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b57d000: abort rx timeout. Force session deactivation [ 586.681205][T21563] ip6erspan0: entered promiscuous mode [ 586.695103][T21563] ip6erspan0: entered allmulticast mode [ 587.138414][T21579] __nla_validate_parse: 2 callbacks suppressed [ 587.138495][T21579] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4046'. [ 587.140095][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b57d400: abort rx timeout. Force session deactivation [ 587.150822][T21579] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4046'. [ 587.192534][T21579] netlink: 292 bytes leftover after parsing attributes in process `syz.0.4046'. [ 587.207571][T21579] netlink: 'syz.0.4046': attribute type 1 has an invalid length. [ 587.219543][T21581] x_tables: unsorted underflow at hook 4 [ 587.236852][T21579] netlink: 'syz.0.4046': attribute type 1 has an invalid length. [ 587.267866][T21579] netlink: 60 bytes leftover after parsing attributes in process `syz.0.4046'. [ 587.294743][T21579] netlink: 488 bytes leftover after parsing attributes in process `syz.0.4046'. [ 588.045781][T21601] netlink: 'syz.3.4054': attribute type 4 has an invalid length. [ 588.094460][T21601] netlink: 'syz.3.4054': attribute type 4 has an invalid length. [ 588.111758][T21605] bond0: Caught tx_queue_len zero misconfig [ 588.135487][T21605] bond0: entered promiscuous mode [ 588.146049][T21605] bond_slave_0: entered promiscuous mode [ 588.161294][T21605] bond_slave_1: entered promiscuous mode [ 588.201242][T21605] bond0: left promiscuous mode [ 588.212807][T21605] bond_slave_0: left promiscuous mode [ 588.239598][T21605] bond_slave_1: left promiscuous mode [ 588.359834][T21613] Unsupported ieee802154 address type: 0 [ 588.457332][T21630] tipc: Failed to remove unknown binding: 66,0,0/0:2706198725/2706198727 [ 588.474596][T21630] tipc: Failed to remove unknown binding: 66,0,0/0:2706198725/2706198726 [ 588.498606][T21630] tipc: Failed to remove unknown binding: 66,0,0/0:2706198725/2706198727 [ 588.512171][T21630] tipc: Failed to remove unknown binding: 66,0,0/0:2706198725/2706198726 [ 588.544846][T21636] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4058'. [ 588.584436][T21640] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4062'. [ 588.638593][T21623] syzkaller0: entered promiscuous mode [ 588.652360][T21643] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4064'. [ 588.666785][T21623] syzkaller0: entered allmulticast mode [ 588.684588][ T6078] net_ratelimit: 336 callbacks suppressed [ 588.684677][ T6078] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 588.868256][T21655] xt_limit: Overflow, try lower: 268435456/134217728 [ 589.740279][T21681] netlink: 27 bytes leftover after parsing attributes in process `syz.2.4074'. [ 589.777590][T21681] netlink: 'syz.2.4074': attribute type 1 has an invalid length. [ 589.875104][T21689] netlink: 'syz.3.4076': attribute type 1 has an invalid length. [ 589.950115][T21683] bond4 (unregistering): Released all slaves [ 590.032924][T21702] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4078'. [ 590.139198][T21697] 8021q: adding VLAN 0 to HW filter on device bond11 [ 590.175926][T21697] bond10: (slave bond11): making interface the new active one [ 590.206108][T21697] bond10: (slave bond11): Enslaving as an active interface with an up link [ 590.268498][T21702] hsr_slave_0: left promiscuous mode [ 590.292478][T21702] hsr_slave_1: left promiscuous mode [ 590.900338][T21757] netlink: 'syz.4.4093': attribute type 1 has an invalid length. [ 590.980231][T21757] bond3: entered promiscuous mode [ 590.987053][T21757] 8021q: adding VLAN 0 to HW filter on device bond3 [ 591.284827][T21786] pim6reg: entered allmulticast mode [ 591.311204][T21788] erspan1: entered promiscuous mode [ 591.320502][T21788] erspan1: entered allmulticast mode [ 591.328605][T21786] pim6reg: left allmulticast mode [ 591.824762][T21822] netlink: 'syz.0.4109': attribute type 58 has an invalid length. [ 591.967054][T21827] sctp: [Deprecated]: syz.4.4110 (pid 21827) Use of struct sctp_assoc_value in delayed_ack socket option. [ 591.967054][T21827] Use struct sctp_sack_info instead [ 592.165205][T21816] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 592.176674][T21816] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 592.198915][T21846] sock: sock_timestamping_bind_phc: sock not bind to device [ 592.209672][T21832] pim6reg0: tun_chr_ioctl cmd 1074025677 [ 592.218871][T21832] pim6reg0: linktype set to 780 [ 592.259666][T21829] tipc: Started in network mode [ 592.295503][T21829] tipc: Node identity 1eccc49442c6, cluster identity 4711 [ 592.323992][T21829] tipc: Enabled bearer , priority 0 [ 592.376144][T21851] netlink: 'syz.1.4116': attribute type 1 has an invalid length. [ 592.487565][T21864] __nla_validate_parse: 10 callbacks suppressed [ 592.487581][T21864] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4118'. [ 592.505614][T21864] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4118'. [ 592.547540][T21816] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 592.565120][T21816] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 592.631967][T21870] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.4121'. [ 592.638858][T21869] netlink: 16186 bytes leftover after parsing attributes in process `syz.1.4121'. [ 592.655396][T21864] 8021q: VLANs not supported on sit0 [ 592.827295][T21816] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 592.846527][T21816] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 592.940024][T21877] netlink: 'syz.1.4123': attribute type 8 has an invalid length. [ 593.179104][T21888] bridge0: port 2(bridge_slave_1) entered blocking state [ 593.186418][T21888] bridge0: port 2(bridge_slave_1) entered forwarding state [ 593.195234][T21888] bridge0: port 1(bridge_slave_0) entered blocking state [ 593.202392][T21888] bridge0: port 1(bridge_slave_0) entered forwarding state [ 593.366041][T21888] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 593.474181][T21816] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 593.493692][T21816] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.584873][ T6489] tipc: Node number set to 1544209556 [ 593.600325][T21914] netlink: 'syz.3.4132': attribute type 1 has an invalid length. [ 593.639058][ T6082] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 593.671048][ T6082] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 593.706501][ T6082] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 593.763913][ T6082] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 593.794044][T21921] netlink: 'syz.1.4135': attribute type 10 has an invalid length. [ 593.886984][T21921] team0: Port device veth1_to_hsr added [ 594.012096][T21930] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4138'. [ 594.040908][ T6078] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 594.055169][ T6078] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.117687][ T6082] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 594.127156][ T6082] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.145906][T21939] netlink: 'syz.0.4141': attribute type 8 has an invalid length. [ 594.167070][ T6082] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 594.175927][ T6082] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.192150][ T6082] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 594.202945][ T6082] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 594.290084][T21949] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4144'. [ 594.299922][T21949] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4144'. [ 594.310257][T21947] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.4143'. [ 594.343130][T21947] syzkaller1: entered promiscuous mode [ 594.352856][T21947] syzkaller1: entered allmulticast mode [ 594.899038][T21961] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4148'. [ 594.967116][T21969] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4148'. [ 594.985761][T21969] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 595.121900][T21977] tipc: Enabling of bearer rejected, failed to enable media [ 595.569663][T22000] lo speed is unknown, defaulting to 1000 [ 597.593743][T22083] __nla_validate_parse: 14 callbacks suppressed [ 597.593759][T22083] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4183'. [ 597.664709][T22087] tipc: Enabling of bearer rejected, failed to enable media [ 597.816167][T22100] ÿ: renamed from bond_slave_0 (while UP) [ 597.939108][T22105] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4189'. [ 597.954080][T22105] netlink: 112 bytes leftover after parsing attributes in process `syz.4.4189'. [ 598.008458][T22109] bridge0: port 4(batadv1) entered blocking state [ 598.020036][T22109] bridge0: port 4(batadv1) entered disabled state [ 598.027210][T22109] batadv1: entered allmulticast mode [ 598.034572][T22109] batadv1: entered promiscuous mode [ 598.129342][T22111] bridge0: port 1(veth0_virt_wifi) entered blocking state [ 598.136909][T22111] bridge0: port 1(veth0_virt_wifi) entered disabled state [ 598.145100][T22111] veth0_virt_wifi: entered allmulticast mode [ 598.152956][T22111] veth0_virt_wifi: entered promiscuous mode [ 598.172314][T22111] bridge0: port 1(veth0_virt_wifi) entered blocking state [ 598.179585][T22111] bridge0: port 1(veth0_virt_wifi) entered forwarding state [ 598.200870][T22120] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4195'. [ 598.346524][T22122] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.492595][T22141] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4195'. [ 598.501927][ T6084] batman_adv: batadv1: IGMP Querier appeared [ 598.509029][ T6084] batman_adv: batadv1: MLD Querier appeared [ 598.887634][T22139] bridge0: port 2(bridge_slave_1) entered disabled state [ 598.895738][T22139] bridge0: port 1(bridge_slave_0) entered disabled state [ 599.010627][ T5623] block nbd5: Receive control failed (result -32) [ 599.018374][ T5628] block nbd5: Receive control failed (result -32) [ 599.077066][T22171] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4203'. [ 599.438526][T22139] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 599.480072][T22139] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 599.744856][T22139] tipc: Resetting bearer [ 599.876345][T22139] batadv0: left allmulticast mode [ 599.957040][T22163] tipc: Started in network mode [ 599.962103][T22163] tipc: Node identity f271b90c7e5f, cluster identity 4711 [ 599.971729][T22163] tipc: Enabled bearer , priority 0 [ 599.985861][T22168] syzkaller0: entered promiscuous mode [ 599.991371][T22168] syzkaller0: entered allmulticast mode [ 600.000091][ T6078] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.008901][ T6078] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.072123][T22122] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.097185][ T6078] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.106936][ T6078] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.115447][ T6078] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.125538][ T6078] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.164458][ T6078] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 600.189359][ T6078] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.201893][T22181] tipc: Resetting bearer [ 600.239943][T22181] tipc: Disabling bearer [ 600.292316][T22122] team0: Port device netdevsim1 removed [ 600.318605][T22122] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.395453][T22195] A link change request failed with some changes committed already. Interface gre2 may have been left with an inconsistent configuration, please check. [ 600.412134][T22195] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4207'. [ 600.481673][T22122] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.730448][ T6078] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.781586][ T57] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.833696][T22231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4218'. [ 600.843457][T22231] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4218'. [ 600.852976][ T57] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.862574][ T57] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 600.875088][T22232] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4216'. [ 601.056739][T22242] 8021q: adding VLAN 0 to HW filter on device bond5 [ 601.067739][T22242] bond5: option mode: unable to set because the bond device is up [ 601.287533][T22265] xt_l2tp: unknown flags: 51 [ 601.304093][T22265] netlink: 'syz.1.4227': attribute type 16 has an invalid length. [ 601.520923][T22277] syzkaller0: entered promiscuous mode [ 601.526566][T22277] syzkaller0: entered allmulticast mode [ 601.717997][T22289] IPVS: set_ctl: invalid protocol: 233 127.0.0.1:20002 [ 601.984977][T22303] xt_hashlimit: size too large, truncated to 1048576 [ 603.946866][T22287] __nla_validate_parse: 4 