last executing test programs: 11.476747819s ago: executing program 1 (id=6041): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$igmp(0x2, 0x3, 0x2) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x0}, 0x20) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'netdevsim0\x00', 0x0}) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5c0100001000130700000000ffdbdf25e0000001000000000000000000000000ff020000000000000000000000000001000400004e2100020000000021000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc020000000000000000000000000001000004d632000000fc020000000000000000000000000000050000000000000000000000000000000000000000000000090000000000000001000000ffffffff0000000000000000010000800000000043050000000000000400000000000000ffffffffffffff7f000100000000000001000000000000000000000000000000000000002cbd7000053500000a000400500000000000000060001200726663343130362867636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000080000000210466d38547aa140db9a200000000c538c7cb7a0c001c00", @ANYRESDEC=r2, @ANYBLOB='\a\x00'], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 11.348167473s ago: executing program 1 (id=6042): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00"], 0x64}}, 0x0) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="340000002e0003050000000000000000200000f8ffffffffffffff0008000000", @ANYRES32, @ANYBLOB="0c000f"], 0x34}], 0x1}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000000)=@newlink={0x4c, 0x10, 0x503, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6230}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @gtp={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GTP_ROLE={0x8, 0x4, 0x1}, @IFLA_GTP_FD0={0x8, 0x1, @udp=r2}]}}}, @IFLA_ADDRESS={0xa, 0x3, @random="3a712f0756b8"}]}, 0x4c}}, 0x0) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000080)={0xffffffffffffffff, 0x200, 0x18}, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x60, 0x60, 0x3, [@struct={0xf, 0x7, 0x0, 0x4, 0x0, 0x1, [{0xc, 0x0, 0x5}, {0xf, 0x4, 0x8}, {0x9, 0x1, 0x1}, {0xd, 0x0, 0x80000000}, {0xb, 0x0, 0x9}, {0x10, 0x5, 0x8}, {0x3, 0x0, 0x2}]}]}, {0x0, [0x30]}}, &(0x7f00000004c0)=""/240, 0x7b, 0xf0, 0x0, 0x4}, 0x28) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000140)=0x0, &(0x7f0000000240)=0x4) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000340)=0xffffffffffffffff, 0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@bloom_filter={0x1e, 0x2, 0x332, 0x0, 0x10, 0x1, 0xb64, '\x00', r3, r4, 0x2, 0x3, 0x4, 0x9}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1d, 0xc, &(0x7f00000001c0)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x92}}]}, &(0x7f0000000180)='syzkaller\x00', 0x4, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2b}, 0x94) 11.19141805s ago: executing program 1 (id=6043): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) close(r0) r1 = getpid() (async, rerun: 64) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@getqdisc={0x24, 0x26, 0x10, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x1, 0x5}, {0x10, 0xd}, {0xfff3, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x20040000) (async, rerun: 32) r2 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32) r3 = socket(0x10, 0x803, 0x0) sendto(r3, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0xffffffffffffff2f}}], 0x4000000000003b4, 0x2040000, &(0x7f0000003700)={0x77359400}) getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async, rerun: 32) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r5, {0x0, 0x8}, {0xffff, 0xffff}, {0x0, 0x5}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xc, 0x2, {0x2, 0xfffffff7}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80d1}, 0x34008098) (async) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$unix(r0, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000240)='C', 0x1}], 0x1, &(0x7f0000000e00)=[@cred={{0x1c, 0x1, 0x2, {r1, 0x0, 0xee01}}}], 0x20, 0x10}, 0x80) r6 = syz_open_procfs$namespace(r1, &(0x7f0000000000)='ns/time_for_children\x00') ioctl$EXT4_IOC_SETFSUUID(r6, 0x4008662c, 0x0) 11.109148601s ago: executing program 1 (id=6044): socket(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000480), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000a00)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0x4}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x44, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xcdd68600331fc8b7}, @TCA_TBF_PARMS={0x28, 0x1, {{0x10, 0x1, 0x0, 0x5, 0x0, 0x1}, {0x8, 0x2, 0xd, 0xf, 0x8, 0x7}, 0x0, 0x2, 0xde4}}, @TCA_TBF_RATE64={0xc, 0x4, 0x2ef0682d0c86cfd3}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r9) r10 = socket$unix(0x1, 0x2, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0x80000, {0x0, 0x0, 0x0, r12, {0x0, 0x6}, {0x2, 0xb}, {0xffe0, 0xb}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0xb, 0x5, 0xcac, 0xc}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x2404c0f1}, 0x4008000) ioctl$SIOCSIFHWADDR(r9, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0xfff2}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xb5b}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4008845}, 0x0) r13 = socket$unix(0x1, 0x1, 0x0) r14 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r14, &(0x7f00000000c0)={&(0x7f0000000140)=@xdp={0x2c, 0xa888, r15, 0x34}, 0x80, &(0x7f0000000500)=[{&(0x7f00000002c0)="f2", 0x1}], 0x1}, 0x4000084) 9.671602424s ago: executing program 1 (id=6050): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x58}}, 0x0) 9.522473725s ago: executing program 1 (id=6051): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) syz_emit_ethernet(0x74, &(0x7f0000000000)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x73, 0x0, @private=0x300, @multicast1}, {0x0, 0x0, 0xfffffe9a, 0x0, @gue={{0x2}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f00000004c0)=ANY=[], 0x0, 0x47a, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffffffffffd9d}, 0x94) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xe}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000340)={0x4, 0x5, 0x4, 0x6, 0x7, 0x8004, 0x0, 0x4, r5}, 0x20) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f00000001c0)={r5, 0x3ff8}, &(0x7f0000000240)=0x8) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_buf(r6, 0x29, 0x2f, &(0x7f0000001240)="432997c4f818dd26399e12cf2c6f3b8dfbb623b237b9a33e082cd95eac141f73d458c9cedb8345fb80c2cc8b156b2e445513e0e4a67088e76cf049455a3c728bf28cec32f84d52a6922e142cb7b7dc494d3a858adde7570e9109dfb6d8b85bb1190c1a2c8fdd9465268852f4c3acf41fcc21cf3546f3f24f3b269d025ec3ee302b6a888f80f3333d0a6ccffd1784c4b6ed7f5491b32bf8c5dad0adf4dec6bc27bc1f7819779aded59b87e004e3d5697b2f655e7683701586014e31c4378cf877e8f0e9395199a09080b56e08092ee9939dae58c953ec49d94fb2a5957c53e6cdd384a35a3f962e96a7225fa723e8542a4d29c7089fe079609dac364b83e97f9945ff1960f9a1798c", 0x108) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r10, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000022c0)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {}, {0x4, 0xe}}}, 0x24}, 0x1, 0x0, 0x0, 0xf7513c36066f8910}, 0x20000010) sendmsg$nl_route_sched(r7, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001740)=@newqdisc={0x2c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r9, {}, {}, {0xa, 0x3}}, [@TCA_RATE={0x6, 0x5, {0x7, 0x1}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40098}, 0x0) r12 = socket$netlink(0x10, 0x3, 0x0) r13 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r13, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r13, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r14, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r12, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000004c0)=ANY=[@ANYBLOB="580000001099adc4001ff826bd70000100000000000000d95d6417d4248428a2d8f1f2b7a8f24a3b4f7d6dca7f83bf51d9261159362dd39e320a2aec60b73b9e704a84", @ANYRES32=0x0, @ANYBLOB="0000000000000000300012800b00010067656e65766500002000028005000a0001000000140007002001000000000000000000000000000008000a00", @ANYRES32=r14, @ANYBLOB], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 5.502088466s ago: executing program 3 (id=6092): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x7c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x2}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x3}, @NFTA_NAT_TYPE={0x8}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xa4}}, 0x0) (fail_nth: 22) 5.405242025s ago: executing program 3 (id=6093): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4543(gcm(aes))\x00'}, 0x58) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa802, 0x0) close(r3) socket(0x10, 0x803, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x1, 0xd}, {}, {0x8, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x24048840}, 0x40004) recvmmsg(r6, &(0x7f0000001480)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000040)=""/55, 0x37}, {&(0x7f0000000540)=""/189, 0xbd}, {&(0x7f0000001ac0)=""/4096, 0x1000}, {&(0x7f0000000940)=""/74, 0x4a}], 0x4}, 0x5d}], 0x1b00, 0x10022, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r1, 0x117, 0x5, 0x0, 0x4) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) r9 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$tcp_congestion(r9, 0x0, 0xeffd) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r11 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000140)={{0xa, 0x4e23, 0x1, @loopback, 0xfffffe00}, {0xa, 0x4e22, 0x8, @remote, 0x10001}, 0x1, {[0x40, 0x7, 0xc74a, 0x7, 0xffe00000, 0xfffffffe, 0xfff, 0x1]}}, 0x5c) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r13, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000380)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0x4}, {0xffff, 0xffff}, {0xe, 0x1}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x7, 0x1}}}}, @TCA_RATE={0x6, 0x5, {0x0, 0xc1}}]}, 0x48}, 0x1, 0x0, 0x0, 0x400dc}, 0x4000080) 4.935905305s ago: executing program 0 (id=6098): ioctl$XFS_IOC_PATH_TO_HANDLE(0xffffffffffffffff, 0xc0385869, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000000)='\\\x00', 0x111040, &(0x7f0000000040)={@_ha_fsid={[0x7, 0x6]}, {0x7, 0xc9d, 0x800, 0x7}}, 0x6, &(0x7f0000000080)={@_ha_fsid}, &(0x7f00000000c0)=0xfffffffa}) ioctl$SIOCX25SENDCALLACCPT(r0, 0x89e9) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_SET_SHORT_ADDR(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x20, r2, 0x600, 0x70bd26, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x20}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000002c0)=0x0) sendmsg$NFC_CMD_START_POLL(r1, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x4c, 0x0, 0x2, 0x70bd29, 0x25dfdbfd, {}, [@NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x3a}, @NFC_ATTR_IM_PROTOCOLS={0x8, 0xd, 0x90}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x90}, @NFC_ATTR_PROTOCOLS={0x8, 0x3, 0x98}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}, @NFC_ATTR_TM_PROTOCOLS={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000040) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r1) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x5c, r5, 0x1, 0x70bd2c, 0x25dfdbff, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'geneve0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @mcast1}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @multicast2}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000004}, 0x9000) sendmsg$NL802154_CMD_SET_LBT_MODE(r4, &(0x7f0000000640)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x28, r2, 0x800, 0x70bd28, 0x25dfdbff, {}, [@NL802154_ATTR_LBT_MODE={0x5}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x20040004) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000006c0)={'wpan4\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_KEY(r1, &(0x7f0000000840)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000800)={&(0x7f0000000700)={0xf8, r2, 0x20, 0x70bd2a, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_KEY={0xb8, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xf7}, @NL802154_KEY_ATTR_ID={0x80, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}]}, @NL802154_KEY_ID_ATTR_INDEX={0x5, 0x2, 0x3}, @NL802154_KEY_ID_ATTR_IMPLICIT={0x40, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa3}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa1}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}, @NL802154_DEV_ADDR_ATTR_EXTENDED={0xc, 0x4, {0xaaaaaaaaaaaa0302}}]}, @NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa2}]}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x2}]}, @NL802154_KEY_ATTR_ID={0x2c, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x3}]}, @NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_SHORT={0x8, 0x4, 0x4}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6}]}]}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0xf8}, 0x1, 0x0, 0x0, 0x20001005}, 0x200008c0) r7 = socket(0x9, 0x3, 0x5) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r7, 0x89f2, &(0x7f0000000a00)={'tunl0\x00', &(0x7f00000008c0)={'ip_vti0\x00', 0x0, 0x10, 0x7f87, 0x2, 0xfff, {{0x3b, 0x4, 0x2, 0x33, 0xec, 0x65, 0x0, 0x1, 0x4, 0x0, @multicast1, @rand_addr=0x64010100, {[@lsrr={0x83, 0xf, 0x54, [@private=0xa010100, @multicast2, @local]}, @timestamp={0x44, 0x8, 0x44, 0x0, 0x6, [0x70ad]}, @cipso={0x86, 0x35, 0x3, [{0x0, 0x8, "ae3e828d6199"}, {0x0, 0xa, "e7f7e9e0c59274fc"}, {0x0, 0xf, "776c6520a1cc82e12e8c9a48c2"}, {0x7, 0xe, "455d387a3e73b9bdeca5dc9f"}]}, @timestamp={0x44, 0x28, 0xfc, 0x0, 0x1, [0x63, 0x7, 0xd, 0xc, 0x8, 0x58f6, 0x7ff, 0x5, 0x3]}, @timestamp_prespec={0x44, 0x3c, 0xfd, 0x3, 0x1, [{@local, 0x8}, {@broadcast, 0xf7}, {@remote, 0x2}, {@rand_addr=0x64010101, 0x2}, {@rand_addr=0x64010102, 0x7}, {@multicast1, 0x6}, {@dev={0xac, 0x14, 0x14, 0x3a}, 0xfffffff8}]}, @generic={0x88, 0x6, "037539e5"}, @lsrr={0x83, 0x1f, 0xde, [@broadcast, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010100]}]}}}}}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000ac0)={&(0x7f0000000880)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)=@delqdisc={0x2c, 0x25, 0x20, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0xf, 0xe}, {0xffff, 0xe}, {0xffff, 0xffe0}}, [@TCA_RATE={0x6, 0x5, {0x0, 0x1}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x24008000) recvmsg$unix(r7, &(0x7f00000022c0)={&(0x7f0000000b00)=@abs, 0x6e, &(0x7f0000002180)=[{&(0x7f0000000b80)=""/195, 0xc3}, {&(0x7f0000000c80)=""/213, 0xd5}, {&(0x7f0000000d80)=""/200, 0xc8}, {&(0x7f0000000e80)=""/147, 0x93}, {&(0x7f0000000f40)=""/221, 0xdd}, {&(0x7f0000001040)=""/73, 0x49}, {&(0x7f00000010c0)=""/4096, 0x1000}, {&(0x7f00000020c0)=""/26, 0x1a}, {&(0x7f0000002100)=""/4, 0x4}, {&(0x7f0000002140)=""/61, 0x3d}], 0xa, &(0x7f0000002240)=[@rights={{0x10}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x60}, 0x143) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r7, 0x89f2, &(0x7f0000002380)={'ip6gre0\x00', &(0x7f0000002300)={'ip6_vti0\x00', r8, 0x29, 0x8, 0x8, 0x200, 0x30, @private0, @private1={0xfc, 0x1, '\x00', 0x1}, 0x7, 0x7, 0x7, 0x1dc7}}) write$nci(r12, &(0x7f00000023c0)=@NCI_GID_PROPRIETARY_RSP={0xf, 0x0, 0x2, 0x0, 0x6, "39cd9f63f7cbd22602b41ec422553b3de385bdd0df0bab96f0fb9e2fa393e387e107b8d717ff0d8c67c77b77f33f3112615d6d54acb40a914fd5ad0ed6ef97ca95cd18aee25d34d14921d9e2a12c6c19727cbdb459aa2502f626d052afc1345202bda1cba831670718bbc1ae5e0b3a6701d2353ad34b87d90ec92c78906e2a8c4ecf0029e43e310313afab549779f5cbfeaf4a80b46efa42db8ca941627702dcfd5a1513f1ea68546754327a"}, 0xaf) socket$inet(0x2, 0x800, 0x8) getsockopt$packet_buf(r7, 0x107, 0x6, &(0x7f0000002480)=""/188, &(0x7f0000002540)=0xbc) ioctl$SIOCX25SCAUSEDIAG(r0, 0x89ec, &(0x7f0000002580)={0x5}) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$devlink(&(0x7f0000002600), r0) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r13, &(0x7f0000002700)={&(0x7f00000025c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000026c0)={&(0x7f0000002640)={0x60, r14, 0x200, 0x70bd27, 0x25dfdbfc, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0xfffffff3}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x70000000}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000002c00)={&(0x7f0000002740)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000002bc0)={&(0x7f0000002780)={0x438, 0x38, 0x20, 0x70bd2a, 0x25dfdbfe, {0x13}, [@nested={0x183, 0x24, 0x0, 0x1, [@nested={0x4, 0xca}, @typed={0xc, 0xa0, 0x0, 0x0, @u64=0xb}, @typed={0x8, 0x121, 0x0, 0x0, @pid=r10}, @generic="45b5ce3d28f3d48b84e8bd542019c330837198c76dbb393935ed568ed845115c6a3575c17ebb56124ac3dd3a50cc3f2448ccb82e5debf8758fb8452d1a0490772cc9d0db1fdf7eca2d2564f12a73563c61a1db65ecbbb4f1d00aaab9e4fecbc72f6a043024e7ba0dce332a60346e8a38019a820e2b38b085dc0d247a7e36b27aadd30d314234a227298c479df11cb0a99430a8a42015addff44e4c6a54ee19fd6091161348ef9595fc23a4bae1b05061d71ebc350a2a8a40ba66ec97e30bf962d7e895561cdf9fbcc45bada18ff760eabdb8ec44d96303", @generic="44a3c794bfb260492afaae7f54d61438eeec9527a9cbb34e8c1f75f4adad86890c239c311cce1b6410cfc7f81b18ebd10a375ad312fc1577b8e1ecd4486b0579b4bb036b9a779f7db4745416fc9bb038c953e8ed590346d389dc16b035f0abaeeea404a1a57d0608052be76dadc34fa0d703a61151bd712cff2d04d64a3bccfb4e70a01e9ee86c7d4cc9edfc19725a00"]}, @nested={0x29d, 0x6e, 0x0, 0x1, [@generic="4bed14afde707b3c53d0bc3f545dde4406da05b11c05eea6d42f1ea767cc4f838f575ed5441badbae784faf60f9be522cb9eea7c3aed51a5224949a540d804c9c77f5a0d76de5e2ec83a485e8643397f75e2b278a0e97e43736234c70cea57287f2aee41c0be6b5f24e32c970216d0825f75ece5e9a43283977c61a0e894f3ed12e666df00bafb81913c32c16fe188bb0fabc95154fbd122ab4260aecddffbf694e8e962349617102f41010da36c9536c58ac65c20bea0a30563767b6901389a1050320c6f40874d8dbbdb652b8495cd78ea87ff7182b3c806d0cf6fe95441382ca9ecbee996723f692820d862cf23", @nested={0x4, 0xa6}, @generic="60b08f26668975eeee8fcbe4517d1505a52a2a9bba54d4263c336bb1bcb5b5e415247121de962948cebe81f40e9d7294f2b375b9cbb412a5bd891fd340afe7e0a68fdbb09db6436a5856d6473004b2", @generic="29fcede5467879e13df373f8e362505dfaf41864f34dbd8b75b697d6ef35779fc671479eea54ee140445f8da77f7", @nested={0x4, 0x37}, @nested={0x4, 0x6}, @typed={0xbb, 0xba, 0x0, 0x0, @binary="c3b42be36679c721ff6a923aa99723df494cf24e035408a504cf9efddada8c1f850f8107cb9eb4e2ca517e392787a577dbd8228f146d02af8813b10da2f1141ba4cd8ce6c497cdc9eb88d4264b70877dfebaff0e2b2156fc69446749d74552da25dbed9f0e799ad082c2e6872a047713bf8cbcc1776be194876ec1b394cf2e3c5fd1da2f425f531e69790485ec2718332f539a75ceeb85cb59d83e8f412415d7699d7e230a520ccf5a2242e1f4af53c9216f5d73bfecfd"}, @typed={0x8, 0x6e, 0x0, 0x0, @uid=r11}, @generic="fea33eb906f725468bba980ed698fe3b08755c1a30bbd8309ef333ef5891e085add03aae801703010e959e07a0f2fffaed003baabd57056c57ac326f57c9ad8f2eeac2bbbad48565a008b85172e681a0a71ba0215c4fc771082941049f"]}]}, 0x438}, 0x1, 0x0, 0x0, 0x20040000}, 0x850) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r0, 0xf501, 0x0) r15 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r15, &(0x7f0000002d00)={&(0x7f0000002c40)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000002cc0)={&(0x7f0000002c80)={0x1c, r5, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc810}, 0x90) sendmsg$NL80211_CMD_SET_INTERFACE(r9, &(0x7f0000003000)={&(0x7f0000002d40)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000002fc0)={&(0x7f0000002e00)={0x19c, 0x0, 0x8, 0x70bd2a, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0xd0aa, 0x4a}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @mon_options=[@NL80211_ATTR_MNTR_FLAGS={0x28, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0xc, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}]}], @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "911bd5f2fb35f275a29672d30d318cd354142a06fc039459"}], @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "fcd1d5582039c5ea22a521f8582f36645a22d555749cd828"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "fa51220a0e23d71544972b78d75581733a7833d064ca109c"}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR={0xa}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "28d13e093bdb323dc72f4da0f7a8d0a459a4d44198fb7978"}, @NL80211_ATTR_MNTR_FLAGS={0x1c, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}, @NL80211_MNTR_FLAG_PLCPFAIL={0x4}, @NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_OTHER_BSS={0x4}]}, @NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_ACTIVE={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}], @NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}, @NL80211_ATTR_MESH_ID={0xa}, @mon_options=[@NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "df36f43ba609999ae8594f328073e6cfa89e3a0721c6a763"}, @NL80211_ATTR_MNTR_FLAGS={0x18, 0x17, 0x0, 0x1, [@NL80211_MNTR_FLAG_COOK_FRAMES={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_CONTROL={0x4}, @NL80211_MNTR_FLAG_FCSFAIL={0x4}, @NL80211_MNTR_FLAG_COOK_FRAMES={0x4}]}, @NL80211_ATTR_MU_MIMO_GROUP_DATA={0x1c, 0xe7, "e9fd58e88436a496e32ae3ee2207c90db045d1fd99597f4a"}]]}, 0x19c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) 4.691306902s ago: executing program 0 (id=6100): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f00000017c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x19}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000000080)=ANY=[@ANYBLOB="c40000001900f3fe0000000000000000fe8000000000000000000000000000bbac1e000100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fcffffffffffffff00000000b86b6e0000000000000000000c0008"], 0xc4}}, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) ioctl$PPPIOCSACTIVE(0xffffffffffffffff, 0x40047459, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r2], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r3, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r4, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 3.820538989s ago: executing program 0 (id=6105): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000840), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000001400000008000f00fc00000018000180140002006e657464657673696d300000000000000800200000fcffff0800090000000000080011000000000008000e0080000000", @ANYRES64=r0], 0x5c}, 0x1, 0x0, 0x0, 0x800}, 0x0) 3.731556825s ago: executing program 0 (id=6106): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x6) accept4$bt_l2cap(r1, 0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)={'syztnl2\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x4, 0x8, 0x40, 0xfffffffe, 0x2, @private2, @private1, 0x8000, 0x1, 0xd, 0xff}}) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000001080)=0x8) connect$can_j1939(r3, &(0x7f00000000c0)={0x1d, r2, 0x1, {0x0, 0xff, 0x4}, 0x2}, 0x18) r5 = socket(0x40000000015, 0x5, 0x0) setsockopt$RDS_GET_MR(r5, 0x114, 0x2, &(0x7f0000000140)={{0x0}, 0x0, 0x3b}, 0x20) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) write$bt_hci(r6, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000ffff3201"], 0x138) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000100)={r4, 0x5}, 0x8) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000780)=@ipv4_newaddr={0x28, 0x14, 0x4, 0x70bd25, 0x25dfdbfb, {0x2, 0x18, 0x9c, 0x0, r2}, [@IFA_ADDRESS={0x8, 0x1, @remote}, @IFA_ADDRESS={0x8, 0x1, @multicast1}]}, 0x28}}, 0x10) sendmsg$rds(0xffffffffffffffff, &(0x7f0000002b00)={&(0x7f00000001c0)={0x2, 