last executing test programs: 4.207772568s ago: executing program 3 (id=6250): syz_emit_ethernet(0x1ee, &(0x7f0000000640)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000210", 0x1b8, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, '\t\x00', 0x0, 0x11, 0x0, @local, @empty, [@fragment, @hopopts={0x0, 0x2f, '\x00', [@generic={0xf, 0x25, "c9bd942c73856184f927b7e4e553c7f46b4f930d2f1c30ca13154ac498c3eaf13ab58393d7"}, @jumbo={0xc2, 0x4, 0x6}, @generic={0x0, 0x9d, "a17e9ab13f6e142b20582c8d220c698a74dbf13dfc0ad1f526dfc43313759300929090dd4792ce67ea9f8769d3246f94412c56e0247939ed4b318e4b6066b72d91d9aff97fcf30977dfd4028dea535a8e9d1682c4794d255d62089716f2f97577f9bef264da3cfd3e5511fb253122f61808a73cc2e760f93ceb68a0db2613cf0956b23235f057c2f980a19266a6bb4a33a17f550a571c5b4211c6fa371"}, @ra, @generic={0x0, 0x8c, "65fd1a52737fa1ec91495f4d25a766a5dd36bcffb376f4b35d4a5bc51b0f8fb9a273282a9c8ef192a4de26c8732765dbeb6ce083e81cebf0612d1cc7956b78fb34ce0e4a867c8b4094bab04b23680ba97ad5c624055e8504a7a121cf38a402a7aa80e05dbe56fecab8b014420231c0e997cbfda9bdc7f29e3a8b13dcfc396cf6ff1fcd8a7f43a107871fdd7e"}, @generic={0x0, 0xe, "8b168e4b48529453d91cea424030"}, @calipso={0x7, 0x8}]}]}}}}}}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000001900)={0x0, 0x0, &(0x7f00000018c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="c0000000", @ANYRES16=r2, @ANYBLOB="01002abd7000fbdbdf25030000000c00060004000000000000000c00040001000000000000000c000200020007000000000008000100000000"], 0xc0}, 0x1, 0x0, 0x0, 0x66393c82b5350394}, 0x20000804) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=@newqdisc={0x64, 0x24, 0xf0b, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xe, 0xfff1}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x1b, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0xb, 0x5}}}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x9, 0x6, 0x5, 0xa, 0x0, 0x6, 0x6}}, {0x4}}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x54, r2, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x7}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x9}, @NBD_ATTR_BACKEND_IDENTIFIER={0xa, 0xa, '\xbb\xbb\xbb\xbb\xbb\xbb'}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x6}]}, 0x54}, 0x1, 0x0, 0x0, 0x44}, 0x20008004) 3.710086022s ago: executing program 3 (id=6258): r0 = socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@multicast, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x4, 0x1c, 0x66, 0x0, 0x7, 0x2, 0x0, @private=0xa010101, @local}, {0x16, 0xff, 0x0, @dev={0xac, 0x14, 0x14, 0x24}}}}}}, 0x0) (async, rerun: 64) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) ioctl$FIOCLEX(r0, 0x5451) (async) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x800000, 0x11, r0, 0x0) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0x7000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 32) mmap(&(0x7f0000c3e000/0x2000)=nil, 0x2000, 0x8, 0x100010, r0, 0x9070b000) (async, rerun: 64) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x4031, 0xffffffffffffffff, 0x0) (rerun: 64) 2.999330824s ago: executing program 3 (id=6261): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000f000000850000007a00"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00'}) r2 = socket$kcm(0x11, 0x2, 0x300) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000040)={0x2, 0x0, @loopback}, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001a00)={0x30, 0x0, 0x1, 0x0, 0x0, {{}, {}, {0x14, 0x19, {0x2, 0x1}}}}, 0x30}}, 0x40000) sendmsg$rds(r3, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote}, 0x10, 0x0, 0x0, &(0x7f0000000200)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f0000000d00)=[{&(0x7f0000000580)=""/51, 0x33}], 0x1}}, @rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, 0x0, 0x0, 0x4c}}], 0x90}, 0x0) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000040)=r0, 0x4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x29, 0x2, 0x0) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r5, &(0x7f0000000300)=ANY=[@ANYRESHEX=r5], 0xfdef) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ppoll(&(0x7f00000001c0)=[{r7, 0x460}], 0x1, &(0x7f00000002c0), 0x0, 0x0) r8 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r8, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) ioctl$int_in(r8, 0x5421, &(0x7f0000000100)=0x9) socket$nl_route(0x10, 0x3, 0x0) connect$inet(r8, &(0x7f0000000280)={0x2, 0x0, @dev}, 0x10) close(r8) 2.761381519s ago: executing program 3 (id=6268): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d621ffbc9a4fd39b0631f6dde53a9a53608c10556e5734eb84049761471ce540c772e2d9f8004e26f7fcc059c062234d5595f6dba87b81d0806fb0289ce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd8048a967d9b912ef9f1dcc4ff8546fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30816127f46a1aae33d4d63d716c0975e1ce4a655362e7062ff6ab3934555c0184021b829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47910000118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f80492461d273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c528df8000000d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b1e152ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d1bfa928e2ba458ecd989cb3581a3f270ad48255ac0dad4923e3e36629589ff6b0ceb3438e4b432dd454c04be2d538aaf60c9f7a7281d32142f2fdbc3d37e5a072b5d7f0a349f1a75f01b5c203d4bdde6ff12de9a37f7fb9a16059ad97e2edefb5e0b0326bd25f6fd1d108efa9d30a9883815654486fe42cf2f676cdbb91f7582ab314be"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000340), 0xfffffffffffffe19}, 0x42) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000008c0)=r3, 0x4) sendmsg$NL802154_CMD_NEW_INTERFACE(0xffffffffffffffff, 0x0, 0x40240c4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000fc0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2b}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r4, 0x18000000000002a0, 0x78, 0x0, &(0x7f0000000100)="b9ff030f6044238cb89e14f088a81bff88641100404863330283ac14142ce934a0a662079f4b4d2f87e56dca6aab845013f208001a3901050b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31b", 0x0, 0xfb, 0x60000000, 0x0, 0x77, &(0x7f0000000000), &(0x7f0000001c40)="beb61ec2ca90080239f2a54e2368fa761313c3a024a98109ba1e2e7b780d03c54b7a83d56fce397842e724674507d531762055fca371ea775f418df7bee236c9b9968146efb3232ae3413b617445e98bb644a892b9337f1a9135d9f30457a8ffb21aef4a95a155fab70a40b086056b0f63331a66b3457c", 0x2}, 0x50) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000900)=ANY=[@ANYBLOB="9feb0100180000000000000014000000140000002900000007001b0001000006040000000000000103000000006100302e61615f002de06e4d759494192b78d0df1f2b6d9dd2d6839f88890774ba56bf4e1e49f80851b4cf10afe9e827a0fb68417e6c99f6d4001cf43b72c5e6ff082f7a55bc1bd658bb7e3818697a52bd5a4274314b45edcb378acfc5c3644a530d09a50a5548a4cc8de21d44394e2307eac544203d6484f4ccb2a7532e99ff9ebb4ea2378dd0"], 0x0, 0x35}, 0x28) readv(r1, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000540), 0xffffffffffffffff) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, 0x0, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r7, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x3}]}}}]}]}], {0x14}}, 0xc0}}, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000080)=@assoc_value={r8}, 0x8) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000040)=@assoc_value={r8, 0x211d9572}, &(0x7f00000001c0)=0x8) r10 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), r0) sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000c00)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000a00)=ANY=[@ANYBLOB="c0010800", @ANYRES16=r10, @ANYBLOB="20002bbd7000fedbdf250e0000003001058044000280080001000400000008000400050000000800040002000000080004007f000000080001001e0000000800020003000000080003000700000008000400c396000008000100756470003c000280080003000300000008000200ff07000008000100010000000800020003000000080001001c000000080003000000000008000300ce08000034000280080002000010000008000300ba0500000800020004000000080002006700000008000400f0be080008000400020000004c00028008000100190000000800040005000000080003000e00000008000400000000800800020004000000080004000b000000080004000101000008000400a0000000080004000500000007000100696200001c0002800800030002000000080004000c0000000800030005000000640004800c00078008000300010000005400078008000100010000000800020085000000080001000b0000000800030004000000080003000600000008000200040000000800010006000000080003000700000008000100180000000800020009000000180007800c00040001800000000000000800020001000000"], 0x1c0}, 0x1, 0x0, 0x0, 0x400d}, 0x44004) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r5, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000040)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) nanosleep(&(0x7f0000000080)={0x0, 0x4c4b40}, &(0x7f00000000c0)) syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000340)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x2e) 2.610696238s ago: executing program 4 (id=6270): sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=@newlink={0x20, 0x10, 0x439, 0x0, 0x2, {0x0, 0x0, 0xe403, 0x0, 0x62a1}}, 0x20}, 0x1, 0x0, 0x0, 0x4014}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000100)=@newlink={0x20, 0x10, 0x439, 0x0, 0x2, {0x0, 0x0, 0xe403, 0x0, 0x62a1}}, 0x20}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB="00000000aa75d04bc639e0c7349400000000070053eeef1d34971d7c6e1a076e2b2a93a8c0995047b8f799369bc44ffb67b49bc230a117d873633c7ab8be2c4e9ef2d00e90c7afa0479fdf0df07f94ef2c7b31093a90ed29858b015b2193cbd7c46dd29bb1094a20a24c30112dfbf7beb0bd8ddcf9f1466f6755b39e16b7da574344f708ef8ced3ade4c1ec7b761dc11fb54757c9525eff999e023c33bdd274611462c801d65e9e28c1265c1eebe9e67398a884333ebb8074839f789ebc2b38daeca61584b037f6d2f9b5e8298a6", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r0}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000300)={r0}, 0x4) r1 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=ANY=[@ANYBLOB="1b00000000000000000000000020"], 0x48) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000000)) (async) ioctl$sock_inet6_udp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000000)) r3 = socket$nl_route(0x10, 0x3, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) (async) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000006280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000280)=@newtaction={0xc4, 0x30, 0x1, 0x4000000, 0x0, {0x0, 0x0, 0x6a00}, [{0xb0, 0x1, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x0, 0x0, 0x10000000, 0x0, 0x4}, 0x3, r5}}]}, {0x4, 0xa}, {0xc}, {0xffac, 0x8, {0x0, 0x2}}}}, @m_mpls={0x5c, 0x2, 0x0, 0x0, {{0x9}, {0x30}, {0x4}, {0xc}, {0xc}}}]}]}, 0xc4}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0xf, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000004b000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000424c0000850000002d00000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000001400)={@mcast2}, 0x14) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) pread64(r7, &(0x7f0000000480)=""/61, 0x3d, 0x7fffffffffffffff) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r9 = openat$cgroup_ro(r8, &(0x7f0000000280)='blkio.bfq.sectors\x00', 0x0, 0x0) preadv(r9, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/140, 0x8c}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0xf, &(0x7f0000000540)=ANY=[@ANYRES8=0x0, @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x4, 0x1009, &(0x7f0000001440)=""/4111, 0x0, 0x62, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffedf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) 2.506171095s ago: executing program 4 (id=6271): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000e00)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa000000000000007000000080000002d1501000000000095000000000000006916000000000000bf67000000000000350607000fff07206706000003000000160302000ee60060bf350000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dc725f431bcab0ef59b8f0e431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa0100000000000000b93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4ffcae1a8a793a7795a9214a92f66e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc3086936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154baa8e51489a614e69722bac30000000000000000000000000000a006b178438e930b2494db1bf624a70a19a45b8b71869afb13cb2ac1d2f3ec0d93a3e4fd0ad076c7d826f218aa6ba8ec5e58b7c64dc8616127087901dc65418a4b25bfa7ae8b5ad9642815f319230425e8bd89c6983d816d97d81a739917eecd26f9a3aecaf0acdaf6cffab38eae3b10b122b4bf521a46bf01a0c136f745113b589459fbe1666087a7c554a55e2b42ab7e405a77f405a348a64e356b7fb61e48ea9c87bf13f97052c51fdd49f3dbccf9874cf61807ae4b1665ccdd026d4580a068395e8cb851eeadb1da6d1009513ca73a685c66fb15f27eb74a7a4eb5966e3ef4be3ca8ba81b2d17d797265390ce616c3d7b566fe956fb93c6a43f4dc6bfc194daeb7b998d550773bc14aca"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8000}, 0x8) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newspdinfo={0x1c, 0x24, 0x21, 0x0, 0x0, 0x0, [@XFRMA_SPD_IPV6_HTHRESH={0x6}]}, 0x1c}}, 0x0) sendmmsg$inet6(r1, 0x0, 0x0, 0x0) shutdown(r1, 0x1) r3 = socket(0x10, 0x3, 0x0) sendto$inet6(r3, &(0x7f0000000140), 0x0, 0x24040000, 0x0, 0x0) getsockopt$bt_hci(r1, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000001180)=0xfd9) r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_SCAN(r0, &(0x7f0000001880)={&(0x7f0000001780)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001840)={&(0x7f0000001800)={0x1c, 0x0, 0x20, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, ["", "", ""]}, 0x1c}}, 0x10) r5 = socket(0x10, 0x803, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x5) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4) bpf$OBJ_GET_PROG(0x7, &(0x7f0000001580)=@generic={&(0x7f0000001540)='./file0\x00', 0x0, 0x18}, 0x18) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000001740)={&(0x7f00000015c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001700)={&(0x7f0000001600)={0xe8, 0x0, 0x1, 0x201, 0x0, 0x0, {0xa, 0x0, 0x3}, [@CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x1002}, @CTA_ID={0x8}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x3}, @CTA_MARK_MASK={0x8, 0x15, 0x1, 0x0, 0x3}, @CTA_TUPLE_REPLY={0x8c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @private=0xa010101}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast2}}}}]}, @CTA_STATUS={0x8}, @CTA_TUPLE_ORIG={0x18, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x2000}]}, 0xe8}, 0x1, 0x0, 0x0, 0x404c040}, 0xc004010) mmap(&(0x7f0000000000/0x400000)=nil, 0x1400000, 0x0, 0xc3072, 0xffffffffffffffff, 0x0) sendto$inet6(r6, &(0x7f00000001c0)="a6e2976b5c4383036d32dadd2e144d8645ca8d1b230e105614396838da83c754887e7bea2f35d4ea667817d90d532af065f2e398dd9081ea16f8b371a202a6f9e505bbc964a0d3880bf0104a0a0a2f0d311efee1637e85a0125b38f961918f99bf9c2c146e42327f178dc2b3d4936e7f7f0a79f74ba464d83ab41742d1186776dc1779b5c50ac82d0fa8f9e42074b5b6079207fb21e718080907964669be539791e3e98687ee059853", 0xfffffffffffffcc1, 0x840, 0x0, 0x56) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x5}, 0x48) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r8, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000580)="b9ff03076804268c989e14f088a8", 0x0, 0x501, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x7}, 0x50) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="310328bd7000fbdbdf250200"], 0x78}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) 2.259151001s ago: executing program 1 (id=6273): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) r3 = socket$igmp(0x2, 0x3, 0x2) getsockopt$inet_mreq(r3, 0x0, 0x24, &(0x7f0000000100)={@multicast1, @dev}, &(0x7f0000000140)=0x8) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) syz_init_net_socket$llc(0x1a, 0x2, 0x0) sendmsg$BATADV_CMD_SET_MESH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x4c, r2, 0x1, 0x4070bd28, 0x1, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0x3c, 0x6}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xc}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}, @BATADV_ATTR_MULTICAST_FANOUT={0x8}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x2}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000080}, 0x18) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f00000001c0)=@allocspi={0x1f8, 0x16, 0x1, 0x70bd28, 0x25dfdbfc, {{{@in=@multicast1, @in=@empty, 0x4e21, 0x3, 0x4e22, 0x10, 0x2, 0x80, 0xa0, 0x3b}, {@in=@remote, 0x4d4, 0x32}, @in6=@rand_addr=' \x01\x00', {0x373a, 0x4, 0x2, 0xab8, 0x8, 0x1, 0x4, 0x3}, {0x22, 0xd2, 0x4, 0x3}, {0x0, 0xce, 0x7}, 0x70bd2c, 0x3504, 0xf016e6580cc0e8b0, 0x1, 0x0, 0x2c}, 0x1, 0x2}, [@encap={0x1c, 0x4, {0x1, 0x4e22, 0x4e20, @in6=@rand_addr=' \x01\x00'}}, @sa={0xe4, 0x6, {{@in=@loopback, @in=@remote, 0x4e21, 0x1000, 0x4e21, 0xc, 0xa, 0x100, 0xa0, 0x16, r4, r5}, {@in6=@mcast2, 0x4d5, 0x32}, @in6=@mcast2, {0x2, 0x3, 0x7, 0x3, 0x7, 0x2, 0x6, 0x3c}, {0x5, 0x45, 0x8, 0x800}, {0x2, 0xa, 0x10000}, 0x70bd27, 0x3502, 0x2, 0x0, 0x5, 0x8}}]}, 0x1f8}, 0x1, 0x0, 0x0, 0x48095}, 0x4000014) 2.143441116s ago: executing program 1 (id=6275): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x2}, 0x4}}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000009006000000000000000300000a38000000020a0102000000000000694edfb5d3dce7a1183c0938b10000010000020c000440000000030000000109000100f7ffffff000000000c0004400000000000000001140000001100010000000000000000000084000a"], 0x60}, 0x1, 0x0, 0x0, 0x8805}, 0x810) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000000000000000fc000a20000000000a09000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000002c0003802800008008000340000000021c00028018000280080001"], 0xec}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r6, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0x0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r4, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, r6, 0x300, 0x70bd2d, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x45}, 0x810) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00v\x00\t\x00'/20, @ANYRES32=0x0, @ANYBLOB="04000d80080001"], 0x24}, 0x1, 0x5502000000000000}, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000040), &(0x7f0000000100)=0x14) bind$tipc(r0, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x2, 0xffffffff}}, 0x10) close(0x3) 2.117296273s ago: executing program 1 (id=6277): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000300)="a6", 0x1, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='reno', 