callbacks suppressed [ 603.946883][T22287] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4233'. [ 603.962335][T22287] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4233'. [ 604.126803][T22331] tipc: Started in network mode [ 604.139025][T22331] tipc: Node identity ac14140f, cluster identity 4711 [ 604.148949][ T6084] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.156560][T22331] tipc: New replicast peer: 255.255.255.255 [ 604.157548][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.172045][T22331] tipc: Enabled bearer , priority 10 [ 604.180696][T22334] IPv6: NLM_F_CREATE should be specified when creating new route [ 604.188638][ T6084] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.191196][T22338] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4245'. [ 604.197236][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.240937][ T6084] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.249548][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.269726][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.278065][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.315569][ T6084] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.509506][T22356] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4252'. [ 604.550394][T22361] netlink: 'syz.4.4251': attribute type 32 has an invalid length. [ 604.567031][T22363] netlink: 'syz.4.4251': attribute type 32 has an invalid length. [ 604.888631][T22373] sch_tbf: burst 1 is lower than device syzkaller0 mtu (1514) ! [ 604.919845][T22366] syzkaller0: entered promiscuous mode [ 604.933677][T22366] syzkaller0: entered allmulticast mode [ 605.201857][T22379] geneve1: entered promiscuous mode [ 605.286243][ T5634] tipc: Node number set to 2886997007 [ 605.398420][T22389] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4260'. [ 605.520295][T22401] netlink: 'syz.4.4264': attribute type 4 has an invalid length. [ 605.546085][T22401] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4264'. [ 605.573807][T22401] netlink: 40 bytes leftover after parsing attributes in process `syz.4.4264'. [ 605.687117][T22401] ip6tnl1: entered allmulticast mode [ 605.772175][T22408] net_ratelimit: 5 callbacks suppressed [ 605.795481][T22408] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 605.826342][T22424] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.4270'. [ 605.826342][T22426] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.4270'. [ 605.917140][T22422] A link change request failed with some changes committed already. Interface bridge_slave_1 may have been left with an inconsistent configuration, please check. [ 605.942554][T22429] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4272'. [ 605.984097][T22431] xt_hashlimit: size too large, truncated to 1048576 [ 605.991271][T22431] xt_hashlimit: invalid interval [ 606.610428][T22476] netlink: 'syz.1.4286': attribute type 2 has an invalid length. [ 606.631915][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880855b1c00: rx timeout, send abort [ 607.140153][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880855b1c00: abort rx timeout. Force session deactivation [ 607.424296][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880855b1800: rx timeout, send abort [ 607.475258][T22524] xfrm0: entered allmulticast mode [ 607.568014][T22527] netlink: 'syz.3.4302': attribute type 1 has an invalid length. [ 607.626844][T22527] 8021q: adding VLAN 0 to HW filter on device bond12 [ 607.932545][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880855b1800: abort rx timeout. Force session deactivation [ 608.103156][T22542] sch_tbf: peakrate 67108864 is lower than or equals to rate 4294966145 ! [ 608.215930][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880855b2000: rx timeout, send abort [ 608.272780][T22545] netlink: 'syz.0.4306': attribute type 10 has an invalid length. [ 608.300377][T22545] netlink: 'syz.0.4306': attribute type 10 has an invalid length. [ 608.511452][T22554] bond6: option miimon: invalid value (18446744073709551607) [ 608.535541][T22554] bond6: option miimon: allowed values 0 - 2147483647 [ 608.547842][T22554] bond6 (unregistering): Released all slaves [ 608.595354][T22567] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 608.682293][T22571] netlink: 'syz.1.4313': attribute type 1 has an invalid length. [ 608.693190][T22571] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 608.724226][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880855b2000: abort rx timeout. Force session deactivation [ 608.860277][T22589] tipc: Enabling of bearer rejected, failed to enable media [ 609.004733][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880855b1400: rx timeout, send abort [ 609.136118][T22603] bond6 (unregistering): Released all slaves [ 609.376521][T22644] xt_hashlimit: size too large, truncated to 1048576 [ 609.396570][T22647] x_tables: duplicate underflow at hook 2 [ 609.408482][T22648] x_tables: unsorted entry at hook 3 [ 609.507091][T22653] netlink: 'syz.3.4328': attribute type 1 has an invalid length. [ 609.512991][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880855b1400: abort rx timeout. Force session deactivation [ 609.572885][T22660] __nla_validate_parse: 14 callbacks suppressed [ 609.572901][T22660] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4328'. [ 609.607778][T22653] 8021q: adding VLAN 0 to HW filter on device bond13 [ 609.615201][T22655] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4329'. [ 609.678505][T22653] bond13: (slave bridge3): making interface the new active one [ 609.707999][T22653] bond13: (slave bridge3): Enslaving as an active interface with an up link [ 610.001072][T22682] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4334'. [ 610.016818][T22682] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4334'. [ 610.198945][T22693] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4337'. [ 610.236490][T22694] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4337'. [ 610.251723][T22689] netlink: 'syz.4.4336': attribute type 1 has an invalid length. [ 610.252795][T22701] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 610.292980][T22705] netlink: 'syz.1.4340': attribute type 25 has an invalid length. [ 610.318007][T22705] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4340'. [ 610.347347][T22701] x_tables: duplicate underflow at hook 2 [ 610.414941][T22689] bond1: entered promiscuous mode [ 610.513875][T22689] 8021q: adding VLAN 0 to HW filter on device bond1 [ 610.592728][T22705] netlink: 'syz.1.4340': attribute type 25 has an invalid length. [ 610.607709][T22710] tipc: Started in network mode [ 610.618109][T22710] tipc: Node identity fff50000000000000000000000000001, cluster identity 4711 [ 610.627825][T22705] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4340'. [ 610.641750][T22710] tipc: Enabling of bearer rejected, failed to enable media [ 610.651782][T22634] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 610.671051][T22634] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 610.683966][T22634] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 610.726083][T22634] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 611.076711][T22754] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4350'. [ 611.095288][T22758] netlink: 'syz.0.4351': attribute type 32 has an invalid length. [ 611.124494][T22754] ip6gre1: entered promiscuous mode [ 611.148350][T22754] ip6gre1: entered allmulticast mode [ 611.224713][T22754] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4350'. [ 611.441139][T22763] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 611.510828][T22781] netlink: ct family unspecified [ 611.542003][T22763] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 611.832339][T22797] validate_nla: 1 callbacks suppressed [ 611.832430][T22797] netlink: 'syz.2.4357': attribute type 1 has an invalid length. [ 611.981263][T22797] macvlan0: entered promiscuous mode [ 611.997417][T22797] macvlan0: entered allmulticast mode [ 612.020803][T22797] bond4: entered promiscuous mode [ 612.039950][T22797] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 612.067276][T22797] bond4: left promiscuous mode [ 612.551471][T22838] netlink: 'syz.0.4368': attribute type 8 has an invalid length. [ 612.872707][T22865] xt_TCPMSS: Only works on TCP SYN packets [ 613.107337][T22877] dummy0 (unregistering): left promiscuous mode [ 613.297733][T22895] tipc: Enabling of bearer rejected, failed to enable media [ 614.081817][T22930] lo speed is unknown, defaulting to 1000 [ 614.227385][T22936] netlink: 'syz.0.4396': attribute type 1 has an invalid length. [ 614.347602][T22936] 8021q: adding VLAN 0 to HW filter on device bond5 [ 614.405754][T22938] bond5: (slave geneve2): making interface the new active one [ 614.427874][T22938] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 614.479591][T22940] bridge3: entered promiscuous mode [ 614.493595][T22940] bridge3: entered allmulticast mode [ 614.505573][ T1118] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.534416][ T1118] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.557271][ T1118] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.595701][ T1118] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 614.617858][ T5634] IPVS: starting estimator thread 0... [ 614.632984][T22945] netlink: 'syz.0.4398': attribute type 29 has an invalid length. [ 614.644103][T22945] __nla_validate_parse: 15 callbacks suppressed [ 614.644117][T22945] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4398'. [ 614.723334][T22950] IPVS: using max 36 ests per chain, 86400 per kthread [ 617.157732][T22982] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 617.184504][T22982] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 617.226840][T22984] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4407'. [ 617.238454][T22982] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 35306 - 0 [ 617.273580][T22982] netdevsim netdevsim3 eth3 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 617.356337][T22987] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4409'. [ 617.490327][T22982] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 617.523451][T22982] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 617.548946][T22982] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 35306 - 0 [ 617.591403][T22982] netdevsim netdevsim3 eth2 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 617.829389][T22982] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 617.883331][T22982] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 617.905423][T22982] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 35306 - 0 [ 617.924580][T22982] netdevsim netdevsim3 eth1 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 618.018827][T22982] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 618.044372][T22982] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 618.056574][T22982] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 35306 - 0 [ 618.082437][T22982] netdevsim netdevsim3 eth0 (unregistering): unset [1, 2] type 2 family 0 port 6081 - 0 [ 618.159953][T23018] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4418'. [ 618.281972][T23013] lo speed is unknown, defaulting to 1000 [ 618.352099][ T134] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 618.387611][ T134] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 618.424767][ T134] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 35306 - 0 [ 618.453596][ T134] netdevsim netdevsim3 eth0: set [1, 2] type 2 family 0 port 6081 - 0 [ 618.501233][ T134] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 618.519027][ T134] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 618.527522][ T134] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 35306 - 0 [ 618.542848][ T134] netdevsim netdevsim3 eth1: set [1, 2] type 2 family 0 port 6081 - 0 [ 618.580645][T23028] netlink: 830 bytes leftover after parsing attributes in process `syz.1.4422'. [ 618.657089][ T1118] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 618.681534][ T1118] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 618.721102][ T1118] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 35306 - 0 [ 618.746503][ T1118] netdevsim netdevsim3 eth2: set [1, 2] type 2 family 0 port 6081 - 0 [ 618.747367][T23040] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4424'. [ 618.794671][T22640] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 618.814408][T22640] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 618.840525][T22640] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 35306 - 0 [ 618.859821][T22640] netdevsim netdevsim3 eth3: set [1, 2] type 2 family 0 port 6081 - 0 [ 619.078925][T23058] netlink: 'syz.4.4430': attribute type 3 has an invalid length. [ 619.110587][T23062] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4429'. [ 619.142956][T23060] bridge_slave_1: left allmulticast mode [ 