0x4e23, @private=0xa010100}, 0x10, &(0x7f0000002540)=[{&(0x7f00000002c0)=""/177, 0xb1}, {&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000002180)=""/149, 0x95}, {&(0x7f0000002240)=""/109, 0x6d}, {&(0x7f00000022c0)=""/8, 0x8}, {&(0x7f0000002300)=""/84, 0x54}, {&(0x7f0000002380)=""/165, 0xa5}, {&(0x7f0000002440)=""/223, 0xdf}], 0x8, &(0x7f00000028c0)=[@fadd={0x58, 0x114, 0x6, {{0x3, 0x2}, &(0x7f00000025c0)=0x4205, &(0x7f0000002600)=0x7fffffff, 0xff, 0x1, 0x4, 0xeb, 0x10, 0x746}}, @cswp={0x58, 0x114, 0x7, {{0xa9d, 0x401}, &(0x7f0000002640)=0x2914, &(0x7f0000002680)=0x97e, 0x0, 0x3, 0x9, 0x0, 0x2, 0x4}}, @rdma_dest={0x18, 0x114, 0x2, {0x1c, 0xc}}, @fadd={0x58, 0x114, 0x6, {{0x5a, 0x3}, &(0x7f00000026c0)=0xffffffffffffab6d, &(0x7f0000002700)=0x1, 0xffffffffffffffff, 0x9, 0x462, 0xffff, 0x1, 0x8001}}, @mask_fadd={0x58, 0x114, 0x8, {{0x3, 0x10}, &(0x7f0000002740)=0x2, &(0x7f0000002780)=0x8000000000000000, 0x6, 0x36, 0x0, 0x5, 0x40, 0x401}}, @mask_cswp={0x58, 0x114, 0x9, {{0x80, 0x10000}, &(0x7f00000027c0)=0xfffffffffffffffb, &(0x7f0000002800)=0x5, 0x2, 0x7ff, 0xb27, 0x30, 0x11, 0x2}}, @cswp={0x58, 0x114, 0x7, {{0x3, 0x2}, &(0x7f0000002840)=0x8, &(0x7f0000002880)=0x7fffffffffffffff, 0xa, 0xa0, 0x9, 0x2000000000000, 0x4, 0x7168}}], 0x228}, 0x0) 3.621095855s ago: executing program 0 (id=6107): r0 = socket$l2tp(0x2, 0x2, 0x73) bind$l2tp(r0, &(0x7f00000000c0), 0x10) sendto$l2tp(r0, &(0x7f00000001c0)="e5786a0d000000000000003b", 0xc, 0xc0c1, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2e}, 0x2004}, 0x10) 1.936497161s ago: executing program 3 (id=6110): r0 = socket(0x10, 0x80003, 0x0) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000fe0000000000000008000f00fd000000", 0xb9) r1 = socket$igmp(0x2, 0x3, 0x2) syz_emit_ethernet(0x5e, &(0x7f0000000080)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd308", 0x28, 0x6, 0x0, @local, @local, {[], {{0x3, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0xa, 0x2, 0x2, 0x0, 0x0, {[@fastopen={0x22, 0x12, "873d0f3206472b2e0c4e5103ad781518"}]}}}}}}}}, 0x0) setsockopt$MRT_FLUSH(r1, 0x0, 0xd1, 0x0, 0x0) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000000100)={0x1, 0x0, 0x0, 0x3206, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x33}, @remote}, 0x10) close(0x3) 1.891688016s ago: executing program 0 (id=6111): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @dynset={{0xb}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_DYNSET_FLAGS={0x8}, @NFTA_DYNSET_SREG_KEY={0x8}, @NFTA_DYNSET_OP={0x8}, @NFTA_DYNSET_SET_NAME={0x9, 0x1, 'syz0\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x90}}, 0x0) sendto(0xffffffffffffffff, 0x0, 0x0, 0x20044004, 0x0, 0x0) getsockopt$IP_SET_OP_GET_BYNAME(0xffffffffffffffff, 0x1, 0x53, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x9, 0x3, 0x1, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0xfffffffffffffff7}, {0x0, 0x8, 0xfffffffffffffff8, 0x8}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in=@multicast2, 0x2, 0x6c}, 0xa, @in=@empty, 0x0, 0x5, 0x0, 0xb7}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x32, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}}}, 0xb8}}, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.net/syz1\x00', 0x200002, 0x0) r5 = openat$cgroup_ro(r4, &(0x7f00000005c0)='cpuacct.usage_sys\x00', 0x275a, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_PROTOCOL(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x1, 0x6, 0x101, 0x0, 0x0, {0xa, 0x0, 0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x810}, 0x80) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x110, r8, 0x2f6dc000) write$cgroup_int(r6, &(0x7f0000000200)=0xffffffffffffffff, 0x12) sendfile(r6, r5, 0x0, 0xbdc4) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r9, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r10, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r11, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="500000000101030000000000000000000a00004ed10000802c00018014000300fc02000000000000000000000000000014000400ff020000000000000000000000009a7d6b872983423200010c000280"], 0x50}}, 0x0) 1.597912691s ago: executing program 3 (id=6112): r0 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000000)={'veth1_to_team\x00', &(0x7f0000000480)=@ethtool_ringparam={0x10, 0x106f, 0x6, 0x0, 0xbb63, 0x200, 0xc45, 0x6, 0x4}}) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000080)={'gretap0\x00', 0x0, 0x10, 0x1, 0x0, 0x64, {{0x11, 0x4, 0x2, 0x1, 0x44, 0x68, 0x0, 0xd4, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@ra={0x94, 0x4}, @ssrr={0x89, 0x1b, 0x7c, [@initdev={0xac, 0x1e, 0x0, 0x0}, @local, @broadcast, @empty, @loopback, @remote]}, @ra={0x94, 0x4}, @timestamp_addr={0x44, 0xc, 0xf, 0x1, 0xb, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4}]}]}}}}}) setsockopt$MRT6_DEL_MIF(0xffffffffffffffff, 0x29, 0xcb, &(0x7f0000000200)={0x0, 0x1, 0x5, r2}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@exit]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x24}, 0x94) 1.594698079s ago: executing program 4 (id=6113): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000004000ffff0900010073797a30000000000900020073797a3100000000140003"], 0x138}, 0x1, 0x0, 0x0, 0x20040855}, 0x0) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16, @ANYBLOB="01000000000000000000010000003800018006000100e2fffff7"], 0x4c}}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000040000701fefffff8ff000000017c0000040042800c000180060006"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc800) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="600000000206010100000000000000000000000a050001000700000009000200736c1db8ab000000140007800500150007002a00080012400000000514000300686173683a69702c706f72742c6970000500050002000000050004"], 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)={0x28, 0x1e, 0x21, 0x0, 0x0, {0x7}, [@typed={0x5, 0x0, 0x0, 0x0, @str='\x00'}, @typed={0xa, 0x2, 0x0, 0x0, @str='w\xa9\xe2\x00\x00\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd0002800800"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000003c0)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xfff5, 0x4}, {}, {0x8, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x6, 0x7e, 0x1, 0xfffffffc, 0x8}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000001380)={'ip6_vti0\x00', &(0x7f0000001300)={'syztnl0\x00', 0x0, 0x29, 0x9, 0x4, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x14}, @empty, 0x40, 0x20, 0x9, 0x4}}) sendto$packet(r2, &(0x7f00000012c0)="0f4d4bb9658f8281141393e59ab766428f2e0b09a54164c0fe7144362dc0736cef90b433b5f5ee586aa8702433ac3118b71fadce905fc9dd2b186363", 0x3c, 0x20048800, &(0x7f00000013c0)={0x11, 0x106, r5, 0x1, 0xff, 0x6, @random="b59da4d9b8d1"}, 0x14) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = socket$kcm(0x29, 0x0, 0x0) vmsplice(r7, &(0x7f0000001280)=[{&(0x7f0000000080)="bc30432a843b33d61e19cf1a6c1c04f5089878cc509dc1b8a44843c6c05fc291ec2ebd5e90f640fd249c61945bbe8f9ee1f04e35c9c319d61c0530ec35cda47ef9b9e26893e40c363bf9a6391a4f4c4d5aad030720f0890902ddb07d4fe2283b8d090760109928cc402f23331734c01bc186dc8feac2e6c61fd7c4025b6945646eafd241709179b3cc9bc049f9", 0x8d}, {&(0x7f0000000140)="aee835e044ae56bc2bd865dd963ed1e27e7d3a64187d88a6ca5c136c0aadafafb34a6f1b2e87a56ebfb26aea8fc47ca6a2c5c88dd8584ab2e815fb721b54b43da834a3253790aa76347367e3b0b8ecf496aebeb76b3e5489c66c5d800b9b26ce8b66159811da7effa3b52702a1f51070b11b0c291d945a486e165633027716131c812a168b47b4fcc636e7c7c0045e9c2434ff", 0x93}, {&(0x7f0000000280)="a35548f62176f44e06ee70c6b4a197bc13649d3935895d119802eeb8ac12d8b888f89dd74457d8c60e1551f20fd3d1249769ee1e3f6defa7c149a86df7079a9fd8511e648a80c53412b532793d627c483712f626c9c43dec11b420337ea7a4ab18d3335ffb7b4d89e973aa4bad9bc579e8a5b24a00ac3cb389ff476885b909352d0dc13c3bddabb342cce20d7e0f40ba1c5a412602f43523bed4f21413d6c9cf0fb681228b4fe70e65fe8a69056a3d79cacadc33f011a5ccdcc0493a939abe3b6fa2c024f639b50021429f3942ff78ee9544b7c03b593f2e582a638cd8ee9d90da9befcafc461d9b3fa71cc17c273b53a82dc1036b45ac890b11a328d621079d2aaea3d5a75a361f7ce35f1728b71b4ac8c84dc32f405a3a90b73d8e8a07269830bf89dc3c3e4134ff41746c9461f6f659a8fa4fb60fc9c353cb45941d930f05fbb583bd39ab8af39cc9e1203a47a45b577c99622a4be088c6fee4efd8cd58bd455baf58ba2582cc8bf3a56f68486bbd8135d9644b3049f107e22d8db3407fd1af239e58831bfc8801e4ac4a70a6aa933f30eb72b98ac0d4eecfd5e96e8fa869875c89645a1928f63f7f5acfa3fe98af962e8d4625e6b82c72d3ad5dab75fcb62c96669d7de92484608aa87e1ad84815f79b7a26028d7886e29fc0da9d5a7c019460a0ca2c4607eede0c75d2a7077642fe9a4e5ab58b0b9a41e16ce54e548085059043bc76879a61c7b345464d0db2b2145f210ab85813231313921ece93f56fd38f34ab443adb81081c1e53279be2a598d374b0dfde3351a4b05c8095b1f5503ec7be5183b887dfd6704d70aaa9dbc301c1ec6a84fab0e990c0fde094790c48b1a072bad81f99e67737c498916f896c21e395e5e117361bcf79ab52814101f3b61f0c1ebc23f7580758d43c618565173b9e42ddc672c2bdd1a951a3520a4682e45e9475f27fbfd28a2048124bead7e07c7d82522898063aaa5fb2d97647a9b183ca8d89c17270a2a01d1e5bf871efe55bdee0664ab99dad83a7f32e38240d7622b9d7b603ae41ba53c4ad3fe9de15995bd586a2be6269c5c2d02189a971d785f980bcd9a99d9a7098cc4b724f8ccd4a4fe2c433ce1c53762110edd9e00b492154d58317446e583466b34cd41d47828ab38a4f6f04836834ab6ba8f641c42cbc40879e71f7fd7972f8c072d8a7d0049e7e00cb2a97304192f079982491b2460571a59794c5bb1a2ccdf0d72598afc3d410fe64a1fa32592a9eb5c54e9fb707ba2baabfd123224b365c43e540b377375a9cb16ec22e85e74b234cecf1d0718a60ccbe5b7c8951665e86b3ca8cebf7669efe7ec0bfc0d30785d16e1020dfa4a71d3b2bd63c78ab65912d4fcf1b21e1052be75d2fd9ba0b637784ceabd29c78429f09fa37648146429e922ff163d4e2b74da70d2b9140c4822f8a28ae1bce92479cf5e43ae1bce758a9451d9fc48842216db387c6e1c062ca0d444629f7e74c42fae1b57f421df2a0b301c98e08b1292140bdcffb86a5bcf53ad3268dea2e9a4817eb54557bb60c724740213e50feb8072b578ee154fd0397bb5465a5c12d28560a2fc1bc41b23291094536c0e63244655a6492b04fecd8de2d405f0ea6b98d1f966444a9a9dbd6b36146bc08ecea815d9f8da05b9fb05774f0e7b9c37bf1a9c775225b02f27ab564bebb70bd979bab348c22b829e077393bf61f83945e05f73f183f713998de5aba7fbd9607a1906811c900d011b754afc6340ad9a2505c22d5bc4af37bebfdb1636bd0590b0d5701907e3d4bd8fdd643041447e3d3446e1b659cab3c831e1100970d4fd23afa06a672c31a7737627ac2220309f7f7160c32f4a4384110885330046a2a63a12268d6329ed9c21ccafbbaa0245bf4f8c72cbf9f43fa9485ff34e67748fe806576c84433a3ec72f713de20d2351862aae7c1d53d01ac13688bf197742f88a0d7f54dfa72a6ecf3f48b5d06a8b319330fa1f17b66b92fe8aaf5bd440d45e18c332bed3b18d320b3b4ae2c440a5fcdeeb34ab1173e9d262c12539c2aca6db059916b4bf6474576ed869a22bc47553853944f4ae1b1a632b94cef9c916608e6f6a92c0ec8cc4f16a31333cb3784593482e5a65897233d73c0a234daa0e52377f01955c7947d716db9b6aa71e4fc86b7bd4adb7ee2625d3d98c8614f3da28bc7116fbf3bd5b9631a6bfb44f21886687b60f31a9faec3adeff0b4b00edf534f53d81318f8125ddb02671acb94b7a88839d6353d9bab763b9810279d113e5832544d57cca9e40c47512526c6c3b7160170ad9c340810e029882753b3fb36c91753b7273229e243f18873f528edbca4b875b198bf428ff4545b6c36117dfebaaa7ca83bc0ca12bc23892b6e50b1b37fe06b6e7662c636530327752f6abb9e8c4b800b3fb102b942952c0881105633e51fd2561abf93a2007607322e38ccb4c68d8bf839c693af3c1539e20839c87abfa667f59d63ba2e5e3093c04dee0a7f99ca153d6fcf28b637b0ddce5f528b4e90cddc3b6b0bfe8f0a9fcd70ab315fd6a3b7f77455e586b36e841667793f9b8a34c10f5c7074b67aedf8d55304d99eac9843fe82018483b077c47e00a7085fd5145e29f5286f3bcdcea7cf7e53187cf72378e144e38d3e2b29b387700efde115529f162791c6e80f80b783d44437c75ac466d4aba7a2da7ad4faa1bf8acd761d39d20f4ace34641e877b3299fb4959f226cf1b17d40096742ecd17783732cb1e22159e747068806a56b6b80e2aa33729fb7e61d1e53fa6fad940751f890d8a8dd4a4ad2bf3008740baeea9949373a7ca636dbfaa4c68b90648ed6afbbd8c3f7567dfc19b992b42f9696cfee4d7c67dd5bfa0339b218b9fd3017fe4486f793314de67b9c98821e767535eddf022fc7c56bb41276ea7b70246d5808d530acdeea62bdb0b8cc39fc7385aa13d635615d102921bb7b8897e3c83ca039ce887cf112205ccc6e3295a1ba6edeb84203582a845f88c4e424bf004b93f3c618528c4fc797eda362c1f626fa088664c4fd25d3b83a11ab186e6cc9ba1739b237e1836504dc340c6c8c546519d28c3ea556f98adca6d8cab2263c646c1f989e34d649001017b5fa650546fab0cafc7de3e15487023517662f6411a4c8cb1a8dbded5ee5a4d2a6c2bfe05ee4f87236267c9d2854454a5275cd45e1de3ca3142619fbd812f4c82d91f576a8ef8ae5ba45aa00c3b8af91fe388fc5c633efe1df2976c35897afcb62b0fa9fee7c1f2d629f513b22b18bf5f5f72f87b8bda29fd80665f00783062758e97422d3a5902bcdcb3bc8cd782b434b7d34553574f034d9383469c1f9090a9fa10551c44ac9bb35ec4e9d7914eaaed1b0a35b352105357cbbae473c1d03912d5c7ba4d4a800e590dac0cb6879a9f31764f8b12a615de259ecdc58f6ee86f44b07721fb9d47889a48ef2757b7e2e891c1c3c74c48f6c862a6c4925ecf6ec1299682d3929f941569c8073665e18724795da489de939bd5bf3638ec3cf75ec2c3689ef3bc2929cd44347c20169c491fb3ff17d2a1df692381c421f19649a37e27b4712a09c23b6a4564dc5de91673561c9df0f3580003267c721c91d2d85aad0fbe58f865dcce95b4d501c2106cb3757b18fdf4e9a5e19b324c487e213db8ec640d8b65f902cb9418a715fad2a84293d03438e4aae741a1f027d87148cb4ce994f5536d719551b86f4b785b0c19f55030dc9631e0bb17ae1a98a634630ba62d11a6e492569ab964b134bbdce0ef178c7a39436f714f90558ee660b6daa42ec67b3d02132adade707f620124db60707b8afc69009f3720128c363077f668dae8b557a4ec2168eee3b3e6c7f9140714664d78d9cdc49658d451ca4e2ffb625a06ffb08ac3ec4d34243b0c860a4a777bffdc74ee85c058cb9c6867b2955666ea0c5f7ac7dc19f27d91e76c1991894314110bd2d6d4f04f8435f429b140edeb17eeb6c2ee4563040db3ed5ab032da42fcac2371b59a12b1697f3d90b4d7b06abadee1a61602e3382c04fd99151b0465925d13c0e2e982dcccfdd77a46d37b01f5c56df08ca273a2969c454bc8e4add3c56ccd1cf2afd0af936eab07b8ade58616ab7c3f869518a1adeed70fab595f7cca068d849f5f1d31c4b7e41793bc5410528c1a127c71a9ca524d3142a3ed8e5c58627e4e82566b79de2c0303a89e446bf01a769a5185444cd3d470502008084513c703bf8d583e31bb46af6dcb3abae540273c1532271744a5b1e1fdd704b796028c7c4f3b9d6a022c59c209d1157933e6c0af5395e92208e065e4588f0a4d384f7bce2241142510bae038acff7860f7053da88da669738565eefefc601722750f914c5a4cccd8fed9cde92547ed293805bf14c26572c43b7eaeb3b9b0cb73f98a6eddf979b7e24c5cadc81e8bac64a7e3b91185eaebabbe471261b3d830e9ee5711635ee3e5a376c8120e61dd9bbd0780d42b2515578c9f454844adc9c81998fc92c479346f3afa3ddf3a1f8ecd9717682e1418ea9861e9c5dc5efa11666497a423c153f62659eb6c43750ab3ebb9da45ec58d1bbf4ebbc324e787c5fb5b839bb21f70dcc32405cfaed6c17848413af73256ee852e3f2f8956c7a6a49ab2ad271bb618084a377a899339842b4b1a9e55d7dc97f6366774872acbcc42ead76eaae71bc18543521431b6c9c15cf8673272105d2730f627c14f46ec7ffa6147f745e52b5815a6affcc59b6b84c2b5b797c7b0f41d61d381a0c2215d970309264a437e234024726ca8fd7e716664f06325d06eae8a5d692a960de441ae2af14f078b8ee8ce85adb3b30f33b3b13f4c51b01dd0ed351a347e9b02ab66dbf94b7deb9b3a446e0c02709f51e82d8f9847933d376de38db7b17a866ff3a79503a923229757ceef6016d752ee69c57a5cd8d67595c11134df56ac8ef87b18f3def60bf7e4712094a818ca47f2bdd553029443ccfe538617da2e5d3ed4ad1fd1871e300deb500a90d477014b6af7a840e269ebb7c5e8bcdddf12e6ecaf5cb753b2f420d0148dbcb4cd5cee0557476af646272186604240b0e9e9981f4188cbdbd1dd8cc87ef24c55fcb4e94375aa3dc923a61f9c09b9b68e7a972afa47d3ab49050e3f27b09f85f7d73873a4766e51eab86a9c54b64e736c9ec6a2fabf5bc3fa5719d3f81d9d40c29b9fba3644017f0195a100cf5b6617c3251cd60a01ef1379b2a163b2b9329681f1e7c45c27d14dcb4acbdefe379c866ac53846388a4d23c89c4f873be4254d7b2925e640514c85904fc9f3a16e38701d9e2ad2bbc40484f2fd5b77bbf6abf6ff73299e1910196136cd8ac683f5372381ea10d2be9c86f8b1ef943dd3961a9b195eddcdf10cd84f18be508fb680cc91993a6a959da930d7496758b355f9f1fdec4034b19da0d6ad52926e81d53eea0ac8740c18b12a4edf20f1a1aabd488fb31d840def57ce285a3414130873fac5e0c1743bd462aa4d50d263d64336b7bfd1bec8b201a49d8157c6841f9c84ff8d277c2e3ebd0acf322aa4d58fc9473bc21008aff0dae4a1791d10f2be4c46086ac471c8c361097d30717972eda846b486be3d79d519aba57d73e63f7a393b73ad5008658398868d757840c47116227c5adcbadd21d143b6fba388b8ff6567aa82af9ae443cbf42492fab0919ec18f3056f705bb41edd1ef87c5b43f5f0b959ce3e11133e1c490b486e56a724b6661ce39a53f946aa034a6ba1680f982c17541799842dad9643de4b47d42c1e183271e5fbc01a001bd84076eab34223dce49171b36dd42ecc3aa18c9da8c4", 0x1000}], 0x3, 0x2) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_int(r8, 0x0, 0x18, 0x0, &(0x7f0000000080)) r9 = openat$cgroup_pressure(r6, &(0x7f0000000240)='memory.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r9, &(0x7f0000000040)={'full', 0x20, 0xfd6, 0x20, 0xfffffffffffffff7}, 0x2f) 1.198514753s ago: executing program 3 (id=6114): r0 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000040)={'nr0\x00'}) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x29, &(0x7f0000001500)=[{&(0x7f0000001580)="d80000001a0081044e81f782db4cb904021d08007b490d4f1e81f8d815001000ff05142603600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e", 0xd8}], 0x1}, 0x0) 1.18546079s ago: executing program 4 (id=6115): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2e, 0x1, 0x0, 0x25dddbfb, "", [@nested={0x104, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac0b}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x41}, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEY(r1, 0x110, 0x1, &(0x7f0000000040)='!^!%\\\xb0%-\x00', 0x9) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f0000000200)={r1, &(0x7f00000000c0)='!^!%\\\xb0%-\x00', 0x101001, &(0x7f0000000100)={@_ha_fsid={[0x2, 0x3]}, {0x0, 0x3, 0x0, 0x6}}, 0x4, &(0x7f0000000140), &(0x7f0000000180)=0x10}) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x58}}, 0x0) setsockopt$inet6_int(r3, 0x29, 0x12, &(0x7f00000001c0)=0x10, 0x4) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x58, 0x2, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x58}}, 0x0) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200000001514010100100000000000000800030005000000080001"], 0x20}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x70bd26, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x3}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8000}, 0x4008000) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f0000000240)={0x11, 0x5, '\x00', [@hao={0xc9, 0x10, @mcast2}, @jumbo={0xc2, 0x4, 0x8}, @hao={0xc9, 0x10, @empty}]}, 0x38) 1.038627194s ago: executing program 2 (id=6116): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x803, 0x0) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) (async) poll(&(0x7f0000000300)=[{r2, 0x9145}], 0x1, 0xff) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f00000000c0), &(0x7f00000001c0)=0x4) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000002c0)={0x34, 0x0, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x34}}, 0x20000000) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3400000040000701fcffffff00000100017c0000040042800c0001800600060065580000100002800c0008"], 0x34}}, 0x400c010) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xac}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r5, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) (async) r6 = socket(0x1, 0x803, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003580)={0x20, 0x24, 0x107, 0x270bd2e, 0x259fdbfb, {0x3, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @u32=0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x24008030) (async) sendmsg$nl_route(r7, &(0x7f0000002180)={0x0, 0x0, &(0x7f0000002140)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001900010000000000000000001d01000015000200000000000000000089543896f10eee1e0200000008000e002ef7dde4a54152b3a949401b2162ce6a240389ccccb1281855306580e798f01c7a13ae7d4bc2d49b36e6aa6d77212e6e7e1b0d9c8ab2d28d8cf77c2a821fb947220ae9f0e6944b952f85e0e071bbb900000000000000", @ANYRES32=0x0, @ANYBLOB="0800050002000000"], 0x3c}}, 0x0) (async) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) (async) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000940)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x12}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r5}]}, 0x3c}}, 0x0) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r10 = syz_open_procfs$namespace(0x0, &(0x7f0000006180)='ns/pid_for_children\x00') ioctl$NS_GET_PARENT(r10, 0xb702, 0x0) setsockopt$IP_VS_SO_SET_EDITDEST(r6, 0x0, 0x489, &(0x7f0000000400)={{0x29, @remote, 0x4e21, 0x0, 'lblc\x00', 0x5, 0x1, 0x37}, {@local, 0x4e20, 0x0, 0x200, 0xd, 0x7f}}, 0x44) r11 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000200)='io.weight\x00', 0x2, 0x0) close(r11) 1.004983312s ago: executing program 3 (id=6117): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000000)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4c080}, 0x8010) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000100)=0x49, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001000010024bd7000fc0ddf2500000000", @ANYRES32=0x0, @ANYBLOB="1b0b04000300000008001b", @ANYRESOCT=r2], 0x28}, 0x1, 0x0, 0x0, 0x68010}, 0x0) write$tun(0xffffffffffffffff, &(0x7f00000013c0)=ANY=[@ANYBLOB="03000500030019000c0066644cfb00103a000000ff02000000000000000000000000000186009078000002"], 0x42) recvmmsg(r0, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) 992.586873ms ago: executing program 2 (id=6118): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYRES32=r0, @ANYRESOCT=r0], 0x48) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f00000000c0)=@ccm_128={{0x7}, "00001200", "edfc4a7c2853770307e48bfdb8644800", "6eb4a89a", "c277dbc4b45a157c"}, 0x28) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000003340), r2) sendmsg$NL802154_CMD_NEW_SEC_KEY(r2, &(0x7f0000003600)={0x0, 0x0, &(0x7f00000035c0)={&(0x7f00000033c0)={0x44, r4, 0x52b9ada956aca011, 0x70bd29, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_KEY={0x24, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5}, @NL802154_KEY_ATTR_ID={0x4}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "00bbfb8608180ce4d3c9a4d3f77c6a6b"}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f00000001c0)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000100)=@framed={{0x18, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, [@map_fd={0x18, 0x1, 0x1, 0x0, r5}, @exit={0x95, 0x0, 0x7b00}]}, &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x41000}, 0x94) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=@newtaction={0x6c, 0x30, 0xffff, 0x0, 0x0, {}, [{0x58, 0x1, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x6}}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_PRIO={0x8, 0x3, @val=0x6}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x6c}}, 0x0) r6 = socket$kcm(0xa, 0x1, 0x106) setsockopt$sock_attach_bpf(r6, 0x29, 0x31, 0x0, 0x0) pwrite64(r1, &(0x7f0000000380)="be0b5b1c3b5b6f1981247685b316056187afb00648e69f92de449ce23e9d3b9d072d0be1445a0f8be8c36411c302af5d51a7cb8cef862d4b778789138aa90b7bfcfe8475ee76c5c1e3d7eda0d923f1d7086e1b345b6bca5dd2c76c00ace2f3ab2b14935977fe834a1744844c138d8f3e2f8bd33cc51ca017eaa90d2b4b4e3f0ac81c363f67d505ac427c6fd3f1384dfa7abe960403c4d3b1899f6b07c4b39ef0913a1ef550acda", 0xa7, 0x66f) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)={0x40, 0x0, 0x9, 0x5, 0x0, 0x0, {}, [@NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0x8001}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8, 0x1, 0x1, 0x0, 0x208}}, @NFCTH_POLICY={0xc, 0x4, 0x0, 0x1, {0x8}}, @NFCTH_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x40}}, 0x0) 913.99782ms ago: executing program 4 (id=6119): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0xc, &(0x7f0000000000)=@framed={{}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x54}}]}, &(0x7f0000000540)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xfffe, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 