0x4) sendto$inet6(r0, &(0x7f0000000380)="b3", 0x1, 0x20060000, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r1) r2 = socket$packet(0x11, 0x2, 0x300) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020100000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a32000000001400000011001f"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6, 0x1, 0x1, 0x0, 0x800}, @NFTA_QUEUE_TOTAL={0x6, 0x2, 0x1, 0x0, 0xfffe}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x7c}}, 0x40) setsockopt$packet_int(r2, 0x107, 0xe, &(0x7f0000000280)=0x9, 0x4) r4 = socket(0x28, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f0000000100)={0x1, [0x0]}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r4, 0x84, 0x17, &(0x7f0000000280)={r5, 0x0, 0xff, "b4058093502487db8c583981aa1488407e1dc0d220061f17d3f94cb4483cda07d2f0c2e71a3401b70a46a619ef4ecabdb1b2a04259fae8b5ace305ce4ceaef183af8f7ff6829f11bc25a0cc0b6d2f2161271b491997c2ab6a61c2fb336fc10481647bd28469e505f7d2799c3110afc188cbde95c0aab3899a3955694ab19b016b4fdaa44bf6e8822cf90365ddc353222b91233100cd962b90edd1da871912c3ffb3a9c01ac8566980c0d931a160e2fbe5cdaf5b51bcac8dd9c4ffd544e3383d2361b264b55878e8da59dbdb5587e261efe98d5a9b8dd6f76a59453e5bbf43b88f2c42464526dd75f8ffd7ef906728745283f702ebc68ec71a4e26666c78f8a"}, 0x107) r6 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r6, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) listen(r6, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x54, 0x10, 0x1, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x1438a}, [@IFLA_VFINFO_LIST={0x18, 0x16, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@IFLA_VF_VLAN={0x10, 0x2, {0x80000001, 0x4a9, 0x52f}}]}]}, @IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}, @IFLA_LINKMODE={0x5, 0x11, 0x9a}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000880}, 0x0) connect$vsock_stream(r4, &(0x7f0000000080)={0x28, 0x0, 0x0, @local}, 0x10) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r8}, &(0x7f0000000000), &(0x7f0000000080)=r1}, 0x20) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r9, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r9, &(0x7f0000000640)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000002c0)="8d", 0x1}], 0x1, &(0x7f0000001a80)=[{0x10, 0x1, 0xc}], 0x10}}], 0x1, 0x240048d4) recvmsg$kcm(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x2000) 1.982623802s ago: executing program 4 (id=6279): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000380)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) ioctl$XFS_IOC_GETPARENTS(r0, 0xc028583e, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0_macvtap\x00', 0x0}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x81, 0x6, @remote}, 0x14) sendmmsg$sock(r0, &(0x7f0000000440)=[{{0x0, 0x0, 0x0}, 0x1000000}, {{0x0, 0x0, 0x0}}], 0x2, 0x40500f0) 1.976355781s ago: executing program 0 (id=6280): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="180200000300000000000000000000008500000087000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000002200000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x18000000}, 0x94) 1.841502093s ago: executing program 0 (id=6282): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) write$nci(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r0, &(0x7f0000000dc0)=ANY=[], 0x14) r4 = socket(0x1e, 0x4, 0x0) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES8=r1, @ANYRES16=r4], 0x14) 1.78784777s ago: executing program 4 (id=6283): r0 = socket$inet_tcp(0x2, 0x1, 0x0) (async) r1 = socket$igmp(0x2, 0x3, 0x2) (async) r2 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32) r3 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 32) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async, rerun: 32) recvmsg$can_bcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000100)=""/3, 0x3}, {&(0x7f0000000680)=""/112, 0xfffffef2}], 0x2}, 0x10150) (async, rerun: 32) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01030003000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x38, 0x40, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x14, 0x1, 0x0, 0x1, [@nested={0x10, 0x10, 0x0, 0x1, [@nested={0x4, 0x8}, @typed={0x6, 0xa, 0x0, 0x0, @str='$\x00'}]}]}, @typed={0xc, 0x2, 0x0, 0x0, @u64}]}, 0x38}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) (async, rerun: 32) r9 = socket$kcm(0x10, 0x2, 0x4) (async, rerun: 32) connect$inet(r1, &(0x7f0000000240)={0x2, 0x8, @loopback}, 0x10) sendmsg$kcm(r9, 0x0, 0x800c) (async) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) (async) r10 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r10, 0xc004743e, &(0x7f00000000c0)) (async) ioctl$PPPIOCSMRRU(r10, 0x4004743c, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000940)={&(0x7f0000000100)=@newtclass={0x24, 0x28, 0x2, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x9, 0x5}, {0x7, 0xb}, {0xb, 0xf}}}, 0x24}}, 0x0) (async) r11 = socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000770000000800000002"], 0x50) (async) sendmsg$nl_route(r11, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) 1.78727295s ago: executing program 3 (id=6284): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa006}, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1}, 0x20) unshare(0x60600) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r2, 0x1d, &(0x7f0000002600)}, 0x10) r3 = socket$kcm(0x2, 0xa, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000040010000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000010006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50af8ffffff000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000840)=ANY=[@ANYBLOB="0800080006000600000014000000450a0fc0"], 0xfce) r4 = socket$nl_route(0x10, 0x3, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000100)={0x1f, 0x0, 0x3}, 0x6) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r5, 0x400452c8, &(0x7f0000000100)) syz_emit_ethernet(0x46, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60f91e2e00107300fc040000000000000000000000000000ff02000000000000000000000000000100000000ff"], 0x0) sendmsg$nl_route(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c0000001a00010000000000fbdbdf8441250a808000000000000000000006001d004e20000005001b003a000000"], 0x2c}}, 0x0) 1.614598911s ago: executing program 4 (id=6286): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="b70000000000000007000000000000009500e200000000001e5286574356940658273ad1326fc65be4b1037a74cfb5af100fc4e94d123d9b22a7561b8850821bc1f8b5b0a3e3b79b0d96ab7cc60e0e144f0f04bfffe68fe46421a161eedd1a5cee316f68f7617859f06c8efd5da6abe446649c322209b1af93c6c999058168ad0a70992124d19c7c9cc22ff9a6b1a058039ab938480e8697f8715bcb18e1fd0773909464a783148e0e7b604a6c47b33c43a3ffff92ec8bbde1af40f29cfcf0836a70a2f6b1192ab8f24ca363492393e1c2a3b190180caafbf8cfca720074bdcc7cbd978efd8404a1c700000000d97899514e64e36cad5eba82010b2d149ac02e5f07000000000000000000000000000000000000000000009d5df0e0dbb9821d9c5402474d5866ce5eb60188d83ac741b45aeacac594cf09de9b460f48b96ae8a0eead478e46c8ca3e4c5d2b3cb4ad48c830e8003c45f5b2dcbf36b7e8be59ca4b46266cf75bea8a22ab71895d954dc6d28864144c73391770690a9301cde97565d509effc252599b26555355d7955f551df82ea475a711ec56d00000000a89c"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)=ANY=[@ANYBLOB="200000006a000105fefdffffffdbdf25000100000000000008000a"], 0x20}, 0x1, 0x0, 0x0, 0x200048c0}, 0x20008000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000a40)={r0, 0x27, 0x36, 0x0, &(0x7f0000000840)="f8ad48cc020000000000000086dd19159d0242c0e3f09a5aff72ba0f5cf6678e0f8fedc700fc703c8cc6f6d51708fe4e24dec2ff12cb", 0x0, 0x3, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'hsr0\x00', 0x0}) sendto$packet(r2, &(0x7f0000000040)="c51d37314d6bc8ace323d916892f", 0xe, 0x14000000, &(0x7f0000000140)={0x11, 0xc, r3, 0x1, 0xff, 0x6, @local}, 0x14) r4 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e23, @broadcast}, 0x10) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket(0x18, 0x0, 0x1) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000380)={r3, 0x1, 0x6, @local}, 0x10) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_cmd={0x2c, 0x6, 0x4, 0x0, 0x0, 0x0, 0x0, 0x9, 0xff, 0x0, 0x0, 0x0, 0x3}}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000140)={'sit0\x00', &(0x7f0000000040)={'tunl0\x00', 0x0, 0x10, 0x7, 0x6, 0xf5bc, {{0x29, 0x4, 0x1, 0x18, 0xa4, 0x68, 0x0, 0xe, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @rand_addr=0x64010102, {[@ssrr={0x89, 0x2b, 0xcf, [@local, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback, @empty, @multicast1, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @loopback, @remote, @multicast2]}, @timestamp_addr={0x44, 0x1c, 0xc8, 0x1, 0x9, [{@multicast1, 0xb}, {@private=0xa010101, 0x6}, {@rand_addr=0x64010100, 0x9}]}, @noop, @rr={0x7, 0x27, 0xdf, [@dev={0xac, 0x14, 0x14, 0x25}, @multicast2, @multicast1, @private=0x4, @dev={0xac, 0x14, 0x14, 0x2e}, @multicast2, @empty, @multicast2, @dev={0xac, 0x14, 0x14, 0x28}]}, @rr={0x7, 0x1f, 0xe6, [@empty, @empty, @multicast2, @broadcast, @loopback, @remote, @loopback]}]}}}}}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000180)=0x0, &(0x7f0000000240)=0x4) sendmsg$nl_route(r1, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="500000000f0034072cbd7000ffdbdf251c1014f5fd02fd0a000800f9fdd92f08e8992d8e40667ecee302f000080001000000000008000400", @ANYRES32=r3, @ANYBLOB="08000400", @ANYRES32=r8, @ANYBLOB="0c0009004c48050e", @ANYRES32=r9, @ANYBLOB="08000400", @ANYRES32=r10, @ANYBLOB="05001a000c000000"], 0x50}, 0x1, 0x0, 0x0, 0x24044094}, 0x4841) 1.478840243s ago: executing program 0 (id=6287): r0 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=ANY=[@ANYRESDEC=r0, @ANYRES32=0x0, @ANYRESOCT=r0], 0x44}}, 0x8000) 1.300658037s ago: executing program 0 (id=6289): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2000007, 0x42032, 0xffffffffffffffff, 0x100000000) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000340)={'wpan0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c010000", @ANYRES16=r2, @ANYBLOB="010000000000000000003d0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800820000000000"], 0x3c}}, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r1, 0xc0385869, &(0x7f0000000500)={r1, &(0x7f0000000380)='-]!\x00', 0xcc83162a46a5cddb, &(0x7f0000000440)={@_ha_fsid={[0x4, 0x5]}, {0x4, 0x94, 0x7ff, 0x100}}, 0x6, &(0x7f0000000480)={@_ha_fsid}, &(0x7f00000004c0)=0x80000000}) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000006c0)={@fallback=r1, 0x34, 0x0, 0x6, &(0x7f00000005c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9, 0x0, &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000640)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000680)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r1, 0xc0385868, &(0x7f0000000840)={r1, &(0x7f0000000740)='%\xc0.**\x00', 0x416080, &(0x7f0000000780)={@_ha_fsid={[0x100, 0x401]}, {0x9, 0x8, 0x89, 0xffffffffe166ad98}}, 0x6, &(0x7f00000007c0), &(0x7f0000000800)=0x1}) r6 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000880)=0xffffffffffffffff, 0x4) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000700)=ANY=[@ANYRES32=r5, @ANYRES32=r3, @ANYBLOB="2a00deff1720000004000000", @ANYRES32=r6, @ANYBLOB, @ANYRES64=r4], 0x20) r7 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, r7, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x18}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}, @NLBL_MGMT_A_DOMAIN={0xf, 0x1, 'syzkaller1\x00'}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x1d}, @NLBL_MGMT_A_CV4DOI={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x11}, 0x800) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000040)={0x7fffffff}, 0x10) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r11 = socket(0x400000000010, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850) r14 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x70bd27, 0x25dfdbf9, {0x0, 0x0, 0x0, r15, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_SRC={0xa, 0x6, @broadcast}, @TCA_FLOWER_KEY_ETH_SRC_MASK={0xa, 0x7, [0x0, 0xff, 0xff]}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) sendmsg$kcm(r9, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e00000022008102e00f80ecdb4cb9020a", 0x11}, {&(0x7f0000000a80)="0cf2e153a074a59ae15c1863473bbce6798a60e9000000000000000000", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0) r16 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r16, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r8, &(0x7f0000000040)=[{&(0x7f0000000080)="2e9b690007e03dd6446ce8880000000000", 0x11}, {&(0x7f0000000200)="b7", 0x1}, {&(0x7f0000000100)="cc8b9b2251a9d92e1fc45219ba008fed80a21fc2912949782b436e3ca180e832c6243f930621bbba0cbadc46f61224cde3f74496f6f477ab786e0ad0438d809e1301fadc7412e8fb00af52e0dd514f2e6bf63dcb21370b7b21e65b38be5815", 0x5f}, {&(0x7f0000000540)="0e37b90261e76309b1cac9fade2e9c7d97027847ae3dd4c8ad9bacdc9eb40588f815d4a7290ec85ec1d6e62099c8862720d7231bfc91e78093bec7882a6db8419c6df7296622b23d8d5f7d7d1d196ad5aaba08a8731c748a", 0x58}], 0x4) 1.246328705s ago: executing program 2 (id=6290): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40901, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNGETSNDBUF(0xffffffffffffffff, 0x800454d3, &(0x7f0000000040)) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f00000007c0)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x4}, 0xe) r4 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r4, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000000)="9745010000002024010000ac0a3324491fbb00000098894633120b55", 0x1c}], 0x1, &(0x7f0000000480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x34}, @rand_addr=0x64010101}}}], 0x20}, 0x400c804) setsockopt$bt_l2cap_L2CAP_OPTIONS(r4, 0x6, 0x1, &(0x7f0000000280)={0x3, 0xff, 0x9, 0x4, 0x0, 0x1}, 0xc) setsockopt(r4, 0x2, 0x8, &(0x7f0000000080)="3ae4c6fa97ec933d01c10c63231f74162f4a7a155421168fa31c42d0016660de15ef568266a17c809ed711878fa332a1be8e9021148024ee11077349a51dbc2225597e3e7e3c3d66da411aefd005a4dac25ca431314f1db45ea77fef934d22e146cffcd46ede8122aef7", 0x6a) listen(r3, 0xffffffff) bind$packet(r2, &(0x7f0000000240)={0x11, 0xe, 0x0, 0x1, 0x5, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), r4) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3000004, 0x11, r6, 0x9040d000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000006000000000000000200008409010000040000000400000001000000000000000001000009000000003000002e"], &(0x7f0000000f40)=""/4079, 0x42, 0xfef, 0x1, 0x2}, 0x28) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r4, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0xd0, r5, 0x10, 0x70bd26, 0x25dfdbfb, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}]}, 0xd0}, 0x1, 0x0, 0x0, 0x20004010}, 0x4000) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[], 0xfdef) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f00000004c0)) 1.151395607s ago: executing program 4 (id=6291): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r3 = socket(0x8, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x4a0080, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$XFS_IOC_START_COMMIT(r2, 0x80585882, &(0x7f0000000080)) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f00000004c0)=ANY=[@ANYBLOB="180000000082940000000000000000000000950000001b00a6703704a56dbefc0430273a4b2de109fc0ef55b85a0718ee9ce27e215b0bc04710dbe58d9a94510abd41ee79604bb0901e900c9923ed17556fb5ffe29a959d67b0946d5219baf01978354045650bb987c2efa88a224f32a526bdddd7e81ec46bdd3d44cb1fc80af9747cde9e0c1b10f48b36202e555aa9f55"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x16, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x5, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000300)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x5, 0x0, 0x3}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x90}, 0x40c0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r6, 0xfffff000, 0xe, 0x0, &(0x7f0000000300)="882f1242a03c3f98722780b605a7", 0x0, 0x990d, 0x7000000, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNGETSNDBUF(r4, 0x800454d3, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) r10 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$BATADV_CMD_GET_ORIGINATORS(r9, 0x0, 0x20048041) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000980)=@newqdisc={0x8c, 0x24, 0x4ee4e6a52ff56541, 0x70bd24, 0x1, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xb, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x89, [0x8, 0xe, 0x5, 0x8, 0x1, 0xa, 0x8, 0x1, 0x6, 0x2, 0xe, 0x4a, 0x7, 0xe, 0xe, 0x2], 0x0, [0x3, 0x4, 0xd9, 0x1, 0x2, 0x1, 0xdc9, 0x4, 0x9a, 0x6, 0xa, 0x3ff, 0xa331, 0x100, 0x4, 0x3], [0xd, 0x9, 0x6, 0x6, 0xcbb, 0x7, 0xfff, 0x5, 0x1, 0x6, 0x6, 0x8, 0x9, 0x7291, 0xd, 0x573f]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x8004}, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r0, 0xd000943d, &(0x7f000010c300)={0x0, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0}], 0x2, "f35cdffa4c22ce"}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r2, 0x81f8943c, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(r3, 0xd000943d, &(0x7f0000110700)={0x9, [{}, {}, {}, {}, {r12}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, r18}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r14}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r16}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r17}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {r15}, {}, {}, {}, {}, {}, {}, {}, {0x0, r13}], 0x7, "e81e98e4abedff"}) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r0, 0xd000943e, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r2, 0x81f8943c, &(0x7f0000113700)) 1.149990399s ago: executing program 1 (id=6292): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="180200000300000000000000000000008500000087000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000002200000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x20000000}, 0x94) 1.04054865s ago: executing program 1 (id=6293): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000500)=@newlink={0x70, 0x10, 0x401, 0x5, 0x43, {0x0, 0x0, 0x0, 0x0, 0x587}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x38, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x3}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x2, 0xe}}, @IFLA_VLAN_EGRESS_QOS={0x4}, @IFLA_VLAN_EGRESS_QOS={0x1c, 0x3, 0x0, 