619.151513][T23060] bridge_slave_1: left promiscuous mode [ 619.157398][T23060] bridge0: port 2(bridge_slave_1) entered disabled state [ 619.185616][T23071] netlink: 'syz.4.4432': attribute type 1 has an invalid length. [ 619.193828][T23071] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4432'. [ 619.203332][T23060] bond0: (slave bond_slave_0): Releasing backup interface [ 619.220851][T23060] bond0: (slave bond_slave_1): Releasing backup interface [ 619.254723][T23060] team0: Port device team_slave_0 removed [ 619.262809][T23060] A link change request failed with some changes committed already. Interface veth1_to_team may have been left with an inconsistent configuration, please check. [ 619.396416][T23062] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4429'. [ 619.600033][T23091] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4435'. [ 620.008655][T23096] tipc: Resetting bearer [ 620.214181][ T134] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.252315][ T134] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.284445][ T134] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.315283][ T134] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 620.460795][T23116] openvswitch: netlink: EtherType 50a is less than min 600 [ 620.692538][T23134] __nla_validate_parse: 2 callbacks suppressed [ 620.692556][T23134] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4446'. [ 620.825356][T23142] IPVS: set_ctl: invalid protocol: 92 0.0.0.0:20000 [ 621.729748][T23174] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4451'. [ 623.829920][T23138] tunl0: entered allmulticast mode [ 623.865130][T23140] lo speed is unknown, defaulting to 1000 [ 624.129749][T23183] netlink: 'syz.1.4452': attribute type 11 has an invalid length. [ 624.186610][ T1314] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 624.313365][T23190] Bluetooth: MGMT ver 1.23 [ 624.538357][T23214] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4462'. [ 624.698715][T23222] IPVS: set_ctl: invalid protocol: 29 0.0.0.0:20004 [ 625.165797][T23212] bridge0: port 2(bridge_slave_1) entered disabled state [ 625.584220][T23212] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 625.625774][T23212] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 625.696135][T23212] veth1_to_hsr: left allmulticast mode [ 626.032305][T23212] mac80211_hwsim hwsim39 wlan0: left promiscuous mode [ 626.048200][T23212] mac80211_hwsim hwsim39 wlan0: left allmulticast mode [ 626.056026][T23212] bond1: left promiscuous mode [ 626.060843][T23212] bond1: left allmulticast mode [ 626.262406][T23212] bond3: left promiscuous mode [ 626.283927][T23212] ip6tnl1: left allmulticast mode [ 626.533171][T23239] syzkaller0: left promiscuous mode [ 626.538937][T23239] syzkaller0: left allmulticast mode [ 626.549800][T23247] netlink: 15672 bytes leftover after parsing attributes in process `syz.0.4463'. [ 626.559753][T23247] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4463'. [ 626.569227][T23247] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4463'. [ 626.579383][T23247] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4463'. [ 626.589152][ T6489] syz1: Port: 1 Link DOWN [ 626.595243][T22635] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.625612][T22635] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.655228][T22635] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.683333][T22635] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.799686][T22635] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.814400][T22635] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.824206][T22635] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 626.833156][T22635] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 626.930761][T23263] syzkaller1: entered promiscuous mode [ 626.943411][T23263] syzkaller1: entered allmulticast mode [ 626.967401][T23275] tipc: Enabled bearer , priority 0 [ 626.991132][T23270] syzkaller0: entered promiscuous mode [ 627.012960][T23270] syzkaller0: entered allmulticast mode [ 627.132618][T23270] tipc: Resetting bearer [ 627.167174][T23269] tipc: Resetting bearer [ 627.213924][T23269] tipc: Disabling bearer [ 627.222686][T23284] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 627.289847][T23284] bond6: entered allmulticast mode [ 627.394659][T23289] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 627.639056][T23307] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4479'. [ 628.079342][T23327] netlink: 'syz.1.4485': attribute type 29 has an invalid length. [ 628.093562][T23327] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4485'. [ 628.121206][T23327] netlink: 'syz.1.4485': attribute type 29 has an invalid length. [ 628.129972][T23327] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4485'. [ 628.141362][T23327] netlink: 'syz.1.4485': attribute type 29 has an invalid length. [ 628.149827][T23327] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4485'. [ 628.161092][T23327] netlink: 'syz.1.4485': attribute type 29 has an invalid length. [ 628.185084][T23327] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4485'. [ 628.251441][T23327] netlink: 'syz.1.4485': attribute type 29 has an invalid length. [ 628.259504][T23327] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4485'. [ 628.268929][T23327] netlink: 'syz.1.4485': attribute type 29 has an invalid length. [ 628.277368][T23327] netlink: 'syz.1.4485': attribute type 29 has an invalid length. [ 628.286137][T23327] netlink: 'syz.1.4485': attribute type 29 has an invalid length. [ 628.294448][T23327] netlink: 'syz.1.4485': attribute type 29 has an invalid length. [ 629.205758][T23362] batadv_slave_0: left promiscuous mode [ 629.228330][T23362] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 629.244653][T23362] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 629.835924][T23402] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 629.889564][T23408] bridge4: entered promiscuous mode [ 629.922460][T23408] bridge4: entered allmulticast mode [ 630.137318][T23423] ip6erspan0: entered allmulticast mode [ 630.214455][T23427] syzkaller0: entered promiscuous mode [ 630.232188][T23427] syzkaller0: entered allmulticast mode [ 630.648766][T23456] validate_nla: 16 callbacks suppressed [ 630.648783][T23456] netlink: 'syz.2.4525': attribute type 4 has an invalid length. [ 630.686060][T23461] netlink: 'syz.1.4526': attribute type 11 has an invalid length. [ 630.700265][T23463] netlink: 'syz.2.4525': attribute type 4 has an invalid length. [ 630.932915][T23473] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 630.966422][T23473] gretap2: entered allmulticast mode [ 631.665912][T23531] lo speed is unknown, defaulting to 1000 [ 631.730327][T23538] netlink: 'syz.3.4545': attribute type 1 has an invalid length. [ 631.753387][T23538] netlink: 'syz.3.4545': attribute type 1 has an invalid length. [ 632.315685][T23547] syzkaller0: entered promiscuous mode [ 632.321352][T23547] syzkaller0: entered allmulticast mode [ 633.658832][T23565] netlink: 'syz.4.4553': attribute type 21 has an invalid length. [ 633.881478][T23576] __nla_validate_parse: 33 callbacks suppressed [ 633.881496][T23576] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.4555'. [ 633.998823][T23578] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4556'. [ 634.070894][T23579] IPVS: sh: FWM 3 0x00000003 - no destination available [ 634.079115][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 634.087379][T23579] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4556'. [ 634.096696][T23579] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4556'. [ 635.815703][T23565] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4553'. [ 637.975905][T23578] lo speed is unknown, defaulting to 1000 [ 638.567923][T23629] sctp: [Deprecated]: syz.1.4570 (pid 23629) Use of struct sctp_assoc_value in delayed_ack socket option. [ 638.567923][T23629] Use struct sctp_sack_info instead [ 638.611360][T23629] sctp: [Deprecated]: syz.1.4570 (pid 23629) Use of struct sctp_assoc_value in delayed_ack socket option. [ 638.611360][T23629] Use struct sctp_sack_info instead [ 638.672824][T23629] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 638.692297][T23629] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 638.824457][T23644] netlink: 'syz.4.4574': attribute type 10 has an invalid length. [ 638.858049][T23644] team0: Failed to send options change via netlink (err -105) [ 638.865813][T23644] team0: Port device dummy0 added [ 638.874359][T23644] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4574'. [ 638.884591][T23645] 5nè‹Ò: entered promiscuous mode [ 639.342613][T23655] lo speed is unknown, defaulting to 1000 [ 639.744118][T23676] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4584'. [ 639.763841][T23676] tipc: Invalid UDP bearer configuration [ 639.763896][T23676] tipc: Enabling of bearer rejected, failed to enable media [ 639.781824][T23679] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4585'. [ 640.036428][T23685] netlink: 'syz.3.4586': attribute type 12 has an invalid length. [ 640.126723][T23685] macsec0: entered promiscuous mode [ 640.156944][T23684] macsec0: left promiscuous mode [ 640.393532][T23707] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4591'. [ 640.474790][T23695] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4588'. [ 640.496454][T23695] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 640.515130][T23695] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 640.638465][T23714] netlink: 'syz.3.4594': attribute type 12 has an invalid length. [ 640.731749][T23723] netlink: 'syz.3.4595': attribute type 3 has an invalid length. [ 640.769537][T23723] netlink: 772 bytes leftover after parsing attributes in process `syz.3.4595'. [ 640.806673][T23723] netlink: 'syz.3.4595': attribute type 3 has an invalid length. [ 640.815903][T23723] netlink: 772 bytes leftover after parsing attributes in process `syz.3.4595'. [ 640.827987][T23727] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4597'. [ 640.838003][T23727] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4597'. [ 640.847682][T23727] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4597'. [ 640.857110][T23727] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4597'. [ 641.111198][T23737] RDS: rds_bind could not find a transport for fc02::, load rds_tcp or rds_rdma? [ 641.171367][T23743] lo speed is unknown, defaulting to 1000 [ 641.444077][T23776] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 641.518550][T23782] netlink: 'syz.2.4609': attribute type 27 has an invalid length. [ 645.120807][T23853] __nla_validate_parse: 4 callbacks suppressed [ 645.120823][T23853] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4628'. [ 645.221182][T23855] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4629'. [ 645.298614][T23857] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4630'. [ 645.345360][T23855] lo speed is unknown, defaulting to 1000 [ 645.606106][T23878] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4636'. [ 645.731836][T23886] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4637'. [ 645.908108][T23894] m1Ie5nè‹Ò: entered promiscuous mode [ 645.943946][T23898] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4641'. [ 646.529525][T23925] lo speed is unknown, defaulting to 1000 [ 646.618380][T23931] netlink: 148 bytes leftover after parsing attributes in process `syz.0.4650'. [ 646.627824][T23931] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4650'. [ 647.467458][ T6470] page_pool_release_retry() stalled pool shutdown: id 174, 1 inflight 60 sec [ 647.736488][T23961] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 647.750930][T23963] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4657'. [ 647.882260][T23970] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4658'. [ 648.250791][T23977] lo speed is unknown, defaulting to 1000 [ 649.222469][T24030] netlink: 'syz.4.4677': attribute type 13 has an invalid length. [ 649.344566][T24039] netlink: 'syz.3.4679': attribute type 8 has an invalid length. [ 649.449967][T24036] sch_tbf: burst 6 is lower than device gretap0 mtu (1476) ! [ 649.607357][T24047] tipc: Enabling of bearer rejected, failed to enable media [ 649.646721][T24052] xt_CT: You must specify a L4 protocol and not use inversions on it [ 649.686329][T24047] tipc: Enabled bearer , priority 0 [ 649.704969][T24048] syzkaller0: entered promiscuous mode [ 649.714452][T24052] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 649.725101][T24048] syzkaller0: entered allmulticast mode [ 649.798302][T24047] tipc: Resetting bearer [ 649.827053][T24044] tipc: Resetting bearer [ 649.911124][T24044] tipc: Disabling bearer [ 650.104482][T24073] netlink: 'syz.2.4686': attribute type 9 has an invalid length. [ 650.174238][T24075] __nla_validate_parse: 7 callbacks suppressed [ 650.174254][T24075] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4687'. [ 