767.769293ms ago: executing program 4 (id=6120): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x0, 0x0, 0xade, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x5e55b37311de6d89, 0x0, @empty, @empty}}}}) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x103, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x2d, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x0, 0x0, 0xade, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x5e55b37311de6d89, 0x0, @empty, @empty}}}}) (async) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x114, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x103, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x2d, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x16}}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be", @typed={0x4, 0xe9}]}]}, 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) (async) 761.230513ms ago: executing program 2 (id=6121): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r2, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r2, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000006c0)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd2c, 0x0, {0x0, 0x0, 0x12, r3, {0x0, 0xffe1}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x58, 0x2, {{0x8000, 0x9, 0xf, 0x4, 0x3, 0xac}, [@TCA_NETEM_CORR={0x10, 0x1, {0x6, 0x10, 0x8}}, @TCA_NETEM_SLOT={0x2c, 0xc, {0x200, 0xfffffffffffffffc, 0x8cb, 0x7, 0x8, 0x2}}]}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x8004001}, 0x20000000) ioctl$sock_inet6_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={@private1={0xfc, 0x1, '\x00', 0x1}, 0x22, r3}) r4 = socket(0x2b, 0x80801, 0x1) shutdown(r4, 0x7ffffffe) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) sendmsg$rds(r5, 0x0, 0x40800) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000200)={r5, &(0x7f0000000140)="b770a4cb68b4dd93eda786d99daa615d0b46c54ba6e8400e7bf8cb54c1af5d587963dfb90f574b0bcd98daa85876f8bc2eae08b6b08d484d7ea50a8fcd5dd22d96609c91cfccc547c454d5ff786041c97b77fd8959fffdf3a6f45b46c46b59d8efce3d6008a27c89523935c96cd83ff3ed67b706526c7a041d6faeb48ecc9b22585f9c157c230cbece509e780155c05732a18edf2386ef8f212f45246f4ea604ea340c54563286d50130fe3372092714f539e8385a41bbd5f57951"}, 0x20) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000009b80)=ANY=[@ANYBLOB="300000000d0a010800000000000000000a0000010900020073797a35000000000900010073797a310000000004000380"], 0x30}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) 615.524982ms ago: executing program 2 (id=6122): socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x3c, 0x2c, 0xf3f, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x0, 0xfff3}, {0x0, 0xfff3}, {0xd, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20041004}, 0x0) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40010}, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4040) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) (async) r2 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r3) ioctl$IOCTL_GET_NCIDEV_IDX(r2, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r5], 0x1c}}, 0x840) r6 = socket$nl_rdma(0x10, 0x3, 0x14) getsockopt$netlink(r6, 0x10e, 0xc, 0x0, &(0x7f0000000000)) write$nci(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="71050800dfb33f750cde"], 0x1e) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x58}}, 0x24000044) 463.591081ms ago: executing program 4 (id=6123): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x8080) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'veth0_to_bond\x00', &(0x7f0000000440)=@ethtool_perm_addr={0x20, 0x6, "fbb020b1c236"}}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a88000000060a0b040000000000000000020000005c000480580001800a000100696e6e6572000000480002800800024000000084080003400000000000240005800c0001007061796c6f6164001400028008000340000000e108000240000000050900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000affa0e0492f89b34a28addb1b155a1fb0f336afc85458718a498e5cea0bd2c730858f22ecb95c15c2faeb4026b8ee17569ebad1ba56970c1872d696161019a422f6c3a630b9002e85ed940b763fb03be8598945abe6cf7ede23d15bc8e0c84b0955000000000000000000000000000000bd84c835ad10f806ea3f5a0b6ce48ca686784e1fb8ba148aa23148f4339b645bc8cc165946bac4a6c4b22f12947c49b18b775ad2e44a851224577d91e2ed6b8c9cb56eed7990d7023ad4b004d067dd92746f1908f22fd47338e2847454f84c7b10d06a3c204a28a69a6339b7501c798f982a5da380376f6308b89d2aae997fee461eafeb5788d575edcd6e3245116c47c26064de25a92d0e2fd3d3af2fe3f86e3e6390f078ed0c587aa230e2fcba8036c6b97a3ce6b02387a143a743c336b35241b5725c1603549c28085d6b4832881c1785feac15557f113f3d01"], 0xb0}}, 0x0) sendmsg$NFNL_MSG_ACCT_GET(r1, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000900)={0x14, 0x1, 0x7, 0x5}, 0x14}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_rdma(0x10, 0x3, 0x14) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r7, &(0x7f0000000940)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000900)={&(0x7f0000000840)={0x20, 0x1, 0x8, 0x801, 0x0, 0x0, {0x5, 0x0, 0x7}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x8048000) sendmsg$NFT_MSG_GETCHAIN(r1, &(0x7f0000000600)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000005c0)={&(0x7f0000000480)={0x128, 0x4, 0xa, 0x402, 0x0, 0x0, {0x7}, [@NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x3}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_USERDATA={0x93, 0xc, "ef1b3a6fc8c2ac45d8b81d0582c2f0c9afa36f7e69ebadd76e123669dd1043e55360550b440ddef0d117cbc6ca046621c2ce83938f8a2fde6e7a4c7c54680d223e2064f9b04eda9994da4876ebc4846dcf2e9041b31d76688756bb5e573e90c3ef097ae29a32a7042fb5b3b4e803d3326068ac49309a2b22281069ac83250afb371c1146f071383b0cd5eab28500ab"}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x80000001}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x9}]}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_HOOK={0x20, 0x4, 0x0, 0x1, [@NFTA_HOOK_DEV={0x14, 0x3, 'wlan0\x00'}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6f3968b9}]}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}]}, 0x128}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20000) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r6, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x28, 0x140f, 0x4, 0x70bd25, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xb, 0x45, 'smc_ib\x00'}, @RDMA_NLDEV_ATTR_CHARDEV_TYPE={0xb, 0x45, 'uverbs\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x20008080) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000540), r9) sendmsg$IEEE802154_ADD_IFACE(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01000000ecffffffffbee24de0f2a299a815c2ff2000000005002000000000000c001f00"], 0x28}, 0x1, 0x0, 0x0, 0x4080}, 0x0) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000dc0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r11, 0x8933, &(0x7f0000000200)={'wpan1\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="010029bd7000fedbdf250f00000208000300", @ANYRES32=r13], 0x24}, 0x1, 0x0, 0x0, 0x2004000}, 0x20004010) sendmsg$IEEE802154_LLSEC_ADD_DEVKEY(r8, &(0x7f0000000680)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000640)={&(0x7f00000002c0)={0x1c, r10, 0x100, 0x70bd2b, 0x25dfdbfd, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r13}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8020000}, 0x845) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r5], 0xa8}}, 0x20008094) 393.411908ms ago: executing program 2 (id=6124): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000080)=@bpf_lsm={0xd, 0x3, &(0x7f0000000040)=@framed={{0x26, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x6c}}, &(0x7f0000000000)='GPL\x00'}, 0x94) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r0, 0x89e3, &(0x7f0000000140)={0x5e, 0x0, 0xa, 0x400000b, 0x36, 0x81}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'veth0_to_bond\x00', &(0x7f00000004c0)=@ethtool_channels={0x3d, 0xfffffffc, 0x0, 0x0, 0x0, 0x2, 0x2, 0x3}}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002ec0), 0x301, 0x0) ioctl$PPPIOCNEWUNIT(r2, 0xc004743e, &(0x7f0000000040)=0x1) ioctl$PPPIOCSMAXCID(r2, 0x4004743c, 0x0) ioctl$sock_ifreq(r1, 0x8995, &(0x7f0000000140)={'erspan0\x00', @ifru_map={0xff, 0x0, 0x4, 0x1, 0x9, 0xfa}}) 116.088861ms ago: executing program 4 (id=6125): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd29, 0x25dfdbfe, {{@in6=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0xfffffffffffffffd}, {0x0, 0x5, 0x6}, 0x0, 0x0, 0x1, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x24008040}, 0x8000) syz_emit_ethernet(0x46, &(0x7f0000000400)={@local, @random="df00004000", @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x11}, {[@ssrr={0x89, 0x7, 0xa2, [@broadcast]}, @cipso={0x86, 0x6, 0x1}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) 0s ago: executing program 2 (id=6126): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd29, 0x25dfdbfe, {{@in6=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x4, 0x0, 0x3, 0x0, 0x2, 0xfffffffffffffffd}, {0x0, 0x5, 0x6}, 0x0, 0x0, 0x1, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x24008040}, 0x8000) syz_emit_ethernet(0x46, &(0x7f0000000400)={@local, @random="df00004000", @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x6, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x11}, {[@ssrr={0x89, 0x7, 0xa2, [@broadcast]}, @cipso={0x86, 0x6, 0x1}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) (fail_nth: 1) kernel console output (not intermixed with test programs): 1bd/0x2a0 [ 554.346799][T20830] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 554.346836][T20830] ? __pfx_ksys_write+0x10/0x10 [ 554.346866][T20830] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.346883][T20830] do_syscall_64+0x15f/0xf80 [ 554.346906][T20830] ? trace_irq_disable+0x3b/0x140 [ 554.346929][T20830] ? clear_bhb_loop+0x40/0x90 [ 554.346949][T20830] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 554.346967][T20830] RIP: 0033:0x7fd33e99ce59 [ 554.346984][T20830] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 554.346997][T20830] RSP: 002b:00007fd33f813028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 554.347015][T20830] RAX: ffffffffffffffda RBX: 00007fd33ec16090 RCX: 00007fd33e99ce59 [ 554.347026][T20830] RDX: 0000000000000002 RSI: 0000200000000280 RDI: 000000000000000a [ 554.347036][T20830] RBP: 00007fd33f813090 R08: 0000000000000000 R09: 0000000000000000 [ 554.347045][T20830] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 554.347055][T20830] R13: 00007fd33ec16128 R14: 00007fd33ec16090 R15: 00007ffdb1d1d8b8 [ 554.347082][T20830] [ 555.227183][T20853] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4347'. [ 555.257935][T20848] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 555.315015][T20848] A link change request failed with some changes committed already. Interface batadv1 may have been left with an inconsistent configuration, please check. [ 555.373582][ T3305] netdevsim netdevsim1 netdevsim0: set [1, 2] type 2 family 0 port 20000 - 0 [ 555.408780][ T3305] netdevsim netdevsim1 netdevsim1: set [1, 2] type 2 family 0 port 20000 - 0 [ 555.450895][ T3305] netdevsim netdevsim1 netdevsim2: set [1, 2] type 2 family 0 port 20000 - 0 [ 555.482052][ T3305] netdevsim netdevsim1 netdevsim3: set [1, 2] type 2 family 0 port 20000 - 0 [ 555.510833][T20869] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4352'. [ 555.577666][T20877] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4355'. [ 556.033871][ T5635] IPVS: starting estimator thread 0... [ 556.117092][T20913] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 556.156850][T20904] IPVS: using max 36 ests per chain, 86400 per kthread [ 556.245166][T20919] netlink: 'syz.4.4368': attribute type 3 has an invalid length. [ 556.366193][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 556.963946][T20963] netlink: 'syz.4.4381': attribute type 28 has an invalid length. [ 556.973691][T20963] netlink: 'syz.4.4381': attribute type 3 has an invalid length. [ 556.982513][T20963] __nla_validate_parse: 8 callbacks suppressed [ 556.982526][T20963] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4381'. [ 557.379214][T20986] sctp: [Deprecated]: syz.4.4388 (pid 20986) Use of struct sctp_assoc_value in delayed_ack socket option. [ 557.379214][T20986] Use struct sctp_sack_info instead [ 557.408280][T20990] bridge0: port 2(bridge_slave_1) entered disabled state [ 557.417745][T20990] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.433148][T20992] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4387'. [ 557.668251][T21005] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4394'. [ 557.677441][T21005] netlink: 'syz.4.4394': attribute type 6 has an invalid length. [ 557.707429][T21005] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4394'. [ 557.741824][T21005] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4394'. [ 557.756317][T21005] netlink: 'syz.4.4394': attribute type 6 has an invalid length. [ 557.783135][T21005] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4394'. [ 557.821609][T21012] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4397'. [ 557.833157][T21012] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4397'. [ 558.330804][T21040] netlink: 'syz.4.4406': attribute type 1 has an invalid length. [ 558.408774][T21045] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4406'. [ 558.466995][T21040] bond7: entered promiscuous mode [ 558.483733][T21051] netlink: 'syz.0.4410': attribute type 1 has an invalid length. [ 558.492375][T21040] 8021q: adding VLAN 0 to HW filter on device bond7 [ 558.501732][T21050] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4409'. [ 558.511279][T21045] bond7: entered allmulticast mode [ 558.625483][T21056] bond3: (slave vxcan3): The slave device specified does not support setting the MAC address [ 558.646041][T21056] bond3: (slave vxcan3): Setting fail_over_mac to active for active-backup mode [ 558.669749][T21056] bond3: (slave vxcan3): making interface the new active one [ 558.682412][T21056] bond3: (slave vxcan3): Enslaving as an active interface with an up link [ 558.814774][T21069] netlink: 'syz.0.4415': attribute type 2 has an invalid length. [ 558.939420][T21077] tipc: Trying to set illegal importance in message [ 558.958729][T21073] debugfs: 'KŠŸu ™crµ±K:‘£ÿˆÌ¥ÝBßÝ£| “¼ÚÞlS·œ-!' already exists in 'ieee80211' [ 559.103407][T21087] netlink: 'syz.2.4421': attribute type 1 has an invalid length. [ 559.144724][T21072] infiniband syz1: set active [ 559.149711][T21072] infiniband syz1: added batadv_slave_1 [ 559.158136][T21072] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 559.163165][T21072] infiniband syz1: Couldn't open port 1 [ 559.178167][T21072] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 559.194568][T21072] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 559.216145][T21072] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 559.266531][T21087] bond5: entered promiscuous mode [ 559.284153][T21087] 8021q: adding VLAN 0 to HW filter on device bond5 [ 559.300826][T21072] RDS/IB: syz1: added [ 559.313144][T21072] smc: adding ib device syz1 with port count 1 [ 559.330760][T21072] smc: ib device syz1 port 1 has no pnetid [ 559.467316][T21098] syzkaller1: entered promiscuous mode [ 559.476682][T21098] syzkaller1: entered allmulticast mode [ 560.140855][T21131] netlink: 'syz.1.4435': attribute type 4 has an invalid length. [ 560.628519][T21160] netlink: 'syz.2.4446': attribute type 16 has an invalid length. [ 560.819427][T21160] veth3: left promiscuous mode [ 560.869409][T21160] 8021q: adding VLAN 0 to HW filter on device bond2 [ 560.905329][T21160] vlan2: left promiscuous mode [ 560.922000][T21160] hsr0: left promiscuous mode [ 560.946640][T21160] vlan2: left allmulticast mode [ 560.965487][T21160] hsr0: left allmulticast mode [ 560.982039][T21160] hsr_slave_0: left allmulticast mode [ 561.000829][T21160] hsr_slave_1: left allmulticast mode [ 561.023816][T21160] vlan4: left promiscuous mode [ 561.032218][T21160] bridge0: left promiscuous mode [ 561.042041][T21160] 8021q: adding VLAN 0 to HW filter on device bond3 [ 561.054665][T21160] bond5: left promiscuous mode [ 561.135023][T21168] veth1_vlan (unregistering): left allmulticast mode [ 561.781820][T21194] openvswitch: netlink: Missing key (keys=40, expected=80) [ 562.015215][T21207] bond0: (slave bond_slave_1): Error: Device is in use and cannot be enslaved [ 562.120956][T21217] __nla_validate_parse: 7 callbacks suppressed [ 562.120975][T21217] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4462'. [ 562.701313][T21240] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.4468'. [ 562.740427][T21240] netlink: Conntrack attr type has unexpected length (type=2, length=0, expected=2) [ 562.825175][T21240] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4468'. [ 562.855234][ T1315] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.908839][T21240] geneve4: entered promiscuous mode [ 563.491025][T21283] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 564.179594][T21310] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4486'. [ 564.331951][T21318] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4487'. [ 564.415368][T21325] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4490'. [ 564.457186][T21325] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 564.554824][T21325] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 564.629645][T21338] validate_nla: 1 callbacks suppressed [ 564.629662][T21338] netlink: 'syz.0.4494': attribute type 21 has an invalid length. [ 564.653556][T21338] netlink: 128 bytes leftover after parsing attributes in process `syz.0.4494'. [ 564.676502][T21338] netlink: 3 bytes leftover after parsing attributes in process `syz.0.4494'. [ 564.678817][T21340] netlink: 2 bytes leftover after parsing attributes in process `syz.4.4495'. [ 564.872042][T21345] xt_SECMARK: invalid mode: 9 [ 564.929403][ T5634] Bluetooth: hci2: command 0x0406 tx timeout [ 565.071382][T21358] netlink: 'syz.4.4499': attribute type 5 has an invalid length. [ 565.092791][T21358] netlink: 140 bytes leftover after parsing attributes in process `syz.4.4499'. [ 565.406071][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 566.051692][T21409] netlink: 'syz.2.4515': attribute type 1 has an invalid length. [ 566.153722][T21421] netlink: 'syz.4.4518': attribute type 1 has an invalid length. [ 566.161921][T21421] netlink: 'syz.4.4518': attribute type 11 has an invalid length. [ 566.216602][T21409] 8021q: adding VLAN 0 to HW filter on device bond6 [ 566.312884][T21430] netlink: 'syz.0.4520': attribute type 1 has an invalid length. [ 567.087786][T21475] block nbd3: not configured, cannot reconfigure [ 567.692139][T21506] bond0: option ad_select: unable to set because the bond device is up [ 567.852686][T21509] __nla_validate_parse: 9 callbacks suppressed [ 567.852704][T21509] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4546'. [ 568.072955][T21519] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4550'. [ 568.112827][T21520] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4550'. [ 568.239168][T21530] netlink: 'syz.4.4552': attribute type 12 has an invalid length. [ 568.293200][T21529] netlink: 'syz.4.4552': attribute type 12 has an invalid length. [ 568.322210][T21529] netlink: 190972 bytes leftover after parsing attributes in process `syz.4.4552'. [ 568.354538][T21530] netlink: 190972 bytes leftover after parsing attributes in process `syz.4.4552'. [ 568.494614][T21540] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4556'. [ 568.543661][T21540] netlink: 512 bytes leftover after parsing attributes in process `syz.0.4556'. [ 568.580748][T21540] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4556'. [ 568.645270][T21546] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4557'. [ 568.785258][T21555] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4559'. [ 569.232662][T21573] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 569.238549][T21567] veth0: entered promiscuous mode [ 569.302412][T21566] veth0: left promiscuous mode [ 570.188431][T21578] Bluetooth: hci1: Opcode 0x0401 failed: -4 [ 570.561821][ T29] audit: type=1804 audit(1778969828.584:16): pid=21622 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.4581" name="/newroot/341/cgroup.controllers" dev="tmpfs" ino=1757 res=1 errno=0 [ 570.615971][ T29] audit: type=1800 audit(1778969828.584:17): pid=21622 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4581" name="cgroup.controllers" dev="tmpfs" ino=1757 res=0 errno=0 [ 570.845626][ C1] vcan0: j1939_tp_rxtimer: 0xffff888025759800: rx timeout, send abort [ 570.859123][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888025759800: 0x20000: (3) A timeout occurred and this is the connection abort to close the session. [ 571.406288][ T5638] Bluetooth: hci1: command 0x0406 tx timeout [ 571.557798][T21662] netlink: 'syz.1.4595': attribute type 6 has an invalid length. [ 571.584228][T21662] netlink: 'syz.1.4595': attribute type 5 has an invalid length. [ 571.632190][T21662] IPVS: length: 196 != 8 [ 572.711649][T21720] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 572.966264][T21737] netlink: 'syz.2.4614': attribute type 1 has an invalid length. [ 573.009547][T21737] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 573.015385][T21741] __nla_validate_parse: 16 callbacks suppressed [ 573.015405][T21741] netlink: 240 bytes leftover after parsing attributes in process `syz.0.4616'. [ 573.296087][T21761] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4622'. [ 573.393216][T21746] mac80211_hwsim hwsim41 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 573.724956][T21778] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4630'. [ 573.765802][T21778] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 573.868407][T21778] macvtap1: entered promiscuous mode [ 573.886967][T21778] macvtap1: entered allmulticast mode [ 573.895320][T21778] veth1_vlan: entered allmulticast mode [ 574.007260][T21801] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4635'. [ 574.102279][T21813] xt_SECMARK: invalid mode: 9 [ 574.128055][T21812] netlink: 830 bytes leftover after parsing attributes in process `syz.4.4640'. [ 574.621978][T21848] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4651'. [ 574.637867][T21853] xt_SECMARK: invalid mode: 9 [ 574.674984][T21848] tipc: New replicast peer: fe80:0000:0040:0000:0000:0000:0000:00bb [ 574.706336][T21848] tipc: Enabled bearer , priority 10 [ 574.781685][ T5635] hid-generic 0005:0C45:0058.0002: item fetching failed at offset 0/1 [ 574.820162][ T5635] hid-generic 0005:0C45:0058.0002: probe with driver hid-generic failed with error -22 [ 574.842568][T21860] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.4654'. [ 574.920932][T21864] syzkaller0: entered promiscuous mode [ 574.945513][T21864] syzkaller0: entered allmulticast mode [ 575.284988][T21885] syzkaller0: entered promiscuous mode [ 575.292603][T21885] syzkaller0: entered allmulticast mode [ 575.367836][T21893] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4661'. [ 575.429260][T21898] xt_SECMARK: invalid mode: 9 [ 575.448257][T21899] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4663'. [ 575.531111][T21903] netlink: 'syz.4.4665': attribute type 1 has an invalid length. [ 575.817021][ T12] wlan1: Trigger new scan to find an IBSS to join [ 576.380606][T21932] netlink: 'syz.0.4672': attribute type 58 has an invalid length. [ 576.423223][T21934] netlink: 'syz.0.4672': attribute type 58 has an invalid length. [ 576.441246][T21932] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4672'. [ 576.582763][T21944] xt_SECMARK: invalid mode: 9 [ 576.762481][T21953] netlink: 'syz.0.4679': attribute type 11 has an invalid length. [ 576.792771][T21953] netlink: 'syz.0.4679': attribute type 5 has an invalid length. [ 576.886259][T21965] netlink: zone id is out of range [ 576.918267][T21965] netlink: zone id is out of range [ 576.944283][T21965] netlink: zone id is out of range [ 576.980073][T21965] netlink: zone id is out of range [ 577.018924][T21971] netlink: 'syz.0.4683': attribute type 4 has an invalid length. [ 577.030193][T21965] netlink: zone id is out of range [ 577.073074][T21975] netlink: 'syz.0.4683': attribute type 4 has an invalid length. [ 577.103109][T21965] netlink: zone id is out of range [ 577.137819][T21965] netlink: zone id is out of range [ 577.167688][T21965] netlink: zone id is out of range [ 577.193821][T21965] netlink: zone id is out of range [ 577.229962][T21965] netlink: zone id is out of range [ 577.457371][T21994] xt_SECMARK: invalid mode: 9 [ 577.921892][T22021] netlink: 'syz.1.4698': attribute type 39 has an invalid length. [ 578.076710][T22026] bridge0: port 3(syz_tun) entered blocking state [ 578.098821][T22026] bridge0: port 3(syz_tun) entered disabled state [ 578.108160][T22026] syz_tun: entered allmulticast mode [ 578.121812][T22026] syz_tun: entered promiscuous mode [ 578.137701][T22026] bridge0: port 3(syz_tun) entered blocking state [ 578.144615][T22026] bridge0: port 3(syz_tun) entered forwarding state [ 578.166724][T22028] Bluetooth: MGMT ver 1.23 [ 578.233948][T22031] __nla_validate_parse: 6 callbacks suppressed [ 578.233976][T22031] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4702'. [ 578.766393][ T135] wlan1: Trigger new scan to find an IBSS to join [ 578.857084][T22062] nbd: must specify an index to disconnect [ 579.426941][ T12] nci: nci_rx_work: unknown MT 0x1 [ 579.538235][T22091] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.4718'. [ 581.806307][ T35] wlan1: Trigger new scan to find an IBSS to join [ 582.200882][T22074] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 582.418806][T22115] xt_HMARK: spi-set and port-set can't be combined [ 582.660487][T22152] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4729'. [ 582.686302][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 582.721151][T22137] wlan1: Creating new IBSS network, BSSID a2:c8:41:6a:a3:b7 [ 583.143910][T22169] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4735'. [ 583.233706][T22183] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 3, id = 0 [ 583.353486][T22179] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4738'. [ 583.387339][T22189] netlink: 'syz.0.4740': attribute type 1 has an invalid length. [ 583.510815][T22199] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4738'. [ 583.572528][T22202] netlink: 'syz.4.4743': attribute type 1 has an invalid length. [ 583.581457][T22202] netlink: 'syz.4.4743': attribute type 3 has an invalid length. [ 583.589670][T22202] netlink: 172 bytes leftover after parsing attributes in process `syz.4.4743'. [ 583.599385][T22202] NCSI netlink: No device for ifindex 813332851 [ 583.631647][T22189] 8021q: adding VLAN 0 to HW filter on device bond4 [ 583.699164][T22203] bond4: (slave geneve3): making interface the new active one [ 583.708390][T22203] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 583.798228][T22212] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4745'. [ 584.029278][T22229] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4752'. [ 584.047015][T22231] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4750'. [ 584.278972][T22244] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4755'. [ 584.294999][T22245] netlink: 'syz.0.4754': attribute type 1 has an invalid length. [ 584.443585][T22247] bond5: (slave vxcan5): The slave device specified does not support setting the MAC address [ 584.477562][T22250] atomic_op ffff888057d97198 conn xmit_atomic 0000000000000000 [ 584.493029][T22247] bond5: (slave vxcan5): Setting fail_over_mac to active for active-backup mode [ 584.564089][T22247] bond5: (slave vxcan5): making interface the new active one [ 584.582252][T22247] bond5: (slave vxcan5): Enslaving as an active interface with an up link [ 584.643344][T22245] bond5: (slave vxcan7): The slave device specified does not support setting the MAC address [ 584.691039][T22245] bond5: (slave vxcan7): Enslaving as a backup interface with an up link [ 584.709833][T22263] netlink: 332 bytes leftover after parsing attributes in process `syz.3.4758'. [ 584.720513][T22263] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4758'. [ 584.968539][T22276] netlink: 'syz.2.4760': attribute type 1 has an invalid length. [ 585.000509][T22276] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4760'. [ 585.041761][T22276] netlink: 'syz.2.4760': attribute type 1 has an invalid length. [ 585.470262][T22304] net_ratelimit: 134 callbacks suppressed [ 585.470280][T22304] openvswitch: netlink: Key type 305 is out of range max 32 [ 585.490129][T22304] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 585.545650][T22304] 8021q: adding VLAN 0 to HW filter on device bond6 [ 585.555611][T22304] bridge0: port 4(bond6) entered blocking state [ 585.562633][T22304] bridge0: port 4(bond6) entered disabled state [ 585.570106][T22304] bond6: entered allmulticast mode [ 585.578717][T22304] bond6: entered promiscuous mode [ 585.584651][T22304] bridge0: port 4(bond6) entered blocking state [ 585.591013][T22304] bridge0: port 4(bond6) entered forwarding state [ 585.659748][T22137] bridge0: port 4(bond6) entered disabled state [ 585.833910][T22330] Bluetooth: MGMT ver 1.23 [ 585.856393][T22332] vlan3: entered promiscuous mode [ 585.861576][T22332] hsr0: entered promiscuous mode [ 585.867415][T22332] vlan3: entered allmulticast mode [ 586.079940][T22341] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:1) [ 587.984607][T22278] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 588.386351][T22376] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 588.653301][T22396] __nla_validate_parse: 5 callbacks suppressed [ 588.653320][T22396] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.4788'. [ 588.667656][T22385] bond7: entered promiscuous mode [ 588.674503][T22385] bond7: entered allmulticast mode [ 588.680163][T22385] 8021q: adding VLAN 0 to HW filter on device bond7 [ 588.694445][T22390] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4787'. [ 588.711224][T22390] netlink: 6 bytes leftover after parsing attributes in process `syz.2.4787'. [ 588.851147][T22403] netlink: 'syz.4.4790': attribute type 1 has an invalid length. [ 588.923722][T22408] x_tables: ip_tables: owner match: used from hooks PREROUTING, but only valid from OUTPUT/POSTROUTING [ 588.950907][T22403] 8021q: adding VLAN 0 to HW filter on device bond8 [ 588.999221][T22407] bond8: (slave veth0_to_bond): making interface the new active one [ 589.012723][T22407] bond8: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 589.229459][T22427] netlink: 252 bytes leftover after parsing attributes in process `syz.2.4796'. [ 589.253344][T22428] netlink: 'syz.4.4797': attribute type 32 has an invalid length. [ 589.272060][T22428] netlink: 776 bytes leftover after parsing attributes in process `syz.4.4797'. [ 589.342154][T22423] syzkaller1: entered promiscuous mode [ 589.352777][T22423] syzkaller1: entered allmulticast mode [ 589.372390][T22433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4799'. [ 589.744535][T22446] bond9: entered promiscuous mode [ 589.750288][T22446] bond9: entered allmulticast mode [ 589.758883][T22446] 8021q: adding VLAN 0 to HW filter on device bond9 [ 589.794180][T22435] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4800'. [ 589.859853][T22440] netlink: 732 bytes leftover after parsing attributes in process `syz.4.4800'. [ 590.004934][T22461] ieee802154 phy0 wpan0: encryption failed: -22 [ 590.081747][T22471] netlink: 168 bytes leftover after parsing attributes in process `syz.0.4809'. [ 590.148589][T22473] syzkaller0: entered promiscuous mode [ 590.165451][T22473] syzkaller0: entered allmulticast mode [ 590.391652][T22487] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4816'. [ 590.419792][T22487] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048) [ 590.463385][T22485] veth1_macvtap: left promiscuous mode [ 590.556531][T22494] netlink: 'syz.2.4820': attribute type 1 has an invalid length. [ 590.593722][T22496] netlink: Unknown conntrack attr (type=2304, max=9) [ 590.649059][T22498] netlink: 'syz.3.4821': attribute type 21 has an invalid length. [ 590.658003][T22498] netlink: 'syz.3.4821': attribute type 6 has an invalid length. [ 591.257979][T22535] veth1_macvtap: entered promiscuous mode [ 591.278648][T22535] macsec2: entered promiscuous mode [ 591.290304][T22535] veth1_macvtap: left promiscuous mode [ 591.587613][T22566] IPVS: set_ctl: invalid protocol: 33 224.0.0.2:20003 [ 591.733163][T22575] netlink: 'syz.2.4843': attribute type 1 has an invalid length. [ 591.847367][T22575] veth7: entered promiscuous mode [ 591.888855][T22589] FAULT_INJECTION: forcing a failure. [ 591.888855][T22589] name failslab, interval 1, probability 0, space 0, times 0 [ 591.901682][T22589] CPU: 0 UID: 0 PID: 22589 Comm: syz.4.4846 Not tainted syzkaller #0 PREEMPT(full) [ 591.901705][T22589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 591.901716][T22589] Call Trace: [ 591.901723][T22589] [ 591.901731][T22589] dump_stack_lvl+0xe8/0x150 [ 591.901754][T22589] should_fail_ex+0x412/0x560 [ 591.901781][T22589] should_failslab+0xa8/0x100 [ 591.901805][T22589] __kmalloc_cache_noprof+0x88/0x660 [ 591.901823][T22589] ? __pfx_stack_trace_save+0x10/0x10 [ 591.901844][T22589] ? rtnl_newlink+0x136/0x1bb0 [ 591.901945][T22589] rtnl_newlink+0x136/0x1bb0 [ 591.901964][T22589] ? kasan_save_track+0x3e/0x80 [ 591.901981][T22589] ? kasan_save_free_info+0x46/0x50 [ 591.901996][T22589] ? __kasan_slab_free+0x5c/0x80 [ 591.902016][T22589] ? dev_hard_start_xmit+0x2cd/0x830 [ 591.902083][T22589] ? __dev_queue_xmit+0x14d9/0x3950 [ 591.902101][T22589] ? __netlink_deliver_tap+0x5ad/0x850 [ 591.902119][T22589] ? netlink_deliver_tap+0x19c/0x1b0 [ 591.902136][T22589] ? netlink_unicast+0x730/0x8e0 [ 591.902150][T22589] ? netlink_sendmsg+0x813/0xb40 [ 591.902169][T22589] ? __pfx_rtnl_newlink+0x10/0x10 [ 591.902184][T22589] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.902232][T22589] ? kasan_quarantine_put+0xbb/0x1f0 [ 591.902248][T22589] ? lockdep_hardirqs_on+0x7a/0x110 [ 591.902306][T22589] ? nlmon_xmit+0xb0/0x100 [ 591.902382][T22589] ? kmem_cache_free+0x182/0x650 [ 591.902413][T22589] ? __lock_acquire+0x6b5/0x2cf0 [ 591.902435][T22589] ? __dev_queue_xmit+0x2b6/0x3950 [ 591.902459][T22589] ? __local_bh_enable_ip+0xd0/0x130 [ 591.902476][T22589] ? lockdep_hardirqs_on+0x7a/0x110 [ 591.902495][T22589] ? __dev_queue_xmit+0x2b6/0x3950 [ 591.902515][T22589] ? __local_bh_enable_ip+0xd0/0x130 [ 591.902529][T22589] ? __dev_queue_xmit+0x2b6/0x3950 [ 591.902557][T22589] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 591.902589][T22589] ? __pfx_rtnl_newlink+0x10/0x10 [ 591.902608][T22589] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 591.902630][T22589] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 591.902647][T22589] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 591.902667][T22589] ? ref_tracker_free+0x693/0x840 [ 591.902734][T22589] ? __pfx_ref_tracker_free+0x10/0x10 [ 591.902762][T22589] netlink_rcv_skb+0x232/0x4b0 [ 591.902783][T22589] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 591.902802][T22589] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 591.902832][T22589] ? netlink_deliver_tap+0x2e/0x1b0 [ 591.902850][T22589] ? netlink_deliver_tap+0x2e/0x1b0 [ 591.902873][T22589] netlink_unicast+0x75c/0x8e0 [ 591.902900][T22589] netlink_sendmsg+0x813/0xb40 [ 591.902927][T22589] ? __pfx_netlink_sendmsg+0x10/0x10 [ 591.902948][T22589] ? aa_sock_msg_perm+0xf1/0x1b0 [ 591.902970][T22589] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 591.902991][T22589] ____sys_sendmsg+0x972/0x9f0 [ 591.903011][T22589] ? __might_fault+0xaf/0x130 [ 591.903033][T22589] ? __pfx_____sys_sendmsg+0x10/0x10 [ 591.903056][T22589] ? import_iovec+0x73/0xa0 [ 591.903117][T22589] ___sys_sendmsg+0x2a5/0x360 [ 591.903138][T22589] ? __lock_acquire+0x6b5/0x2cf0 [ 591.903159][T22589] ? __pfx____sys_sendmsg+0x10/0x10 [ 591.903211][T22589] ? __fget_files+0x2a/0x420 [ 591.903226][T22589] ? __fget_files+0x3a0/0x420 [ 591.903277][T22589] __x64_sys_sendmsg+0x1bd/0x2a0 [ 591.903301][T22589] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 591.903330][T22589] ? __pfx_ksys_write+0x10/0x10 [ 591.903364][T22589] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.903380][T22589] do_syscall_64+0x15f/0xf80 [ 591.903400][T22589] ? trace_irq_disable+0x3b/0x140 [ 591.903422][T22589] ? clear_bhb_loop+0x40/0x90 [ 591.903455][T22589] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.903478][T22589] RIP: 0033:0x7f4d8099ce59 [ 591.903495][T22589] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 591.903509][T22589] RSP: 002b:00007f4d817a5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 591.903526][T22589] RAX: ffffffffffffffda RBX: 00007f4d80c15fa0 RCX: 00007f4d8099ce59 [ 591.903537][T22589] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000006 [ 591.903547][T22589] RBP: 00007f4d817a5090 R08: 0000000000000000 R09: 0000000000000000 [ 591.903557][T22589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 591.903566][T22589] R13: 00007f4d80c16038 R14: 00007f4d80c15fa0 R15: 00007fffac0f9e58 [ 591.903592][T22589] [ 594.505080][T22565] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 594.780409][T22620] netlink: 'syz.0.4855': attribute type 6 has an invalid length. [ 594.806453][T22620] tipc: New replicast peer: 255.255.255.255 [ 594.834794][T22629] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 594.840355][T22620] tipc: Enabled bearer , priority 10 [ 594.856143][T22629] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 594.943170][T22620] bond2: (slave lo): Releasing backup interface [ 594.995508][T22620] bond2: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 595.047428][T22620] syz_tun: left allmulticast mode [ 595.061910][T22620] syz_tun: left promiscuous mode [ 595.077757][T22620] bridge0: port 3(syz_tun) entered disabled state [ 595.149904][T22620] bridge_slave_0: left allmulticast mode [ 595.164595][T22620] bridge_slave_0: left promiscuous mode [ 595.184794][T22620] bridge0: port 1(bridge_slave_0) entered disabled state [ 595.222471][T22620] bridge_slave_1: left allmulticast mode [ 595.231721][T22620] bridge_slave_1: left promiscuous mode [ 595.245186][T22620] bridge0: port 2(bridge_slave_1) entered disabled state [ 595.265158][T22620] bond6: left promiscuous mode [ 595.289574][T22620] bond0: (slave bond_slave_0): Releasing backup interface [ 595.309291][T22620] bond0: (slave bond_slave_1): Releasing backup interface [ 595.329126][T22620] team0: Port device team_slave_0 removed [ 595.352486][T22620] team0: Port device team_slave_1 removed [ 595.366927][T22620] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 595.375570][T22620] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 595.385082][T22620] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 595.397934][T22620] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 595.413620][T22620] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 595.444010][T22612] ip6gre2: entered allmulticast mode [ 595.452208][T22612] team0: Port device ip6gre2 added [ 595.459787][T22640] FAULT_INJECTION: forcing a failure. [ 595.459787][T22640] name failslab, interval 1, probability 0, space 0, times 0 [ 595.472699][T22640] CPU: 0 UID: 0 PID: 22640 Comm: syz.2.4860 Not tainted syzkaller #0 PREEMPT(full) [ 595.472721][T22640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 595.472731][T22640] Call Trace: [ 595.472739][T22640] [ 595.472747][T22640] dump_stack_lvl+0xe8/0x150 [ 595.472771][T22640] should_fail_ex+0x412/0x560 [ 595.472797][T22640] should_failslab+0xa8/0x100 [ 595.472820][T22640] __kvmalloc_node_noprof+0x178/0x8a0 [ 595.472843][T22640] ? alloc_netdev_mqs+0xa8/0x1210 [ 595.472941][T22640] alloc_netdev_mqs+0xa8/0x1210 [ 595.472955][T22640] ? __pfx_vlan_setup+0x10/0x10 [ 595.473030][T22640] rtnl_create_link+0x31f/0xd70 [ 595.473053][T22640] rtnl_newlink_create+0x277/0xb70 [ 595.473074][T22640] ? __pfx___nla_validate_parse+0x10/0x10 [ 595.473102][T22640] ? __mutex_lock+0x608/0x1550 [ 595.473158][T22640] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 595.473182][T22640] ? __pfx___mutex_lock+0x10/0x10 [ 595.473214][T22640] ? ns_capable+0x89/0xe0 [ 595.473234][T22640] rtnl_newlink+0x166a/0x1bb0 [ 595.473268][T22640] ? __pfx_rtnl_newlink+0x10/0x10 [ 595.473284][T22640] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.473336][T22640] ? kasan_quarantine_put+0xbb/0x1f0 [ 595.473356][T22640] ? lockdep_hardirqs_on+0x7a/0x110 [ 595.473381][T22640] ? nlmon_xmit+0xb0/0x100 [ 595.473399][T22640] ? kmem_cache_free+0x182/0x650 [ 595.473431][T22640] ? __lock_acquire+0x6b5/0x2cf0 [ 595.473452][T22640] ? __dev_queue_xmit+0x2b6/0x3950 [ 595.473486][T22640] ? __local_bh_enable_ip+0xd0/0x130 [ 595.473502][T22640] ? lockdep_hardirqs_on+0x7a/0x110 [ 595.473521][T22640] ? __dev_queue_xmit+0x2b6/0x3950 [ 595.473540][T22640] ? __local_bh_enable_ip+0xd0/0x130 [ 595.473554][T22640] ? __dev_queue_xmit+0x2b6/0x3950 [ 595.473582][T22640] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 595.473616][T22640] ? __pfx_rtnl_newlink+0x10/0x10 [ 595.473633][T22640] rtnetlink_rcv_msg+0x7d5/0xbe0 [ 595.473656][T22640] ? rtnetlink_rcv_msg+0x1b9/0xbe0 [ 595.473674][T22640] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 595.473691][T22640] ? ref_tracker_free+0x693/0x840 [ 595.473714][T22640] ? __pfx_ref_tracker_free+0x10/0x10 [ 595.473744][T22640] netlink_rcv_skb+0x232/0x4b0 [ 595.473767][T22640] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 595.473786][T22640] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 595.473818][T22640] ? netlink_deliver_tap+0x2e/0x1b0 [ 595.473837][T22640] ? netlink_deliver_tap+0x2e/0x1b0 [ 595.473862][T22640] netlink_unicast+0x75c/0x8e0 [ 595.473891][T22640] netlink_sendmsg+0x813/0xb40 [ 595.473920][T22640] ? __pfx_netlink_sendmsg+0x10/0x10 [ 595.473944][T22640] ? aa_sock_msg_perm+0xf1/0x1b0 [ 595.473966][T22640] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 595.473989][T22640] ____sys_sendmsg+0x972/0x9f0 [ 595.474008][T22640] ? __might_fault+0xaf/0x130 [ 595.474034][T22640] ? __pfx_____sys_sendmsg+0x10/0x10 [ 595.474067][T22640] ? import_iovec+0x73/0xa0 [ 595.474093][T22640] ___sys_sendmsg+0x2a5/0x360 [ 595.474113][T22640] ? __lock_acquire+0x6b5/0x2cf0 [ 595.474134][T22640] ? __pfx____sys_sendmsg+0x10/0x10 [ 595.474161][T22640] ? finish_task_switch+0x41f/0xbe0 [ 595.474211][T22640] ? __fget_files+0x2a/0x420 [ 595.474229][T22640] ? __fget_files+0x3a0/0x420 [ 595.474258][T22640] __x64_sys_sendmsg+0x1bd/0x2a0 [ 595.474281][T22640] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 595.474299][T22640] ? sched_clock_cpu+0x74/0x440 [ 595.474336][T22640] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.474353][T22640] do_syscall_64+0x15f/0xf80 [ 595.474376][T22640] ? clear_bhb_loop+0x40/0x90 [ 595.474395][T22640] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 595.474411][T22640] RIP: 0033:0x7faa6599ce59 [ 595.474427][T22640] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 595.474439][T22640] RSP: 002b:00007faa668ea028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 595.474455][T22640] RAX: ffffffffffffffda RBX: 00007faa65c15fa0 RCX: 00007faa6599ce59 [ 595.474472][T22640] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000006 [ 595.474481][T22640] RBP: 00007faa668ea090 R08: 0000000000000000 R09: 0000000000000000 [ 595.474490][T22640] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 595.474498][T22640] R13: 00007faa65c16038 R14: 00007faa65c15fa0 R15: 00007fffb762a528 [ 595.474524][T22640] [ 595.942355][T22650] syzkaller1: entered promiscuous mode [ 595.948742][T22650] syzkaller1: entered allmulticast mode [ 596.210065][T22666] __nla_validate_parse: 5 callbacks suppressed [ 596.210083][T22666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4868'. [ 596.247029][T22666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4868'. [ 596.256894][T22666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4868'. [ 596.271250][T22666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4868'. [ 596.283602][T22666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4868'. [ 596.293063][T22666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4868'. [ 596.303561][T22666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4868'. [ 596.313160][T22666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4868'. [ 596.330297][T22666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4868'. [ 596.339720][T22666] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4868'. [ 596.358693][T22676] netlink: 'syz.3.4871': attribute type 1 has an invalid length. [ 596.659281][T22693] bridge3: entered promiscuous mode [ 596.677173][T22693] bridge3: entered allmulticast mode [ 597.076207][T22710] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 597.126236][T22716] netlink: 'syz.4.4884': attribute type 1 has an invalid length. [ 597.580262][T22742] xfrm0: entered promiscuous mode [ 597.588532][T22742] xfrm0: entered allmulticast mode [ 597.626419][T22749] syzkaller0: entered promiscuous mode [ 597.634099][T22741] openvswitch: netlink: Missing key (keys=40, expected=80) [ 597.648103][T22749] syzkaller0: entered allmulticast mode [ 597.821858][T22753] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 597.839879][T22758] netlink: 'syz.1.4897': attribute type 11 has an invalid length. [ 597.959364][T22763] openvswitch: netlink: Flow key attr not present in new flow. [ 598.059190][ T5638] Bluetooth: hci4: link tx timeout [ 598.071139][ T5638] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 598.085059][ T5634] Bluetooth: hci4: link tx timeout [ 598.091967][ T5634] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 598.101404][ T5634] Bluetooth: hci4: link tx timeout [ 598.109420][ T5634] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 598.117357][ T5634] Bluetooth: hci4: link tx timeout [ 598.122494][ T5634] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 