0x1, [@IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x5, 0x1}}, @IFLA_VLAN_QOS_MAPPING={0xc, 0x1, {0x5, 0xa}}]}]}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x70}}, 0x4000000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x3, 0x5, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2}, [@call={0x85, 0x0, 0x0, 0x2f}, @call={0x85, 0x0, 0x0, 0xe}]}, &(0x7f0000000340)='syzkaller\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc}, 0x94) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f0000001e00)={'macvtap0\x00', 0x0}) syz_emit_ethernet(0x26, &(0x7f0000000040)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv4={0x800, @generic={{0x6, 0x4, 0x0, 0x0, 0x18, 0x66, 0x0, 0x0, 0x84, 0x0, @empty, @multicast1, {[@generic={0x0, 0x2}]}}}}}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newtaction={0x88, 0x30, 0xffff, 0x70bd29, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xffdff7e8, 0x3}, 0x1, r1}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x0, 0x1, 0x5, 0xfffffff7}, 0x21, r5}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x88}, 0x1, 0x0, 0x0, 0x20008880}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x5, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000fdfffefe000000000300000085000000110000008500000011000000950000000000000082f1374954dbf4ff8932db8fe53205f6e5a8a19842d48fe8"], &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x8, '\x00', 0x0, @fallback=0x17, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000003f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x15) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r8, 0x4101}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x14, 0x2, @private1}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4001}, 0x0) r9 = socket$alg(0x26, 0x5, 0x0) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$SEG6(&(0x7f0000003e40), 0xffffffffffffffff) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$SEG6_CMD_SETHMAC(r12, &(0x7f0000004440)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)={0x34, r11, 0x20d, 0x70bd2a, 0x25dfdbfe, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x2}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x4}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}, @SEG6_ATTR_SECRET={0x8, 0x4, [0x26]}]}, 0x34}, 0x1, 0x0, 0x0, 0xc051}, 0x4000) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$SEG6_CMD_SETHMAC(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYRESDEC=r3, @ANYRES16=r13, @ANYBLOB="010028bd7000fcdbdf250100000005000600af000000080003000600000005000500000000002084"], 0x2c}}, 0x24000806) bind$alg(r9, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'sha384\x00'}, 0x58) getsockopt$WPAN_SECURITY_LEVEL(r7, 0x0, 0x2, &(0x7f0000000340), &(0x7f0000000380)=0x4) accept$nfc_llcp(0xffffffffffffffff, 0x0, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000000)={0x3, 0x46eb, 0x6, 0x0, 0x8, 0x80, 0x7}, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x15, &(0x7f0000000200)=ANY=[@ANYRESHEX=r13], &(0x7f0000000100)='GPL\x00', 0x3}, 0x94) 894.033573ms ago: executing program 2 (id=6294): r0 = openat$cgroup_netprio_ifpriomap(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000180)) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000000140)={0x38, r2, 0x1, 0xfffffffc, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x4}, @ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x81}, 0x0) 712.020958ms ago: executing program 2 (id=6295): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xd, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="1808000000000000000000002000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b70300002bb91a008500000008001800bc0900000000000045090100002000009500000000000000850000000c000000bf9800000000000056090000000400008500000084000000b7000000000000009500000000000000309b"], &(0x7f0000000980)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x6b, '\x00', 0x0, @sock_ops=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}, 0x94) 617.321347ms ago: executing program 1 (id=6296): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r0, 0x0, 0x30, 0x12, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000100)=[0x4, 0xfffffffffffffffd, 0x4, 0x1], 0x0, 0x200000002700, 0x4}}, 0x40) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)=r0}, 0x20) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r3, 0x400448cc, &(0x7f0000000100)) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r5) getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@delchain={0x90, 0x64, 0xf31, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0x2}, {0xfff3, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x60, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x44, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x1c, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x6e7d}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_DIR={0x5, 0x3, 0x56}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}, @TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x24, 0x1, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_GENEVE_CLASS={0x6, 0x1, 0x5}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_TYPE={0x5, 0x2, 0x80}, @TCA_FLOWER_KEY_ENC_OPT_GENEVE_DATA={0x5, 0x3, 0xc0}]}]}, @TCA_FLOWER_KEY_MPLS_BOS={0x5}, @TCA_FLOWER_KEY_ENC_IP_TTL={0x5, 0x52, 0x5}, @TCA_FLOWER_KEY_IP_TOS_MASK={0x5, 0x4a, 0xfb}]}}]}, 0x90}, 0x1, 0x0, 0x0, 0x40054}, 0x4804) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r7, 0x1, 0x4c, &(0x7f0000000000), 0x4) recvmsg$unix(r7, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x2000) ioctl$sock_inet6_SIOCADDRT(r8, 0x890b, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xedc623580215bdcd, 0x12, r9, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000640)=@bpf_ext={0x1c, 0x12, &(0x7f0000000300)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xdc5}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r1}}, @printk, @call={0x85, 0x0, 0x0, 0x2a}, @exit, @alu={0x4, 0x0, 0xb, 0x9, 0x3, 0xffffffffffffffc0, 0xfffffffffffffffc}]}, &(0x7f00000003c0)='syzkaller\x00', 0xb9c, 0xc6, &(0x7f0000000400)=""/198, 0x41100, 0x20, '\x00', r6, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000540)={0x5, 0xe, 0x5, 0xac5}, 0x10, 0x12e2f, r0, 0x3, &(0x7f00000005c0)=[r8, r9, r10], &(0x7f0000000600)=[{0x3, 0x4, 0x1, 0x7}, {0x4, 0x1, 0x4, 0x5}, {0x0, 0x2, 0x9, 0x9}], 0x10, 0x6b6}, 0x94) 591.183247ms ago: executing program 2 (id=6297): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) write$nci(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r0, &(0x7f0000000dc0)=ANY=[], 0x14) r4 = socket(0x1e, 0x4, 0x0) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="5001", @ANYRES8=r1, @ANYRES16=r4], 0x14) 491.978928ms ago: executing program 3 (id=6298): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) r1 = accept4(r0, 0x0, 0x0, 0x80800) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r2, &(0x7f0000001bc0)=[{{&(0x7f0000000240)={0xa, 0x4f21, 0x400, @private0, 0x3}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000440)="14", 0x1}], 0x1}}], 0x1, 0x931766f6319eed40) shutdown(r2, 0x1) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r1, 0x84, 0x6c, &(0x7f0000000500)={r4, 0xd1, "1d516e3f806269afad87aeb7f5a6d3c9e897d0581f5913ec43884b2000000000010000005e291356088e0e78d14301097c5d8c30debe5bb7c2a27e363783f0ae287152f4fd09d61bbb270587c424eaac9d51963f0788a86427ebf9e3ce5bc3db909c1ea84092b30cf087c6aa4e9e9c088b00a5201850388d445708145a4d3359108b904ce052a70712422e04f16a6ffd8105ea9d6e4db797d2d36b7afe2e6123019097cc14f7b8b86c95ed602295937f04fe1835e29101e12b3218420302148bbabe4460e5972f3cd4e367794b5ba543ed"}, &(0x7f0000000080)=0xd9) 444.053137ms ago: executing program 0 (id=6299): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'xcbc(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmmsg$inet6(r1, &(0x7f000000a440)=[{{0x0, 0x0, &(0x7f00000086c0)=[{&(0x7f0000006240)="c1346f2d260685eb57d897465edd4823", 0x10}, {&(0x7f00000062c0)="2977c9c80000000000", 0x9}, {&(0x7f0000006300)="5c711d9c51a0c1a7", 0x8}], 0x3}}, {{0x0, 0x0, &(0x7f000000a3c0)=[{&(0x7f00000090c0)="9a4037055e1d2207e96d56db2b87dc0f58811431433ec0e2435dab2ea838935a599486af8d13ab2df30ff8d0a89465852ec7abbeffae9462a84e0967d932a92cccb35fdc84", 0x45}, {&(0x7f0000009140)="14b48e5b08fd6c6c9c03031067a0f6194cf12963721ad167aa845aa732510bdfc2795ea40719d18c35e44298992aafa50921ae2de7ce25d85f96044894250e8a684d06c37ca05fddbafd651f2f0ab91dadf0ed44f422cf", 0x57}, {&(0x7f0000000080)="59058e8bf0cc944add2bc5e92c2a324f8f63fd70006d7d", 0xffffffaa}], 0x3}}], 0x2, 0x44051) mmap$xdp(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x99af8e632bfb392d, 0x11, 0xffffffffffffffff, 0x100000000) pipe(0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42072, 0xffffffffffffffff, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000800)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000280), 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{}, &(0x7f0000000180), &(0x7f0000000280)=r4}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@bloom_filter={0x1e, 0xfffffff9, 0x7, 0x4, 0x2482, r2, 0x5, '\x00', 0x0, r3, 0x5, 0x5, 0x5, 0xc}, 0x50) 223.513909ms ago: executing program 2 (id=6300): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006900010028bd7000ffdbc86e0000000000400000080001"], 0x20}, 0x1, 0x0, 0x0, 0x40c00}, 0x800) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r3) getsockname$packet(r3, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r4, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000640)=@delchain={0x60, 0x64, 0xf31, 0xfffffffd, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xfff3, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x30, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x8}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}]}]}, @TCA_FLOWER_KEY_CT_LABELS={0x14, 0x61, "aa2bd5a4b2efd4891dd3707e022dd6b6"}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40044}, 0x4804) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r5 = socket(0xa, 0x3, 0x87) socket$nl_sock_diag(0x10, 0x3, 0x4) sendto$packet(r5, &(0x7f00000000c0)="cbc5d3a811c2fc77d5", 0x9, 0x8c0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'gretap0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r7) sendmsg$ETHTOOL_MSG_COALESCE_SET(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e657464657673696d300000000000000800050000fcffff08000900fc000000080011000700000008000e00800000000800", @ANYRES32=r8], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000140)={@dev={0xfe, 0x80, '\x00', 0xa}, 0x78, r6}) ioctl$sock_inet6_tcp_SIOCINQ(r5, 0x8936, &(0x7f0000000000)) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000002dc0)=[{{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000300)="b4f7672071979d161b44fbc55fe6513b163c9d9d34fb13bb1581f5ebbb90857d987d6de32304f03d449dc2d5024e38eb5ea1ad87aeb03d1c083b5c2dfa43549c8d951279", 0x44}], 0x1}}], 0x1, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r10, 0x0) unshare(0x20000400) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r12, 0x1, r11, &(0x7f0000000280)={0x5}) unshare(0x20000400) 121.70548ms ago: executing program 0 (id=6301): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) socketpair(0x6, 0x3, 0x1c, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) bind$rds(r3, &(0x7f0000000180)={0x2, 0x4e20, @rand_addr=0x64010100}, 0x10) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x121c02, 0x0) ioctl$PPPIOCNEWUNIT(r5, 0xc004743e, &(0x7f0000000100)) ioctl$PPPIOCSACTIVE(r5, 0x40107446, &(0x7f00000003c0)={0x2, &(0x7f0000000080)=[{0x50, 0x1, 0x2, 0x9}, {0x6, 0x0, 0x3, 0x365}]}) write$ppp(r5, &(0x7f0000000180)="6bdff9110d5fe7bd08", 0x9) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000100)={'bond_slave_0\x00', &(0x7f00000001c0)=@ethtool_perm_addr={0x4b, 0x48, "4b721b782a17a7b6a00d960a64048655bcb0b0ac551fdb8a571f6b3c1cb52ecdf3e8721b8ac2e3bdbbff5ee018d48c7c3b54f8dbdeee0aab7d3d8edaf144e5d52400000000000069"}}) sendto$inet6(r0, &(0x7f0000000300)="a6", 0x1, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x9}, 0x1c) syz_emit_ethernet(0x36, &(0x7f0000000040)={@broadcast, @random, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x1, 0x0, @rand_addr=0x64010100, @multicast1}, @timestamp={0xd, 0x0, 0x0, 0x4, 0x1, 0x4, 0xbb, 0x8}}}}}, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='reno', 0x4) sendto$inet6(r0, &(0x7f0000000380)="b3", 0x1, 0x20060000, 0x0, 0x0) recvfrom$inet(r3, &(0x7f0000000240)=""/17, 0x11, 0x40000020, 0x0, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000440)={0x9, 0x2000, 0x3, 0x40, 0xffffffff, 0x8, 0x8ff83, 0xb}, 0x20) sendmsg$inet_sctp(r6, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000000)="fd", 0x1}], 0x1, 0x0, 0x0, 0x804c044}, 0x881) ioctl$XFS_IOC_FSGROWFSLOG(r0, 0x4008586f, &(0x7f0000000000)={0x5, 0x80}) r7 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r7, 0x1, r0, &(0x7f0000000040)={0x20000002}) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r8, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x1000, 0x9, 0x5, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x9, 0x4, 0x7, 0x4, 0x100000, 0x762, 0x3, 0xd, 0x3, 0x2b12, 0x100, 0x6, 0x1c00, 0x3, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x0, 0x11000, 0x80000000, 0x5, 0x79b, 0x2, 0x1, 0x7d, 0x4, 0x2, 0x7, 0xf, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x8, 0x180000, 0x400a, 0x8b, 0x5, 0x2af, 0xf7, 0x5, 0x5, 0x6, 0x9, 0x9, 0xb, 0x4009, 0x0, 0x4, 0xffffff01, 0x8, 0x752, 0x0, 0x1005, 0x5, 0x10001, 0x2, 0xffffffff, 0x6, 0x4, 0x9, 0x7ffffffe, 0xfdffffff, 0x2, 0x2, 0x84, 0x800100, 0x5, 0x252, 0x7, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x2, 0x2, 0x5, 0x12, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x3, 0x401, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) setsockopt$TIPC_MCAST_BROADCAST(r2, 0x10f, 0x85) 0s ago: executing program 2 (id=6302): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000e001400400000004000000041"], 0x50) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=@newsa={0x144, 0x10, 0x1, 0xbffffffe, 0x100, {{@in=@empty, @in6=@ipv4={'\x00', '\xff\xff', @remote}, 0x1, 0x394, 0x4e20, 0x3ff, 0x0, 0x0, 0x0, 0x3a}, {@in6=@private1, 0x4d6, 0x6c}, @in=@remote, {0xfffffffffffffffd, 0x9, 0x100006, 0xffff, 0x8251c, 0x9, 0xfffffffffffffff8}, {0x6, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xe, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @offload={0xc, 0x1c, {0x0, 0x3}}]}, 0x144}, 0x1, 0x0, 0x0, 0x4845}, 0x10) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)="f3d34c328eb9fb9244ebdcdf956468ce26b69ae785f6c17430d58cded19b380965a2ad0ab7089071b11b9dfb66cae0895fa8b21930489a9961f4ad4a82be40a89a9e84aea1e75fe0ec5c857c38595519c45f517be4a51ebad720e9aa33c9962a5b112b8e70dee09aa758a9b3d8c7eafd2f42e868a98f7353badf", &(0x7f0000000040), 0x1006, r0}, 0x38) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_GET(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x80, 0x0, 0x0, 0x70bd2c, 0x25dfdbfe, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @multicast1}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @remote}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'batadv_slave_1\x00'}, @L2TP_ATTR_UDP_SPORT={0x6, 0x1a, 0x4e20}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @private=0xa010102}, @L2TP_ATTR_FD={0x8, 0x17, @l2tp6}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x4}, @L2TP_ATTR_IFNAME={0x14, 0x8, 'veth1_virt_wifi\x00'}]}, 0x80}, 0x1, 0x0, 0x0, 0x400c0}, 0x40001) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000040)={r0, &(0x7f00000000c0), &(0x7f0000000080)=""/17}, 0x20) kernel console output (not intermixed with test programs): [T25236] tipc: Disabling bearer [ 753.395824][T25262] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4759'. [ 753.816188][T25280] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4762'. [ 753.961376][T25287] netlink: 84 bytes leftover after parsing attributes in process `syz.3.4765'. [ 753.985202][T25285] bridge8: entered allmulticast mode [ 754.150556][T25290] A link change request failed with some changes committed already. Interface ip6gre0 may have been left with an inconsistent configuration, please check. [ 754.284286][T25305] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4773'. [ 754.371748][T25312] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 755.086498][T25348] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4785'. [ 755.107937][T25348] openvswitch: netlink: Flow key attr not present in new flow. [ 755.609730][T25361] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4788'. [ 756.286771][T25386] syzkaller0: entered promiscuous mode [ 756.297996][T25386] syzkaller0: entered allmulticast mode [ 756.364122][T25393] xt_bpf: check failed: parse error [ 756.569724][T25404] veth3: left allmulticast mode [ 756.580154][T25404] veth3: left promiscuous mode [ 756.595412][T25404] bridge5: port 1(veth3) entered disabled state [ 756.624007][T25404] veth5: left allmulticast mode [ 756.639516][T25404] veth5: left promiscuous mode [ 756.650060][T25404] bridge5: port 2(veth5) entered disabled state [ 756.662553][T25415] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 756.777889][T25419] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 756.836223][T25419] pim6reg: entered allmulticast mode [ 756.858717][T25419] pim6reg: left allmulticast mode [ 756.905803][T25426] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 757.061329][T25433] netlink: 'syz.0.4807': attribute type 13 has an invalid length. [ 757.173577][T25438] FAULT_INJECTION: forcing a failure. [ 757.173577][T25438] name failslab, interval 1, probability 0, space 0, times 0 [ 757.208762][T25438] CPU: 0 UID: 0 PID: 25438 Comm: syz.4.4810 Not tainted syzkaller #0 PREEMPT(full) [ 757.208793][T25438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 757.208806][T25438] Call Trace: [ 757.208815][T25438] [ 757.208824][T25438] dump_stack_lvl+0xe8/0x150 [ 757.208855][T25438] should_fail_ex+0x412/0x560 [ 757.208891][T25438] should_failslab+0xa8/0x100 [ 757.208926][T25438] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 757.208960][T25438] ? __alloc_skb+0x1d0/0x7d0 [ 757.208988][T25438] ? __local_bh_enable_ip+0xd0/0x130 [ 757.209018][T25438] __alloc_skb+0x1d0/0x7d0 [ 757.209046][T25438] ? netlink_ack_tlv_len+0x6c/0x210 [ 757.209081][T25438] netlink_ack+0x146/0xa50 [ 757.209118][T25438] ? __pfx_genl_rcv_msg+0x10/0x10 [ 757.209162][T25438] netlink_rcv_skb+0x2b6/0x4b0 [ 757.209195][T25438] ? __pfx_genl_rcv_msg+0x10/0x10 [ 757.209221][T25438] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 757.209271][T25438] ? down_read+0x270/0x2e0 [ 757.209296][T25438] ? genl_rcv+0xd/0x40 [ 757.209322][T25438] genl_rcv+0x28/0x40 [ 757.209343][T25438] netlink_unicast+0x75c/0x8e0 [ 757.209384][T25438] netlink_sendmsg+0x813/0xb40 [ 757.209428][T25438] ? __pfx_netlink_sendmsg+0x10/0x10 [ 757.209464][T25438] ? aa_sock_msg_perm+0xf1/0x1b0 [ 757.209495][T25438] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 757.209530][T25438] ____sys_sendmsg+0x972/0x9f0 [ 757.209565][T25438] ? __might_fault+0xaf/0x130 [ 757.209600][T25438] ? __pfx_____sys_sendmsg+0x10/0x10 [ 757.209645][T25438] ? import_iovec+0x73/0xa0 [ 757.209683][T25438] ___sys_sendmsg+0x2a5/0x360 [ 757.209716][T25438] ? __lock_acquire+0x6b5/0x2cf0 [ 757.209746][T25438] ? __pfx____sys_sendmsg+0x10/0x10 [ 757.209821][T25438] ? __fget_files+0x2a/0x420 [ 757.209847][T25438] ? __fget_files+0x3a0/0x420 [ 757.209887][T25438] __x64_sys_sendmsg+0x1bd/0x2a0 [ 757.209925][T25438] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 757.209970][T25438] ? __pfx_ksys_write+0x10/0x10 [ 757.210013][T25438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.210037][T25438] do_syscall_64+0x15f/0xf80 [ 757.210061][T25438] ? clear_bhb_loop+0x40/0x90 [ 757.210089][T25438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 757.210118][T25438] RIP: 0033:0x7fcae079ce59 [ 757.210140][T25438] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 757.210159][T25438] RSP: 002b:00007fcae1727028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 757.210183][T25438] RAX: ffffffffffffffda RBX: 00007fcae0a15fa0 RCX: 00007fcae079ce59 [ 757.210200][T25438] RDX: 0000000000000800 RSI: 0000200000000640 RDI: 0000000000000005 [ 757.210215][T25438] RBP: 00007fcae1727090 R08: 0000000000000000 R09: 0000000000000000 [ 757.210229][T25438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 757.210243][T25438] R13: 00007fcae0a16038 R14: 00007fcae0a15fa0 R15: 00007ffffbf07648 [ 757.210280][T25438] [ 757.542025][T25444] __nla_validate_parse: 3 callbacks suppressed [ 757.542049][T25444] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4812'. [ 757.570480][T25444] xt_bpf: check failed: parse error [ 757.659133][T25445] netlink: 172 bytes leftover after parsing attributes in process `syz.0.4813'. [ 757.745804][T25451] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 758.246102][T25469] batadv0: entered promiscuous mode [ 758.260895][T25469] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 758.433573][T25479] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4826'. [ 758.503041][T25483] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.4828'. [ 758.595961][T25487] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 758.682260][T25491] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 758.817210][ T5648] block nbd2: Receive control failed (result -32) [ 758.817286][ T5650] block nbd2: Receive control failed (result -32) [ 759.255643][T25520] netlink: 'syz.2.4839': attribute type 4 has an invalid length. [ 759.307462][T25520] netlink: 'syz.2.4839': attribute type 4 has an invalid length. [ 759.364687][T25522] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4841'. [ 759.634119][T25540] syzkaller0: entered promiscuous mode [ 759.646008][T25540] syzkaller0: entered allmulticast mode [ 759.738414][ T5648] Bluetooth: hci2: command 0x0405 tx timeout [ 759.744607][ T5641] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 759.861776][T25549] netlink: 'syz.0.4850': attribute type 1 has an invalid length. [ 759.909242][T25549] netlink: 'syz.0.4850': attribute type 6 has an invalid length. [ 759.920837][T25553] netlink: 68 bytes leftover after parsing attributes in process `syz.4.4849'. [ 759.932566][T25549] netlink: 'syz.0.4850': attribute type 7 has an invalid length. [ 759.943344][T25553] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4849'. [ 759.947512][T25549] netlink: 'syz.0.4850': attribute type 1 has an invalid length. [ 760.122556][T25556] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4852'. [ 760.147638][T25556] xt_bpf: check failed: parse error [ 760.485013][T25568] netlink: 'syz.3.4855': attribute type 4 has an invalid length. [ 760.525457][T25568] netlink: 'syz.3.4855': attribute type 4 has an invalid length. [ 760.869012][T25585] netlink: 220 bytes leftover after parsing attributes in process `syz.0.4859'. [ 760.923684][T25589] netlink: 1304 bytes leftover after parsing attributes in process `syz.2.4860'. [ 761.248141][T25608] netlink: 'syz.0.4868': attribute type 4 has an invalid length. [ 761.417235][T25619] nbd: must specify at least one socket [ 761.451749][T25619] : renamed from bond_slave_0 [ 761.800236][T25632] sctp: [Deprecated]: syz.0.4877 (pid 25632) Use of int in max_burst socket option. [ 761.800236][T25632] Use struct sctp_assoc_value instead [ 761.840315][T25632] syzkaller0: entered promiscuous mode [ 761.845939][T25632] syzkaller0: entered allmulticast mode [ 762.779164][ T5648] Bluetooth: hci2: command 0x0405 tx timeout [ 762.787650][ T5641] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 762.899745][T25679] __nla_validate_parse: 6 callbacks suppressed [ 762.899770][T25679] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4891'. [ 763.314842][T25687] netlink: 120 bytes leftover after parsing attributes in process `syz.3.4893'. [ 763.599796][T25694] validate_nla: 3 callbacks suppressed [ 763.599821][T25694] netlink: 'syz.3.4894': attribute type 4 has an invalid length. [ 763.616692][T25694] netlink: 'syz.3.4894': attribute type 4 has an invalid length. [ 763.757553][T25698] tipc: Enabling of bearer rejected, failed to enable media [ 763.854766][T25704] netlink: 'syz.3.4897': attribute type 21 has an invalid length. [ 763.895720][T25704] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4897'. [ 763.929907][T25711] netlink: 'syz.3.4897': attribute type 2 has an invalid length. [ 763.958082][T25711] netlink: 'syz.3.4897': attribute type 1 has an invalid length. [ 763.963350][T25712] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4898'. [ 763.976200][T25711] netlink: 'syz.3.4897': attribute type 1 has an invalid length. [ 764.035577][T25712] ip6gre2: entered promiscuous mode [ 764.090654][T25712] ip6gre2: entered allmulticast mode [ 764.131909][T11917] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 764.155895][T11917] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 764.164128][T12889] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 764.615307][T25743] netlink: 9 bytes leftover after parsing attributes in process `syz.2.4908'. [ 764.628522][T12889] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 764.649806][T25743] 0: renamed from hsr0 [ 764.692975][T25743] 0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 764.705607][T25743] 0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 764.716941][T25743] 0: entered allmulticast mode [ 764.722686][T25743] hsr_slave_0: entered allmulticast mode [ 764.728968][T25743] hsr_slave_1: entered allmulticast mode [ 764.736450][T25743] A link change request failed with some changes committed already. Interface c0 may have been left with an inconsistent configuration, please check. [ 764.788117][T12890] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 765.042514][T25755] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 765.257229][T25767] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4917'. [ 765.575905][T25774] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4920'. [ 765.764979][T25774] bond13: option miimon: invalid value (18446744073709551607) [ 765.797943][T25774] bond13: option miimon: allowed values 0 - 2147483647 [ 765.856963][T25774] bond13 (unregistering): Released all slaves [ 765.998188][T25807] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4926'. [ 766.056310][T25807] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4926'. [ 766.078450][ T5641] block nbd3: Receive control failed (result -32) [ 766.322377][T25816] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4928'. [ 766.365946][T25818] tipc: Enabling of bearer rejected, failed to enable media [ 766.500299][T25820] bond0: (slave vlan4): Opening slave failed [ 766.702807][T25832] dvmrp0: entered allmulticast mode [ 766.739780][T25836] netlink: 'syz.1.4935': attribute type 4 has an invalid length. [ 766.767430][T25836] netlink: 'syz.1.4935': attribute type 4 has an invalid length. [ 767.069131][T25855] netlink: 'syz.2.4941': attribute type 1 has an invalid length. [ 767.675190][T25888] netlink: 'syz.4.4949': attribute type 4 has an invalid length. [ 767.898091][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 768.335096][T25929] __nla_validate_parse: 4 callbacks suppressed [ 768.335118][T25929] netlink: 280 bytes leftover after parsing attributes in process `syz.1.4962'. [ 768.563485][T25947] sctp: [Deprecated]: syz.1.4966 (pid 25947) Use of int in max_burst socket option deprecated. [ 768.563485][T25947] Use struct sctp_assoc_value instead [ 768.609350][T25950] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4970'. [ 768.808572][ T30] audit: type=1804 audit(1778687531.807:14): pid=25966 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.4975" name="/newroot/362/cgroup.controllers" dev="tmpfs" ino=1855 res=1 errno=0 [ 768.865165][ T30] audit: type=1800 audit(1778687531.817:15): pid=25966 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.4975" name="cgroup.controllers" dev="tmpfs" ino=1855 res=0 errno=0 [ 768.964579][T25973] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4977'. [ 768.974054][T25973] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4977'. [ 768.983447][T25969] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4978'. [ 768.993696][T25973] validate_nla: 4 callbacks suppressed [ 768.993715][T25973] netlink: 'syz.3.4977': attribute type 15 has an invalid length. [ 769.191884][T25988] netlink: 'syz.4.4982': attribute type 1 has an invalid length. [ 769.248988][T25990] xt_CT: You must specify a L4 protocol and not use inversions on it [ 769.614213][T26009] netlink: 'syz.1.4990': attribute type 2 has an invalid length. [ 769.631231][T26009] netlink: 'syz.1.4990': attribute type 2 has an invalid length. [ 769.691276][T26009] macsec1: entered promiscuous mode [ 769.978112][ T9] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 770.001228][ T5641] Bluetooth: hci2: link tx timeout [ 770.013199][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.028366][ T5641] Bluetooth: hci2: link tx timeout [ 770.033785][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.041731][ T5641] Bluetooth: hci2: link tx timeout [ 770.047124][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.055097][ T5641] Bluetooth: hci2: link tx timeout [ 770.060677][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.071257][ T5641] Bluetooth: hci2: link tx timeout [ 770.076543][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.085056][ T5641] Bluetooth: hci2: link tx timeout [ 770.090585][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.098711][ T5641] Bluetooth: hci2: link tx timeout [ 770.103968][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.120219][ T5641] Bluetooth: hci2: link tx timeout [ 770.125601][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.133971][ T5641] Bluetooth: hci2: link tx timeout [ 770.139632][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.149379][ T5641] Bluetooth: hci2: link tx timeout [ 770.156559][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.164635][ T5641] Bluetooth: hci2: link tx timeout [ 770.170382][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.180681][ T5641] Bluetooth: hci2: link tx timeout [ 770.185867][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.193923][ T5641] Bluetooth: hci2: link tx timeout [ 770.199208][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.206891][ T5641] Bluetooth: hci2: link tx timeout [ 770.212293][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 770.222505][ T5641] Bluetooth: hci2: link tx timeout [ 770.227705][ T5641] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 771.062098][T26061] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 771.135710][T26053] bond0: entered promiscuous mode [ 771.145968][T26053] bond0: left promiscuous mode [ 771.169029][T26058] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5005'. [ 771.568208][T26083] tipc: Started in network mode [ 771.587164][T26083] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 771.608071][T26083] tipc: Enabling of bearer rejected, failed to enable media [ 771.669533][T26087] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5011'. [ 771.768210][T26089] netlink: 'syz.3.5014': attribute type 4 has an invalid length. [ 771.796992][T26089] netlink: 'syz.3.5014': attribute type 4 has an invalid length. [ 772.060223][ T5641] Bluetooth: hci2: command 0x0405 tx timeout [ 772.356365][T26103] bond13: entered promiscuous mode [ 772.370753][T26103] 8021q: adding VLAN 0 to HW filter on device bond13 [ 772.387377][T26103] bridge0: port 1(bond13) entered blocking state [ 772.402036][T26103] bridge0: port 1(bond13) entered disabled state [ 772.409367][T26103] bond13: entered allmulticast mode [ 772.421361][T26103] bridge0: port 1(bond13) entered blocking state [ 772.427963][T26103] bridge0: port 1(bond13) entered forwarding state [ 772.515831][T11917] bridge0: port 1(bond13) entered disabled state [ 772.615991][T26115] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 772.677472][T26118] netlink: 'syz.1.5024': attribute type 32 has an invalid length. [ 772.870857][T26123] netlink: 'syz.1.5026': attribute type 4 has an invalid length. [ 772.903797][T26123] netlink: 'syz.1.5026': attribute type 4 has an invalid length. [ 774.979989][T26196] syzkaller0: entered promiscuous mode [ 775.001368][T26196] syzkaller0: entered allmulticast mode [ 775.021984][T26195] tipc: Enabled bearer , priority 0 [ 775.086073][T26196] tipc: Resetting bearer [ 775.117324][T26194] tipc: Resetting bearer [ 775.180292][T26194] tipc: Disabling bearer [ 775.379547][T26208] netlink: 840 bytes leftover after parsing attributes in process `syz.1.5051'. [ 775.417966][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 775.512902][T26211] hmac(sha2: entered promiscuous mode [ 775.824134][T26229] netlink: 'syz.0.5057': attribute type 4 has an invalid length. [ 775.875889][T26234] netlink: 'syz.0.5057': attribute type 4 has an invalid length. [ 776.320948][T26256] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5063'. [ 776.347826][T26256] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5063'. [ 776.393963][T26256] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5063'. [ 776.403674][T26256] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5063'. [ 776.653907][T26218] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5054'. [ 776.914738][T26274] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5067'. [ 776.954614][T26274] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5067'. [ 776.987946][T26274] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5067'. [ 776.995466][T26270] IPVS: wlc: UDP 224.0.0.2:0 - no destination available [ 777.035554][T26274] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5067'. [ 777.232731][T26278] 8021q: adding VLAN 0 to HW filter on device bond13 [ 777.250483][ T30] audit: type=1107 audit(1778687540.247:16): pid=26287 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 777.313855][T26285] bond13: (slave gretap3): Enslaving as an active interface with an up link [ 777.414840][T26288] bond14: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 777.440676][T26288] bond14 (unregistering): Released all slaves [ 777.541878][T26293] netlink: 'syz.0.5072': attribute type 4 has an invalid length. [ 777.626832][T26299] netlink: 'syz.0.5072': attribute type 4 has an invalid length. [ 777.892177][T26320] vxcan2: entered allmulticast mode [ 778.346735][T26344] ipvlan0: entered promiscuous mode [ 778.382227][T26344] ipvlan0: left promiscuous mode [ 778.456271][T26341] syzkaller0: entered promiscuous mode [ 778.463873][T26341] syzkaller0: entered allmulticast mode [ 778.503554][T26350] netlink: 'syz.4.5088': attribute type 4 has an invalid length. [ 778.534077][T26350] netlink: 'syz.4.5088': attribute type 4 has an invalid length. [ 779.962642][T26412] IPVS: sync thread started: state = MASTER, mcast_ifn = bridge_slave_0, syncid = 0, id = 0 [ 780.175455][T26425] netlink: 'syz.3.5102': attribute type 4 has an invalid length. [ 780.203477][T26425] netlink: 'syz.3.5102': attribute type 4 has an invalid length. [ 780.856046][T26448] __nla_validate_parse: 6 callbacks suppressed [ 780.856070][T26448] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5107'. [ 781.069753][T26453] bond0: (slave vlan2): Opening slave failed [ 781.290037][T26467] tipc: Enabled bearer , priority 0 [ 781.311246][T26467] syzkaller0: entered promiscuous mode [ 781.318287][T26467] syzkaller0: entered allmulticast mode [ 781.394729][T26467] tipc: Resetting bearer [ 781.466856][T26466] tipc: Resetting bearer [ 781.523756][T26466] tipc: Disabling bearer [ 781.706561][T26475] netlink: 'syz.2.5113': attribute type 4 has an invalid length. [ 781.756346][T26475] netlink: 'syz.2.5113': attribute type 4 has an invalid length. [ 781.888328][T26478] bond0: entered promiscuous mode [ 782.269621][T26489] bond14 (unregistering): Released all slaves [ 782.709832][T26505] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5121'. [ 783.016908][T26516] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5122'. [ 783.061189][T26515] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 783.470717][T26525] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 783.790142][T26543] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5127'. [ 783.805058][T26548] tipc: Failed to obtain node identity [ 783.828990][T26548] tipc: Enabling of bearer rejected, failed to enable media [ 783.908831][T26557] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5126'. [ 784.059837][ T5648] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 784.066220][ T5641] Bluetooth: hci2: command 0x0405 tx timeout [ 784.345575][T26331] Set syz1 is