650.409332][T24085] "syz.0.4692" (24085) uses obsolete ecb(arc4) skcipher [ 650.668118][T24097] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4694'. [ 650.822250][T24107] netlink: 7060 bytes leftover after parsing attributes in process `syz.3.4697'. [ 651.094901][T24115] lo speed is unknown, defaulting to 1000 [ 651.158618][T24126] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4702'. [ 651.235763][T24134] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4702'. [ 651.840928][T24157] lo speed is unknown, defaulting to 1000 [ 651.906438][T24173] netlink: 'syz.1.4715': attribute type 8 has an invalid length. [ 651.961583][T24173] netlink: 'syz.1.4715': attribute type 1 has an invalid length. [ 651.989732][T24173] netlink: 'syz.1.4715': attribute type 2 has an invalid length. [ 652.000769][T24179] netlink: 'syz.4.4716': attribute type 11 has an invalid length. [ 652.019925][T24173] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4715'. [ 652.057777][T24173] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4715'. [ 652.336809][T24199] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4720'. [ 652.693857][T24204] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4721'. [ 653.118037][T24220] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4725'. [ 653.556122][T24233] Can't find ip_set type bitmap:ip [ 654.159614][T24270] bond14: option ad_actor_sys_prio: mode dependency failed, not supported in mode broadcast(3) [ 654.196335][T24270] bond14 (unregistering): Released all slaves [ 654.271288][T24277] lo: Caught tx_queue_len zero misconfig [ 654.288638][T24277] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 654.754300][T24314] ip6erspan0: entered promiscuous mode [ 654.775226][T24314] ip6erspan0: entered allmulticast mode [ 654.894339][T24334] sctp: [Deprecated]: syz.2.4752 (pid 24334) Use of int in max_burst socket option. [ 654.894339][T24334] Use struct sctp_assoc_value instead [ 654.939996][T24333] syzkaller0: entered promiscuous mode [ 654.972209][T24333] syzkaller0: entered allmulticast mode [ 655.171210][T24343] bridge3: entered promiscuous mode [ 655.176718][T24343] bridge3: entered allmulticast mode [ 655.310313][T24349] lo speed is unknown, defaulting to 1000 [ 656.136146][T24374] __nla_validate_parse: 13 callbacks suppressed [ 656.136161][T24374] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4765'. [ 656.157219][T24374] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4765'. [ 657.787439][T24321] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 657.981970][T24378] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 658.009668][T24383] bridge4: entered promiscuous mode [ 658.015291][T24383] bridge4: entered allmulticast mode [ 658.253576][T24397] netlink: 'syz.4.4774': attribute type 1 has an invalid length. [ 658.464733][T24421] IPVS: set_ctl: invalid protocol: 0 10.1.1.0:20001 [ 658.487893][T24424] netlink: 'syz.3.4782': attribute type 1 has an invalid length. [ 658.506764][T24424] netlink: 'syz.3.4782': attribute type 2 has an invalid length. [ 658.603913][T24433] netlink: 'syz.1.4784': attribute type 1 has an invalid length. [ 658.622375][T24436] veth1_to_bond: entered allmulticast mode [ 658.645065][T24435] veth1_to_bond: left allmulticast mode [ 658.836549][T24445] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4790'. [ 658.956749][T24455] lo speed is unknown, defaulting to 1000 [ 658.958396][T24459] netlink: 45 bytes leftover after parsing attributes in process `syz.0.4795'. [ 658.994797][T24461] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4796'. [ 659.007627][T24465] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 659.035917][T24457] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 659.084063][T24451] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4792'. [ 659.707929][T24507] netlink: 'syz.4.4808': attribute type 1 has an invalid length. [ 659.794689][T24507] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 660.141837][T24532] netlink: 'syz.1.4812': attribute type 9 has an invalid length. [ 660.430584][T24552] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4818'. [ 660.437467][T24545] lo speed is unknown, defaulting to 1000 [ 660.584671][T24555] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4819'. [ 660.795661][T24572] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4823'. [ 660.807400][T24572] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4823'. [ 661.063157][T24589] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 661.152766][T24593] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4829'. [ 661.241620][T24597] openvswitch: netlink: Missing valid actions attribute. [ 661.273767][T24597] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 661.297777][T24601] team_slave_0: left promiscuous mode [ 661.306215][T24601] team_slave_1: left promiscuous mode [ 661.414125][T24601] team0 (unregistering): Failed to send options change via netlink (err -105) [ 661.430833][T24601] team0 (unregistering): Failed to send port change of device team_slave_0 via netlink (err -105) [ 661.444543][T24601] team0 (unregistering): Port device team_slave_0 removed [ 661.452074][T24613] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4833'. [ 661.475674][T24601] team0 (unregistering): Failed to send options change via netlink (err -105) [ 661.485951][T24601] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 661.498228][T24601] team0 (unregistering): Port device team_slave_1 removed [ 661.549825][T24607] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 661.562810][T24607] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 661.632172][T24613] 8021q: adding VLAN 0 to HW filter on device bond14 [ 661.670646][T24615] bond14: (slave veth7): Enslaving as an active interface with an up link [ 661.681546][T24619] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4835'. [ 662.316844][T24634] lo speed is unknown, defaulting to 1000 [ 662.367947][T24643] netlink: 'syz.1.4840': attribute type 11 has an invalid length. [ 662.384056][T24643] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4840'. [ 662.384611][T24649] netlink: 'syz.2.4842': attribute type 10 has an invalid length. [ 662.509340][T24649] netlink: 'syz.2.4842': attribute type 4 has an invalid length. [ 662.582829][T24653] A link change request failed with some changes committed already. Interface team_slave_1 may have been left with an inconsistent configuration, please check. [ 662.614923][T24655] netlink: 'syz.2.4842': attribute type 10 has an invalid length. [ 662.643188][T24655] team0: Port device dummy0 removed [ 662.697758][T24655] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 663.063577][T24649] nbd6: detected capacity change from 0 to 63 [ 663.102802][ T5628] block nbd6: Receive control failed (result -32) [ 663.104185][ T5623] block nbd6: Receive control failed (result -32) [ 663.118963][T23181] block nbd6: Dead connection, failed to find a fallback [ 663.126904][T23181] block nbd6: shutting down sockets [ 663.132139][T23181] blk_print_req_error: 138 callbacks suppressed [ 663.132152][T23181] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 663.148829][T23181] buffer_io_error: 138 callbacks suppressed [ 663.148843][T23181] Buffer I/O error on dev nbd6, logical block 0, async page read [ 663.164522][T23181] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 663.177079][T23181] Buffer I/O error on dev nbd6, logical block 1, async page read [ 663.185679][T23181] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 663.195377][T23181] Buffer I/O error on dev nbd6, logical block 2, async page read [ 663.203888][T23181] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 663.212985][T23181] Buffer I/O error on dev nbd6, logical block 3, async page read [ 663.221762][T23181] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 663.233891][T23181] Buffer I/O error on dev nbd6, logical block 0, async page read [ 663.241791][T23181] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 663.251397][T23181] Buffer I/O error on dev nbd6, logical block 1, async page read [ 663.259724][T23181] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 663.269791][T23181] Buffer I/O error on dev nbd6, logical block 2, async page read [ 663.278902][T23181] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 663.288849][T23181] Buffer I/O error on dev nbd6, logical block 3, async page read [ 663.297548][T23181] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 663.327438][T23181] Buffer I/O error on dev nbd6, logical block 0, async page read [ 663.358026][T23181] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 663.387782][T23181] Buffer I/O error on dev nbd6, logical block 1, async page read [ 663.451702][T23181] ldm_validate_partition_table(): Disk read failed. [ 663.491480][T23181] Dev nbd6: unable to read RDB block 0 [ 663.522134][T23181] nbd6: unable to read partition table [ 663.627027][T23181] ldm_validate_partition_table(): Disk read failed. [ 663.641471][T24693] netlink: 'syz.1.4852': attribute type 83 has an invalid length. [ 663.667699][T23181] Dev nbd6: unable to read RDB block 0 [ 663.691962][T24693] netlink: 7064 bytes leftover after parsing attributes in process `syz.1.4852'. [ 663.695615][T23181] nbd6: unable to read partition table [ 663.734300][T24693] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 663.884811][T24705] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4855'. [ 663.910768][T24705] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4855'. [ 663.924656][T24710] sctp: [Deprecated]: syz.1.4857 (pid 24710) Use of int in maxseg socket option. [ 663.924656][T24710] Use struct sctp_assoc_value instead [ 663.952630][T24712] netlink: 'syz.4.4855': attribute type 1 has an invalid length. [ 663.977634][T22636] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 663.981292][T24705] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4855'. [ 663.995945][T22636] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 664.016650][T22636] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 664.038356][T22636] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 664.165254][T24725] netlink: 'syz.0.4862': attribute type 10 has an invalid length. [ 664.238131][T24729] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4860'. [ 664.250466][T24730] bond5 (unregistering): Released all slaves [ 664.316512][T24729] gtp0: entered promiscuous mode [ 664.348064][T24729] gtp0: entered allmulticast mode [ 664.450600][T24735] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4858'. [ 664.880436][T24762] ÿ: renamed from bond_slave_0 (while UP) [ 665.135208][T24773] xt_hashlimit: size too large, truncated to 1048576 [ 665.271186][T24783] team_slave_0: entered promiscuous mode [ 665.305797][T24783] team_slave_0: left promiscuous mode [ 665.342559][T24787] veth0: entered promiscuous mode [ 665.589534][T24800] netlink: 'syz.1.4877': attribute type 1 has an invalid length. [ 665.606187][T24798] syzkaller0: entered promiscuous mode [ 665.618439][T24798] syzkaller0: entered allmulticast mode [ 665.627271][T24803] netlink: 'syz.3.4878': attribute type 2 has an invalid length. [ 665.637076][T24803] netlink: 'syz.3.4878': attribute type 1 has an invalid length. [ 665.701647][T24800] 8021q: adding VLAN 0 to HW filter on device bond7 [ 665.720382][T24806] vlan3: entered allmulticast mode [ 665.726177][T24806] bond7: entered allmulticast mode [ 665.754671][T24780] veth0: left promiscuous mode [ 665.799399][T24803] syzkaller0: entered promiscuous mode [ 665.814451][T24812] netlink: zone id is out of range [ 665.820808][T24803] syzkaller0: entered allmulticast mode [ 665.821411][T24812] netlink: zone id is out of range [ 665.834658][T24812] netlink: zone id is out of range [ 665.840199][T24812] netlink: zone id is out of range [ 665.846065][T24812] netlink: zone id is out of range [ 665.851263][T24812] netlink: zone id is out of range [ 665.856958][T24812] netlink: zone id is out of range [ 665.862138][T24812] netlink: zone id is out of range [ 665.867796][T24812] netlink: zone id is out of range [ 666.150307][T24837] netlink: 'syz.2.4886': attribute type 1 has an invalid length. [ 666.589328][T24861] lo speed is unknown, defaulting to 1000 [ 666.730610][T24871] __nla_validate_parse: 10 callbacks suppressed [ 666.730626][T24871] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4896'. [ 666.792466][T24871] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4896'. [ 666.812479][T24871] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4896'. [ 666.842100][T24871] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4896'. [ 667.016500][T24880] netlink: 'syz.0.4898': attribute type 1 has an invalid length. [ 667.045017][T24880] netlink: 'syz.0.4898': attribute type 4 has an invalid length. [ 667.072269][T24880] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.4898'. [ 667.345519][T24890] netlink: 224 bytes leftover after parsing attributes in process `syz.2.4900'. [ 668.109214][T24921] bridge0: port 2(veth1_virt_wifi) entered blocking state [ 668.117359][T24921] bridge0: port 2(veth1_virt_wifi) entered disabled state [ 668.125363][T24921] veth1_virt_wifi: entered allmulticast mode [ 668.135473][T24921] veth1_virt_wifi: left allmulticast mode [ 668.179286][T24926] veth6: entered allmulticast mode [ 668.265592][T24934] xt_hashlimit: overflow, try lower: 18446744073709551615/32 [ 668.301929][T24928] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4910'. [ 668.323873][T24928] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4910'. [ 668.368511][T24928] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4910'. [ 668.375644][T24941] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4914'. [ 668.459986][T24941] netlink: 'syz.4.4914': attribute type 8 has an invalid length. [ 668.905483][T24984] nbd: must specify a device to reconfigure [ 669.716300][T24994] bridge0: port 2(bridge_slave_1) entered disabled state [ 669.723778][T24994] bridge0: port 1(bridge_slave_0) entered disabled state [ 669.897956][T24994] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 669.914597][T24994] xfrm0: left allmulticast mode [ 670.044121][T24994] geneve1: left promiscuous mode [ 670.151995][T24994] geneve3: left promiscuous mode [ 670.162364][T24994] geneve4: left promiscuous mode [ 670.172571][T24994] geneve4: left allmulticast mode [ 670.234384][T24994] ip6erspan0: left promiscuous mode [ 670.239598][T24994] ip6erspan0: left allmulticast mode [ 670.293996][T22636] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 670.312647][T22636] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 256 - 0 [ 670.322470][T22636] netdevsim netdevsim3 eth0: unset [1, 1] type 2 family 0 port 35306 - 0 [ 670.370324][T22636] netdevsim netdevsim3 eth0: unset [1, 2] type 2 family 0 port 6081 - 0 [ 670.407934][T22636] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 670.448020][T22636] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 256 - 0 [ 670.482416][T22636] netdevsim netdevsim3 eth1: unset [1, 1] type 2 family 0 port 35306 - 0 [ 670.519258][T22636] netdevsim netdevsim3 eth1: unset [1, 2] type 2 family 0 port 6081 - 0 [ 670.568002][T22636] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 670.591685][T22636] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 256 - 0 [ 670.610650][T25025] validate_nla: 2 callbacks suppressed [ 670.610664][T25025] netlink: 'syz.4.4938': attribute type 30 has an invalid length. [ 670.635869][T22636] netdevsim netdevsim3 eth2: unset [1, 1] type 2 family 0 port 35306 - 0 [ 670.651906][T22636] netdevsim netdevsim3 eth2: unset [1, 2] type 2 family 0 port 6081 - 0 [ 670.694736][T22636] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 670.720723][T22636] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 256 - 0 [ 670.756634][T22636] netdevsim netdevsim3 eth3: unset [1, 1] type 2 family 0 port 35306 - 0 [ 670.790799][T22636] netdevsim netdevsim3 eth3: unset [1, 2] type 2 family 0 port 6081 - 0 [ 671.726319][T25099] sctp: [Deprecated]: syz.4.4956 (pid 25099) Use of struct sctp_assoc_value in delayed_ack socket option. [ 671.726319][T25099] Use struct sctp_sack_info instead [ 671.809942][T25099] netlink: 'syz.4.4956': attribute type 1 has an invalid length. [ 671.818933][T25103] __nla_validate_parse: 62 callbacks suppressed [ 671.818948][T25103] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4957'. [ 671.836201][T25099] netlink: 'syz.4.4956': attribute type 2 has an invalid length. [ 671.880062][T25099] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4956'. [ 672.140990][T25131] netlink: 'syz.4.4962': attribute type 11 has an invalid length. [ 672.180683][T25131] netlink: 199828 bytes leftover after parsing attributes in process `syz.4.4962'. [ 672.336807][T25138] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 672.389543][T25138] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4964'. [ 672.584858][T25151] IPVS: set_ctl: invalid protocol: 50 172.20.20.45:20002 [ 672.616055][T25147] netlink: 84 bytes leftover after parsing attributes in process `syz.0.4964'. [ 672.616252][T25150] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4966'. [ 673.617000][T25206] lo speed is unknown, defaulting to 1000 [ 673.715161][T25221] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4976'. [ 673.793188][T25228] net_ratelimit: 168 callbacks suppressed [ 673.801432][T25216] bond8: entered promiscuous mode [ 673.830737][T25226] ±ÿ: renamed from lo [ 673.845911][T25228] netlink: ct family unspecified [ 673.895183][T25228] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 674.042066][T25231] syzkaller0: entered promiscuous mode [ 674.056719][T25231] syzkaller0: entered allmulticast mode [ 674.082922][T25231] simple: basic_1 [ 674.088188][T25231] simple: basic_2 [ 674.091879][T25231] simple: basic_3 [ 674.095655][T25231] simple: basic_4 [ 674.099289][T25231] simple: basic_5 [ 674.102925][T25231] simple: basic_6 [ 674.106599][T25231] simple: basic_7 [ 674.110234][T25231] simple: basic_8 [ 674.113913][T25231] simple: basic_9 [ 674.117571][T25231] simple: basic_10 [ 674.121289][T25231] simple: basic_11 [ 674.125047][T25231] simple: basic_12 [ 674.128776][T25231] simple: basic_13 [ 674.132516][T25231] simple: basic_14 [ 674.135428][T25237] netlink: 104 bytes leftover after parsing attributes in process `syz.3.4977'. [ 674.137931][T25231] simple: basic_15 [ 674.149004][T25231] simple: basic_16 [ 674.152751][T25231] simple: basic_17 [ 674.156510][T25231] 0: reclassify loop, rule prio 0, protocol 800 [ 674.226690][T25239] lo speed is unknown, defaulting to 1000 [ 674.558674][T25257] syzkaller0: entered promiscuous mode [ 674.574913][T25257] syzkaller0: entered allmulticast mode [ 674.862755][T25272] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4990'. [ 674.887942][T25274] netlink: 'syz.1.4991': attribute type 1 has an invalid length. [ 674.920429][T25270] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.4989'. [ 675.000896][T25274] bond9: entered promiscuous mode [ 675.006928][T25274] bond9: entered allmulticast mode [ 675.012498][T25274] 8021q: adding VLAN 0 to HW filter on device bond9 [ 675.149356][T25277] erspan1: entered allmulticast mode [ 675.175015][T25277] bond9: (slave erspan1): making interface the new active one [ 675.182631][T25277] erspan1: entered promiscuous mode [ 675.190905][T25285] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 675.198178][T25285] IPv6: NLM_F_CREATE should be set when creating new route [ 675.205454][T25285] IPv6: NLM_F_CREATE should be set when creating new route [ 675.212771][T25277] bond9: (slave erspan1): Enslaving as an active interface with an up link [ 675.803114][T25311] openvswitch: netlink: IP tunnel dst address not specified [ 675.825059][T25311] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 676.082773][T25316] nbd: device at index 64 is going down [ 676.245920][T23181] udevd[23181]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 676.884961][T25350] __nla_validate_parse: 4 callbacks suppressed [ 676.884979][T25350] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 676.914410][T25352] netlink: 'syz.3.5014': attribute type 4 has an invalid length. [ 676.958240][T25354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 677.003949][T25354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 677.040620][T25354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 677.081620][T25354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 677.118374][T25354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 677.134030][T25354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 677.145634][T25354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 677.158900][T25354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 677.170684][T25354] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5013'. [ 677.245801][T25367] bridge5: entered promiscuous mode [ 677.261013][T25367] bridge5: entered allmulticast mode [ 677.361871][T25380] netlink: 'syz.4.5023': attribute type 3 has an invalid length. [ 677.362434][T25381] netlink: 'syz.4.5023': attribute type 3 has an invalid length. [ 677.492340][T25392] netlink: 'syz.0.5027': attribute type 32 has an invalid length. [ 677.592361][T25393] veth7: entered promiscuous mode [ 677.610191][T25390] lo speed is unknown, defaulting to 1000 [ 677.622722][T25393] netlink: 'syz.4.5026': attribute type 4 has an invalid length. [ 678.348582][T25437] ip6gretap0: entered promiscuous mode [ 678.377559][T25437] 8021q: adding VLAN 0 to HW filter on device bond0 [ 678.388996][T25437] batadv0: left promiscuous mode [ 678.400817][T25437] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 678.458668][T25397] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 678.470782][T25444] xt_hashlimit: size too large, truncated to 1048576 [ 678.507572][T25445] netlink: 'syz.1.5041': attribute type 1 has an invalid length. [ 678.608225][T25437] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 678.650102][T25437] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 678.699037][T25437] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 678.770009][T22641] bridge0: port 1(bridge_slave_0) entered blocking state [ 678.777208][T22641] bridge0: port 1(bridge_slave_0) entered forwarding state [ 678.831252][T22641] bridge0: port 2(bridge_slave_1) entered blocking state [ 678.838475][T22641] bridge0: port 2(bridge_slave_1) entered forwarding state [ 678.957209][T25445] 8021q: adding VLAN 0 to HW filter on device bond10 [ 679.298290][T25470] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 679.360481][T25478] netlink: 'syz.3.5051': attribute type 1 has an invalid length. [ 679.369239][T25478] netlink: 'syz.3.5051': attribute type 1 has an invalid length. [ 679.409680][T25481] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 679.424291][T25478] netlink: 'syz.3.5051': attribute type 30 has an invalid length. [ 679.468130][T22635] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.481781][T25478] netlink: 'syz.3.5051': attribute type 30 has an invalid length. [ 679.492917][T22635] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.521808][T22635] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.557154][T22635] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 679.605553][T25500] IPVS: Unknown mcast interface: vcan0 [ 679.772688][T25511] mac80211_hwsim hwsim42 wlan0: entered promiscuous mode [ 679.788960][T25511] mac80211_hwsim hwsim42 wlan0: entered allmulticast mode [ 679.799990][T25511] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 679.835897][T25513] tunl0: left allmulticast mode [ 679.959438][T25522] bond0: option fail_over_mac: unable to set because the bond device has slaves [ 680.269037][T25544] macsec1: entered promiscuous mode [ 680.289438][T25544] batman_adv: batadv0: Adding interface: macsec1 [ 680.298700][T25544] batman_adv: batadv0: The MTU of interface macsec1 is too small (1468) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 680.333874][T25544] batman_adv: batadv0: Interface activated: macsec1 [ 680.404299][T25561] tipc: Enabled bearer , priority 0 [ 680.415725][T25561] syzkaller0: entered promiscuous mode [ 680.428393][T25561] syzkaller0: entered allmulticast mode [ 680.544194][T25560] tipc: Resetting bearer [ 680.587820][T25560] tipc: Disabling bearer [ 680.781907][ T30] audit: type=1800 audit(1779057780.810:15): pid=25591 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.5079" name="blkio.bfq.time_recursive" dev="tmpfs" ino=2426 res=0 errno=0 [ 680.842827][T25594] xt_CT: You must specify a L4 protocol and not use inversions on it [ 680.873752][T25594] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 681.332904][T25617] lo speed is unknown, defaulting to 1000 [ 681.647844][T25633] 8021q: adding VLAN 0 to HW filter on device bond7 [ 681.955197][T25653] validate_nla: 2 callbacks suppressed [ 681.955213][T25653] netlink: 'syz.1.5092': attribute type 2 has an invalid length. [ 682.047350][T25655] x_tables: duplicate underflow at hook 3 [ 682.838579][T25661] lo speed is unknown, defaulting to 1000 [ 682.859983][T25673] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 682.877294][T25673] syzkaller1: linktype set to 270 [ 683.117544][T25688] veth1_macvtap: left promiscuous mode [ 683.128104][T25688] macsec0: entered allmulticast mode [ 683.151386][T25684] syzkaller0: entered promiscuous mode [ 683.165700][T25684] syzkaller0: entered allmulticast mode [ 683.172051][T25688] veth1_macvtap: entered promiscuous mode [ 683.179175][T25684] PF_CAN: dropped non conform CAN FD skbuff: dev type 280, len 65487 [ 683.188398][T25688] veth1_macvtap: entered allmulticast mode [ 683.205865][T25688] macsec0: left allmulticast mode [ 683.218598][T25688] veth1_macvtap: left allmulticast mode [ 683.267495][T25688] __nla_validate_parse: 73 callbacks suppressed [ 683.267512][T25688] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5101'. [ 