598.131392][ T5634] Bluetooth: hci4: link tx timeout [ 598.138273][ T5634] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 598.368753][T22795] netlink: 'syz.0.4908': attribute type 64 has an invalid length. [ 598.382560][T22793] bridge9: entered promiscuous mode [ 598.388113][T22793] bridge9: entered allmulticast mode [ 599.692050][T22833] IPVS: Unknown mcast interface: nicvf0 [ 599.725235][T22862] netlink: 'syz.4.4929': attribute type 11 has an invalid length. [ 599.742654][T22862] netlink: 'syz.4.4929': attribute type 5 has an invalid length. [ 599.772776][T22862] netlink: 'syz.4.4929': attribute type 5 has an invalid length. [ 600.139230][ T5634] Bluetooth: hci4: command 0x0405 tx timeout [ 600.351650][T22881] netlink: 'syz.0.4934': attribute type 1 has an invalid length. [ 600.430716][T22885] openvswitch: netlink: Unexpected mask (mask=200840, allowed=10048) [ 600.471578][T22881] bond7: entered promiscuous mode [ 600.477777][T22881] 8021q: adding VLAN 0 to HW filter on device bond7 [ 600.485600][T22884] bond7: entered allmulticast mode [ 600.521659][T22889] netlink: 'syz.4.4938': attribute type 2 has an invalid length. [ 600.617609][T22892] IPVS: set_ctl: invalid protocol: 0 172.20.20.187:20001 [ 600.868367][T22914] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 601.297589][T22939] xt_SECMARK: invalid mode: 9 [ 601.389058][T22949] __nla_validate_parse: 75 callbacks suppressed [ 601.389075][T22949] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4952'. [ 601.782704][T22977] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4959'. [ 601.815491][T22979] nftables ruleset with unbound set [ 602.171995][T22998] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4964'. [ 602.212519][T22946] Can't find ip_set type  [ 602.301882][T23005] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4965'. [ 602.337891][T23014] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4968'. [ 602.356269][T23005] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 602.431175][T23005] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 602.470232][T23005] gretap2: entered promiscuous mode [ 602.499794][T23005] gretap2: entered allmulticast mode [ 602.506170][T23020] IPVS: set_ctl: invalid protocol: 50 224.0.0.2:20004 [ 602.575481][T22137] netdevsim netdevsim3 : set [0, 1] type 1 family 0 port 8472 - 0 [ 602.589640][T22137] netdevsim netdevsim3 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 602.618764][T22137] netdevsim netdevsim3 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 602.658803][T23034] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4973'. [ 602.670147][T23038] openvswitch: netlink: nsh attribute has 2 unknown bytes. [ 602.695727][T22137] netdevsim netdevsim3 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 602.709958][T23040] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4973'. [ 602.765569][T23034] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4973'. [ 602.804544][T23040] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4973'. [ 602.943004][T23048] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4978'. [ 603.043554][T23063] netlink: 'syz.0.4982': attribute type 1 has an invalid length. [ 603.211826][T23063] 8021q: adding VLAN 0 to HW filter on device bond8 [ 603.579013][T23100] openvswitch: netlink: Missing key (keys=40, expected=100) [ 603.641661][T23099] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 604.011598][T23127] xt_SECMARK: invalid mode: 9 [ 604.039847][T23129] netlink: 'syz.0.4998': attribute type 4 has an invalid length. [ 604.165648][T23133] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 604.491523][T23153] sctp: [Deprecated]: syz.1.5008 (pid 23153) Use of struct sctp_assoc_value in delayed_ack socket option. [ 604.491523][T23153] Use struct sctp_sack_info instead [ 604.985529][T23175] tipc: New replicast peer: 255.255.255.255 [ 605.005201][T23175] tipc: Enabled bearer , priority 10 [ 605.061499][T23175] openvswitch: netlink: Key type 30 is not supported [ 605.295453][T23190] xt_SECMARK: invalid mode: 9 [ 606.384540][T23244] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 606.396912][T23244] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 606.405089][T23244] gretap1: entered promiscuous mode [ 606.411024][T23244] gretap1: entered allmulticast mode [ 606.419975][T23245] __nla_validate_parse: 13 callbacks suppressed [ 606.419987][T23245] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5037'. [ 606.439087][T23244] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5037'. [ 606.698358][T23249] netlink: 'syz.0.5039': attribute type 8 has an invalid length. [ 606.771739][T23255] lo: entered promiscuous mode [ 606.777715][T23255] netlink: 'syz.0.5041': attribute type 2 has an invalid length. [ 606.785573][T23255] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 608.574859][T23210] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 608.841612][T23269] netlink: 'syz.2.5045': attribute type 1 has an invalid length. [ 608.854568][T23269] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5045'. [ 608.926085][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 608.978108][T23280] syzkaller0: entered promiscuous mode [ 608.984129][T23280] syzkaller0: entered allmulticast mode [ 609.020699][T23282] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5049'. [ 609.062978][T23282] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5049'. [ 609.101399][T23290] netlink: 'syz.2.5052': attribute type 6 has an invalid length. [ 609.119663][T23291] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.5052'. [ 609.131654][T23291] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.5052'. [ 609.142202][T23291] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.5052'. [ 609.160498][T23291] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.5052'. [ 609.177120][T23291] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.5052'. [ 609.315570][T23285] netlink: 'syz.0.5050': attribute type 10 has an invalid length. [ 609.341279][T23285] team0 (unregistering): Port device ip6gre2 removed [ 609.814652][T23316] vlan1: entered allmulticast mode [ 609.817588][T23318] netlink: 'syz.0.5062': attribute type 1 has an invalid length. [ 609.821291][T23316] gretap0: entered allmulticast mode [ 609.866630][T23321] netlink: 'syz.0.5062': attribute type 1 has an invalid length. [ 610.431908][T23345] bond9: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 610.484117][T23345] bond9 (unregistering): Released all slaves [ 610.553953][T23359] bridge7: entered promiscuous mode [ 610.559819][T23359] bridge7: entered allmulticast mode [ 611.435102][T23425] __nla_validate_parse: 74 callbacks suppressed [ 611.435114][T23425] netlink: 27 bytes leftover after parsing attributes in process `syz.1.5088'. [ 613.328652][T23350] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 613.547243][T23435] netlink: 112 bytes leftover after parsing attributes in process `syz.3.5093'. [ 613.580146][T23441] netlink: 212356 bytes leftover after parsing attributes in process `syz.1.5094'. [ 613.887038][T23466] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5100'. [ 613.952830][T23468] tipc: Enabling of bearer rejected, failed to enable media [ 613.966238][T23469] xt_l2tp: v2 tid > 0xffff: 1114244 [ 613.991362][T23470] veth0: entered promiscuous mode [ 613.991807][T23468] netlink: 'syz.3.5101': attribute type 2 has an invalid length. [ 614.016355][T23469] netlink: 44 bytes leftover after parsing attributes in process `syz.4.5103'. [ 614.122331][T23475] openvswitch: netlink: Flow actions attr not present in new flow. [ 614.161318][T23468] vlan3: entered promiscuous mode [ 614.189894][T23468] 0·: entered promiscuous mode [ 614.214213][T23468] vlan3: entered allmulticast mode [ 614.302256][T23493] netlink: 'syz.2.5108': attribute type 83 has an invalid length. [ 614.446064][T23502] netlink: 'syz.3.5111': attribute type 30 has an invalid length. [ 614.561241][T23511] xt_hl: Unknown TTL match mode: 255 [ 614.953194][T23483] bond9: option resend_igmp: invalid value (32767) [ 614.969104][T23483] bond9: option resend_igmp: allowed values 0 - 255 [ 614.988459][T23483] bond9 (unregistering): Released all slaves [ 615.151403][T23540] xt_SECMARK: invalid mode: 9 [ 615.327378][T22137] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 615.350699][T23548] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 615.506452][T23559] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5127'. [ 615.761024][T23565] xt_CT: No such helper "snmp_trap" [ 615.951061][T23581] x_tables: unsorted underflow at hook 3 [ 616.177744][T23553] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 616.188861][T23553] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 616.284671][T23553] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 616.299937][T23553] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 616.385044][T23553] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 616.401273][T23553] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 616.477230][T23553] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 616.484973][T23553] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 616.616384][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 616.661081][ T3353] bridge_slave_1: left allmulticast mode [ 616.682958][ T3353] bridge_slave_1: left promiscuous mode [ 616.713678][ T3353] bridge0: port 2(bridge_slave_1) entered disabled state [ 616.806501][T23632] netlink: 'syz.4.5151': attribute type 39 has an invalid length. [ 617.240489][ T3353] bond21 (unregistering): (slave geneve4): Releasing active interface [ 617.252072][ T3353] geneve4 (unregistering): left allmulticast mode [ 617.263812][ T3353] bond13 (unregistering): (slave geneve3): Releasing active interface [ 617.280972][ T3353] bond5 (unregistering): (slave geneve2): Releasing active interface [ 617.344170][ T3353]  (unregistering): (slave bridge1): Releasing backup interface [ 617.392172][ T3353] bond1 (unregistering): (slave bridge2): Releasing active interface [ 617.451544][ T3353] bond2 (unregistering): (slave bridge3): Releasing backup interface [ 617.611871][ T3353] bond3 (unregistering): (slave bridge7): Releasing backup interface [ 617.620726][ T3353] bridge7 (unregistering): left promiscuous mode [ 617.688941][ T3353] bond15 (unregistering): (slave bridge8): Releasing backup interface [ 617.697583][ T3353] bridge8 (unregistering): left promiscuous mode [ 617.991395][ T3353]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 618.002028][ T3353]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 618.012080][ T3353]  (unregistering): Released all slaves [ 618.022058][ T3353] bond1 (unregistering): Released all slaves [ 618.038476][ T3353] bond2 (unregistering): Released all slaves [ 618.056571][ T3353] bond3 (unregistering): Released all slaves [ 618.072466][ T3353] bond4 (unregistering): Released all slaves [ 618.094199][ T3353] bond5 (unregistering): Released all slaves [ 618.108508][ T3353] bond6 (unregistering): Released all slaves [ 618.122567][ T3353] bond7 (unregistering): Released all slaves [ 618.142941][ T3353] bond8 (unregistering): Released all slaves [ 618.156991][ T3353] bond9 (unregistering): Released all slaves [ 618.171514][ T3353] bond10 (unregistering): Released all slaves [ 618.191564][ T3353] bond11 (unregistering): (slave dummy0): Releasing backup interface [ 618.206412][ T3353] bond11 (unregistering): Released all slaves [ 618.224365][ T3353] bond12 (unregistering): Released all slaves [ 618.239338][ T3353] bond13 (unregistering): Released all slaves [ 618.253385][ T3353] bond14 (unregistering): Released all slaves [ 618.269723][ T3353] bond15 (unregistering): Released all slaves [ 618.289457][ T3353] bond16 (unregistering): Released all slaves [ 618.303657][ T3353] bond17 (unregistering): (slave lo): Releasing backup interface [ 618.311914][ T3353] bond17 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 618.328962][ T3353] bond17 (unregistering): Released all slaves [ 618.344432][ T3353] bond18 (unregistering): Released all slaves [ 618.358945][ T3353] bond19 (unregistering): Released all slaves [ 618.373096][ T3353] bond20 (unregistering): Released all slaves [ 618.394691][ T3353] bond21 (unregistering): Released all slaves [ 618.415215][ T3353] bond22 (unregistering): Released all slaves [ 618.588220][T23647] netlink: 'syz.0.5152': attribute type 49 has an invalid length. [ 618.661448][T23649] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5153'. [ 618.683439][T23649] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5153'. [ 618.864921][T23647] ip6gretap0: entered promiscuous mode [ 618.868480][T23657] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5154'. [ 618.875028][T23647] ip6gretap0: entered allmulticast mode [ 619.051252][ T3353] : left promiscuous mode [ 619.152482][T23657] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 619.224581][T23674] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5157'. [ 619.250067][T23657] netlink: 184 bytes leftover after parsing attributes in process `syz.4.5154'. [ 619.307115][T23674] : entered promiscuous mode [ 619.397213][ T3353] tipc: Left network mode [ 619.467892][T23682] vlan1: entered allmulticast mode [ 619.507566][T23682] veth0_vlan: entered allmulticast mode [ 619.560019][T23686] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5160'. [ 619.603142][T23686] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5160'. [ 620.009496][T23716] netlink: 'syz.2.5166': attribute type 1 has an invalid length. [ 620.045020][T23716] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5166'. [ 620.245521][T23726] netlink: 'syz.1.5170': attribute type 1 has an invalid length. [ 620.297865][T23726] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 620.575270][T23726] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.5170'. [ 620.604525][T23726] veth0_to_bond: default FDB implementation only supports local addresses [ 620.872933][T23749] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5172'. [ 621.214200][T23763] xt_hashlimit: overflow, rate too high: 0 [ 621.454896][T23784] netlink: 'syz.0.5183': attribute type 1 has an invalid length. [ 621.508680][T23782] xt_cluster: node mask cannot exceed total number of nodes [ 621.564954][T23784] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 621.824592][T23812] netlink: 'syz.0.5189': attribute type 1 has an invalid length. [ 622.426438][T23838] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 622.476298][ T3353] hsr_slave_0: left promiscuous mode [ 622.556138][ T3353] hsr_slave_1: left promiscuous mode [ 622.602826][ T3353] veth1_vlan: left promiscuous mode [ 622.915005][T23871] sock: sock_set_timeout: `syz.4.5201' (pid 23871) tries to set negative timeout [ 623.054541][T23879] netlink: 'syz.4.5204': attribute type 21 has an invalid length. [ 623.260886][ T3353] team0 (unregistering): Port device team_slave_1 removed [ 623.268375][T23888] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 623.291848][ T3353] team0 (unregistering): Port device team_slave_0 removed [ 623.438103][T23863] hsr_slave_1 (unregistering): left promiscuous mode [ 623.864709][ T3353] IPVS: stop unused estimator thread 0... [ 624.265101][T23936] veth0: entered promiscuous mode [ 624.345608][T23936] veth0: left promiscuous mode [ 624.472657][T23949] __nla_validate_parse: 4 callbacks suppressed [ 624.472673][T23949] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5224'. [ 624.503080][T23952] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5225'. [ 624.527318][T23952] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5225'. [ 624.553835][T23955] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5222'. [ 624.589550][T23955] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5222'. [ 624.880093][T23946] bridge_slave_0: left allmulticast mode [ 624.897774][T23946] bridge_slave_0: left promiscuous mode [ 624.912770][T23946] bridge0: port 1(bridge_slave_0) entered disabled state [ 624.947200][T23983] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5231'. [ 624.954528][T23946] bridge_slave_1: left allmulticast mode [ 624.961070][T23984] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5229'. [ 624.977981][T23946] bridge_slave_1: left promiscuous mode [ 624.982003][T23984] sctp: Trying to GSO but underlying device doesn't support it. [ 624.989653][T23946] bridge0: port 2(bridge_slave_1) entered disabled state [ 625.012376][T23946] bond0: (slave bond_slave_0): Releasing backup interface [ 625.025550][T23986] netlink: 'syz.2.5231': attribute type 1 has an invalid length. [ 625.036301][T23946] bond0: (slave bond_slave_1): Releasing backup interface [ 625.052989][T23946] team0: Port device team_slave_0 removed [ 625.063685][T23946] team0: Port device team_slave_1 removed [ 625.072142][T23946] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 625.082904][T23946] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 625.098920][T23946] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 625.119858][T23952] gretap0: entered promiscuous mode [ 625.126656][T23952] gretap0: left promiscuous mode [ 625.139542][T23975] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5230'. [ 625.314007][T23986] 8021q: adding VLAN 0 to HW filter on device bond8 [ 625.380579][T23987] bond8: (slave veth0_to_bond): making interface the new active one [ 625.393537][T23987] bond8: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 625.810473][T24032] netlink: 'syz.4.5242': attribute type 1 has an invalid length. [ 625.834829][T24035] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5242'. [ 625.863527][T24035] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5242'. [ 626.162158][T24045] tipc: Started in network mode [ 626.193808][T24045] tipc: Node identity c2c0a00be234, cluster identity 4711 [ 626.231506][T24045] tipc: Enabled bearer , priority 0 [ 626.577495][T24086] netlink: 'syz.1.5250': attribute type 10 has an invalid length. [ 626.715534][T24047] syzkaller0: entered promiscuous mode [ 626.721262][T24047] syzkaller0: entered allmulticast mode [ 626.728881][T24047] tipc: Resetting bearer [ 626.844620][T24086] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 626.873951][T24086] bond0: (slave netdevsim1): Enslaving as an active interface with an up link [ 626.994638][T24040] tipc: Resetting bearer [ 629.702771][T24040] tipc: Disabling bearer [ 629.720226][T24117] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 629.798088][T24119] netlink: 'syz.2.5256': attribute type 1 has an invalid length. [ 629.809468][ T993] tipc: Node number set to 552902667 [ 629.980947][T24119] 8021q: adding VLAN 0 to HW filter on device bond9 [ 630.012459][T24132] openvswitch: netlink: VXLAN extension 78 out of range max 1 [ 630.203648][T24141] netlink: 'syz.0.5261': attribute type 1 has an invalid length. [ 630.354401][T24155] sctp: [Deprecated]: syz.4.5265 (pid 24155) Use of int in maxseg socket option. [ 630.354401][T24155] Use struct sctp_assoc_value instead [ 630.459143][T24148] bond9: (slave gretap3): making interface the new active one [ 630.490920][T24148] bond9: (slave gretap3): Enslaving as an active interface with an up link [ 630.636261][T24164] __nla_validate_parse: 3 callbacks suppressed [ 630.636277][T24164] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5267'. [ 631.043396][T24193] netlink: 81336 bytes leftover after parsing attributes in process `syz.0.5277'. [ 631.083674][T24190] netlink: 81336 bytes leftover after parsing attributes in process `syz.0.5277'. [ 631.339883][T24209] netlink: 56 bytes leftover after parsing attributes in process `syz.0.5283'. [ 631.341223][T24211] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5282'. [ 631.374050][T24211] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5282'. [ 631.409979][T24211] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5282'. [ 631.421197][T24211] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5282'. [ 631.650095][ T5638] block nbd3: Receive control failed (result -32) [ 631.863722][T24240] bridge_slave_0: default FDB implementation only supports local addresses [ 631.881775][T24251] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5295'. [ 631.899705][T24251] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5295'. [ 631.958798][T24251] xt_hashlimit: max too large, truncated to 1048576 [ 632.033326][T24251] xt_ecn: cannot match TCP bits for non-tcp packets [ 632.480819][T24288] xt_hashlimit: overflow, rate too high: 0 [ 633.056720][T24333] x_tables: unsorted underflow at hook 1 [ 633.374550][T24352] vlan4: entered allmulticast mode [ 633.383489][T24352] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 634.094733][T24388] xt_hl: Unknown TTL match mode: 255 [ 634.224535][T24395] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 634.236331][T24396] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 634.568387][T24413] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 634.617415][T24416] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 634.743602][T24418] lo speed is unknown, defaulting to 1000 [ 634.764108][T24422] openvswitch: netlink: Message has 8 unknown bytes. [ 634.783745][T24422] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 634.829705][T24418] lo speed is unknown, defaulting to 1000 [ 634.870529][T24418] lo speed is unknown, defaulting to 1000 [ 634.963094][T24437] netlink: 'syz.1.5348': attribute type 1 has an invalid length. [ 635.110605][T24437] 8021q: adding VLAN 0 to HW filter on device bond5 [ 635.193642][T24449] IPVS: set_ctl: invalid protocol: 51 172.20.20.53:20001 [ 635.274783][T24418] infiniband syz0: set active [ 635.281145][T24418] infiniband syz0: added lo [ 635.305758][T24418] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 635.321456][T24418] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 635.339735][T24418] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 635.388283][T24418] RDS/IB: syz0: added [ 635.394866][T24418] smc: adding ib device syz0 with port count 1 [ 635.401661][T24418] smc: ib device syz0 port 1 has no pnetid [ 637.568493][T24447] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 637.580858][T24447] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 637.591227][T24447] bond0 (unregistering): Released all slaves [ 637.603538][ T24] lo speed is unknown, defaulting to 1000 [ 637.633371][T24418] lo speed is unknown, defaulting to 1000 [ 637.694100][T22134] bond8: (slave veth0_to_bond): link status definitely down, disabling slave [ 637.776042][T24462] IPVS: set_ctl: invalid protocol: 0 172.20.20.170:20004 [ 637.802620][T22134] bond8: now running without any active interface! [ 637.841455][ T5635] lo speed is unknown, defaulting to 1000 [ 637.890137][T24466] netlink: 'syz.1.5356': attribute type 25 has an invalid length. [ 638.049125][T24478] __nla_validate_parse: 11 callbacks suppressed [ 638.049144][T24478] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5356'. [ 638.432363][T24418] lo speed is