full, maxelem 65536 reached [ 784.450464][T26571] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5132'. [ 784.562821][T26577] : renamed from sit0 [ 784.866400][T26592] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5139'. [ 785.175202][T26611] syzkaller0: entered promiscuous mode [ 785.190199][T26611] syzkaller0: entered allmulticast mode [ 785.682489][T26627] hm3): entered promiscuous mode [ 785.881211][T26636] netlink: 'syz.4.5153': attribute type 1 has an invalid length. [ 785.907971][T26641] netlink: 'syz.3.5154': attribute type 8 has an invalid length. [ 785.973039][T26643] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5156'. [ 786.061052][T26636] 8021q: adding VLAN 0 to HW filter on device bond13 [ 786.217835][ T5648] Bluetooth: hci2: command 0x0405 tx timeout [ 786.224067][ T5641] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 786.233015][T26652] sctp: [Deprecated]: syz.3.5157 (pid 26652) Use of struct sctp_assoc_value in delayed_ack socket option. [ 786.233015][T26652] Use struct sctp_sack_info instead [ 786.250688][T26652] sctp: [Deprecated]: syz.3.5157 (pid 26652) Use of struct sctp_assoc_value in delayed_ack socket option. [ 786.250688][T26652] Use struct sctp_sack_info instead [ 786.429188][T26661] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5161'. [ 786.451438][T26661] netlink: 540 bytes leftover after parsing attributes in process `syz.4.5161'. [ 786.624577][T26663] tipc: Started in network mode [ 786.632818][T26663] tipc: Node identity 080211000001, cluster identity 4711 [ 786.641479][T26663] tipc: Enabled bearer , priority 0 [ 786.679217][T26663] tipc: Resetting bearer [ 786.784249][T26670] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5164'. [ 786.804634][T26669] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5165'. [ 786.874758][T26671] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5164'. [ 787.039457][T26680] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 787.189923][T26684] netlink: 72 bytes leftover after parsing attributes in process `syz.3.5170'. [ 787.203634][T26684] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5170'. [ 787.213378][T26684] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5170'. [ 787.317552][T26684] veth0_vlan: left promiscuous mode [ 787.338405][T26684] veth0_vlan: entered promiscuous mode [ 787.364106][T26692] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5171'. [ 787.659783][T12889] tipc: Node number set to 134418688 [ 788.223564][T26734] syzkaller1: entered promiscuous mode [ 788.243565][T26734] syzkaller1: entered allmulticast mode [ 788.522039][T26741] netlink: 'syz.4.5182': attribute type 1 has an invalid length. [ 788.536773][T26741] netlink: 'syz.4.5182': attribute type 2 has an invalid length. [ 788.589878][T26742] syzkaller0: entered promiscuous mode [ 788.602800][T26742] syzkaller0: entered allmulticast mode [ 789.265323][T26766] gretap0: entered promiscuous mode [ 789.287917][T26766] vlan4: entered promiscuous mode [ 789.357129][T26773] 8021q: adding VLAN 0 to HW filter on device bond0 [ 789.381627][T26773] 8021q: adding VLAN 0 to HW filter on device team0 [ 789.390479][T26771] netlink: 'syz.4.5192': attribute type 6 has an invalid length. [ 789.400282][T26773] dummy0: left promiscuous mode [ 789.410710][T26773] batadv0: left promiscuous mode [ 789.416725][T26773] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 789.498127][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 789.543720][T26773] 0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 789.568850][T26773] 0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 789.589311][T26773] 0: left allmulticast mode [ 789.606654][T26773] hsr_slave_0: left allmulticast mode [ 789.626100][T26773] hsr_slave_1: left allmulticast mode [ 789.693148][T26773] veth1_vlan: left promiscuous mode [ 789.703655][T26773] veth0_vlan: left promiscuous mode [ 789.713931][T26773] veth0_vlan: entered promiscuous mode [ 789.725567][T26773] veth1_vlan: entered promiscuous mode [ 789.742566][T26773] veth1_macvtap: left promiscuous mode [ 789.750335][T26773] veth0_macvtap: left promiscuous mode [ 789.772802][T26773] veth0_macvtap: entered promiscuous mode [ 789.788656][T26773] veth1_macvtap: entered promiscuous mode [ 789.820089][T26773] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 789.831465][T26773] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 789.842049][T26773] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 789.854285][T26773] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 789.869334][T26784] netlink: 'syz.1.5194': attribute type 1 has an invalid length. [ 789.870569][T26773] 8021q: adding VLAN 0 to HW filter on device bond1 [ 789.888493][T26773] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 789.896457][T26773] bond2: left promiscuous mode [ 789.905943][T26773] 8021q: adding VLAN 0 to HW filter on device bond2 [ 789.915109][T26773] batman_adv: batadv0: Interface activated: ipvlan2 [ 789.922527][T26773] veth0_to_team: entered promiscuous mode [ 789.966831][T26773] bridge2: port 1(gretap1) entered blocking state [ 789.973427][T26773] bridge2: port 1(gretap1) entered forwarding state [ 789.988919][T26773] 8021q: adding VLAN 0 to HW filter on device bond3 [ 789.996502][T26773] bond4: left promiscuous mode [ 790.001485][T26773] bridge4: left promiscuous mode [ 790.007697][T26773] 8021q: adding VLAN 0 to HW filter on device bond4 [ 790.018699][T26773] bond4: entered allmulticast mode [ 790.023884][T26773] bridge4: entered allmulticast mode [ 790.032771][T26773] macvtap1: left allmulticast mode [ 790.038704][T26773] bond4: left allmulticast mode [ 790.043645][T26773] bridge4: left allmulticast mode [ 790.050314][T26773] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 790.060842][T26773] bridge4: entered promiscuous mode [ 790.069797][T26773] 8021q: adding VLAN 0 to HW filter on device bond5 [ 790.081840][T26773] 8021q: adding VLAN 0 to HW filter on device bond6 [ 790.091684][T26773] 8021q: adding VLAN 0 to HW filter on device bond7 [ 790.102894][T26773] 8021q: adding VLAN 0 to HW filter on device bond8 [ 790.112825][T26773] 8021q: adding VLAN 0 to HW filter on device bond9 [ 790.122317][T26773] 8021q: adding VLAN 0 to HW filter on device bond10 [ 790.131230][T26773] 8021q: adding VLAN 0 to HW filter on device bond11 [ 790.170903][T26773] 8021q: adding VLAN 0 to HW filter on device bond12 [ 790.182041][T26773] bond13: left promiscuous mode [ 790.187426][T26773] 8021q: adding VLAN 0 to HW filter on device bond13 [ 790.196524][T26773] 8021q: adding VLAN 0 to HW filter on device bond14 [ 790.206774][T26773] 8021q: adding VLAN 0 to HW filter on device bond15 [ 790.216744][T26773] 8021q: adding VLAN 0 to HW filter on device bond16 [ 790.314997][T26789] netlink: 'syz.2.5195': attribute type 2 has an invalid length. [ 790.329659][T26789] netlink: 'syz.2.5195': attribute type 1 has an invalid length. [ 790.368801][ T76] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.398476][ T76] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.444103][T26784] 8021q: adding VLAN 0 to HW filter on device bond14 [ 790.493040][T26785] bond14: (slave veth5): Enslaving as an active interface with a down link [ 790.536943][T26786] bond14: (slave veth7): Enslaving as an active interface with a down link [ 790.681264][ T76] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.715111][ T76] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 791.470814][T26803] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 791.507143][T26803] bridge2: port 1(gretap1) entered disabled state [ 791.832344][T11920] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 791.853777][T11920] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 791.960411][T26824] bond14 (unregistering): Released all slaves [ 792.006455][T11920] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 792.042530][T11920] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 792.261058][T26840] __nla_validate_parse: 7 callbacks suppressed [ 792.261081][T26840] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5209'. [ 792.467418][T26850] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5211'. [ 792.510734][T26850] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5211'. [ 792.564091][T26853] netlink: 'syz.4.5212': attribute type 1 has an invalid length. [ 792.743740][T26864] sctp: [Deprecated]: syz.3.5215 (pid 26864) Use of int in max_burst socket option deprecated. [ 792.743740][T26864] Use struct sctp_assoc_value instead [ 792.780853][ T30] audit: type=1804 audit(1778687555.777:17): pid=26830 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.5206" name="/newroot/331/memory.events" dev="tmpfs" ino=1705 res=1 errno=0 [ 792.816963][ T30] audit: type=1800 audit(1778687555.787:18): pid=26830 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.5206" name="memory.events" dev="tmpfs" ino=1705 res=0 errno=0 [ 792.944649][T26830] 8021q: adding VLAN 0 to HW filter on device bond17 [ 793.019853][ T5648] Bluetooth: hci2: command 0x0405 tx timeout [ 793.250445][T26880] tipc: Enabling of bearer rejected, already enabled [ 793.471230][T26885] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 793.532199][T26896] netlink: 'syz.2.5224': attribute type 4 has an invalid length. [ 793.583966][T26896] netlink: 'syz.2.5224': attribute type 4 has an invalid length. [ 793.723517][T26905] netlink: 80 bytes leftover after parsing attributes in process `syz.3.5225'. [ 793.752513][T26905] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5225'. [ 794.116733][T26923] netlink: 'syz.2.5230': attribute type 6 has an invalid length. [ 794.136737][T26924] netlink: 'syz.2.5230': attribute type 6 has an invalid length. [ 794.246615][T26934] netlink: 'syz.4.5229': attribute type 30 has an invalid length. [ 794.959780][T26964] 5: entered promiscuous mode [ 795.087590][T26973] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5240'. [ 795.149754][T26973] bond16: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 795.170892][T26973] bond16 (unregistering): Released all slaves [ 795.520608][T26990] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5245'. [ 795.634179][T26993] xt_addrtype: ipv6 does not support BROADCAST matching [ 795.652838][T26993] mac80211_hwsim hwsim40 syzkaller0: left promiscuous mode [ 795.681034][T26993] mac80211_hwsim hwsim40 syzkaller0: left allmulticast mode [ 795.701163][T26993] xt_addrtype: ipv6 does not support BROADCAST matching [ 795.976071][T26997] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5247'. [ 796.105953][T27003] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5247'. [ 796.174110][T27018] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5251'. [ 796.478012][T27029] netlink: 'syz.4.5252': attribute type 83 has an invalid length. [ 799.191862][T27026] tipc: Enabling of bearer rejected, already enabled [ 799.440332][T27055] sch_tbf: burst 19872 is lower than device lo mtu (32783) ! [ 799.611031][T27064] netlink: 'syz.2.5262': attribute type 4 has an invalid length. [ 799.667664][T27064] netlink: 'syz.2.5262': attribute type 4 has an invalid length. [ 799.799791][T27072] netlink: 'syz.2.5266': attribute type 4 has an invalid length. [ 799.812909][T27072] netlink: 'syz.2.5266': attribute type 4 has an invalid length. [ 799.815049][T27071] netlink: 277 bytes leftover after parsing attributes in process `syz.1.5265'. [ 800.366610][T27098] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5273'. [ 800.404443][T27098] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5273'. [ 800.729729][T27114] netlink: 'syz.1.5279': attribute type 1 has an invalid length. [ 800.756633][T27114] netlink: 96 bytes leftover after parsing attributes in process `syz.1.5279'. [ 800.780440][T27114] netlink: 658 bytes leftover after parsing attributes in process `syz.1.5279'. [ 800.790132][T27118] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5279'. [ 800.802866][T27114] netlink: 1 bytes leftover after parsing attributes in process `syz.1.5279'. [ 800.831780][T27118] hsr_slave_0: left promiscuous mode [ 800.860761][T27118] hsr_slave_1: left promiscuous mode [ 801.272856][T27137] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5285'. [ 801.413802][T27142] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5286'. [ 801.753630][T27160] netlink: 'syz.2.5293': attribute type 13 has an invalid length. [ 801.917302][T27164] batadv1: entered promiscuous mode [ 801.922911][T27164] batadv1: entered allmulticast mode [ 802.218870][T27182] netlink: 211856 bytes leftover after parsing attributes in process `syz.2.5299'. [ 802.709822][T27198] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 802.742885][T27198] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 802.967700][T27207] netlink: 'syz.2.5306': attribute type 13 has an invalid length. [ 803.377624][T27231] netlink: 'syz.2.5308': attribute type 13 has an invalid length. [ 803.441760][T27233] veth7: entered promiscuous mode [ 803.828704][T27253] syzkaller1: entered promiscuous mode [ 803.834594][T27253] syzkaller1: entered allmulticast mode [ 804.324215][T27272] netlink: 'syz.3.5318': attribute type 13 has an invalid length. [ 804.345123][T27273] netlink: 'syz.0.5319': attribute type 2 has an invalid length. [ 804.563042][T27281] bond8: (slave ip6gretap2): Releasing active interface [ 804.590302][T27281] gretap2: left allmulticast mode [ 804.605731][T27281] gretap2: left promiscuous mode [ 804.614438][T27281] bridge3: port 1(gretap2) entered disabled state [ 804.674028][T27281] bond11: (slave veth3): Releasing active interface [ 804.746479][T27281] bond13: (slave gretap3): Releasing backup interface [ 804.855365][T27281] bond14: (slave veth5): Releasing active interface [ 804.873821][T27281] bond14: (slave veth5): the permanent HWaddr of slave - ee:9c:5f:49:a3:9b - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 804.940873][T27281] bond14: (slave veth7): Releasing active interface [ 804.967475][T27289] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 805.001680][T27289] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 805.030817][T27289] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 805.124158][T27278] netlink: 'syz.2.5321': attribute type 1 has an invalid length. [ 805.201025][T27307] __nla_validate_parse: 4 callbacks suppressed [ 805.201046][T27307] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5325'. [ 805.239310][T27306] pim6reg: entered allmulticast mode [ 805.552118][T27278] 8021q: adding VLAN 0 to HW filter on device bond18 [ 805.755156][T27305] bond18: (slave veth7): Enslaving as an active interface with an up link [ 805.770516][T27306] pim6reg: left allmulticast mode [ 805.977042][T27342] syzkaller1: entered allmulticast mode [ 806.108678][T27348] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5330'. [ 806.187091][T27355] netlink: 'syz.0.5332': attribute type 1 has an invalid length. [ 806.458737][ T30] audit: type=1804 audit(1778687569.457:19): pid=27374 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.5340" name="/newroot/494/cgroup.controllers" dev="tmpfs" ino=2531 res=1 errno=0 [ 806.525520][ T30] audit: type=1800 audit(1778687569.457:20): pid=27372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.5340" name="cgroup.controllers" dev="tmpfs" ino=2531 res=0 errno=0 [ 806.596671][ T30] audit: type=1800 audit(1778687569.467:21): pid=27374 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.5340" name="cgroup.controllers" dev="tmpfs" ino=2531 res=0 errno=0 [ 806.621145][T27377] sctp: [Deprecated]: syz.3.5339 (pid 27377) Use of struct sctp_assoc_value in delayed_ack socket option. [ 806.621145][T27377] Use struct sctp_sack_info instead [ 806.656840][T27378] netlink: 14 bytes leftover after parsing attributes in process `syz.4.5343'. [ 806.672733][ T30] audit: type=1804 audit(1778687569.497:22): pid=27372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.5340" name="/newroot/494/cgroup.controllers" dev="tmpfs" ino=2531 res=1 errno=0 [ 806.738000][T27381] sctp: [Deprecated]: syz.3.5339 (pid 27381) Use of struct sctp_assoc_value in delayed_ack socket option. [ 806.738000][T27381] Use struct sctp_sack_info instead [ 806.815128][T27388] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5345'. [ 806.864254][T27388] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5345'. [ 807.130451][T27400] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5350'. [ 807.231671][T27400] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5350'. [ 807.245962][T27400] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5350'. [ 807.389450][T27414] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5353'. [ 807.429500][T27413] syzkaller1: entered promiscuous mode [ 807.438580][T27413] syzkaller1: entered allmulticast mode [ 808.138780][T27445] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5361'. [ 808.559321][T27448] bond0 (unregistering): Released all slaves [ 808.622187][T27467] : renamed from sit0 [ 808.693911][T27473] netlink: 'syz.0.5370': attribute type 11 has an invalid length. [ 808.709924][ T1318] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 808.858420][ T5641] Bluetooth: hci2: command 0x0405 tx timeout [ 808.960683][T27490] netlink: 'syz.3.5372': attribute type 4 has an invalid length. [ 809.041373][T27490] netlink: 'syz.3.5372': attribute type 4 has an invalid length. [ 809.075649][T27497] geneve2: entered promiscuous mode [ 809.102887][T11918] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.138218][T11918] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.156403][T11918] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.227105][T11918] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.882361][T27532] syzkaller0: entered promiscuous mode [ 809.898107][T27532] syzkaller0: entered allmulticast mode [ 810.427053][T27556] __nla_validate_parse: 8 callbacks suppressed [ 810.427075][T27556] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5393'. [ 810.443301][T27556] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5393'. [ 810.465918][T27556] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5393'. [ 810.486999][T27559] netlink: 'syz.0.5391': attribute type 3 has an invalid length. [ 810.533796][T27556] bond0: entered promiscuous mode [ 810.543693][T27556] gretap0: entered promiscuous mode [ 