683.322910][T25688] ip6erspan1: entered allmulticast mode [ 683.587206][T25697] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.5103'. [ 683.839414][T25709] syzkaller0: entered promiscuous mode [ 683.845186][T25709] syzkaller0: entered allmulticast mode [ 684.077512][T25711] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5105'. [ 684.090463][T25711] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5105'. [ 684.106218][T25711] xt_hashlimit: size too large, truncated to 1048576 [ 684.114201][T25711] xt_hashlimit: max too large, truncated to 1048576 [ 684.154517][T25711] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 684.443055][T25727] netlink: 44 bytes leftover after parsing attributes in process `syz.2.5109'. [ 684.562767][T25739] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5113'. [ 684.670249][T25731] lo speed is unknown, defaulting to 1000 [ 684.894619][T25753] netlink: 'syz.2.5118': attribute type 10 has an invalid length. [ 684.906714][T25751] 8021q: adding VLAN 0 to HW filter on device bond0 [ 684.929321][T25751] 8021q: adding VLAN 0 to HW filter on device team0 [ 684.964454][T25751] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 685.010281][T25756] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 685.010281][T25756] Please contact the netfilter-devel mailing list or update your nftables rules. [ 685.170180][T25751] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 685.183129][T25751] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 685.222582][T25751] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 685.258016][T25751] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 685.299153][T25751] hsr0: left promiscuous mode [ 685.320175][T25751] veth1_vlan: left promiscuous mode [ 685.327107][T25751] veth0_vlan: left promiscuous mode [ 685.333619][T25751] veth0_vlan: entered promiscuous mode [ 685.342878][T25751] veth1_vlan: entered promiscuous mode [ 685.354688][T25751] veth0_macvtap: left promiscuous mode [ 685.361409][T25751] veth0_macvtap: entered promiscuous mode [ 685.378729][T25751] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 685.387167][T25751] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 685.398157][T25751] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 685.424783][T25751] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 685.453128][T25751] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 685.475792][ T8082] syz1: Port: 1 Link ACTIVE [ 685.482911][ T134] bridge0: port 2(bridge_slave_1) entered blocking state [ 685.490130][ T134] bridge0: port 2(bridge_slave_1) entered forwarding state [ 685.626046][ T1314] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.707504][T25753] syz_tun: entered promiscuous mode [ 685.733792][T25753] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 685.776538][ T1118] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 685.795023][T22635] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 685.816354][T25763] netlink: 'syz.0.5121': attribute type 7 has an invalid length. [ 685.833974][T25763] netlink: 'syz.0.5121': attribute type 8 has an invalid length. [ 685.872309][T22635] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 685.892070][T22635] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 686.151984][T25784] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5127'. [ 686.209367][T25786] openvswitch: netlink: IPv4 tun info is not correct [ 686.888107][T25825] netlink: 148 bytes leftover after parsing attributes in process `syz.1.5138'. [ 687.095852][T25831] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5142'. [ 687.177081][T25833] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5143'. [ 687.361721][T25844] syzkaller0: left promiscuous mode [ 687.369850][T25846] netlink: 'syz.1.5149': attribute type 10 has an invalid length. [ 687.378441][T25844] syzkaller0: left allmulticast mode [ 687.500433][T25847] lo speed is unknown, defaulting to 1000 [ 687.530840][T25856] sctp: [Deprecated]: syz.0.5150 (pid 25856) Use of int in maxseg socket option. [ 687.530840][T25856] Use struct sctp_assoc_value instead [ 687.873799][T25865] netlink: 'syz.3.5155': attribute type 30 has an invalid length. [ 690.046630][T25865] netlink: 'syz.3.5155': attribute type 30 has an invalid length. [ 690.260637][T25893] __nla_validate_parse: 2 callbacks suppressed [ 690.260654][T25893] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5160'. [ 690.278217][T25893] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5160'. [ 690.308320][T25893] netlink: 'syz.4.5160': attribute type 11 has an invalid length. [ 690.350630][T25891] netlink: 'syz.3.5161': attribute type 4 has an invalid length. [ 690.632462][T25913] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5168'. [ 690.883400][T25891] netlink: 'syz.3.5161': attribute type 4 has an invalid length. [ 691.245153][T25931] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5173'. [ 691.370393][T25939] netlink: 1544 bytes leftover after parsing attributes in process `syz.4.5175'. [ 691.402781][T25933] bond0: (slave dummy0): Releasing backup interface [ 691.639086][T25950] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 691.825105][T25965] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5183'. [ 691.859647][T25960] ip6erspan0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 691.898524][T25960] ip6erspan0: entered promiscuous mode [ 691.918977][T25959] tipc: Enabled bearer , priority 0 [ 692.032431][T25959] tipc: Disabling bearer [ 692.095820][T25983] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5188'. [ 692.202838][T25987] syzkaller0: entered promiscuous mode [ 692.217487][T25987] syzkaller0: entered allmulticast mode [ 692.314428][T25993] netlink: 'syz.3.5189': attribute type 4 has an invalid length. [ 692.569699][T26002] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5194'. [ 692.674888][T26007] netlink: 'syz.0.5195': attribute type 62 has an invalid length. [ 692.812796][T26015] netlink: 10 bytes leftover after parsing attributes in process `syz.1.5198'. [ 692.859019][T26018] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5199'. [ 693.228115][T26047] netlink: 'syz.2.5206': attribute type 11 has an invalid length. [ 693.242398][T26042] lo speed is unknown, defaulting to 1000 [ 693.261335][T26030] Cannot find set identified by id 65534 to match [ 693.597897][T26061] netlink: 'syz.2.5210': attribute type 1 has an invalid length. [ 693.715619][T26063] bond8: (slave vxcan3): The slave device specified does not support setting the MAC address [ 693.734170][T26063] bond8: (slave vxcan3): Error -95 calling set_mac_address [ 693.900649][T26061] macvlan0: entered promiscuous mode [ 693.906808][T26061] macvlan0: entered allmulticast mode [ 693.913115][T26061] bond8: entered promiscuous mode [ 693.926721][T26061] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 693.935881][T26061] bond8: left promiscuous mode [ 694.244807][T26069] netlink: 'syz.0.5212': attribute type 49 has an invalid length. [ 694.716887][T26089] lo speed is unknown, defaulting to 1000 [ 694.724256][T26093] xt_recent: hitcount (262144) is larger than allowed maximum (65535) [ 694.855436][T26097] lo speed is unknown, defaulting to 1000 [ 695.324243][T26110] ipvlan2: entered promiscuous mode [ 695.489861][T26112] ipvlan3: entered promiscuous mode [ 695.597719][T26120] __nla_validate_parse: 12 callbacks suppressed [ 695.597740][T26120] netlink: 84 bytes leftover after parsing attributes in process `syz.3.5223'. [ 695.671268][T26124] nbd: must specify at least one socket [ 695.771208][T26130] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 695.785956][T26127] netlink: 6032 bytes leftover after parsing attributes in process `syz.3.5226'. [ 695.970408][T26135] lo speed is unknown, defaulting to 1000 [ 696.000035][T26132] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5225'. [ 696.066393][T26139] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5227'. [ 696.079197][T26140] netlink: 104 bytes leftover after parsing attributes in process `syz.4.5228'. [ 696.350124][T26139] vlan3: entered promiscuous mode [ 696.400669][T26145] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5230'. [ 696.421426][T26139] gretap0: entered promiscuous mode [ 696.781543][T26147] bond5: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 696.820332][T26147] bond5 (unregistering): Released all slaves [ 696.943769][T26168] netlink: 'syz.0.5235': attribute type 13 has an invalid length. [ 696.963431][T26168] netlink: 'syz.0.5235': attribute type 17 has an invalid length. [ 697.026989][T26163] bridge0: port 2(bridge_slave_1) entered disabled state [ 697.034932][T26163] bridge0: port 1(bridge_slave_0) entered disabled state [ 697.291265][T26163] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 697.306491][T26163] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 697.335962][T26163] tipc: Resetting bearer [ 697.416397][T26168] gretap0: left allmulticast mode [ 697.456297][T26191] netlink: 'syz.1.5238': attribute type 1 has an invalid length. [ 697.474357][T26168] ip6gretap0: left promiscuous mode [ 697.490584][T26168] 8021q: adding VLAN 0 to HW filter on device bond0 [ 697.501581][T26168] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 697.532765][T26168] bridge0: port 1(bridge_slave_0) entered blocking state [ 697.539987][T26168] bridge0: port 1(bridge_slave_0) entered forwarding state [ 697.559308][T26168] bridge0: port 2(bridge_slave_1) entered blocking state [ 697.566447][T26168] bridge0: port 2(bridge_slave_1) entered forwarding state [ 697.586933][T26168] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 697.596920][T26168] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 697.614183][T26168] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 697.647620][T26173] bridge0: port 2(bridge_slave_1) entered disabled state [ 697.776289][T26191] 8021q: adding VLAN 0 to HW filter on device bond11 [ 697.831016][T26202] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5240'. [ 698.022558][T26210] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5243'. [ 699.583506][T26236] tipc: Enabling of bearer rejected, failed to enable media [ 699.908676][T26276] x_tables: duplicate underflow at hook 3 [ 700.451748][T26294] lo speed is unknown, defaulting to 1000 [ 700.916095][T26331] netlink: 'syz.0.5270': attribute type 1 has an invalid length. [ 701.151228][T26342] A link change request failed with some changes committed already. Interface veth1_to_team may have been left with an inconsistent configuration, please check. [ 701.234447][T26342] team0: No ports can be present during mode change [ 701.362625][T26351] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5278'. [ 701.389064][T26351] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5278'. [ 701.401949][T26353] tipc: New replicast peer: 255.255.255.255 [ 701.409722][T26353] tipc: Enabled bearer , priority 26 [ 701.438650][T26351] vlan3: entered promiscuous mode [ 701.460264][T26351] syz_tun: entered promiscuous mode [ 701.477502][T26351] vlan3: entered allmulticast mode [ 701.500013][T26351] syz_tun: entered allmulticast mode [ 701.655225][T26362] netlink: 'syz.0.5281': attribute type 1 has an invalid length. [ 701.675651][T26362] netlink: 88 bytes leftover after parsing attributes in process `syz.0.5281'. [ 701.718549][T26364] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5281'. [ 701.736510][T26362] netlink: 1 bytes leftover after parsing attributes in process `syz.0.5281'. [ 701.768304][T26362] netlink: 'syz.0.5281': attribute type 1 has an invalid length. [ 701.801037][T26362] netlink: 634 bytes leftover after parsing attributes in process `syz.0.5281'. [ 701.904633][T26369] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5284'. [ 702.202834][T26392] bond15: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 702.220415][T26392] bond15 (unregistering): Released all slaves [ 702.361478][T26410] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5293'. [ 702.371925][T26410] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5293'. [ 702.422614][T26411] netlink: 'syz.2.5293': attribute type 10 has an invalid length. [ 702.499383][T26416] bond0: entered promiscuous mode [ 702.509547][T26416] batadv0: entered promiscuous mode [ 702.516330][T26416] hsr2: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 702.537976][T26416] 8021q: adding VLAN 0 to HW filter on device hsr2 [ 702.558355][ T10] tipc: Node number set to 2180023185 [ 702.842249][T26439] syz_tun: entered promiscuous mode [ 702.848145][T26441] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5304'. [ 702.865821][T26439] macvtap1: entered promiscuous mode [ 702.889096][T26443] xt_hashlimit: size too large, truncated to 1048576 [ 702.955878][T26446] bridge_slave_0 (unregistering): left allmulticast mode [ 702.992876][T26446] bridge_slave_0 (unregistering): left promiscuous mode [ 703.004650][T26446] bridge0: port 