unknown, defaulting to 1000 [ 638.819499][T24527] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5374'. [ 638.852505][T24527] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5374'. [ 639.090337][T24534] netlink: 'syz.3.5376': attribute type 1 has an invalid length. [ 639.115610][T24535] netlink: 'syz.3.5376': attribute type 1 has an invalid length. [ 639.167819][T24534] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5376'. [ 639.169000][T24543] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5376'. [ 639.304601][T24534] bond8: (slave bridge5): making interface the new active one [ 639.338979][T24534] bond8: (slave bridge5): Enslaving as an active interface with an up link [ 639.359278][T24418] lo speed is unknown, defaulting to 1000 [ 639.466363][T24543] bond8: (slave bridge6): Enslaving as an active interface with a down link [ 639.561779][T24553] bridge4: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 639.700294][T24558] netlink: 'syz.3.5382': attribute type 1 has an invalid length. [ 639.748498][T24558] netlink: 88 bytes leftover after parsing attributes in process `syz.3.5382'. [ 639.774723][T24558] netlink: 1 bytes leftover after parsing attributes in process `syz.3.5382'. [ 639.794267][T24558] netlink: 'syz.3.5382': attribute type 1 has an invalid length. [ 639.815570][T24558] netlink: 634 bytes leftover after parsing attributes in process `syz.3.5382'. [ 639.870274][T24563] tipc: Bearer : already 2 bearers with priority 10 [ 639.882192][T24563] tipc: Bearer : trying with adjusted priority [ 639.890630][T24563] tipc: Enabling of bearer rejected, failed to enable media [ 639.961906][T24418] lo speed is unknown, defaulting to 1000 [ 640.093767][T24573] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5389'. [ 640.113932][T24573] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5389'. [ 640.258912][T24571] bond9: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 640.304653][T24571] bond9 (unregistering): Released all slaves [ 640.411757][T24586] netlink: 'syz.1.5392': attribute type 1 has an invalid length. [ 640.423126][T24586] netlink: 'syz.1.5392': attribute type 1 has an invalid length. [ 640.662422][T24418] lo speed is unknown, defaulting to 1000 [ 640.787453][T24605] netlink: 'syz.3.5399': attribute type 1 has an invalid length. [ 640.807607][T24608] ipt_REJECT: TCP_RESET invalid for non-tcp [ 640.851238][T24605] 8021q: adding VLAN 0 to HW filter on device bond9 [ 640.859212][T24601] syzkaller0: entered promiscuous mode [ 640.864758][T24601] syzkaller0: entered allmulticast mode [ 640.892202][T24605] team0: Port device team_slave_0 removed [ 640.904150][T24605] bond9: (slave team_slave_0): Enslaving as a backup interface with an up link [ 641.170563][T24418] lo speed is unknown, defaulting to 1000 [ 641.618955][T24647] lo: left promiscuous mode [ 641.636103][T24647] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 642.090575][T24418] lo speed is unknown, defaulting to 1000 [ 642.121953][T24664] syzkaller0: entered promiscuous mode [ 642.146621][T24664] syzkaller0: entered allmulticast mode [ 642.588374][T24704] netlink: 'syz.4.5424': attribute type 2 has an invalid length. [ 642.947947][T24725] xt_cgroup: path and classid specified [ 643.030258][T24418] lo speed is unknown, defaulting to 1000 [ 643.674857][T24759] __nla_validate_parse: 13 callbacks suppressed [ 643.674873][T24759] netlink: 36 bytes leftover after parsing attributes in process `syz.2.5437'. [ 643.707176][T24759] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5437'. [ 643.794645][T24759] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5437'. [ 643.823429][T24759] syzkaller1: entered promiscuous mode [ 643.829438][T24759] syzkaller1: entered allmulticast mode [ 643.987924][T24772] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5442'. [ 644.134883][T24780] netlink: 'syz.1.5445': attribute type 1 has an invalid length. [ 644.548780][T24802] veth9: entered promiscuous mode [ 644.589087][T24812] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5455'. [ 645.931725][T24893] bridge10: entered allmulticast mode [ 645.949611][T24893] team0: Port device bridge10 added [ 646.170337][T24908] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5500'. [ 646.182026][T24908] openvswitch: netlink: Flow actions attr not present in new flow. [ 646.677178][T24940] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5511'. [ 646.885133][T24945] syzkaller0: entered promiscuous mode [ 646.904769][T24945] syzkaller0: entered allmulticast mode [ 647.061345][T24961] syzkaller0: entered promiscuous mode [ 647.091082][T24961] syzkaller0: entered allmulticast mode [ 647.290658][T24963] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 647.563572][T24987] netlink: 7 bytes leftover after parsing attributes in process `syz.1.5530'. [ 648.010263][T25006] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5537'. [ 648.093766][T25009] netlink: 276 bytes leftover after parsing attributes in process `syz.2.5538'. [ 648.285025][T25017] syzkaller0: entered promiscuous mode [ 648.291194][T25017] syzkaller0: entered allmulticast mode [ 648.676076][T25038] IPVS: sync thread started: state = BACKUP, mcast_ifn = bridge0, syncid = 0, id = 0 [ 648.909169][T25050] syzkaller0: entered promiscuous mode [ 648.938113][T25050] syzkaller0: entered allmulticast mode [ 649.051044][T25062] __nla_validate_parse: 2 callbacks suppressed [ 649.051061][T25062] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5560'. [ 649.356566][T25081] xt_hashlimit: size too large, truncated to 1048576 [ 649.403742][T25082] xt_CT: You must specify a L4 protocol and not use inversions on it [ 649.453344][T25087] TCP: tcp_parse_options: Illegal window scaling value 167 > 14 received [ 649.749468][T25095] syzkaller0: entered promiscuous mode [ 649.766265][T25095] syzkaller0: entered allmulticast mode [ 649.862292][T25105] tipc: Enabling of bearer rejected, failed to enable media [ 650.729007][T25158] netlink: 104 bytes leftover after parsing attributes in process `syz.1.5600'. [ 650.739070][T25159] syzkaller0: entered promiscuous mode [ 650.744685][T25159] syzkaller0: entered allmulticast mode [ 651.466126][T25198] xt_CT: You must specify a L4 protocol and not use inversions on it [ 651.824918][T25218] gretap1: entered allmulticast mode [ 652.050016][T25230] syz_tun: entered allmulticast mode [ 652.080806][T25230] syz_tun: left allmulticast mode [ 652.285537][T25240] netlink: 127 bytes leftover after parsing attributes in process `syz.4.5641'. [ 652.286976][T25243] FAULT_INJECTION: forcing a failure. [ 652.286976][T25243] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 652.319598][T25243] CPU: 0 UID: 0 PID: 25243 Comm: syz.3.5643 Not tainted syzkaller #0 PREEMPT(full) [ 652.319620][T25243] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 652.319630][T25243] Call Trace: [ 652.319637][T25243] [ 652.319645][T25243] dump_stack_lvl+0xe8/0x150 [ 652.319671][T25243] should_fail_ex+0x412/0x560 [ 652.319700][T25243] _copy_from_iter+0x1d3/0x1670 [ 652.319725][T25243] ? rcu_is_watching+0x15/0xb0 [ 652.319751][T25243] ? __pfx__copy_from_iter+0x10/0x10 [ 652.319778][T25243] ? netlink_sendmsg+0x650/0xb40 [ 652.319798][T25243] ? skb_put+0x11b/0x210 [ 652.319821][T25243] netlink_sendmsg+0x6c0/0xb40 [ 652.319850][T25243] ? __pfx_netlink_sendmsg+0x10/0x10 [ 652.319880][T25243] ? aa_sock_msg_perm+0xf1/0x1b0 [ 652.319902][T25243] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 652.319927][T25243] ____sys_sendmsg+0x972/0x9f0 [ 652.319949][T25243] ? __might_fault+0xaf/0x130 [ 652.319975][T25243] ? __pfx_____sys_sendmsg+0x10/0x10 [ 652.320004][T25243] ? import_iovec+0x73/0xa0 [ 652.320028][T25243] ___sys_sendmsg+0x2a5/0x360 [ 652.320048][T25243] ? __lock_acquire+0x6b5/0x2cf0 [ 652.320070][T25243] ? __pfx____sys_sendmsg+0x10/0x10 [ 652.320122][T25243] ? __fget_files+0x2a/0x420 [ 652.320140][T25243] ? __fget_files+0x3a0/0x420 [ 652.320167][T25243] __x64_sys_sendmsg+0x1bd/0x2a0 [ 652.320190][T25243] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 652.320219][T25243] ? __pfx_ksys_write+0x10/0x10 [ 652.320249][T25243] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 652.320267][T25243] do_syscall_64+0x15f/0xf80 [ 652.320289][T25243] ? trace_irq_disable+0x3b/0x140 [ 652.320311][T25243] ? clear_bhb_loop+0x40/0x90 [ 652.320330][T25243] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 652.320346][T25243] RIP: 0033:0x7fd33e99ce59 [ 652.320362][T25243] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 652.320375][T25243] RSP: 002b:00007fd33f834028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 652.320393][T25243] RAX: ffffffffffffffda RBX: 00007fd33ec15fa0 RCX: 00007fd33e99ce59 [ 652.320404][T25243] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 652.320414][T25243] RBP: 00007fd33f834090 R08: 0000000000000000 R09: 0000000000000000 [ 652.320424][T25243] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 652.320433][T25243] R13: 00007fd33ec16038 R14: 00007fd33ec15fa0 R15: 00007ffdb1d1d8b8 [ 652.320461][T25243] [ 652.357298][T25245] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5642'. [ 652.372699][T25247] IPVS: set_ctl: invalid protocol: 8 100.1.1.2:20000 [ 652.739100][T25260] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 652.759259][ T5763] lo speed is unknown, defaulting to 1000 [ 652.921264][T25268] syzkaller0: entered promiscuous mode [ 652.938460][T25268] syzkaller0: entered allmulticast mode [ 653.378707][T25299] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5662'. [ 653.425377][T25303] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.5665'. [ 653.441630][T25305] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5663'. [ 653.585024][T25307] tipc: Enabled bearer , priority 0 [ 653.633837][T25307] tipc: Resetting bearer [ 653.674676][T25307] syzkaller0: entered promiscuous mode [ 653.687449][T25307] syzkaller0: entered allmulticast mode [ 653.709343][T25319] netlink: 212344 bytes leftover after parsing attributes in process `syz.3.5669'. [ 653.740741][T25306] tipc: Resetting bearer [ 653.782000][T25323] sctp: [Deprecated]: syz.0.5672 (pid 25323) Use of int in maxseg socket option. [ 653.782000][T25323] Use struct sctp_assoc_value instead [ 653.783268][T25321] openvswitch: netlink: IPv4 tun info is not correct [ 653.803765][T25306] tipc: Disabling bearer [ 653.830850][T25319] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5669'. [ 654.044806][T25333] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5675'. [ 654.067581][T25332] IPVS: Unknown mcast interface: vcan0 [ 654.079030][T25333] netlink: 'syz.0.5675': attribute type 7 has an invalid length. [ 654.120177][T25333] netlink: 'syz.0.5675': attribute type 8 has an invalid length. [ 654.142642][T25341] netlink: 'syz.1.5677': attribute type 1 has an invalid length. [ 654.163924][T25333] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5675'. [ 654.200978][T25341] 8021q: adding VLAN 0 to HW filter on device bond6 [ 654.240738][T25343] netlink: 'syz.2.5678': attribute type 11 has an invalid length. [ 654.283690][T25343] netlink: 'syz.2.5678': attribute type 5 has an invalid length. [ 654.296281][T25343] netlink: 6548 bytes leftover after parsing attributes in process `syz.2.5678'. [ 654.316421][T25343] netlink: 'syz.2.5678': attribute type 1 has an invalid length. [ 654.382823][T25350] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5678'. [ 654.434045][T25350] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5678'. [ 654.615144][T25379] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5686'. [ 654.624447][T25379] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5686'. [ 654.639388][T25378] bridge0: port 1(veth1_to_bridge) entered blocking state [ 654.647465][T25378] bridge0: port 1(veth1_to_bridge) entered disabled state [ 654.654886][T25378] veth1_to_bridge: entered allmulticast mode [ 654.663692][T25378] veth1_to_bridge: entered promiscuous mode [ 654.674989][T25380] IPVS: set_ctl: invalid protocol: 8 224.0.0.2:20002 [ 654.784585][T25385] netlink: 144 bytes leftover after parsing attributes in process `syz.4.5689'. [ 654.800940][T25385] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5689'. [ 654.811247][T25385] openvswitch: netlink: Unknown nsh attribute 0 [ 654.825015][T25385] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5689'. [ 654.847317][T25385] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5689'. [ 655.213705][T25412] FAULT_INJECTION: forcing a failure. [ 655.213705][T25412] name failslab, interval 1, probability 0, space 0, times 0 [ 655.227333][T25412] CPU: 1 UID: 0 PID: 25412 Comm: syz.4.5697 Not tainted syzkaller #0 PREEMPT(full) [ 655.227355][T25412] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 655.227364][T25412] Call Trace: [ 655.227371][T25412] [ 655.227377][T25412] dump_stack_lvl+0xe8/0x150 [ 655.227402][T25412] should_fail_ex+0x412/0x560 [ 655.227426][T25412] should_failslab+0xa8/0x100 [ 655.227447][T25412] ? skb_clone+0x212/0x3a0 [ 655.227544][T25412] kmem_cache_alloc_noprof+0x87/0x650 [ 655.227565][T25412] ? apparmor_capable+0x126/0x170 [ 655.227628][T25412] skb_clone+0x212/0x3a0 [ 655.227647][T25412] ? nfnetlink_rcv+0x4b0/0x27b0 [ 655.227698][T25412] nfnetlink_rcv+0x4de/0x27b0 [ 655.227726][T25412] ? lockdep_hardirqs_on+0x7a/0x110 [ 655.227747][T25412] ? __local_bh_enable_ip+0xd0/0x130 [ 655.227764][T25412] ? __dev_queue_xmit+0x2b6/0x3950 [ 655.227785][T25412] ? __dev_queue_xmit+0x1fe5/0x3950 [ 655.227803][T25412] ? __x64_sys_sendmsg+0x1bd/0x2a0 [ 655.227827][T25412] ? __dev_queue_xmit+0x2b6/0x3950 [ 655.227850][T25412] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 655.227880][T25412] ? ref_tracker_free+0x693/0x840 [ 655.227901][T25412] ? __pfx_ref_tracker_free+0x10/0x10 [ 655.227933][T25412] ? skb_clone+0x246/0x3a0 [ 655.227956][T25412] ? __netlink_deliver_tap+0x807/0x850 [ 655.227976][T25412] ? netlink_deliver_tap+0x2e/0x1b0 [ 655.228001][T25412] ? netlink_deliver_tap+0x2e/0x1b0 [ 655.228019][T25412] ? netlink_deliver_tap+0x2e/0x1b0 [ 655.228043][T25412] netlink_unicast+0x75c/0x8e0 [ 655.228068][T25412] netlink_sendmsg+0x813/0xb40 [ 655.228093][T25412] ? __pfx_netlink_sendmsg+0x10/0x10 [ 655.228110][T25412] ? aa_sock_msg_perm+0xf1/0x1b0 [ 655.228129][T25412] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 655.228150][T25412] ____sys_sendmsg+0x972/0x9f0 [ 655.228168][T25412] ? __might_fault+0xaf/0x130 [ 655.228189][T25412] ? __pfx_____sys_sendmsg+0x10/0x10 [ 655.228212][T25412] ? import_iovec+0x73/0xa0 [ 655.228234][T25412] ___sys_sendmsg+0x2a5/0x360 [ 655.228253][T25412] ? __lock_acquire+0x6b5/0x2cf0 [ 655.228274][T25412] ? __pfx____sys_sendmsg+0x10/0x10 [ 655.228321][T25412] ? __fget_files+0x2a/0x420 [ 655.228338][T25412] ? __fget_files+0x3a0/0x420 [ 655.228365][T25412] __x64_sys_sendmsg+0x1bd/0x2a0 [ 655.228388][T25412] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 655.228417][T25412] ? __pfx_ksys_write+0x10/0x10 [ 655.228445][T25412] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 655.228463][T25412] do_syscall_64+0x15f/0xf80 [ 655.228492][T25412] ? trace_irq_disable+0x3b/0x140 [ 655.228514][T25412] ? clear_bhb_loop+0x40/0x90 [ 655.228533][T25412] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 655.228548][T25412] RIP: 0033:0x7f4d8099ce59 [ 655.228564][T25412] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 655.228577][T25412] RSP: 002b:00007f4d817a5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 655.228594][T25412] RAX: ffffffffffffffda RBX: 00007f4d80c15fa0 RCX: 00007f4d8099ce59 [ 655.228606][T25412] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 655.228616][T25412] RBP: 00007f4d817a5090 R08: 0000000000000000 R09: 0000000000000000 [ 655.228625][T25412] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 655.228634][T25412] R13: 00007f4d80c16038 R14: 00007f4d80c15fa0 R15: 00007fffac0f9e58 [ 655.228659][T25412] [ 655.802392][T25426] bond3: option mode: unable to set because the bond device is up [ 655.861542][T25434] IPv6: NLM_F_CREATE should be specified when creating new route [ 656.152880][T25453] set match dimension is over the limit! [ 657.020981][T25505] vlan5: entered allmulticast mode [ 657.027182][T25505] bond0: entered allmulticast mode [ 657.259337][T25521] netlink: 'syz.1.5735': attribute type 1 has an invalid length. [ 657.301666][T25521] netlink: 'syz.1.5735': attribute type 1 has an invalid length. [ 657.361650][T25521] netlink: 'syz.1.5735': attribute type 1 has an invalid length. [ 657.392298][T25523] bond7: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 657.401858][T25521] netlink: 'syz.1.5735': attribute type 1 has an invalid length. [ 657.409974][T25521] netlink: 'syz.1.5735': attribute type 1 has an invalid length. [ 657.737134][T25538] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.2.5738:25538 [ 658.079376][T25565] sctp: [Deprecated]: syz.1.5746 (pid 25565) Use of int in max_burst socket option. [ 658.079376][T25565] Use struct sctp_assoc_value instead [ 658.367442][T25575] ip_tunnel: non-ECT from 2.0.0.0 with TOS=0x3 [ 659.143781][T25578] validate_nla: 29 callbacks suppressed [ 659.143799][T25578] netlink: 'syz.0.5751': attribute type 1 has an invalid length. [ 659.202683][T25578] __nla_validate_parse: 113 callbacks suppressed [ 659.202700][T25578] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5751'. [ 659.226357][T25578] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5751'. [ 659.241008][T25578] netlink: 'syz.0.5751': attribute type 2 has an invalid length. [ 659.250974][T25578] netlink: 'syz.0.5751': attribute type 2 has an invalid length. [ 659.278837][T25578] netlink: 'syz.0.5751': attribute type 2 has an invalid length. [ 659.382795][T25617] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5763'. [ 659.410246][T25617] syzkaller1: entered promiscuous mode [ 659.420539][T25617] syzkaller1: entered allmulticast mode [ 659.448048][T25626] netlink: 'syz.0.5765': attribute type 1 has an invalid length. [ 659.503533][T25626] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 659.719930][T25644] openvswitch: netlink: Tunnel attr 78 out of range max 16 [ 660.009471][T25669] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5779'. [ 660.149218][T25681] netlink: 'syz.4.5781': attribute type 21 has an invalid length. [ 660.157377][T25680] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5782'. [ 660.221766][T25685] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5783'. [ 660.309903][T25691] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5787'. [ 660.489219][T25700] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5790'. [ 660.862354][T25731] openvswitch: netlink: nsh attr 5 is out of range max 3 [ 660.870725][T25728] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5798'. [ 660.886611][T25731] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 660.901078][T25735] netlink: 'syz.3.5800': attribute type 3 has an invalid length. [ 660.941852][T25728] ip6tnl1: entered promiscuous mode [ 661.100547][T25741] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 661.116968][T25747] netlink: 'syz.0.5806': attribute type 1 has an invalid length. [ 661.181218][T25747] 8021q: adding VLAN 0 to HW filter on device bond10 [ 661.194778][T25751] netlink: 'syz.3.5807': attribute type 29 has an invalid length. [ 661.212323][T25751] netlink: 'syz.3.5807': attribute type 29 has an invalid length. [ 661.221414][T25751] netlink: 264 bytes leftover after parsing attributes in process `syz.3.5807'. [ 661.677011][T25782] bond8: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 661.689811][T25782] bond8 (unregistering): Released all slaves [ 662.739118][T25848] netem: change failed [ 663.517322][T25907] gre0: entered promiscuous mode [ 663.542959][T25907] gre0: entered allmulticast mode [ 663.771629][T25916] nbd: error processing sock list [ 663.789798][T25915] nbd: error processing sock list [ 663.907380][T25924] netlink: 'syz.3.5855': attribute type 11 has an invalid length. [ 664.505356][T25948] validate_nla: 5 callbacks suppressed [ 664.505373][T25948] netlink: 'syz.3.5863': attribute type 1 has an invalid length. [ 664.535263][T25948] netlink: 'syz.3.5863': attribute type 2 has an invalid length. [ 664.552685][T25949] __nla_validate_parse: 14 callbacks suppressed [ 664.552702][T25949] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5865'. [ 664.663535][T25949] 8021q: adding VLAN 0 to HW filter on device bond8 [ 664.718300][T25955] bond8: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 664.942748][T25961] netlink: 'syz.3.5868': attribute type 26 has an invalid length. [ 665.081523][T25977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5872'. [ 665.113063][T25977] netlink: 92 bytes leftover after parsing attributes in process `syz.0.5872'. [ 665.361570][T25988] syzkaller1: entered promiscuous mode [ 665.384317][T25988] syzkaller1: entered allmulticast mode [ 665.724333][T26010] netlink: 'syz.2.5880': attribute type 10 has an invalid length. [ 665.781830][T26010] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 665.796448][T26010] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 665.883059][T26019] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5885'. [ 665.894570][T26019] netlink: 120 bytes leftover after parsing attributes in process `syz.3.5885'. [ 665.903975][T26019] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5885'. [ 666.008975][T26010] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 666.057115][T26010] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 666.291071][T26033] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5891'. [ 666.330747][T26039] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5889'. [ 666.355237][T26039] erspan0: entered promiscuous mode [ 666.369740][T26036] can: request_module (can-proto-0) failed. [ 666.378754][T26040] tipc: Enabled bearer , priority 0 [ 666.395040][T26040] syzkaller0: entered promiscuous mode [ 666.412230][T26040] syzkaller0: entered allmulticast mode [ 666.492296][T26040] tipc: Resetting bearer [ 666.520706][T26037] tipc: Resetting bearer [ 666.588478][T26037] tipc: Disabling bearer [ 666.645487][T26050] syzkaller0: entered promiscuous mode [ 666.656488][T26050] syzkaller0: entered allmulticast mode [ 666.970308][T26071] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5901'. [ 666.981578][T26078] IPv6: addrconf: prefix option has invalid lifetime [ 666.984174][T26080] openvswitch: netlink: nsh attribute has 2 unknown bytes. [ 666.988325][T26078] IPv6: addrconf: prefix option has invalid lifetime [ 667.005468][T26071] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5901'. [ 667.549702][T26118] netlink: 'syz.0.5916': attribute type 1 has an invalid length. [ 667.612111][T26118] 8021q: adding VLAN 0 to HW filter on device bond11 [ 668.565185][T26154] sctp: [Deprecated]: syz.3.5926 (pid 26154) Use of struct sctp_assoc_value in delayed_ack socket option. [ 668.565185][T26154] Use struct sctp_sack_info instead [ 668.920150][ T993] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 