810.552387][T27556] hsr0: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 810.585725][T27556] hsr0: Slave B (gretap0) is not up; please bring it up to get a fully working HSR network [ 810.616784][T27556] hsr0: entered promiscuous mode [ 811.293326][T27597] tipc: Enabling of bearer rejected, already enabled [ 811.331007][T27597] mac80211_hwsim hwsim40 syzkaller0: entered promiscuous mode [ 811.354539][T27597] mac80211_hwsim hwsim40 syzkaller0: entered allmulticast mode [ 811.403213][T27600] openvswitch: netlink: IP tunnel dst address not specified [ 811.992706][ T30] audit: type=1804 audit(1778687574.997:23): pid=27627 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.5415" name="/newroot/465/cgroup.controllers" dev="tmpfs" ino=2378 res=1 errno=0 [ 812.056921][ T30] audit: type=1800 audit(1778687574.997:24): pid=27627 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.5415" name="cgroup.controllers" dev="tmpfs" ino=2378 res=0 errno=0 [ 812.083154][T27634] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5416'. [ 812.128200][ T30] audit: type=1804 audit(1778687575.027:25): pid=27628 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.3.5415" name="/newroot/465/cgroup.controllers" dev="tmpfs" ino=2378 res=1 errno=0 [ 812.168034][T27633] netlink: 224 bytes leftover after parsing attributes in process `syz.0.5416'. [ 812.206225][T27635] netlink: 'syz.4.5409': attribute type 1 has an invalid length. [ 812.225644][T27635] netlink: 240 bytes leftover after parsing attributes in process `syz.4.5409'. [ 812.246580][T27637] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5418'. [ 813.086781][T27672] IPVS: set_ctl: invalid protocol: 47 224.0.0.2:20000 [ 813.110257][T27674] siw: device registration error -23 [ 813.259126][T27678] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5427'. [ 813.415582][T27679] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5427'. [ 813.611003][T27694] netlink: 'syz.4.5431': attribute type 4 has an invalid length. [ 813.673680][T27695] netlink: 'syz.4.5431': attribute type 4 has an invalid length. [ 813.877315][T27698] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5432'. [ 814.141542][T27711] sctp: [Deprecated]: syz.1.5436 (pid 27711) Use of struct sctp_assoc_value in delayed_ack socket option. [ 814.141542][T27711] Use struct sctp_sack_info instead [ 814.161497][T27713] netlink: 'syz.1.5436': attribute type 21 has an invalid length. [ 815.097987][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 815.199668][T27637] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 815.446306][T27740] __nla_validate_parse: 1 callbacks suppressed [ 815.446327][T27740] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5442'. [ 815.712084][T27762] netlink: 'syz.0.5447': attribute type 30 has an invalid length. [ 815.724218][T27760] team0: entered promiscuous mode [ 815.747400][T27760] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 816.576697][T27791] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5457'. [ 816.608039][T27791] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5457'. [ 816.652167][T27795] syzkaller0: entered promiscuous mode [ 816.658075][T27795] syzkaller0: entered allmulticast mode [ 816.855762][T27802] syzkaller0: entered promiscuous mode [ 816.862325][T27802] syzkaller0: entered allmulticast mode [ 816.902405][T27803] sctp: [Deprecated]: syz.4.5462 (pid 27803) Use of struct sctp_assoc_value in delayed_ack socket option. [ 816.902405][T27803] Use struct sctp_sack_info instead [ 816.940350][T27803] sctp: [Deprecated]: syz.4.5462 (pid 27803) Use of struct sctp_assoc_value in delayed_ack socket option. [ 816.940350][T27803] Use struct sctp_sack_info instead [ 817.027179][T27806] netlink: 'syz.1.5463': attribute type 4 has an invalid length. [ 817.069259][T27807] netlink: 148 bytes leftover after parsing attributes in process `syz.2.5464'. [ 817.080353][T27810] netlink: 'syz.1.5463': attribute type 4 has an invalid length. [ 817.222733][T27818] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5468'. [ 817.276258][T27823] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5470'. [ 817.323505][T27829] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5471'. [ 817.350545][T27829] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5471'. [ 817.460259][T27838] netlink: 'syz.3.5474': attribute type 39 has an invalid length. [ 817.591100][T27845] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5476'. [ 817.741583][T27854] netlink: 'syz.4.5479': attribute type 4 has an invalid length. [ 817.750383][T27854] netlink: 'syz.4.5479': attribute type 4 has an invalid length. [ 817.917937][T27862] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20001 [ 818.115175][T27877] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5487'. [ 818.307924][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 819.023795][T27933] sctp: [Deprecated]: syz.2.5502 (pid 27933) Use of int in maxseg socket option. [ 819.023795][T27933] Use struct sctp_assoc_value instead [ 819.052381][T27928] hsr0: entered allmulticast mode [ 819.057571][T27928] hsr_slave_0: entered allmulticast mode [ 819.063791][T27928] hsr_slave_1: entered allmulticast mode [ 819.266350][T27940] ip6tnl2: entered allmulticast mode [ 819.587163][T27959] netlink: 'syz.1.5513': attribute type 4 has an invalid length. [ 819.955457][T27983] openvswitch: netlink: Missing valid actions attribute. [ 820.009052][T27983] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 823.121714][T28016] netlink: 'syz.3.5523': attribute type 13 has an invalid length. [ 823.435181][T28024] __nla_validate_parse: 2 callbacks suppressed [ 823.435424][T28024] netlink: 220 bytes leftover after parsing attributes in process `syz.3.5525'. [ 823.468136][T28024] netlink: 'syz.3.5525': attribute type 2 has an invalid length. [ 824.639252][T28083] netlink: 'syz.2.5537': attribute type 14 has an invalid length. [ 824.661110][T28085] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5534'. [ 824.942576][T28096] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5541'. [ 824.985505][ T5648] block nbd4: Receive control failed (result -1) [ 825.066763][T28100] wg1 speed is unknown, defaulting to 1000 [ 825.081848][T28100] wg1 speed is unknown, defaulting to 1000 [ 825.122908][T28100] wg1 speed is unknown, defaulting to 1000 [ 825.458613][T28114] tipc: Enabling of bearer rejected, failed to enable media [ 825.678816][T28100] infiniband sy0: set down [ 825.699739][T28100] infiniband sy0: added wg1 [ 825.711573][ T6289] wg1 speed is unknown, defaulting to 1000 [ 825.737930][ T5648] Bluetooth: hci2: command 0x0405 tx timeout [ 825.745791][ T5641] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 825.787339][T28100] smbdirect: ib_dev[sy0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 825.806903][T28100] smbdirect: ib_dev[sy0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 825.825482][T28100] smbdirect: ib_dev[sy0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 825.835653][T28129] netlink: 'syz.0.5547': attribute type 13 has an invalid length. [ 825.876056][T28100] RDS/IB: sy0: added [ 825.884167][T28100] smc: adding ib device sy0 with port count 1 [ 825.884350][T28129] netlink: 'syz.0.5547': attribute type 17 has an invalid length. [ 825.891343][T28100] smc: ib device sy0 port 1 has no pnetid [ 825.906393][T12883] wg1 speed is unknown, defaulting to 1000 [ 825.913940][T28100] wg1 speed is unknown, defaulting to 1000 [ 825.949273][T28131] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5547'. [ 826.215880][T28140] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5551'. [ 826.226321][T28129] 8021q: adding VLAN 0 to HW filter on device team0 [ 826.264818][T28129] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 826.521683][T28129] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 826.532713][T28129] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 826.556216][T28129] hsr0: left allmulticast mode [ 826.562052][T28129] hsr_slave_0: left allmulticast mode [ 826.568172][T28129] hsr_slave_1: left allmulticast mode [ 826.604485][T28129] veth1_vlan: left promiscuous mode [ 826.619050][T28129] vlan0: left promiscuous mode [ 826.626603][T28129] veth1_vlan: entered promiscuous mode [ 826.641567][T28129] veth0_macvtap: left promiscuous mode [ 826.649295][T28129] veth0_macvtap: entered promiscuous mode [ 826.676327][T28129] veth1_macvtap: entered promiscuous mode [ 826.690710][T28129] mac80211_hwsim hwsim31 wlan0: left promiscuous mode [ 826.700544][T28129] mac80211_hwsim hwsim31 wlan0: left allmulticast mode [ 826.715000][T28129] 8021q: adding VLAN 0 to HW filter on device bond1 [ 826.751447][T28129] 8021q: adding VLAN 0 to HW filter on device bond2 [ 826.760923][T28129] 8021q: adding VLAN 0 to HW filter on device eth0 [ 826.777342][T28129] 8021q: adding VLAN 0 to HW filter on device eth1 [ 826.799333][T28129] 8021q: adding VLAN 0 to HW filter on device eth2 [ 826.816528][T28129] 8021q: adding VLAN 0 to HW filter on device eth3 [ 826.839229][T28129] 8021q: adding VLAN 0 to HW filter on device bond3 [ 826.848741][T28129] ip6gre1: left promiscuous mode [ 826.854015][T28129] ip6gre1: left allmulticast mode [ 826.871499][T28129] 8021q: adding VLAN 0 to HW filter on device bond4 [ 826.902205][T28129] geneve3: left promiscuous mode [ 826.907335][T28129] geneve3: left allmulticast mode [ 826.917474][T28129] 8021q: adding VLAN 0 to HW filter on device bond5 [ 827.006063][T28129] bridge6: port 1(gretap1) entered blocking state [ 827.012769][T28129] bridge6: port 1(gretap1) entered forwarding state [ 827.106137][T28129] bond6: left promiscuous mode [ 827.111070][T28129] erspan1: left promiscuous mode [ 827.116179][T28129] bond6: left allmulticast mode [ 827.122432][T28129] 8021q: adding VLAN 0 to HW filter on device bond6 [ 827.130903][T28129] erspan1: left allmulticast mode [ 827.145299][T28129] 8021q: adding VLAN 0 to HW filter on device bond7 [ 827.155080][T28129] 8021q: adding VLAN 0 to HW filter on device bond8 [ 827.177599][T28129] vlan3: left promiscuous mode [ 827.185518][T28129] 8021q: adding VLAN 0 to HW filter on device bond9 [ 827.234675][T28129] 8021q: adding VLAN 0 to HW filter on device bond10 [ 827.244443][T28129] 8021q: adding VLAN 0 to HW filter on device bond11 [ 827.253884][T28129] 8021q: adding VLAN 0 to HW filter on device bond12 [ 827.262777][T28129] veth0_to_team: entered promiscuous mode [ 827.402538][T11924] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.411186][T28100] wg1 speed is unknown, defaulting to 1000 [ 827.417197][T11924] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.435116][T11924] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 20004 - 0 [ 827.452629][T11924] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.470942][T11924] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.494734][T11924] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 20004 - 0 [ 827.512396][T28153] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 827.602321][T28157] bridge11: the hash_elasticity option has been deprecated and is always 16 [ 827.629719][T28157] bridge11: entered allmulticast mode [ 827.651869][T11924] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.669229][T11924] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.690428][T11924] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 20004 - 0 [ 827.708248][T11924] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 827.719303][T11924] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.727585][T11924] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 20004 - 0 [ 827.760855][T28164] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5557'. [ 827.769773][T11918] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 827.925415][T28163] syzkaller0: entered promiscuous mode [ 827.931375][T28163] syzkaller0: entered allmulticast mode [ 827.959370][T28100] wg1 speed is unknown, defaulting to 1000 [ 828.023176][T28169] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5558'. [ 828.359578][T28178] netlink: 'syz.1.5560': attribute type 1 has an invalid length. [ 830.856370][T28175] mac80211_hwsim hwsim29 wlan0: entered promiscuous mode [ 830.864063][T28100] wg1 speed is unknown, defaulting to 1000 [ 830.870472][T28177] netlink: 'syz.0.5561': attribute type 1 has an invalid length. [ 830.886080][T28177] netlink: 244 bytes leftover after parsing attributes in process `syz.0.5561'. [ 830.898579][T28178] workqueue: Failed to create a rescuer kthread for wq "bond16": -EINTR [ 831.262004][T11918] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 831.416189][T28201] netlink: 15 bytes leftover after parsing attributes in process `syz.0.5566'. [ 831.457988][T28100] wg1 speed is unknown, defaulting to 1000 [ 831.738590][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 832.284765][T28231] gretap0: entered promiscuous mode [ 832.309702][T28231] vlan0: entered promiscuous mode [ 832.411130][T28233] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5575'. [ 832.744162][T28248] netlink: 'syz.0.5580': attribute type 4 has an invalid length. [ 832.752283][T28248] netlink: 17 bytes leftover after parsing attributes in process `syz.0.5580'. [ 832.982363][ T30] audit: type=1800 audit(1778687595.987:26): pid=28255 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.5582" name="memory.events" dev="tmpfs" ino=2098 res=0 errno=0 [ 833.098405][T28255] netlink: 'syz.4.5582': attribute type 1 has an invalid length. [ 833.124060][T28255] netlink: 280 bytes leftover after parsing attributes in process `syz.4.5582'. [ 833.264114][T28264] netlink: 192 bytes leftover after parsing attributes in process `syz.3.5584'. [ 833.288376][T28273] netlink: 'syz.1.5586': attribute type 10 has an invalid length. [ 833.298390][T28269] wg1 speed is unknown, defaulting to 1000 [ 833.304328][T28273] netlink: 228 bytes leftover after parsing attributes in process `syz.1.5586'. [ 833.313674][T28264] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5584'. [ 833.329115][T28273] netlink: 'syz.1.5586': attribute type 10 has an invalid length. [ 833.341797][T28273] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5586'. [ 833.412642][T28273] team0: Failed to send options change via netlink (err -105) [ 833.434584][T28273] team0: Port device geneve1 added [ 833.453532][T11918] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.476892][T11918] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.499528][T11918] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.520702][T11918] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 833.746671][T28289] x_tables: duplicate underflow at hook 2 [ 833.778601][T28291] netlink: 'syz.0.5589': attribute type 1 has an invalid length. [ 833.832938][T28291] netlink: 'syz.0.5589': attribute type 1 has an invalid length. [ 833.868066][T28291] netlink: 'syz.0.5589': attribute type 1 has an invalid length. [ 833.892110][T28291] netlink: 'syz.0.5589': attribute type 1 has an invalid length. [ 833.917699][T28291] netlink: 'syz.0.5589': attribute type 1 has an invalid length. [ 833.945181][T28291] netlink: 'syz.0.5589': attribute type 1 has an invalid length. [ 833.957990][T28291] netlink: 'syz.0.5589': attribute type 1 has an invalid length. [ 834.000294][T28291] netlink: 'syz.0.5589': attribute type 1 has an invalid length. [ 834.027263][T28291] netlink: 'syz.0.5589': attribute type 1 has an invalid length. [ 834.050781][T28291] netlink: 'syz.0.5589': attribute type 1 has an invalid length. [ 834.143992][T28295] team0: Port device geneve1 removed [ 834.167014][T11918] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.205990][T11918] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.234324][T11918] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.254136][T11918] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.655478][T28302] tipc: Resetting bearer [ 835.202451][ T1174] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 835.224955][ T1174] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 835.337980][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 835.363313][ T1174] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 835.411275][ T1174] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 835.458231][ T1174] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 835.491397][ T1174] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 835.541042][ T1174] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 835.556337][ T1174] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 835.663452][ T7455] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 835.711188][ T7455] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 836.524176][T28375] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5610'. [ 836.745838][T28394] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5616'. [ 837.099969][T28415] syzkaller0: entered promiscuous mode [ 837.112192][T28415] syzkaller0: entered allmulticast mode [ 837.483178][T28435] netlink: 96 bytes leftover after parsing attributes in process `syz.3.5628'. [ 837.514479][T28435] netlink: 638 bytes leftover after parsing attributes in process `syz.3.5628'. [ 837.539114][T28435] netlink: 1 bytes leftover after parsing attributes in process `syz.3.5628'. [ 837.599589][T28438] bond15: option packets_per_slave: mode dependency failed, not supported in mode balance-tlb(5) [ 837.630670][T28438] bond15 (unregistering): Released all slaves [ 838.020331][T28415] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 838.126794][T28457] pimreg9: entered allmulticast mode [ 838.320289][T28460] netlink: 25 bytes leftover after parsing attributes in process `syz.2.5634'. [ 838.344977][T28460] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5634'. [ 839.811314][T28467] bridge6: port 1(gretap1) entered disabled state [ 840.188636][ T7448] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 840.207684][ T7448] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 840.237391][ T7448] netdevsim netdevsim0 eth0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 840.270320][T28466] wg1 speed is unknown, defaulting to 1000 [ 840.278456][ T7448] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 840.324277][ T7448] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 840.361186][ T7448] netdevsim netdevsim0 eth1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 