1(bridge_slave_0) entered disabled state [ 703.005380][T26450] netlink: 'syz.3.5305': attribute type 1 has an invalid length. [ 703.045870][T26449] netlink: 'syz.1.5307': attribute type 1 has an invalid length. [ 703.291092][T26464] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 703.308939][T26465] netlink: 'syz.2.5310': attribute type 1 has an invalid length. [ 703.319668][T26464] syzkaller1: linktype set to 1 [ 703.475548][T26465] bond9: entered promiscuous mode [ 703.489908][T26465] 8021q: adding VLAN 0 to HW filter on device bond9 [ 703.532281][T26475] bond9: (slave bridge4): making interface the new active one [ 703.549994][T26475] bridge4: entered promiscuous mode [ 703.559581][T26475] bond9: (slave bridge4): Enslaving as an active interface with an up link [ 703.690083][T26490] IPVS: set_ctl: invalid protocol: 29 172.20.20.10:20002 [ 703.810417][T26490] macvtap1: entered promiscuous mode [ 703.979720][T26510] netlink: 'syz.4.5321': attribute type 10 has an invalid length. [ 704.009419][T26510] netlink: 'syz.4.5321': attribute type 10 has an invalid length. [ 704.039204][T26510] team0: Port device dummy0 removed [ 704.157223][T26524] syz_tun: left promiscuous mode [ 704.221786][T26524] 8021q: adding VLAN 0 to HW filter on device team0 [ 704.284031][T26531] nbd: nbd64 already in use [ 704.304563][T26524] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 704.534163][T23181] udevd[23181]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 705.547606][T26602] team0 (unregistering): Port device team_slave_1 removed [ 705.577177][T26602] team0 (unregistering): Port device veth1_to_hsr removed [ 705.682221][T26606] tunl0: Caught tx_queue_len zero misconfig [ 706.011888][T26628] netlink: 'syz.0.5346': attribute type 1 has an invalid length. [ 706.186171][T26628] 8021q: adding VLAN 0 to HW filter on device bond9 [ 706.998905][T26696] netlink: 'syz.4.5360': attribute type 8 has an invalid length. [ 707.705831][T26741] netlink: 'syz.1.5371': attribute type 1 has an invalid length. [ 707.807688][T26750] gretap3: entered allmulticast mode [ 707.846218][T26750] bond13: (slave gretap3): making interface the new active one [ 707.854796][T26750] bond13: (slave gretap3): Enslaving as an active interface with an up link [ 707.965208][T26758] netlink: 'syz.1.5375': attribute type 1 has an invalid length. [ 707.973402][T26758] __nla_validate_parse: 13 callbacks suppressed [ 707.973416][T26758] netlink: 248 bytes leftover after parsing attributes in process `syz.1.5375'. [ 708.041728][T26756] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5374'. [ 708.094422][T26759] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5374'. [ 708.142404][T26768] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 708.157712][T26770] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.5378'. [ 708.205591][T26770] netlink: 'syz.4.5378': attribute type 33 has an invalid length. [ 708.236291][T26770] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5378'. [ 708.362416][T26781] netlink: 228 bytes leftover after parsing attributes in process `syz.3.5380'. [ 708.428604][T26788] netlink: 'syz.0.5382': attribute type 11 has an invalid length. [ 708.441230][T26786] erspan0: entered promiscuous mode [ 708.456603][T26788] netlink: 199788 bytes leftover after parsing attributes in process `syz.0.5382'. [ 708.619445][T26806] netlink: 'syz.0.5388': attribute type 10 has an invalid length. [ 708.850196][T26813] bond14: option arp_validate: invalid value (18446744073709551613) [ 708.860947][T26813] bond14 (unregistering): Released all slaves [ 709.307267][T26835] veth0: entered promiscuous mode [ 709.344266][T26835] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5395'. [ 709.401900][T26835] veth0 (unregistering): left promiscuous mode [ 709.455307][T26845] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5397'. [ 709.468515][T26838] syzkaller0: entered promiscuous mode [ 709.483478][T26838] syzkaller0: entered allmulticast mode [ 709.648257][T26856] netlink: 52 bytes leftover after parsing attributes in process `syz.4.5401'. [ 709.727027][T26856] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 709.884119][T26861] xfrm0: entered allmulticast mode [ 709.989246][T23181] udevd[23181]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 714.922356][T26856] lo speed is unknown, defaulting to 1000 [ 715.079416][T26888] __nla_validate_parse: 2 callbacks suppressed [ 715.079434][T26888] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5406'. [ 715.156341][T26893] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5407'. [ 715.191484][T26894] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5407'. [ 715.254103][T26901] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5407'. [ 715.275490][T26894] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5407'. [ 715.299688][T26898] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5410'. [ 715.366935][T26901] netlink: 'syz.3.5407': attribute type 13 has an invalid length. [ 715.390592][T26901] netlink: 'syz.3.5407': attribute type 17 has an invalid length. [ 716.078211][T26901] bridge0: left promiscuous mode [ 716.091941][T26901] 8021q: adding VLAN 0 to HW filter on device bond0 [ 716.112286][T26901] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 716.171943][T26901] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 716.180417][T26901] xfrm0: left allmulticast mode [ 716.196578][T26901] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 716.208456][T26901] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 716.224038][T26901] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 716.250594][T22641] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 716.275774][T22641] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 716.309234][T22634] bridge0: port 2(bridge_slave_1) entered blocking state [ 716.316454][T22634] bridge0: port 2(bridge_slave_1) entered forwarding state [ 716.405694][T22641] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 716.428347][T22641] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 716.804250][T26941] sctp: [Deprecated]: syz.2.5421 (pid 26941) Use of struct sctp_assoc_value in delayed_ack socket option. [ 716.804250][T26941] Use struct sctp_sack_info instead [ 716.857333][T26943] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5419'. [ 716.950808][T26947] tipc: New replicast peer: 255.255.255.255 [ 716.958843][T26947] tipc: Enabled bearer , priority 26 [ 717.022370][T26950] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5424'. [ 717.262120][T26963] netlink: 'syz.0.5423': attribute type 1 has an invalid length. [ 717.329118][T26969] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5423'. [ 717.405024][T26963] 8021q: adding VLAN 0 to HW filter on device bond10 [ 717.437306][T26972] lo: entered allmulticast mode [ 717.444517][T26972] lo: left allmulticast mode [ 717.619447][T26981] bond0: Caught tx_queue_len zero misconfig [ 717.625926][T26982] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5431'. [ 717.646812][T26978] vxcan0: tx drop: invalid sa for name 0x0000000000000002 [ 717.766305][T26988] netlink: 'syz.3.5434': attribute type 30 has an invalid length. [ 717.787543][T26988] netlink: 'syz.3.5434': attribute type 8 has an invalid length. [ 717.875357][T26992] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 717.966714][T26999] netlink: 'syz.3.5438': attribute type 21 has an invalid length. [ 717.983108][T26999] netlink: 'syz.3.5438': attribute type 4 has an invalid length. [ 718.000765][T26999] netlink: 'syz.3.5438': attribute type 5 has an invalid length. [ 718.079512][T22180] tipc: Node number set to 4294246401 [ 718.207246][T27016] netlink: 'syz.3.5444': attribute type 1 has an invalid length. [ 718.234039][T27017] debugfs: 'netdev:syzkaller0' already exists in 'phy36' [ 718.632658][T27038] netlink: 'syz.4.5451': attribute type 1 has an invalid length. [ 719.135346][T27057] bond12: entered promiscuous mode [ 719.158435][T27057] bond12: entered allmulticast mode [ 719.368750][T27073] x_tables: ip_tables: RATEEST.0 target: invalid size 32 (kernel) != (user) 0 [ 719.420147][T27080] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 720.115709][T27122] __nla_validate_parse: 15 callbacks suppressed [ 720.115727][T27122] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5469'. [ 720.143888][T27109] syzkaller0: entered promiscuous mode [ 720.151491][T27109] syzkaller0: entered allmulticast mode [ 720.558505][T27148] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5476'. [ 720.592908][T27148] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5476'. [ 720.616778][T27150] validate_nla: 6 callbacks suppressed [ 720.616795][T27150] netlink: 'syz.1.5477': attribute type 1 has an invalid length. [ 720.649185][T27148] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5476'. [ 720.672717][T27150] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5477'. [ 720.750413][T27155] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5479'. [ 720.777831][T27157] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5480'. [ 720.922712][T27174] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5483'. [ 721.090464][T27164] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5483'. [ 721.357038][T27205] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5494'. [ 721.378445][T27207] netlink: 'syz.1.5492': attribute type 11 has an invalid length. [ 721.695748][T27231] IPVS: set_ctl: invalid protocol: 43 10.1.1.1:20002 [ 721.857875][T27241] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 721.881553][T27063] udevd[27063]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 721.918495][T27232] udevd[27232]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 721.937634][T27246] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 722.480614][T27277] tipc: Enabled bearer , priority 0 [ 722.614667][T27277] syzkaller0: entered promiscuous mode [ 722.624890][T27277] syzkaller0: entered allmulticast mode [ 722.631090][T27277] tipc: Resetting bearer [ 722.752451][T22635] tipc: Resetting bearer [ 722.829710][T27276] tipc: Resetting bearer [ 724.126782][T27332] netlink: 'syz.2.5525': attribute type 8 has an invalid length. [ 725.260568][T27276] tipc: Disabling bearer [ 725.514962][T27345] sctp: [Deprecated]: syz.0.5531 (pid 27345) Use of int in max_burst socket option. [ 725.514962][T27345] Use struct sctp_assoc_value instead [ 725.568255][T27347] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 725.606714][T27347] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.617070][T27352] netlink: 'syz.3.5529': attribute type 1 has an invalid length. [ 725.634248][T27354] netlink: 'syz.1.5532': attribute type 1 has an invalid length. [ 725.827283][T27354] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 725.884306][T27347] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 725.894377][T27347] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 725.967213][T27342] bond15: (slave vxcan1): The slave device specified does not support setting the MAC address [ 725.979105][T27342] bond15: (slave vxcan1): Error -95 calling set_mac_address [ 726.014670][T27372] netlink: 'syz.2.5536': attribute type 8 has an invalid length. [ 726.026301][T27347] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 726.039308][T27347] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 726.129139][T27347] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 726.151001][T27347] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 726.199205][T27382] ip6tnl2: entered allmulticast mode [ 726.238042][T27388] __nla_validate_parse: 8 callbacks suppressed [ 726.238059][T27388] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5541'. [ 726.298138][T27391] netlink: 'syz.0.5541': attribute type 17 has an invalid length. [ 726.342502][T27389] bridge0: port 1(bridge_slave_0) entered disabled state [ 726.396297][T27389] tipc: Resetting bearer [ 726.410691][T27389] tipc: Resetting bearer [ 726.478674][T27391] veth1_vlan: left promiscuous mode [ 726.486361][T27404] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5544'. [ 726.486873][T27391] veth0_vlan: left promiscuous mode [ 726.505171][T27391] veth0_vlan: entered promiscuous mode [ 726.524314][T27391] veth1_vlan: entered promiscuous mode [ 726.549528][T27391] veth1_macvtap: left promiscuous mode [ 726.569491][T27391] veth0_macvtap: left promiscuous mode [ 726.577009][T27391] veth0_macvtap: entered promiscuous mode [ 726.587491][T27391] veth1_macvtap: entered promiscuous mode [ 726.598474][T27391] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 726.618384][T27405] netlink: 16178 bytes leftover after parsing attributes in process `syz.2.5543'. [ 726.629181][T22640] bridge0: port 2(bridge_slave_1) entered blocking state [ 726.636340][T22640] bridge0: port 2(bridge_slave_1) entered forwarding state [ 726.690219][T27402] netlink: 'syz.3.5545': attribute type 4 has an invalid length. [ 