668.977110][ T993] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 669.147097][T26188] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 669.281188][ T5634] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 669.299430][ T5634] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 669.308892][ T5634] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 669.326657][ T5634] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 669.341736][ T5634] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 669.448031][ T5638] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 669.459455][ T5638] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 669.470212][ T5638] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 669.484517][ T5638] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 669.493445][ T5638] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 669.872040][T26215] __nla_validate_parse: 8 callbacks suppressed [ 669.872055][T26215] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5943'. [ 669.909528][T26216] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5943'. [ 669.925649][T26221] netlink: 'syz.1.5944': attribute type 4 has an invalid length. [ 669.948723][T26220] netlink: 'syz.3.5945': attribute type 10 has an invalid length. [ 669.996764][T26223] syzkaller0: entered promiscuous mode [ 670.002277][T26223] syzkaller0: entered allmulticast mode [ 670.433954][T26192] lo speed is unknown, defaulting to 1000 [ 670.739606][T26192] bridge0: port 1(bridge_slave_0) entered blocking state [ 670.747101][T26192] bridge0: port 1(bridge_slave_0) entered disabled state [ 670.754449][T26192] bridge_slave_0: entered allmulticast mode [ 670.762329][T26192] bridge_slave_0: entered promiscuous mode [ 670.771753][T26192] bridge0: port 2(bridge_slave_1) entered blocking state [ 670.779318][T26192] bridge0: port 2(bridge_slave_1) entered disabled state [ 670.786768][T26192] bridge_slave_1: entered allmulticast mode [ 670.794017][T26192] bridge_slave_1: entered promiscuous mode [ 670.823004][T26192] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 670.835190][T26192] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 670.885087][T26192] team0: Port device team_slave_0 added [ 670.898533][T26192] team0: Port device team_slave_1 added [ 670.944345][T26192] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 670.951983][T26192] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 671.002895][T26192] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 671.054057][T26192] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 671.079872][T26192] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 671.112073][T26192] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 671.197094][T26192] hsr_slave_0: entered promiscuous mode [ 671.207102][T26192] hsr_slave_1: entered promiscuous mode [ 671.324891][T26273] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5960'. [ 671.368632][T16043] IPVS: starting estimator thread 0... [ 671.465967][T26276] IPVS: using max 38 ests per chain, 91200 per kthread [ 671.483402][T26270] syzkaller0: entered promiscuous mode [ 671.490012][T26270] syzkaller0: entered allmulticast mode [ 671.512734][T26272] gre2: entered promiscuous mode [ 671.566992][ T5638] Bluetooth: hci3: command tx timeout [ 673.656012][ T5638] Bluetooth: hci3: command tx timeout [ 674.062098][T26284] bridge7: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 674.212845][T26315] FAULT_INJECTION: forcing a failure. [ 674.212845][T26315] name failslab, interval 1, probability 0, space 0, times 0 [ 674.253486][T26315] CPU: 0 UID: 0 PID: 26315 Comm: syz.1.5967 Not tainted syzkaller #0 PREEMPT(full) [ 674.253510][T26315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 674.253520][T26315] Call Trace: [ 674.253527][T26315] [ 674.253535][T26315] dump_stack_lvl+0xe8/0x150 [ 674.253560][T26315] should_fail_ex+0x412/0x560 [ 674.253589][T26315] should_failslab+0xa8/0x100 [ 674.253615][T26315] __kvmalloc_node_noprof+0x178/0x8a0 [ 674.253639][T26315] ? nf_hook_entries_grow+0x288/0x720 [ 674.253751][T26315] ? __pfx___mutex_lock+0x10/0x10 [ 674.253779][T26315] nf_hook_entries_grow+0x288/0x720 [ 674.253812][T26315] __nf_register_net_hook+0x2c9/0x930 [ 674.253845][T26315] nf_register_net_hook+0xb2/0x190 [ 674.253869][T26315] nf_register_net_hooks+0x44/0x1b0 [ 674.253895][T26315] nf_defrag_ipv4_enable+0x87/0x120 [ 674.253997][T26315] nf_ct_netns_do_get+0x18c/0x5c0 [ 674.254046][T26315] ? rcu_is_watching+0x15/0xb0 [ 674.254067][T26315] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 674.254090][T26315] ? nft_parse_register_load+0x31e/0x3b0 [ 674.254182][T26315] ? nf_ct_netns_get+0xe9/0x320 [ 674.254207][T26315] nf_tables_newrule+0x17ac/0x28b0 [ 674.254236][T26315] ? __pfx_nf_tables_newrule+0x10/0x10 [ 674.254250][T26315] ? nfnl_pernet+0x23/0x240 [ 674.254270][T26315] ? nfnl_pernet+0x23/0x240 [ 674.254298][T26315] ? __nla_parse+0x40/0x60 [ 674.254325][T26315] nfnetlink_rcv+0x123e/0x27b0 [ 674.254381][T26315] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 674.254450][T26315] ? netlink_deliver_tap+0x2e/0x1b0 [ 674.254482][T26315] ? netlink_deliver_tap+0x2e/0x1b0 [ 674.254501][T26315] ? netlink_deliver_tap+0x2e/0x1b0 [ 674.254525][T26315] netlink_unicast+0x75c/0x8e0 [ 674.254551][T26315] netlink_sendmsg+0x813/0xb40 [ 674.254577][T26315] ? __pfx_netlink_sendmsg+0x10/0x10 [ 674.254598][T26315] ? aa_sock_msg_perm+0xf1/0x1b0 [ 674.254618][T26315] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 674.254640][T26315] ____sys_sendmsg+0x972/0x9f0 [ 674.254659][T26315] ? __might_fault+0xaf/0x130 [ 674.254682][T26315] ? __pfx_____sys_sendmsg+0x10/0x10 [ 674.254707][T26315] ? import_iovec+0x73/0xa0 [ 674.254822][T26315] ___sys_sendmsg+0x2a5/0x360 [ 674.254840][T26315] ? __lock_acquire+0x6b5/0x2cf0 [ 674.254860][T26315] ? __pfx____sys_sendmsg+0x10/0x10 [ 674.254912][T26315] ? __fget_files+0x2a/0x420 [ 674.254928][T26315] ? __fget_files+0x3a0/0x420 [ 674.254955][T26315] __x64_sys_sendmsg+0x1bd/0x2a0 [ 674.254979][T26315] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 674.255010][T26315] ? __pfx_ksys_write+0x10/0x10 [ 674.255036][T26315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.255053][T26315] do_syscall_64+0x15f/0xf80 [ 674.255074][T26315] ? trace_irq_disable+0x3b/0x140 [ 674.255096][T26315] ? clear_bhb_loop+0x40/0x90 [ 674.255116][T26315] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 674.255130][T26315] RIP: 0033:0x7f52e259ce59 [ 674.255146][T26315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 674.255159][T26315] RSP: 002b:00007f52e3510028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 674.255182][T26315] RAX: ffffffffffffffda RBX: 00007f52e2815fa0 RCX: 00007f52e259ce59 [ 674.255193][T26315] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 674.255202][T26315] RBP: 00007f52e3510090 R08: 0000000000000000 R09: 0000000000000000 [ 674.255211][T26315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 674.255220][T26315] R13: 00007f52e2816038 R14: 00007f52e2815fa0 R15: 00007ffd3d2625e8 [ 674.255248][T26315] [ 674.612896][T26318] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5968'. [ 674.728684][T26322] netlink: 'syz.1.5971': attribute type 3 has an invalid length. [ 674.744686][T26322] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5971'. [ 674.796256][T26192] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 674.811675][T26192] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 674.949008][T26192] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 674.961564][T26192] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.113786][T26335] syzkaller0: entered promiscuous mode [ 675.119383][T26335] syzkaller0: entered allmulticast mode [ 675.159686][T26192] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 675.170742][T26192] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.552147][T26348] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5977'. [ 675.739495][ T5638] Bluetooth: hci3: command tx timeout [ 675.816292][T26356] FAULT_INJECTION: forcing a failure. [ 675.816292][T26356] name failslab, interval 1, probability 0, space 0, times 0 [ 675.829640][T26356] CPU: 0 UID: 0 PID: 26356 Comm: syz.3.5980 Not tainted syzkaller #0 PREEMPT(full) [ 675.829663][T26356] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 675.829671][T26356] Call Trace: [ 675.829678][T26356] [ 675.829685][T26356] dump_stack_lvl+0xe8/0x150 [ 675.829710][T26356] should_fail_ex+0x412/0x560 [ 675.829737][T26356] should_failslab+0xa8/0x100 [ 675.829762][T26356] __kvmalloc_node_noprof+0x178/0x8a0 [ 675.829785][T26356] ? nf_hook_entries_grow+0x288/0x720 [ 675.829810][T26356] ? __pfx___mutex_lock+0x10/0x10 [ 675.829837][T26356] nf_hook_entries_grow+0x288/0x720 [ 675.829874][T26356] __nf_register_net_hook+0x2c9/0x930 [ 675.829907][T26356] nf_register_net_hook+0xb2/0x190 [ 675.829931][T26356] nf_register_net_hooks+0x44/0x1b0 [ 675.829955][T26356] nf_defrag_ipv4_enable+0x87/0x120 [ 675.829981][T26356] nf_ct_netns_do_get+0x18c/0x5c0 [ 675.830003][T26356] ? rcu_is_watching+0x15/0xb0 [ 675.830022][T26356] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 675.830044][T26356] ? nft_parse_register_load+0x31e/0x3b0 [ 675.830070][T26356] ? nf_ct_netns_get+0xe9/0x320 [ 675.830095][T26356] nf_tables_newrule+0x17ac/0x28b0 [ 675.830125][T26356] ? __pfx_nf_tables_newrule+0x10/0x10 [ 675.830139][T26356] ? nfnl_pernet+0x23/0x240 [ 675.830156][T26356] ? nfnl_pernet+0x23/0x240 [ 675.830193][T26356] ? __nla_parse+0x40/0x60 [ 675.830219][T26356] nfnetlink_rcv+0x123e/0x27b0 [ 675.830272][T26356] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 675.830308][T26356] ? ref_tracker_free+0x693/0x840 [ 675.830358][T26356] ? __netlink_deliver_tap+0x807/0x850 [ 675.830388][T26356] ? netlink_deliver_tap+0x2e/0x1b0 [ 675.830408][T26356] ? netlink_deliver_tap+0x2e/0x1b0 [ 675.830433][T26356] netlink_unicast+0x75c/0x8e0 [ 675.830462][T26356] netlink_sendmsg+0x813/0xb40 [ 675.830491][T26356] ? __pfx_netlink_sendmsg+0x10/0x10 [ 675.830515][T26356] ? aa_sock_msg_perm+0xf1/0x1b0 [ 675.830542][T26356] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 675.830568][T26356] ____sys_sendmsg+0x972/0x9f0 [ 675.830614][T26356] ? __might_fault+0xaf/0x130 [ 675.830640][T26356] ? __pfx_____sys_sendmsg+0x10/0x10 [ 675.830669][T26356] ? import_iovec+0x73/0xa0 [ 675.830695][T26356] ___sys_sendmsg+0x2a5/0x360 [ 675.830714][T26356] ? __lock_acquire+0x6b5/0x2cf0 [ 675.830736][T26356] ? __pfx____sys_sendmsg+0x10/0x10 [ 675.830793][T26356] ? __fget_files+0x2a/0x420 [ 675.830810][T26356] ? __fget_files+0x3a0/0x420 [ 675.830838][T26356] __x64_sys_sendmsg+0x1bd/0x2a0 [ 675.830861][T26356] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 675.830893][T26356] ? __pfx_ksys_write+0x10/0x10 [ 675.830922][T26356] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.830939][T26356] do_syscall_64+0x15f/0xf80 [ 675.830959][T26356] ? trace_irq_disable+0x3b/0x140 [ 675.830982][T26356] ? clear_bhb_loop+0x40/0x90 [ 675.831001][T26356] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 675.831014][T26356] RIP: 0033:0x7fd33e99ce59 [ 675.831030][T26356] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 675.831042][T26356] RSP: 002b:00007fd33f834028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 675.831058][T26356] RAX: ffffffffffffffda RBX: 00007fd33ec15fa0 RCX: 00007fd33e99ce59 [ 675.831068][T26356] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 675.831076][T26356] RBP: 00007fd33f834090 R08: 0000000000000000 R09: 0000000000000000 [ 675.831085][T26356] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 675.831093][T26356] R13: 00007fd33ec16038 R14: 00007fd33ec15fa0 R15: 00007ffdb1d1d8b8 [ 675.831123][T26356] [ 677.809025][ T5638] Bluetooth: hci3: command tx timeout [ 678.022824][T26358] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5981'. [ 678.083769][T26359] vlan4: entered allmulticast mode [ 678.112230][ T3353] bond2: left allmulticast mode [ 678.132950][T26366] netlink: 'syz.2.5983': attribute type 2 has an invalid length. [ 678.134376][ T3353] bond2: left promiscuous mode [ 678.147275][ T3353] bridge0: port 3(bond2) entered disabled state [ 678.147664][T26366] netlink: 'syz.2.5983': attribute type 2 has an invalid length. [ 678.164127][T26366] netlink: 'syz.2.5983': attribute type 1 has an invalid length. [ 678.173772][ T3353] bridge_slave_1: left allmulticast mode [ 678.191982][ T3353] bridge_slave_1: left promiscuous mode [ 678.203103][ T3353] bridge0: port 2(bridge_slave_1) entered disabled state [ 678.222627][ T3353] bridge_slave_0: left allmulticast mode [ 678.238348][ T3353] bridge_slave_0: left promiscuous mode [ 678.244141][ T3353] bridge0: port 1(bridge_slave_0) entered disabled state [ 678.254424][T26368] netlink: 'syz.3.5984': attribute type 1 has an invalid length. [ 678.269933][T26368] netlink: 'syz.3.5984': attribute type 21 has an invalid length. [ 678.278507][T26368] netlink: 'syz.3.5984': attribute type 22 has an invalid length. [ 678.290496][T26368] netlink: 'syz.3.5984': attribute type 23 has an invalid length. [ 678.301804][T26368] netlink: 'syz.3.5984': attribute type 25 has an invalid length. [ 678.310718][T26368] netlink: 96 bytes leftover after parsing attributes in process `syz.3.5984'. [ 678.323759][ T3353] pimreg: left allmulticast mode [ 678.329861][ T993] IPVS: starting estimator thread 0... [ 678.427043][T26373] IPVS: using max 34 ests per chain, 81600 per kthread [ 678.570262][T26383] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5988'. [ 678.652622][T26388] FAULT_INJECTION: forcing a failure. [ 678.652622][T26388] name failslab, interval 1, probability 0, space 0, times 0 [ 678.669634][T26388] CPU: 1 UID: 0 PID: 26388 Comm: syz.3.5990 Not tainted syzkaller #0 PREEMPT(full) [ 678.669657][T26388] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 678.669667][T26388] Call Trace: [ 678.669674][T26388] [ 678.669682][T26388] dump_stack_lvl+0xe8/0x150 [ 678.669707][T26388] should_fail_ex+0x412/0x560 [ 678.669733][T26388] should_failslab+0xa8/0x100 [ 678.669759][T26388] __kvmalloc_node_noprof+0x178/0x8a0 [ 678.669790][T26388] ? nf_hook_entries_grow+0x288/0x720 [ 678.669815][T26388] ? __pfx___mutex_lock+0x10/0x10 [ 678.669842][T26388] nf_hook_entries_grow+0x288/0x720 [ 678.669878][T26388] __nf_register_net_hook+0x2c9/0x930 [ 678.669911][T26388] nf_register_net_hook+0xb2/0x190 [ 678.669936][T26388] nf_register_net_hooks+0x44/0x1b0 [ 678.669962][T26388] nf_defrag_ipv4_enable+0x87/0x120 [ 678.669989][T26388] nf_ct_netns_do_get+0x18c/0x5c0 [ 678.670013][T26388] ? rcu_is_watching+0x15/0xb0 [ 678.670042][T26388] ? __pfx_nf_ct_netns_do_get+0x10/0x10 [ 678.670065][T26388] ? nft_parse_register_load+0x31e/0x3b0 [ 678.670094][T26388] ? nf_ct_netns_get+0xe9/0x320 [ 678.670118][T26388] nf_tables_newrule+0x17ac/0x28b0 [ 678.670151][T26388] ? __pfx_nf_tables_newrule+0x10/0x10 [ 678.670165][T26388] ? nfnl_pernet+0x23/0x240 [ 678.670185][T26388] ? nfnl_pernet+0x23/0x240 [ 678.670214][T26388] ? __nla_parse+0x40/0x60 [ 678.670243][T26388] nfnetlink_rcv+0x123e/0x27b0 [ 678.670295][T26388] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 678.670330][T26388] ? ref_tracker_free+0x693/0x840 [ 678.670381][T26388] ? __netlink_deliver_tap+0x807/0x850 [ 678.670412][T26388] ? netlink_deliver_tap+0x2e/0x1b0 [ 678.670431][T26388] ? netlink_deliver_tap+0x2e/0x1b0 [ 678.670458][T26388] netlink_unicast+0x75c/0x8e0 [ 678.670488][T26388] netlink_sendmsg+0x813/0xb40 [ 678.670519][T26388] ? __pfx_netlink_sendmsg+0x10/0x10 [ 678.670543][T26388] ? aa_sock_msg_perm+0xf1/0x1b0 [ 678.670566][T26388] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 678.670591][T26388] ____sys_sendmsg+0x972/0x9f0 [ 678.670611][T26388] ? __might_fault+0xaf/0x130 [ 678.670637][T26388] ? __pfx_____sys_sendmsg+0x10/0x10 [ 678.670668][T26388] ? import_iovec+0x73/0xa0 [ 678.670693][T26388] ___sys_sendmsg+0x2a5/0x360 [ 678.670713][T26388] ? __lock_acquire+0x6b5/0x2cf0 [ 678.670735][T26388] ? __pfx____sys_sendmsg+0x10/0x10 [ 678.670800][T26388] ? __fget_files+0x2a/0x420 [ 678.670818][T26388] ? __fget_files+0x3a0/0x420 [ 678.670846][T26388] __x64_sys_sendmsg+0x1bd/0x2a0 [ 678.670870][T26388] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 678.670901][T26388] ? __pfx_ksys_write+0x10/0x10 [ 678.670931][T26388] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.670949][T26388] do_syscall_64+0x15f/0xf80 [ 678.670969][T26388] ? trace_irq_disable+0x3b/0x140 [ 678.670991][T26388] ? clear_bhb_loop+0x40/0x90 [ 678.671011][T26388] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 678.671027][T26388] RIP: 0033:0x7fd33e99ce59 [ 678.671043][T26388] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 678.671056][T26388] RSP: 002b:00007fd33f834028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 678.671072][T26388] RAX: ffffffffffffffda RBX: 00007fd33ec15fa0 RCX: 00007fd33e99ce59 [ 678.671082][T26388] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 678.671090][T26388] RBP: 00007fd33f834090 R08: 0000000000000000 R09: 0000000000000000 [ 678.671098][T26388] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 678.671106][T26388] R13: 00007fd33ec16038 R14: 00007fd33ec15fa0 R15: 00007ffdb1d1d8b8 [ 678.671134][T26388] [ 678.674698][ T3353] bond10 (unregistering): (slave ip6gretap2): Releasing backup interface [ 678.849697][T26391] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.5991'. [ 679.153823][ T3353] bond6 (unregistering): (slave geneve3): Releasing active interface [ 679.300291][ T3353] bond1 (unregistering): (slave bridge2): Releasing backup interface [ 679.529299][ T3353] bond8 (unregistering): (slave bridge7): Releasing active interface [ 679.537692][ T3353] bridge7 (unregistering): left promiscuous mode [ 679.544241][ T3353] bridge7 (unregistering): left allmulticast mode [ 679.570324][ T3353] bond9 (unregistering): (slave bridge8): Releasing backup interface [ 679.578771][ T3353] bridge8 (unregistering): left promiscuous mode [ 679.611072][ T3353] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 679.622373][ T3353] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 679.633082][ T3353] bond0 (unregistering): Released all slaves [ 679.642988][ T3353] bond1 (unregistering): Released all slaves [ 679.661811][ T3353] bond2 (unregistering): Released all slaves [ 679.678629][ T3353] bond3 (unregistering): Released all slaves [ 679.692114][ T3353] bond4 (unregistering): Released all slaves [ 679.715164][ T3353] bond5 (unregistering): Released all slaves [ 679.733449][ T3353] bond6 (unregistering): Released all slaves [ 679.747869][ T3353] bond7 (unregistering): (slave veth5): Releasing active interface [ 679.756214][ T3353] veth0_to_bond: entered promiscuous mode [ 679.764352][ T3353] bond7 (unregistering): (slave veth0_to_bond): Releasing active interface [ 679.776777][ T3353] bond7 (unregistering): Released all slaves [ 679.795313][ T3353] bond8 (unregistering): Released all slaves [ 679.810875][ T3353] bond9 (unregistering): Released all slaves [ 679.831052][ T3353] bond10 (unregistering): Released all slaves [ 679.859383][T26192] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 679.869805][T26192] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 679.888427][T26385] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 679.891138][T26392] netlink: 'syz.3.5991': attribute type 40 has an invalid length. [ 680.066165][T26395] syzkaller0: entered promiscuous mode [ 680.083776][T26395] syzkaller0: entered allmulticast mode [ 680.095233][ T3353] tipc: Left network mode [ 680.288179][T26405] netlink: 276 bytes leftover after parsing attributes in process `syz.0.5995'. [ 680.304016][T26407] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5996'. [ 680.391993][T26407] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5996'. [ 680.579498][T26420] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5999'. [ 680.973657][T26192] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 681.064302][T26192] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 681.099499][T26192] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 681.115378][T26192] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 681.124057][T26192] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 681.194989][T26192] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 681.260628][T26454] netlink: 276 bytes leftover after parsing attributes in process `syz.2.6006'. [ 681.298082][T26192] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 681.342045][T26192] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 681.472739][T26451] syzkaller1: entered promiscuous mode [ 681.491876][T26451] syzkaller1: entered allmulticast mode [ 681.613869][T26451] netlink: 496 bytes leftover after parsing attributes in process `syz.0.6005'. [ 681.693397][T26471] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6010'. [ 681.718584][T26455] syzkaller0: entered promiscuous mode [ 681.725490][T26455] syzkaller0: entered allmulticast mode [ 681.772415][T26473] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 681.800325][T26473] openvswitch: netlink: IP tunnel dst address not specified [ 681.870926][T26476] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6011'. [ 682.002325][T26480] netlink: 'syz.2.6013': attribute type 1 has an invalid length. [ 684.524970][T26491] SET target dimension over the limit! [ 684.594578][T26495] netlink: 276 bytes leftover after parsing attributes in process `syz.0.6017'. [ 684.689354][T26497] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6019'. [ 684.838359][T26192] 8021q: adding VLAN 0 to HW filter on device bond0 [ 685.238750][T26192] 8021q: adding VLAN 0 to HW filter on device team0 [ 685.270284][T22144] bridge0: port 1(bridge_slave_0) entered blocking state [ 685.277492][T22144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 685.347733][T22136] bridge0: port 2(bridge_slave_1) entered blocking state [ 685.354906][T22136] bridge0: port 2(bridge_slave_1) entered forwarding state [ 685.622262][T26534] tipc: Enabled bearer , priority 0 [ 685.657835][T26540] syzkaller0: entered promiscuous mode [ 685.667846][T26540] syzkaller0: entered allmulticast mode [ 685.697066][T26527] tipc: Resetting bearer [ 685.737668][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 685.936976][T26526] tipc: Disabling bearer [ 686.010362][T26548] block nbd3: NBD_DISCONNECT [ 686.015466][T26548] block nbd3: Send disconnect failed -32 [ 686.040907][T26548] block nbd3: shutting down sockets [ 686.129935][ T3353] hsr_slave_0: left promiscuous mode [ 686.145700][T26555] netlink: 516 bytes leftover after parsing attributes in process `syz.3.6033'. [ 686.147784][ T3353] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 686.162485][ T3353] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 686.180444][ T3353] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 686.196201][ T3353] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 686.258658][ T3353] veth1_vlan: left promiscuous mode [ 686.265874][ T3353] veth0_vlan: left promiscuous mode [ 