840.399640][ T7455] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 840.422898][ T7455] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 840.447861][ T7455] netdevsim netdevsim0 eth2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 840.563564][ T7455] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 840.605177][ T7455] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 840.661843][ T7455] netdevsim netdevsim0 eth3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 840.749907][T28500] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5642'. [ 840.759601][T28500] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5642'. [ 840.809002][T28500] 8021q: VLANs not supported on ip_vti0 [ 840.856510][T28502] sctp: [Deprecated]: syz.4.5643 (pid 28502) Use of struct sctp_assoc_value in delayed_ack socket option. [ 840.856510][T28502] Use struct sctp_sack_info instead [ 841.036921][T28506] validate_nla: 65 callbacks suppressed [ 841.036942][T28506] netlink: 'syz.0.5644': attribute type 5 has an invalid length. [ 841.551765][T28512] wg1 speed is unknown, defaulting to 1000 [ 841.565565][T28522] xt_connbytes: Forcing CT accounting to be enabled [ 842.026692][T28531] netlink: 'syz.4.5649': attribute type 13 has an invalid length. [ 842.606185][T28543] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5651'. [ 842.744986][T28551] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5653'. [ 842.758990][T28546] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5651'. [ 842.805047][T28543] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5651'. [ 842.946600][T28559] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5651'. [ 843.291494][T28573] IPv6: Can't replace route, no match found [ 843.482176][T28586] netlink: 'syz.0.5660': attribute type 13 has an invalid length. [ 844.317864][T28622] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 844.336733][T28622] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 844.362648][T28622] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 844.392803][T28622] netdevsim netdevsim1 netdevsim0: refused to change device tx_queue_len [ 844.641566][T28632] netlink: 'syz.1.5671': attribute type 11 has an invalid length. [ 845.029083][T28648] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5676'. [ 845.569785][T28675] sctp: [Deprecated]: syz.1.5683 (pid 28675) Use of struct sctp_assoc_value in delayed_ack socket option. [ 845.569785][T28675] Use struct sctp_sack_info instead [ 845.633233][T28670] sctp: [Deprecated]: syz.1.5683 (pid 28670) Use of struct sctp_assoc_value in delayed_ack socket option. [ 845.633233][T28670] Use struct sctp_sack_info instead [ 845.716146][T28681] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5686'. [ 845.745862][ T5641] Bluetooth: hci2: command 0x0405 tx timeout [ 845.752077][ T5648] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 845.927110][T28690] netlink: 28 bytes leftover after parsing attributes in process `syz.0.5688'. [ 846.974675][T28741] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5700'. [ 847.013958][T28741] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5700'. [ 847.310272][T28761] netlink: 'syz.4.5708': attribute type 1 has an invalid length. [ 847.401480][T28761] bond18: (slave vxcan3): The slave device specified does not support setting the MAC address [ 847.412997][T28761] bond18: (slave vxcan3): Error -95 calling set_mac_address [ 847.505345][T28763] bond18: (slave gretap4): making interface the new active one [ 847.529417][T28763] bond18: (slave gretap4): Enslaving as an active interface with an up link [ 847.653188][T28761] bond18: (slave bridge10): Enslaving as an active interface with a down link [ 847.691813][T28763] macvlan10: entered promiscuous mode [ 847.707526][T28763] macvlan10: entered allmulticast mode [ 847.729278][T28763] bond18: entered promiscuous mode [ 847.743449][T28763] gretap4: entered promiscuous mode [ 847.750866][T28763] 8021q: adding VLAN 0 to HW filter on device macvlan10 [ 847.765181][T28763] bond18: (slave macvlan10): the slave hw address is in use by the bond; giving it the hw address of gretap4 [ 847.779656][T28763] bond18: left promiscuous mode [ 847.784685][T28763] gretap4: left promiscuous mode [ 847.847908][T28780] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 847.868394][T28778] netlink: 88 bytes leftover after parsing attributes in process `syz.1.5712'. [ 847.909021][T28784] netlink: 32 bytes leftover after parsing attributes in process `syz.0.5714'. [ 848.262249][T28788] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5715'. [ 848.290138][T28798] bond20: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 848.326079][T28798] bond20 (unregistering): Released all slaves [ 848.572189][T28805] wg1 speed is unknown, defaulting to 1000 [ 848.699451][T28821] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5721'. [ 849.161112][T28845] netem: change failed [ 849.765980][T28870] netlink: 'syz.2.5727': attribute type 3 has an invalid length. [ 849.940582][ T30] audit: type=1804 audit(1778687612.937:27): pid=28873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.5728" name="/newroot/445/cgroup.controllers" dev="tmpfs" ino=2271 res=1 errno=0 [ 849.994123][ T30] audit: type=1800 audit(1778687612.937:28): pid=28873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.5728" name="cgroup.controllers" dev="tmpfs" ino=2271 res=0 errno=0 [ 850.044684][ T30] audit: type=1804 audit(1778687612.977:29): pid=28873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.5728" name="/newroot/445/cgroup.controllers" dev="tmpfs" ino=2271 res=1 errno=0 [ 850.322838][T28891] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5732'. [ 850.450825][T28893] netlink: 96 bytes leftover after parsing attributes in process `syz.0.5733'. [ 851.432841][T28914] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5740'. [ 851.469349][T28918] netlink: 'syz.0.5739': attribute type 1 has an invalid length. [ 851.673502][T28914] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5740'. [ 852.015766][T28936] bridge0: entered allmulticast mode [ 852.022198][T28936] pim6reg: left allmulticast mode [ 852.027449][T28936] bridge0: left allmulticast mode [ 852.276445][T28947] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5750'. [ 853.505212][T28987] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5760'. [ 853.635806][T28996] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5763'. [ 853.651289][T28996] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5763'. [ 854.551784][T29032] netlink: 'syz.2.5766': attribute type 13 has an invalid length. [ 854.935641][T29054] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5773'. [ 854.983847][T29054] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5773'. [ 855.039579][T29059] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5773'. [ 855.283347][T29071] nbd: nbd0 already in use [ 855.288662][T29071] block nbd0: NBD_DISCONNECT [ 855.293476][T29071] block nbd0: Send disconnect failed -32 [ 855.300108][T29071] block nbd0: Send disconnect failed -32 [ 855.309122][T29071] block nbd0: shutting down sockets [ 855.480173][T29071] bridge0: left promiscuous mode [ 855.506203][T29071] 8021q: adding VLAN 0 to HW filter on device team0 [ 855.535249][T29071] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 855.601022][T29071] veth0_to_team: left promiscuous mode [ 855.632089][T29071] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 855.644369][T29071] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 855.663421][T29071] veth1_vlan: left promiscuous mode [ 855.670752][T29071] veth0_vlan: left promiscuous mode [ 855.677165][T29071] veth0_vlan: entered promiscuous mode [ 855.689994][T29071] veth1_vlan: entered promiscuous mode [ 855.701622][T29071] veth1_macvtap: left promiscuous mode [ 855.709207][T29071] veth0_macvtap: left promiscuous mode [ 855.716127][T29071] veth0_macvtap: entered promiscuous mode [ 855.724078][T29071] veth1_macvtap: entered promiscuous mode [ 855.741962][T29071] 8021q: adding VLAN 0 to HW filter on device bond1 [ 855.794813][T29071] 8021q: adding VLAN 0 to HW filter on device bond2 [ 855.810430][T29071] 8021q: adding VLAN 0 to HW filter on device eth0 [ 855.823102][T29071] 8021q: adding VLAN 0 to HW filter on device eth1 [ 855.832393][T29071] 8021q: adding VLAN 0 to HW filter on device eth2 [ 855.841450][T29071] 8021q: adding VLAN 0 to HW filter on device eth3 [ 855.861155][T29071] 8021q: adding VLAN 0 to HW filter on device bond3 [ 855.876749][T29071] 8021q: adding VLAN 0 to HW filter on device bond4 [ 855.908678][T29071] 8021q: adding VLAN 0 to HW filter on device bond5 [ 855.926787][T29071] bridge6: port 1(gretap1) entered blocking state [ 855.933581][T29071] bridge6: port 1(gretap1) entered forwarding state [ 855.945985][T29071] 8021q: adding VLAN 0 to HW filter on device bond6 [ 855.968349][T29071] 8021q: adding VLAN 0 to HW filter on device bond7 [ 855.981850][T29071] 8021q: adding VLAN 0 to HW filter on device bond8 [ 856.005848][T29071] 8021q: adding VLAN 0 to HW filter on device bond9 [ 856.096400][T29071] 8021q: adding VLAN 0 to HW filter on device bond10 [ 856.141446][T29071] 8021q: adding VLAN 0 to HW filter on device bond11 [ 856.151496][T29071] 8021q: adding VLAN 0 to HW filter on device bond12 [ 856.161438][T29071] veth0_to_team: entered promiscuous mode [ 856.183512][T29071] bridge11: left allmulticast mode [ 856.202359][ T9] bridge0: entered promiscuous mode [ 856.231654][T29092] sctp: [Deprecated]: syz.3.5784 (pid 29092) Use of struct sctp_assoc_value in delayed_ack socket option. [ 856.231654][T29092] Use struct sctp_sack_info instead [ 856.250913][T29092] sctp: [Deprecated]: syz.3.5784 (pid 29092) Use of struct sctp_assoc_value in delayed_ack socket option. [ 856.250913][T29092] Use struct sctp_sack_info instead [ 856.302963][ T1183] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.311837][ T1183] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.327274][ T1183] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 20004 - 0 [ 856.340477][ T1183] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.359106][ T1183] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.377000][ T1183] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 20004 - 0 [ 856.411310][ T1183] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.437147][ T1183] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.466502][ T1183] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 20004 - 0 [ 856.490841][ T1183] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.513234][ T1183] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.524777][ T1183] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 20004 - 0 [ 856.534031][T29095] netlink: 'syz.4.5785': attribute type 3 has an invalid length. [ 856.549022][T29095] netlink: 'syz.4.5785': attribute type 3 has an invalid length. [ 856.613224][T29095] netlink: 'syz.4.5785': attribute type 12 has an invalid length. [ 856.642935][T12885] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 856.690691][T26394] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 856.716996][T26394] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 856.726573][T12885] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 856.865944][T29103] wg1 speed is unknown, defaulting to 1000 [ 856.913217][T29115] netlink: 14 bytes leftover after parsing attributes in process `syz.0.5790'. [ 856.940621][T26394] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 856.954490][T26394] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 856.962801][T12888] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 857.202310][T12891] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 857.255656][T29125] netlink: 'syz.3.5793': attribute type 1 has an invalid length. [ 857.269043][T12891] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 857.419054][T12891] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 857.714221][T29131] netlink: 'syz.2.5795': attribute type 11 has an invalid length. [ 857.999855][T29150] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5800'. [ 858.062796][T29153] netlink: 'syz.0.5800': attribute type 8 has an invalid length. [ 858.116418][T29150] 8021q: adding VLAN 0 to HW filter on device bond0 [ 858.178702][T29150] bond0 (unregistering): Released all slaves [ 859.044934][T29178] netlink: 'syz.0.5809': attribute type 13 has an invalid length. [ 859.104002][T29174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5808'. [ 859.135175][T29174] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5808'. [ 859.700489][T29196] 8021q: adding VLAN 0 to HW filter on device bond0 [ 859.750646][T29196] 8021q: adding VLAN 0 to HW filter on device team0 [ 859.781185][T29196] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 859.816633][T29196] wireguard: wg2: Could not create IPv6 socket [ 859.826374][T29196] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 860.158209][T29224] netlink: 'syz.0.5823': attribute type 1 has an invalid length. [ 860.244045][T29224] bond0: entered promiscuous mode [ 860.271783][T29224] 8021q: adding VLAN 0 to HW filter on device bond0 [ 860.356156][T29237] veth17: entered promiscuous mode [ 860.374995][T29237] veth17: entered allmulticast mode [ 860.392866][T29237] bond0: (slave veth17): Enslaving as a backup interface with a down link [ 860.536741][T29248] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5827'. [ 861.020568][T29263] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5831'. [ 861.106889][T29270] dvmrp1: entered allmulticast mode [ 861.138548][T29252] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5829'. [ 861.344219][T29277] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5836'. [ 861.389534][T29270] wg1 speed is unknown, defaulting to 1000 [ 862.100429][ T5650] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 862.118418][ T5650] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 862.131493][ T5650] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 862.141752][ T5650] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 862.151824][ T5650] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 862.217942][ C0] ip6_tnl_xmit_ctl: 14 callbacks suppressed [ 862.217964][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 862.690098][T29297] wg1 speed is unknown, defaulting to 1000 [ 862.859668][ T5648] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 862.866240][ T5648] Bluetooth: hci2: command 0x0405 tx timeout [ 863.475403][T29321] bridge6: port 1(gretap1) entered disabled state [ 863.720779][T29302] wg1 speed is unknown, defaulting to 1000 [ 863.720999][ T101] netdevsim netdevsim0 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 863.769544][ T101] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 863.799093][ T101] netdevsim netdevsim0 eth0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 863.824731][ T101] netdevsim netdevsim0 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 863.855637][ T101] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 863.886027][ T101] netdevsim netdevsim0 eth1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 863.983728][ T101] netdevsim netdevsim0 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 864.013770][T29331] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5849'. [ 864.025008][ T101] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 864.039413][ T101] netdevsim netdevsim0 eth2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 864.050356][T29331] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5849'. [ 864.117259][ T101] netdevsim netdevsim0 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 864.126020][ T101] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 864.135466][ T101] netdevsim netdevsim0 eth3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 864.173991][T29334] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5849'. [ 864.213981][T29331] 8021q: adding VLAN 0 to HW filter on device bond20 [ 864.221455][ T5648] Bluetooth: hci4: command tx timeout [ 864.241978][T29337] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5850'. [ 864.359793][T29333] bond20: (slave veth5): Enslaving as an active interface with an up link [ 864.404577][T29334] bond20: (slave bridge11): Enslaving as an active interface with an up link [ 864.970721][T29341] wg1 speed is unknown, defaulting to 1000 [ 865.407519][T26394] dvmrp0: left allmulticast mode [ 866.298002][ T5648] Bluetooth: hci4: command tx timeout [ 866.652522][T26394] bond0 (unregistering): Released all slaves [ 866.664866][T26394] bond1 (unregistering): Released all slaves [ 866.682018][T26394] bond2 (unregistering): Released all slaves [ 866.700025][T26394] bond3 (unregistering): Released all slaves [ 866.722296][T26394] bond4 (unregistering): Released all slaves [ 866.739543][T26394] bond5 (unregistering): Released all slaves [ 866.756105][T26394] bond6 (unregistering): Released all slaves [ 866.782947][T26394] bond7 (unregistering): Released all slaves [ 866.806170][T26394] bond8 (unregistering): Released all slaves [ 866.822698][T26394] bond9 (unregistering): Released all slaves [ 866.846650][T26394] bond10 (unregistering): Released all slaves [ 866.863958][T26394] bond11 (unregistering): Released all slaves [ 866.881002][T26394] bond12 (unregistering): Released all slaves [ 866.906033][T26394] bond13 (unregistering): Released all slaves [ 866.926967][T26394] bond14 (unregistering): Released all slaves [ 866.944106][T26394] bond15 (unregistering): Released all slaves [ 866.977063][T29357] workqueue: Failed to create a rescuer kthread for wq "bond21": -EINTR [ 867.001269][ T5291] 8021q: adding VLAN 0 to HW filter on device eth1 [ 867.337139][T29387] netlink: 'syz.3.5860': attribute type 4 has an invalid length. [ 867.395538][T29390] netlink: 'syz.3.5860': attribute type 4 has an invalid length. [ 867.471402][T26394] tipc: Left network mode [ 867.901647][T26394] IPVS: stopping backup sync thread 28780 ... [ 868.387813][ T5648] Bluetooth: hci4: command tx timeout [ 868.848149][T29302] bridge0: port 1(bridge_slave_0) entered blocking state [ 868.877227][T29302] bridge0: port 1(bridge_slave_0) entered disabled state [ 868.903278][T29302] bridge_slave_0: entered allmulticast mode [ 868.920725][T29302] bridge_slave_0: entered