726.702069][T22641] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.721893][T22641] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.781858][T22641] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.807522][T22641] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.838812][T27412] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5547'. [ 726.849997][T27413] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5547'. [ 726.860945][T22641] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 726.871316][T22641] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.908864][T22641] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 726.917460][T22641] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 726.995888][T22636] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 727.016523][T22636] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.100323][T22640] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 727.110371][T22640] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 727.322702][T27435] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5553'. [ 727.348231][T27435] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5553'. [ 727.361946][T27440] netlink: 'syz.0.5554': attribute type 1 has an invalid length. [ 727.377444][T27440] netlink: 'syz.0.5554': attribute type 4 has an invalid length. [ 727.397693][T27440] netlink: 9462 bytes leftover after parsing attributes in process `syz.0.5554'. [ 727.740762][T27472] netlink: 14 bytes leftover after parsing attributes in process `syz.3.5560'. [ 727.822867][T27480] netlink: 68 bytes leftover after parsing attributes in process `syz.2.5561'. [ 727.843951][T27453] veth1_to_bond: entered allmulticast mode [ 727.882215][T27484] sctp: [Deprecated]: syz.0.5564 (pid 27484) Use of int in max_burst socket option deprecated. [ 727.882215][T27484] Use struct sctp_assoc_value instead [ 727.942858][T27452] veth1_to_bond: left allmulticast mode [ 728.059653][T27492] netlink: 'syz.2.5565': attribute type 2 has an invalid length. [ 728.083390][T27492] netlink: 'syz.2.5565': attribute type 11 has an invalid length. [ 728.456765][T27521] syz_tun (unregistering): left allmulticast mode [ 728.461153][T27520] netlink: 'syz.4.5571': attribute type 1 has an invalid length. [ 728.639146][T27533] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 728.696707][T27539] lo speed is unknown, defaulting to 1000 [ 729.027218][T27556] veth1: entered promiscuous mode [ 729.034678][T27556] vlan0: entered promiscuous mode [ 729.396213][T27581] RDS: rds_bind could not find a transport for fec0:ffff::1, load rds_tcp or rds_rdma? [ 729.672198][T27595] tipc: Resetting bearer [ 730.278018][T27626] ------------[ cut here ]------------ [ 730.283649][T27626] diff > ((u16)~0U) [ 730.283672][T27626] WARNING: ./include/net/netlink.h:2265 at br_fill_linkxstats+0x9e7/0xae0, CPU#1: syz.2.5599/27626 [ 730.298624][T27626] Modules linked in: [ 730.303405][T27626] CPU: 1 UID: 0 PID: 27626 Comm: syz.2.5599 Not tainted syzkaller #0 PREEMPT(full) [ 730.312849][T27626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 730.322978][T27626] RIP: 0010:br_fill_linkxstats+0x9e7/0xae0 [ 730.328967][T27626] Code: b6 bd 08 48 3b 84 24 60 01 00 00 75 33 44 89 f0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 50 8f 30 01 cc e8 0a 1b 49 f7 90 <0f> 0b 90 e9 bc fe ff ff e8 fc 1a 49 f7 90 0f 0b 90 e9 53 ff ff ff [ 730.349007][T27626] RSP: 0018:ffffc9000d04f160 EFLAGS: 00010287 [ 730.352554][T27629] netlink: 'syz.2.5599': attribute type 160 has an invalid length. [ 730.355447][T27626] RAX: ffffffff8a7ca956 RBX: 0000000000013550 RCX: 0000000000080000 [ 730.355466][T27626] RDX: ffffc90010069000 RSI: 0000000000006616 RDI: 0000000000006617 [ 730.355480][T27626] RBP: ffffc9000d04f310 R08: 0000000000000000 R09: 0000000000000000 [ 730.355493][T27626] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 [ 730.355505][T27626] R13: 1ffff92001a09e40 R14: 0000000000000000 R15: dffffc0000000000 [ 730.355519][T27626] FS: 00007f437e58c6c0(0000) GS:ffff88812537a000(0000) knlGS:0000000000000000 [ 730.355536][T27626] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 730.355550][T27626] CR2: 00007f7ecf36ab4c CR3: 000000003d060000 CR4: 00000000003526f0 [ 730.355568][T27626] Call Trace: [ 730.355637][T27626] [ 730.355729][T27626] ? __pfx_br_fill_linkxstats+0x10/0x10 [ 730.441257][T27626] ? __alloc_frozen_pages_noprof+0x1de/0x380 [ 730.447546][T27626] ? nla_put+0xd0/0x150 [ 730.451868][T27626] ? __asan_memcpy+0x40/0x70 [ 730.456600][T27626] ? nla_put+0xd0/0x150 [ 730.460798][T27626] rtnl_fill_statsinfo+0x541/0x26f0 [ 730.466201][T27626] ? __pfx_rtnl_fill_statsinfo+0x10/0x10 [ 730.471846][T27626] ? __kmalloc_node_track_caller_noprof+0x4f9/0x7b0 [ 730.478543][T27626] ? __alloc_skb+0x4e5/0x7d0 [ 730.483320][T27626] rtnl_stats_get+0x4b6/0x6d0 [ 730.488069][T27626] ? __pfx_rtnl_stats_get+0x10/0x10 [ 730.493510][T27626] ? __pfx_rtnl_stats_get+0x10/0x10 [ 730.498744][T27626] rtnetlink_rcv_msg+0x77e/0xbe0 [ 730.503935][T27626] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 730.509064][T27626] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 730.514734][T27626] ? ref_tracker_free+0x693/0x840 [ 730.519851][T27626] ? __pfx_ref_tracker_free+0x10/0x10 [ 730.525342][T27626] netlink_rcv_skb+0x232/0x4b0 [ 730.530199][T27626] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 730.535735][T27626] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 730.541042][T27626] ? netlink_deliver_tap+0x2e/0x1b0 [ 730.546300][T27626] ? netlink_deliver_tap+0x2e/0x1b0 [ 730.551515][T27626] netlink_unicast+0x75c/0x8e0 [ 730.556447][T27626] netlink_sendmsg+0x813/0xb40 [ 730.561231][T27626] ? __pfx_netlink_sendmsg+0x10/0x10 [ 730.566586][T27626] ? aa_sock_msg_perm+0xf1/0x1b0 [ 730.571641][T27626] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 730.577073][T27626] ____sys_sendmsg+0x972/0x9f0 [ 730.581898][T27626] ? __might_fault+0xaf/0x130 [ 730.586784][T27626] ? __pfx_____sys_sendmsg+0x10/0x10 [ 730.592094][T27626] ? import_iovec+0x73/0xa0 [ 730.596765][T27626] ___sys_sendmsg+0x2a5/0x360 [ 730.601447][T27626] ? __lock_acquire+0x6b5/0x2cf0 [ 730.606489][T27626] ? __pfx____sys_sendmsg+0x10/0x10 [ 730.611708][T27626] ? futex_wait+0x2a2/0x390 [ 730.616346][T27626] ? __fget_files+0x2a/0x420 [ 730.620970][T27626] ? __fget_files+0x3a0/0x420 [ 730.625769][T27626] __x64_sys_sendmsg+0x1bd/0x2a0 [ 730.630722][T27626] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 730.636274][T27626] ? rcu_is_watching+0x15/0xb0 [ 730.641077][T27626] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.647308][T27626] do_syscall_64+0x15f/0xf80 [ 730.652024][T27626] ? trace_irq_disable+0x3b/0x140 [ 730.657165][T27626] ? clear_bhb_loop+0x40/0x90 [ 730.661861][T27626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.667903][T27626] RIP: 0033:0x7f437d79ce59 [ 730.672330][T27626] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 730.692045][T27626] RSP: 002b:00007f437e58c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 730.700523][T27626] RAX: ffffffffffffffda RBX: 00007f437da16090 RCX: 00007f437d79ce59 [ 730.708582][T27626] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000a [ 730.712816][T27635] netlink: 'syz.0.5598': attribute type 11 has an invalid length. [ 730.716650][T27626] RBP: 00007f437d832d6f R08: 0000000000000000 R09: 0000000000000000 [ 730.716668][T27626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 730.716687][T27626] R13: 00007f437da16128 R14: 00007f437da16090 R15: 00007ffe687b3418 [ 730.716720][T27626] [ 730.716750][T27626] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 730.716764][T27626] CPU: 1 UID: 0 PID: 27626 Comm: syz.2.5599 Not tainted syzkaller #0 PREEMPT(full) [ 730.716784][T27626] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 730.716796][T27626] Call Trace: [ 730.716804][T27626] [ 730.716812][T27626] vpanic+0x56c/0xa60 [ 730.716869][T27626] ? __pfx__printk+0x10/0x10 [ 730.716892][T27626] ? __pfx_vpanic+0x10/0x10 [ 730.716910][T27626] ? is_bpf_text_address+0x292/0x2b0 [ 730.716929][T27626] ? is_bpf_text_address+0x26/0x2b0 [ 730.716956][T27626] panic+0xc5/0xd0 [ 730.716974][T27626] ? __pfx_panic+0x10/0x10 [ 730.717011][T27626] __warn+0x315/0x4c0 [ 730.717030][T27626] ? br_fill_linkxstats+0x9e7/0xae0 [ 730.717053][T27626] ? br_fill_linkxstats+0x9e7/0xae0 [ 730.717074][T27626] __report_bug+0x29a/0x540 [ 730.717166][T27626] ? br_fill_linkxstats+0x9e7/0xae0 [ 730.717185][T27626] ? __pfx___report_bug+0x10/0x10 [ 730.717216][T27626] ? irqentry_exit+0x218/0x760 [ 730.717265][T27626] ? trace_irq_disable+0x3b/0x140 [ 730.717293][T27626] ? br_fill_linkxstats+0x9e7/0xae0 [ 730.717309][T27626] report_bug+0x16a/0x220 [ 730.717328][T27626] ? br_fill_linkxstats+0x9e7/0xae0 [ 730.717345][T27626] ? br_fill_linkxstats+0x9e9/0xae0 [ 730.717363][T27626] handle_bug+0x9c/0x200 [ 730.717382][T27626] exc_invalid_op+0x1a/0x50 [ 730.717400][T27626] asm_exc_invalid_op+0x1a/0x20 [ 730.717418][T27626] RIP: 0010:br_fill_linkxstats+0x9e7/0xae0 [ 730.717438][T27626] Code: b6 bd 08 48 3b 84 24 60 01 00 00 75 33 44 89 f0 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 50 8f 30 01 cc e8 0a 1b 49 f7 90 <0f> 0b 90 e9 bc fe ff ff e8 fc 1a 49 f7 90 0f 0b 90 e9 53 ff ff ff [ 730.717452][T27626] RSP: 0018:ffffc9000d04f160 EFLAGS: 00010287 [ 730.717469][T27626] RAX: ffffffff8a7ca956 RBX: 0000000000013550 RCX: 0000000000080000 [ 730.717481][T27626] RDX: ffffc90010069000 RSI: 0000000000006616 RDI: 0000000000006617 [ 730.717493][T27626] RBP: ffffc9000d04f310 R08: 0000000000000000 R09: 0000000000000000 [ 730.717505][T27626] R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 [ 730.717516][T27626] R13: 1ffff92001a09e40 R14: 0000000000000000 R15: dffffc0000000000 [ 730.717535][T27626] ? br_fill_linkxstats+0x9e6/0xae0 [ 730.717577][T27626] ? __pfx_br_fill_linkxstats+0x10/0x10 [ 730.717595][T27626] ? __alloc_frozen_pages_noprof+0x1de/0x380 [ 730.717629][T27626] ? nla_put+0xd0/0x150 [ 730.717646][T27626] ? __asan_memcpy+0x40/0x70 [ 730.717668][T27626] ? nla_put+0xd0/0x150 [ 730.717694][T27626] rtnl_fill_statsinfo+0x541/0x26f0 [ 730.717733][T27626] ? __pfx_rtnl_fill_statsinfo+0x10/0x10 [ 730.717752][T27626] ? __kmalloc_node_track_caller_noprof+0x4f9/0x7b0 [ 730.717784][T27626] ? __alloc_skb+0x4e5/0x7d0 [ 730.717810][T27626] rtnl_stats_get+0x4b6/0x6d0 [ 730.717842][T27626] ? __pfx_rtnl_stats_get+0x10/0x10 [ 730.717876][T27626] ? __pfx_rtnl_stats_get+0x10/0x10 [ 730.717898][T27626] rtnetlink_rcv_msg+0x77e/0xbe0 [ 730.717925][T27626] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 730.717947][T27626] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 730.717968][T27626] ? ref_tracker_free+0x693/0x840 [ 730.717992][T27626] ? __pfx_ref_tracker_free+0x10/0x10 [ 730.718025][T27626] netlink_rcv_skb+0x232/0x4b0 [ 730.718044][T27626] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 730.718068][T27626] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 730.718098][T27626] ? netlink_deliver_tap+0x2e/0x1b0 [ 730.718116][T27626] ? netlink_deliver_tap+0x2e/0x1b0 [ 730.718138][T27626] netlink_unicast+0x75c/0x8e0 [ 730.718172][T27626] netlink_sendmsg+0x813/0xb40 [ 730.718198][T27626] ? __pfx_netlink_sendmsg+0x10/0x10 [ 730.718219][T27626] ? aa_sock_msg_perm+0xf1/0x1b0 [ 730.718243][T27626] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 730.718267][T27626] ____sys_sendmsg+0x972/0x9f0 [ 730.718284][T27626] ? __might_fault+0xaf/0x130 [ 730.718311][T27626] ? __pfx_____sys_sendmsg+0x10/0x10 [ 730.718337][T27626] ? import_iovec+0x73/0xa0 [ 730.718364][T27626] ___sys_sendmsg+0x2a5/0x360 [ 730.718380][T27626] ? __lock_acquire+0x6b5/0x2cf0 [ 730.718403][T27626] ? __pfx____sys_sendmsg+0x10/0x10 [ 730.718427][T27626] ? futex_wait+0x2a2/0x390 [ 730.718474][T27626] ? __fget_files+0x2a/0x420 [ 730.718493][T27626] ? __fget_files+0x3a0/0x420 [ 730.718523][T27626] __x64_sys_sendmsg+0x1bd/0x2a0 [ 730.718543][T27626] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 730.718568][T27626] ? rcu_is_watching+0x15/0xb0 [ 730.718598][T27626] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.718617][T27626] do_syscall_64+0x15f/0xf80 [ 730.718640][T27626] ? trace_irq_disable+0x3b/0x140 [ 730.718663][T27626] ? clear_bhb_loop+0x40/0x90 [ 730.718689][T27626] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 730.718706][T27626] RIP: 0033:0x7f437d79ce59 [ 730.718723][T27626] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 730.718737][T27626] RSP: 002b:00007f437e58c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 730.718754][T27626] RAX: ffffffffffffffda RBX: 00007f437da16090 RCX: 00007f437d79ce59 [ 730.718766][T27626] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000a [ 730.718777][T27626] RBP: 00007f437d832d6f R08: 0000000000000000 R09: 0000000000000000 [ 730.718788][T27626] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 730.718799][T27626] R13: 00007f437da16128 R14: 00007f437da16090 R15: 00007ffe687b3418 [ 730.718828][T27626] [ 730.725346][T27626] Kernel Offset: disabled