686.273381][T26562] validate_nla: 1 callbacks suppressed [ 686.273397][T26562] netlink: 'syz.0.6035': attribute type 1 has an invalid length. [ 686.454946][ T3353] team0 (unregistering): Port device batadv1 removed [ 686.612507][ T3353] team0 (unregistering): Port device team_slave_1 removed [ 686.647760][ T3353] team0 (unregistering): Port device team_slave_0 removed [ 686.931492][T26566] 8021q: adding VLAN 0 to HW filter on device bond13 [ 686.948060][T26566] bond12: (slave bond13): making interface the new active one [ 686.962368][T26566] bond12: (slave bond13): Enslaving as an active interface with an up link [ 686.986629][T26569] bond12: (slave gretap5): Enslaving as a backup interface with an up link [ 687.016116][T26579] syzkaller0: entered promiscuous mode [ 687.021674][T26579] syzkaller0: entered allmulticast mode [ 687.359466][ T3353] IPVS: stop unused estimator thread 0... [ 687.614303][T26192] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 687.938113][T26192] veth0_vlan: entered promiscuous mode [ 687.950645][T26192] veth1_vlan: entered promiscuous mode [ 687.975277][T26192] veth0_macvtap: entered promiscuous mode [ 687.986964][T26192] veth1_macvtap: entered promiscuous mode [ 688.005719][T26192] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 688.021784][T26192] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 688.038323][T22144] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.053161][T22144] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.063407][T22144] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.074427][T22144] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.229589][T26625] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6045'. [ 688.933790][T26557] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 688.980927][T22144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 689.021840][T22144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 689.121839][T22144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 689.148071][T22144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 689.163706][T26632] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6049'. [ 689.202575][T26633] netlink: 'syz.3.6048': attribute type 1 has an invalid length. [ 689.347173][T26638] netlink: 'syz.1.6051': attribute type 1 has an invalid length. [ 689.423918][T26648] netlink: 'syz.2.6055': attribute type 2 has an invalid length. [ 689.524138][T26653] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input6 [ 690.000969][ T5634] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 690.021540][ T5634] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 690.032914][ T5634] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 690.059218][ T5634] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 690.073135][ T5634] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 690.965155][T26703] netlink: 'syz.2.6072': attribute type 1 has an invalid length. [ 690.973522][T26703] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6072'. [ 691.535561][T26723] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 691.584984][T26669] lo speed is unknown, defaulting to 1000 [ 691.585042][T26721] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6079'. [ 691.662979][T26727] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 691.751792][T26730] FAULT_INJECTION: forcing a failure. [ 691.751792][T26730] name failslab, interval 1, probability 0, space 0, times 0 [ 691.779012][T26730] CPU: 0 UID: 0 PID: 26730 Comm: syz.3.6081 Not tainted syzkaller #0 PREEMPT(full) [ 691.779037][T26730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 691.779047][T26730] Call Trace: [ 691.779054][T26730] [ 691.779062][T26730] dump_stack_lvl+0xe8/0x150 [ 691.779087][T26730] should_fail_ex+0x412/0x560 [ 691.779116][T26730] should_failslab+0xa8/0x100 [ 691.779139][T26730] ? skb_clone+0x212/0x3a0 [ 691.779163][T26730] kmem_cache_alloc_noprof+0x87/0x650 [ 691.779192][T26730] skb_clone+0x212/0x3a0 [ 691.779218][T26730] __netlink_deliver_tap+0x404/0x850 [ 691.779252][T26730] ? netlink_deliver_tap+0x2e/0x1b0 [ 691.779274][T26730] netlink_deliver_tap+0x19c/0x1b0 [ 691.779296][T26730] netlink_sendskb+0x68/0x140 [ 691.779318][T26730] nlmsg_notify+0x12e/0x1a0 [ 691.779342][T26730] nf_tables_commit+0x9263/0xa7c0 [ 691.779390][T26730] ? __pfx_nf_tables_commit+0x10/0x10 [ 691.779411][T26730] ? __free_frozen_pages+0x749/0xd30 [ 691.779438][T26730] ? nf_tables_newrule+0x2590/0x28b0 [ 691.779471][T26730] ? __pfx_nf_tables_newrule+0x10/0x10 [ 691.779486][T26730] ? nfnl_pernet+0x23/0x240 [ 691.779526][T26730] nfnetlink_rcv+0x1c19/0x27b0 [ 691.779579][T26730] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 691.779615][T26730] ? ref_tracker_free+0x693/0x840 [ 691.779665][T26730] ? __netlink_deliver_tap+0x807/0x850 [ 691.779695][T26730] ? netlink_deliver_tap+0x2e/0x1b0 [ 691.779715][T26730] ? netlink_deliver_tap+0x2e/0x1b0 [ 691.779741][T26730] netlink_unicast+0x75c/0x8e0 [ 691.779771][T26730] netlink_sendmsg+0x813/0xb40 [ 691.779801][T26730] ? __pfx_netlink_sendmsg+0x10/0x10 [ 691.779825][T26730] ? aa_sock_msg_perm+0xf1/0x1b0 [ 691.779847][T26730] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 691.779875][T26730] ____sys_sendmsg+0x972/0x9f0 [ 691.779896][T26730] ? __might_fault+0xaf/0x130 [ 691.779922][T26730] ? __pfx_____sys_sendmsg+0x10/0x10 [ 691.779960][T26730] ? import_iovec+0x73/0xa0 [ 691.779986][T26730] ___sys_sendmsg+0x2a5/0x360 [ 691.780006][T26730] ? __lock_acquire+0x6b5/0x2cf0 [ 691.780028][T26730] ? __pfx____sys_sendmsg+0x10/0x10 [ 691.780085][T26730] ? __fget_files+0x2a/0x420 [ 691.780102][T26730] ? __fget_files+0x3a0/0x420 [ 691.780131][T26730] __x64_sys_sendmsg+0x1bd/0x2a0 [ 691.780156][T26730] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 691.780187][T26730] ? __pfx_ksys_write+0x10/0x10 [ 691.780218][T26730] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.780237][T26730] do_syscall_64+0x15f/0xf80 [ 691.780258][T26730] ? trace_irq_disable+0x3b/0x140 [ 691.780281][T26730] ? clear_bhb_loop+0x40/0x90 [ 691.780301][T26730] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.780317][T26730] RIP: 0033:0x7fd33e99ce59 [ 691.780334][T26730] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 691.780348][T26730] RSP: 002b:00007fd33f834028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 691.780366][T26730] RAX: ffffffffffffffda RBX: 00007fd33ec15fa0 RCX: 00007fd33e99ce59 [ 691.780377][T26730] RDX: 0000000000000000 RSI: 00002000000002c0 RDI: 0000000000000003 [ 691.780387][T26730] RBP: 00007fd33f834090 R08: 0000000000000000 R09: 0000000000000000 [ 691.780397][T26730] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 691.780407][T26730] R13: 00007fd33ec16038 R14: 00007fd33ec15fa0 R15: 00007ffdb1d1d8b8 [ 691.780436][T26730] [ 692.159846][ T5638] Bluetooth: hci5: command tx timeout [ 692.313811][T26734] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6082'. [ 692.825250][T26752] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6088'. [ 693.134195][T26669] bridge0: port 1(bridge_slave_0) entered blocking state [ 693.180891][T26669] bridge0: port 1(bridge_slave_0) entered disabled state [ 693.194283][T26669] bridge_slave_0: entered allmulticast mode [ 693.210079][T26669] bridge_slave_0: entered promiscuous mode [ 693.219955][T26766] pimreg: left allmulticast mode [ 693.284443][T26769] netlink: 'syz.0.6091': attribute type 1 has an invalid length. [ 693.294795][T26669] bridge0: port 2(bridge_slave_1) entered blocking state [ 693.302824][T26669] bridge0: port 2(bridge_slave_1) entered disabled state [ 693.310733][T26669] bridge_slave_1: entered allmulticast mode [ 693.351539][T26669] bridge_slave_1: entered promiscuous mode [ 693.419798][T26769] 8021q: adding VLAN 0 to HW filter on device bond14 [ 693.442196][T26766] bond14: (slave gretap6): making interface the new active one [ 693.450953][T26766] bond14: (slave gretap6): Enslaving as an active interface with an up link [ 693.521458][T26669] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 693.623743][T26775] syzkaller0: entered promiscuous mode [ 693.645925][T26775] syzkaller0: entered allmulticast mode [ 693.660049][T26669] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 693.917795][T26793] netlink: 'syz.2.6099': attribute type 11 has an invalid length. [ 694.209428][ T5638] Bluetooth: hci5: command tx timeout [ 694.267457][T26644] Set syz1 is full, maxelem 65536 reached [ 694.374014][T26801] Unknown options in mask b7f2 [ 694.381629][T26801] netlink: 'syz.4.6101': attribute type 4 has an invalid length. [ 694.389496][T26801] netlink: 156 bytes leftover after parsing attributes in process `syz.4.6101'. [ 696.297798][ T5638] Bluetooth: hci5: command tx timeout [ 696.617406][T26778] netlink: 'syz.3.6093': attribute type 1 has an invalid length. [ 696.651266][T26801] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 696.754747][T26669] team0: Port device team_slave_0 added [ 696.766208][T26669] team0: Port device team_slave_1 added [ 696.883599][T26669] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 696.908690][T26669] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 696.961916][T26669] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 697.048352][ T3353] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 697.061206][ T3353] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 697.072908][ T3353] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 697.101557][T26669] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 697.108952][T26669] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 697.137221][T26669] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 697.201528][T26825] netlink: 'syz.3.6112': attribute type 10 has an invalid length. [ 697.256373][ T3353] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 697.267974][ T3353] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 697.268897][T26829] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.6113'. [ 697.279456][ T3353] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 697.349859][ T5634] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 697.362425][T26825] dummy0: left promiscuous mode [ 697.364250][ T5634] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 697.373731][T26825] dummy0: left allmulticast mode [ 697.380767][ T5634] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 697.398581][ T5634] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 697.410951][ T5634] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 697.451606][T26825] team0: Port device dummy0 added [ 697.479005][T26669] hsr_slave_0: entered promiscuous mode [ 697.485708][T26669] hsr_slave_1: entered promiscuous mode [ 697.493498][T26669] debugfs: 'hsr0' already exists in 'hsr' [ 697.502763][T26669] Cannot create hsr debugfs directory [ 697.595621][ T3353] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 697.624206][T26838] netlink: 'syz.3.6114': attribute type 16 has an invalid length. [ 697.631903][T26840] netlink: 'syz.4.6115': attribute type 11 has an invalid length. [ 697.640548][T26840] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6115'. [ 697.655261][ T3353] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 697.666745][T26838] netlink: 'syz.3.6114': attribute type 3 has an invalid length. [ 697.674657][ T3353] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 697.686821][T26838] netlink: 132 bytes leftover after parsing attributes in process `syz.3.6114'. [ 697.694770][T26844] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 697.902816][ T3353] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 697.915585][ T3353] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 697.927651][ T3353] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 698.013159][T26859] netlink: 224 bytes leftover after parsing attributes in process `syz.4.6120'. [ 698.088029][T26861] netem: change failed [ 698.374932][ T5634] Bluetooth: hci5: command tx timeout [ 698.414137][T26669] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 698.430213][T26669] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 698.442151][T26669] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 49317 - 0 [ 698.452936][T26669] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 698.701996][T26669] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 698.722098][T26893] ------------[ cut here ]------------ [ 698.729670][T26893] 1 [ 698.729694][T26893] WARNING: net/ipv4/route.c:1275 at ip_rt_bug+0x2d/0x140, CPU#1: syz.2.6126/26893 [ 698.739795][T26669] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 698.741475][T26893] Modules linked in: [ 698.757460][T26893] CPU: 1 UID: 0 PID: 26893 Comm: syz.2.6126 Not tainted syzkaller #0 PREEMPT(full) [ 698.766909][T26893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 698.777038][T26893] RIP: 0010:ip_rt_bug+0x2d/0x140 [ 698.782017][T26893] Code: fa 55 41 57 41 56 41 55 41 54 53 48 89 d3 e8 aa d2 b8 f7 66 90 e8 a3 d2 b8 f7 31 ff 48 89 de ba 02 00 00 00 e8 94 68 68 ff 90 <0f> 0b 90 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d e9 bf d6 9e 01 cc 49 [ 698.788829][T26669] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 49317 - 0 [ 698.801692][T26893] RSP: 0018:ffffc900041f71c0 EFLAGS: 00010286 [ 698.801719][T26893] RAX: db9aa7f56dcbb200 RBX: ffff888040408140 RCX: 0000000000000401 [ 698.801731][T26893] RDX: 0000000000000002 RSI: ffffffff8dfa6c27 RDI: ffffffff8c28af60 [ 698.801742][T26893] RBP: ffffc900041f74c0 R08: ffffffff9030bcf7 R09: 1ffffffff206179e [ 698.801753][T26893] R10: dffffc0000000000 R11: fffffbfff206179f R12: dffffc0000000000 [ 698.801765][T26893] R13: 0000000000000000 R14: ffff888040408140 R15: dffffc0000000000 [ 698.801776][T26893] FS: 00007faa668ea6c0(0000) GS:ffff88812538a000(0000) knlGS:0000000000000000 [ 698.801790][T26893] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 698.801801][T26893] CR2: 00007faa65872780 CR3: 00000000479e0000 CR4: 00000000003526f0 [ 698.801818][T26893] Call Trace: [ 698.801827][T26893] [ 698.801841][T26893] ip_push_pending_frames+0x8b/0x110 [ 698.801945][T26893] __icmp_send+0x11e4/0x1690 [ 698.802002][T26893] ? __icmp_send+0x22b/0x1690 [ 698.802034][T26893] ? __pfx___icmp_send+0x10/0x10 [ 698.802071][T26893] ? ip_route_input_noref+0xad/0x270 [ 698.892798][T26669] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 698.893716][T26893] ? __pfx_ip_route_input_noref+0x10/0x10 [ 698.929311][T26893] ? tcp_v4_early_demux+0x465/0x9c0 [ 698.934532][T26893] ? tcp_v4_early_demux+0x5a7/0x9c0 [ 698.939796][T26893] ip_options_compile+0x80/0xb0 [ 698.944667][T26893] ip_rcv_finish_core+0xaa2/0x1c00 [ 698.949858][T26893] ip_rcv_finish+0x14c/0x2a0 [ 698.954551][T26893] NF_HOOK+0x336/0x3c0 [ 698.958670][T26893] ? sock_wfree+0x26e/0x750 [ 698.963188][T26893] ? __pfx_ip_rcv_finish+0x10/0x10 [ 698.968374][T26893] ? NF_HOOK+0x9e/0x3c0 [ 698.972542][T26893] ? __pfx_NF_HOOK+0x10/0x10 [ 698.977202][T26893] ? __pfx_ip_rcv_finish+0x10/0x10 [ 698.982328][T26893] ? netif_receive_skb+0x102/0xbf0 [ 698.987517][T26893] ? __pfx_ip_rcv+0x10/0x10 [ 698.992036][T26893] netif_receive_skb+0x45b/0xbf0 [ 698.997805][T26893] ? __pfx_netif_receive_skb+0x10/0x10 [ 699.003289][T26893] ? tun_rx_batched+0x185/0x790 [ 699.008350][T26893] tun_rx_batched+0x1de/0x790 [ 699.013319][T26893] ? __build_skb+0x62/0x440 [ 699.017920][T26893] ? __pfx_tun_rx_batched+0x10/0x10 [ 699.023139][T26893] ? tun_get_user+0x2787/0x43e0 [ 699.028075][T26893] ? tun_get_user+0x2787/0x43e0 [ 699.032952][T26893] ? tun_get_user+0x2394/0x43e0 [ 699.038911][T26893] ? tun_get_user+0x2394/0x43e0 [ 699.043788][T26893] ? __local_bh_enable_ip+0xd0/0x130 [ 699.049164][T26893] tun_get_user+0x2bbc/0x43e0 [ 699.053863][T26893] ? tun_get_user+0x2787/0x43e0 [ 699.058807][T26893] ? aa_file_perm+0x50e/0x15e0 [ 699.063782][T26893] ? __pfx_tun_get_user+0x10/0x10 [ 699.068916][T26893] ? __lock_acquire+0x6b5/0x2cf0 [ 699.073876][T26893] ? ref_tracker_alloc+0x35c/0x4c0 [ 699.079064][T26893] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 699.084547][T26893] ? tun_get+0x1c/0x2f0 [ 699.088798][T26893] ? tun_get+0x1c/0x2f0 [ 699.092976][T26893] ? tun_get+0x1c/0x2f0 [ 699.097203][T26893] ? tun_get+0x1c/0x2f0 [ 699.101388][T26893] tun_chr_write_iter+0x113/0x200 [ 699.106490][T26893] vfs_write+0x61d/0xb90 [ 699.110763][T26893] ? __pfx_vfs_write+0x10/0x10 [ 699.115556][T26893] ? __fget_files+0x2a/0x420 [ 699.120253][T26893] ksys_write+0x150/0x270 [ 699.124604][T26893] ? __pfx_ksys_write+0x10/0x10 [ 699.129549][T26893] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.135621][T26893] do_syscall_64+0x15f/0xf80 [ 699.140298][T26893] ? trace_irq_disable+0x3b/0x140 [ 699.145359][T26893] ? clear_bhb_loop+0x40/0x90 [ 699.150113][T26893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.156048][T26893] RIP: 0033:0x7faa6595d68e [ 699.160471][T26893] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 699.180157][T26893] RSP: 002b:00007faa668e9fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 699.188624][T26893] RAX: ffffffffffffffda RBX: 00007faa668ea6c0 RCX: 00007faa6595d68e [ 699.196696][T26893] RDX: 0000000000000046 RSI: 0000200000000400 RDI: 00000000000000c8 [ 699.204679][T26893] RBP: 00007faa668ea090 R08: 0000000000000000 R09: 0000000000000000 [ 699.212714][T26893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 699.220724][T26893] R13: 00007faa65c16038 R14: 00007faa65c15fa0 R15: 00007fffb762a528 [ 699.228826][T26893] [ 699.231860][T26893] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 699.239214][T26893] CPU: 1 UID: 0 PID: 26893 Comm: syz.2.6126 Not tainted syzkaller #0 PREEMPT(full) [ 699.248580][T26893] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 699.258617][T26893] Call Trace: [ 699.261971][T26893] [ 699.264884][T26893] vpanic+0x56c/0xa60 [ 699.268875][T26893] ? __pfx__printk+0x10/0x10 [ 699.273454][T26893] ? __pfx_vpanic+0x10/0x10 [ 699.277933][T26893] ? is_bpf_text_address+0x292/0x2b0 [ 699.283214][T26893] ? is_bpf_text_address+0x26/0x2b0 [ 699.288535][T26893] panic+0xc5/0xd0 [ 699.292262][T26893] ? __pfx_panic+0x10/0x10 [ 699.296669][T26893] __warn+0x315/0x4c0 [ 699.300727][T26893] ? ip_rt_bug+0x2d/0x140 [ 699.305052][T26893] ? ip_rt_bug+0x2d/0x140 [ 699.309377][T26893] __report_bug+0x29a/0x540 [ 699.313969][T26893] ? NF_HOOK+0x336/0x3c0 [ 699.318203][T26893] ? netif_receive_skb+0x45b/0xbf0 [ 699.323294][T26893] ? tun_rx_batched+0x1de/0x790 [ 699.328151][T26893] ? ip_rt_bug+0x2d/0x140 [ 699.332466][T26893] ? __pfx___report_bug+0x10/0x10 [ 699.337502][T26893] ? ip_rt_bug+0x2d/0x140 [ 699.341847][T26893] report_bug+0x16a/0x220 [ 699.346280][T26893] ? ip_rt_bug+0x2d/0x140 [ 699.350640][T26893] ? ip_rt_bug+0x2f/0x140 [ 699.354947][T26893] handle_bug+0x9c/0x200 [ 699.359176][T26893] exc_invalid_op+0x1a/0x50 [ 699.363662][T26893] asm_exc_invalid_op+0x1a/0x20 [ 699.368493][T26893] RIP: 0010:ip_rt_bug+0x2d/0x140 [ 699.373412][T26893] Code: fa 55 41 57 41 56 41 55 41 54 53 48 89 d3 e8 aa d2 b8 f7 66 90 e8 a3 d2 b8 f7 31 ff 48 89 de ba 02 00 00 00 e8 94 68 68 ff 90 <0f> 0b 90 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d e9 bf d6 9e 01 cc 49 [ 699.393022][T26893] RSP: 0018:ffffc900041f71c0 EFLAGS: 00010286 [ 699.399081][T26893] RAX: db9aa7f56dcbb200 RBX: ffff888040408140 RCX: 0000000000000401 [ 699.407056][T26893] RDX: 0000000000000002 RSI: ffffffff8dfa6c27 RDI: ffffffff8c28af60 [ 699.415011][T26893] RBP: ffffc900041f74c0 R08: ffffffff9030bcf7 R09: 1ffffffff206179e [ 699.422962][T26893] R10: dffffc0000000000 R11: fffffbfff206179f R12: dffffc0000000000 [ 699.430913][T26893] R13: 0000000000000000 R14: ffff888040408140 R15: dffffc0000000000 [ 699.438893][T26893] ip_push_pending_frames+0x8b/0x110 [ 699.444182][T26893] __icmp_send+0x11e4/0x1690 [ 699.448786][T26893] ? __icmp_send+0x22b/0x1690 [ 699.453455][T26893] ? __pfx___icmp_send+0x10/0x10 [ 699.458384][T26893] ? ip_route_input_noref+0xad/0x270 [ 699.463658][T26893] ? __pfx_ip_route_input_noref+0x10/0x10 [ 699.469363][T26893] ? tcp_v4_early_demux+0x465/0x9c0 [ 699.474543][T26893] ? tcp_v4_early_demux+0x5a7/0x9c0 [ 699.479807][T26893] ip_options_compile+0x80/0xb0 [ 699.484639][T26893] ip_rcv_finish_core+0xaa2/0x1c00 [ 699.489741][T26893] ip_rcv_finish+0x14c/0x2a0 [ 699.494321][T26893] NF_HOOK+0x336/0x3c0 [ 699.498380][T26893] ? sock_wfree+0x26e/0x750 [ 699.502865][T26893] ? __pfx_ip_rcv_finish+0x10/0x10 [ 699.507954][T26893] ? NF_HOOK+0x9e/0x3c0 [ 699.512092][T26893] ? __pfx_NF_HOOK+0x10/0x10 [ 699.516660][T26893] ? __pfx_ip_rcv_finish+0x10/0x10 [ 699.521754][T26893] ? netif_receive_skb+0x102/0xbf0 [ 699.526846][T26893] ? __pfx_ip_rcv+0x10/0x10 [ 699.531332][T26893] netif_receive_skb+0x45b/0xbf0 [ 699.536275][T26893] ? __pfx_netif_receive_skb+0x10/0x10 [ 699.541734][T26893] ? tun_rx_batched+0x185/0x790 [ 699.546577][T26893] tun_rx_batched+0x1de/0x790 [ 699.551276][T26893] ? __build_skb+0x62/0x440 [ 699.555774][T26893] ? __pfx_tun_rx_batched+0x10/0x10 [ 699.560969][T26893] ? tun_get_user+0x2787/0x43e0 [ 699.565804][T26893] ? tun_get_user+0x2787/0x43e0 [ 699.570642][T26893] ? tun_get_user+0x2394/0x43e0 [ 699.575490][T26893] ? tun_get_user+0x2394/0x43e0 [ 699.580326][T26893] ? __local_bh_enable_ip+0xd0/0x130 [ 699.585593][T26893] tun_get_user+0x2bbc/0x43e0 [ 699.590268][T26893] ? tun_get_user+0x2787/0x43e0 [ 699.595114][T26893] ? aa_file_perm+0x50e/0x15e0 [ 699.599858][T26893] ? __pfx_tun_get_user+0x10/0x10 [ 699.604863][T26893] ? __lock_acquire+0x6b5/0x2cf0 [ 699.609807][T26893] ? ref_tracker_alloc+0x35c/0x4c0 [ 699.614910][T26893] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 699.620368][T26893] ? tun_get+0x1c/0x2f0 [ 699.624506][T26893] ? tun_get+0x1c/0x2f0 [ 699.628645][T26893] ? tun_get+0x1c/0x2f0 [ 699.632780][T26893] ? tun_get+0x1c/0x2f0 [ 699.636927][T26893] tun_chr_write_iter+0x113/0x200 [ 699.641956][T26893] vfs_write+0x61d/0xb90 [ 699.646203][T26893] ? __pfx_vfs_write+0x10/0x10 [ 699.651042][T26893] ? __fget_files+0x2a/0x420 [ 699.655626][T26893] ksys_write+0x150/0x270 [ 699.659939][T26893] ? __pfx_ksys_write+0x10/0x10 [ 699.664772][T26893] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.670901][T26893] do_syscall_64+0x15f/0xf80 [ 699.675475][T26893] ? trace_irq_disable+0x3b/0x140 [ 699.680492][T26893] ? clear_bhb_loop+0x40/0x90 [ 699.685186][T26893] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 699.691063][T26893] RIP: 0033:0x7faa6595d68e [ 699.695463][T26893] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 699.715172][T26893] RSP: 002b:00007faa668e9fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 699.723582][T26893] RAX: ffffffffffffffda RBX: 00007faa668ea6c0 RCX: 00007faa6595d68e [ 699.731539][T26893] RDX: 0000000000000046 RSI: 0000200000000400 RDI: 00000000000000c8 [ 699.739497][T26893] RBP: 00007faa668ea090 R08: 0000000000000000 R09: 0000000000000000 [ 699.747459][T26893] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 699.755416][T26893] R13: 00007faa65c16038 R14: 00007faa65c15fa0 R15: 00007fffb762a528 [ 699.763473][T26893] [ 699.766981][T26893] Kernel Offset: disabled [ 699.771300][T26893] Rebooting in 86400 seconds..