promiscuous mode [ 868.940111][T29302] bridge0: port 2(bridge_slave_1) entered blocking state [ 868.954082][T29302] bridge0: port 2(bridge_slave_1) entered disabled state [ 868.961599][T29302] bridge_slave_1: entered allmulticast mode [ 868.969869][T29302] bridge_slave_1: entered promiscuous mode [ 869.176380][T29302] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 869.227390][T29302] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 869.411470][T29302] team0: Port device team_slave_0 added [ 869.439047][T29302] team0: Port device team_slave_1 added [ 869.593475][ T5291] 8021q: adding VLAN 0 to HW filter on device eth2 [ 869.610014][T29459] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5872'. [ 869.644159][T29302] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 869.671433][T29302] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 869.778933][T29302] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 869.825047][T29302] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 869.843331][T29302] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 869.915986][T29302] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 870.072319][T29470] geneve3: entered promiscuous mode [ 870.102628][T11917] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 870.126743][T11917] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 870.162995][ T1318] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 870.383429][T29477] IPVS: Scheduler module ip_vs_sip not found [ 870.467960][ T5648] Bluetooth: hci4: command tx timeout [ 870.960421][T11918] smbdirect: ib_dev[syz1] removed [ 872.075979][ T101] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 872.085237][ T101] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 872.106727][T29302] hsr_slave_0: entered promiscuous mode [ 872.114064][T29302] hsr_slave_1: entered promiscuous mode [ 872.121122][T29302] debugfs: 'hsr0' already exists in 'hsr' [ 872.126967][T29302] Cannot create hsr debugfs directory [ 872.590624][T29512] xt_hashlimit: size too large, truncated to 1048576 [ 872.991760][T29517] veth1: entered promiscuous mode [ 873.028529][T29517] veth1: entered allmulticast mode [ 873.346172][T29525] bridge0: left promiscuous mode [ 873.431768][T29542] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5890'. [ 873.473275][ T6289] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 873.774630][T29557] netlink: 44 bytes leftover after parsing attributes in process `syz.0.5895'. [ 873.929221][ T5291] 8021q: adding VLAN 0 to HW filter on device eth3 [ 873.960114][T29546] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5892'. [ 874.040174][T29564] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5897'. [ 874.076635][T29550] A link change request failed with some changes committed already. Interface bond2 may have been left with an inconsistent configuration, please check. [ 874.100700][T11924] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 874.219332][ T5747] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 874.377353][T29574] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5900'. [ 874.405522][T29574] netlink: 'syz.4.5900': attribute type 5 has an invalid length. [ 874.425383][T29574] netlink: 16 bytes leftover after parsing attributes in process `syz.4.5900'. [ 874.479357][T26394] IPVS: stop unused estimator thread 0... [ 874.513317][T29580] syzkaller0: entered promiscuous mode [ 874.530464][T29580] syzkaller0: entered allmulticast mode [ 874.564840][T29580] netlink: 260 bytes leftover after parsing attributes in process `syz.0.5902'. [ 874.835248][T29581] wg1 speed is unknown, defaulting to 1000 [ 875.222399][T11917] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 875.251000][T11917] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 875.791405][T29302] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 875.833910][T29302] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 875.863813][T29302] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 875.902847][T29302] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 875.927491][T29302] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 875.955610][T29302] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 875.978830][ T9635] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 876.099350][T29302] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 876.137974][T29302] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 876.694096][T29302] 8021q: adding VLAN 0 to HW filter on device bond0 [ 876.793128][T29302] 8021q: adding VLAN 0 to HW filter on device team0 [ 876.830905][ T101] bridge0: port 1(bridge_slave_0) entered blocking state [ 876.838647][ T101] bridge0: port 1(bridge_slave_0) entered forwarding state [ 876.882102][ T101] bridge0: port 2(bridge_slave_1) entered blocking state [ 876.889392][ T101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 876.946727][T29653] netlink: 'syz.4.5914': attribute type 11 has an invalid length. [ 877.165332][T29657] wg1 speed is unknown, defaulting to 1000 [ 877.457571][T29673] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5918'. [ 878.482934][T29302] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 878.615795][T29704] netlink: 'syz.4.5921': attribute type 4 has an invalid length. [ 878.656758][T29302] veth0_vlan: entered promiscuous mode [ 878.714114][T29302] veth1_vlan: entered promiscuous mode [ 878.894114][T29302] veth0_macvtap: entered promiscuous mode [ 878.927382][T29302] veth1_macvtap: entered promiscuous mode [ 878.937943][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 879.022036][T29302] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 879.075241][T29302] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 879.119176][ T1183] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 879.141041][ T1183] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 879.162934][ T1183] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 879.194820][ T1183] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 879.475232][T11917] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 879.499939][T11917] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 879.590050][T29726] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5928'. [ 879.622466][T29725] batman_adv: batadv0: Adding interface: dummy0 [ 879.639272][T29725] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 879.697829][T29725] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 879.716353][ T1183] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 879.749864][ T1183] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 880.111233][T29748] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5839'. [ 880.129078][ T9635] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 880.938852][ T9635] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 880.971048][ T9635] bridge0: entered promiscuous mode [ 881.261509][T29795] netlink: 'syz.3.5942': attribute type 32 has an invalid length. [ 881.484145][T29804] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5943'. [ 881.567393][T29808] netlink: 'syz.4.5944': attribute type 1 has an invalid length. [ 881.587913][T29808] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5944'. [ 881.606235][T29810] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5945'. [ 881.687495][T29814] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5945'. [ 881.717032][T29803] netlink: 76 bytes leftover after parsing attributes in process `syz.3.5942'. [ 881.856164][ T1126] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 881.883637][ T1126] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 881.977284][ T1126] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 881.992103][ T1126] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 882.530891][T29827] 8021q: adding VLAN 0 to HW filter on device bond0 [ 882.560781][T29827] 8021q: adding VLAN 0 to HW filter on device team0 [ 882.590701][T29843] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5953'. [ 882.605515][T29827] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 882.699346][T29827] veth1_vlan: left promiscuous mode [ 882.708905][T29827] veth0_vlan: left promiscuous mode [ 882.715632][T29827] veth0_vlan: entered promiscuous mode [ 882.727590][T29827] veth1_vlan: entered promiscuous mode [ 882.742893][T29827] veth1_macvtap: left promiscuous mode [ 882.750987][T29827] veth0_macvtap: left promiscuous mode [ 882.763129][T29827] veth0_macvtap: entered promiscuous mode [ 882.901984][T29847] veth3: entered allmulticast mode [ 883.080415][T29852] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5956'. [ 883.756884][T29865] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 884.212958][T29874] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 884.661714][T29896] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5965'. [ 885.093090][T29901] syzkaller0: entered promiscuous mode [ 885.114313][T29901] syzkaller0: entered allmulticast mode [ 885.221284][T29911] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5969'. [ 885.416995][T29906] wg1 speed is unknown, defaulting to 1000 [ 885.667321][T29917] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5971'. [ 886.148128][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 886.260414][T29921] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5973'. [ 886.827332][T29943] netlink: 'syz.0.5979': attribute type 4 has an invalid length. [ 886.938646][T29958] netlink: 'syz.0.5979': attribute type 4 has an invalid length. [ 887.086225][T29957] pimreg: entered allmulticast mode [ 887.154914][T29948] pimreg: left allmulticast mode [ 887.662059][T29978] netlink: 272 bytes leftover after parsing attributes in process `syz.4.5985'. [ 887.869064][T29970] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5983'. [ 887.903718][T29989] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5987'. [ 887.947883][T29989] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5987'. [ 888.373163][T29975] syzkaller1: entered promiscuous mode [ 888.381720][T29975] syzkaller1: entered allmulticast mode [ 888.399132][T30001] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5990'. [ 888.544518][T30008] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5992'. [ 888.555742][T30008] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5992'. [ 889.503706][T30023] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5998'. [ 889.634622][T30025] wg1 speed is unknown, defaulting to 1000 [ 889.871342][T30024] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5998'. [ 889.928580][T30024] nbd: device at index 64 is going down [ 890.477200][T28279] udevd[28279]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 890.538343][ T5650] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 890.539986][ T5648] Bluetooth: hci2: command 0x0405 tx timeout [ 890.616036][T28279] udevd[28279]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 890.653373][T30052] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6002'. [ 891.346051][T30067] netlink: 'syz.3.6003': attribute type 10 has an invalid length. [ 891.405418][T30073] netlink: 'syz.3.6003': attribute type 10 has an invalid length. [ 891.490222][T30076] netlink: 'syz.4.6005': attribute type 1 has an invalid length. [ 891.527518][T30067] team0: Port device dummy0 added [ 891.648698][T30073] team0: Port device dummy0 removed [ 891.720340][T30073] dummy0: entered promiscuous mode [ 891.748471][T30073] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 891.850216][T30076] bond21: entered promiscuous mode [ 891.856035][T30076] 8021q: adding VLAN 0 to HW filter on device bond21 [ 892.041987][T30080] bond21: (slave veth7): making interface the new active one [ 892.062112][T30080] veth7: entered promiscuous mode [ 892.084616][T30080] bond21: (slave veth7): Enslaving as an active interface with an up link [ 893.061161][T30106] bond0: (slave dummy0): Releasing backup interface [ 893.074978][T30108] __nla_validate_parse: 1 callbacks suppressed [ 893.075010][T30108] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6014'. [ 893.126769][T30106] dummy0: left promiscuous mode [ 893.235369][T30116] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6015'. [ 893.466265][T30124] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6015'. [ 893.551693][T30124] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6015'. [ 893.756428][T30129] netlink: 'syz.4.6017': attribute type 39 has an invalid length. [ 894.755863][T30151] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 895.042452][T30162] wg1 speed is unknown, defaulting to 1000 [ 895.746911][T30171] batadv_slave_0: entered promiscuous mode [ 895.777092][T30171] batadv_slave_0: entered allmulticast mode [ 896.129022][T30177] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6028'. [ 896.235627][T30180] batman_adv: batadv0: Removing interface: dummy0 [ 896.259967][T12880] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 896.291133][T30180] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 896.318551][T12880] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 896.682956][T30191] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6031'. [ 896.735121][T30193] netlink: 'syz.3.6031': attribute type 1 has an invalid length. [ 896.963026][T30193] 8021q: adding VLAN 0 to HW filter on device bond18 [ 898.126237][T30229] bond19: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 898.164512][T30229] bond19: (slave lo): Enslaving as an active interface with an up link [ 898.218359][T30229] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 898.272618][T30234] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6038'. [ 898.666883][T30243] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6040'. [ 899.015255][T30258] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 899.043217][ T9635] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 899.145043][T30265] netlink: 516 bytes leftover after parsing attributes in process `syz.2.6046'. [ 899.473016][T30277] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6049'. [ 899.694308][T30279] bond22 (unregistering): Released all slaves [ 899.705145][T30288] netlink: 'syz.2.6052': attribute type 1 has an invalid length. [ 900.289460][T30288] 8021q: adding VLAN 0 to HW filter on device bond20 [ 900.503991][T30313] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6053'. [ 900.682350][T30316] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6055'. [ 900.868287][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 900.967052][T30325] veth3: entered allmulticast mode [ 901.014174][T30330] ip6tnl0: Caught tx_queue_len zero misconfig [ 901.535598][T30347] netlink: zone id is out of range [ 901.845862][T30356] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6070'. [ 903.815139][T30402] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6082'. [ 904.035663][T30407] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6084'. [ 904.564929][T30422] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6090'. [ 905.106314][T30443] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6097'. [ 905.170815][T30443] ip6tnl2: entered allmulticast mode [ 905.304937][T30449] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6097'. [ 905.335802][T30443] hmac(sha2: entered promiscuous mode [ 905.483493][T30459] xt_cluster: you have exceeded the maximum number of cluster nodes (524288 > 32) [ 905.721923][T30459] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6100'. [ 905.843370][T30466] syzkaller1: entered promiscuous mode [ 905.868209][T30466] syzkaller1: entered allmulticast mode [ 905.899498][ T7455] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 905.935047][T12890] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 905.944170][ T7455] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 906.018574][T12890] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 906.522646][ T5650] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 906.540752][ T5650] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 906.552230][ T5650] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 906.568482][ T5650] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 906.584142][ T5650] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 906.698415][ T9635] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 907.071948][T30497] netlink: 'syz.2.6109': attribute type 1 has an invalid length. [ 907.307446][T30497] 8021q: adding VLAN 0 to HW filter on device bond21 [ 908.016974][T30480] wg1 speed is unknown, defaulting to 1000 [ 908.617366][T30533] x_tables: duplicate underflow at hook 3 [ 908.701083][ T5648] Bluetooth: hci5: command tx timeout [ 908.920640][T30542] xt_hashlimit: size too large, truncated to 1048576 [ 909.078198][T30552] netlink: 'syz.3.6119': attribute type 1 has an invalid length. [ 909.097296][T30552] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6119'. [ 909.850016][T30573] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6125'. [ 909.859432][T30573] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6125'. [ 910.378170][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 910.534845][T30595] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6127'. [ 910.727272][T30604] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6129'. [ 910.749805][T30604] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6129'. [ 910.788050][ T5648] Bluetooth: hci5: command tx timeout [ 911.051499][T30609] can: request_module (can-proto-5) failed. [ 911.176025][T30603] bond0: left promiscuous mode [ 911.263502][T30603] ipvlan1: left promiscuous mode [ 911.319037][T30603] veth1_macvtap: entered promiscuous mode [ 911.358290][T30603] 8021q: adding VLAN 0 to HW filter on device bond1 [ 911.386473][T30603] 8021q: adding VLAN 0 to HW filter on device bond2 [ 911.534536][T30603] 8021q: adding VLAN 0 to HW filter on device bond3 [ 912.859942][ T5648] Bluetooth: hci5: command tx timeout [ 914.473694][T30603] 8021q: adding VLAN 0 to HW filter on device bond4 [ 914.488141][T30603] 8021q: adding VLAN 0 to HW filter on device eth0 [ 914.507063][T30603] 8021q: adding VLAN 0 to HW filter on device eth1 [ 914.525879][T30603] 8021q: adding VLAN 0 to HW filter on device eth2 [ 914.542714][T30603] 8021q: adding VLAN 0 to HW filter on device eth3 [ 914.557376][T30603] 8021q: adding VLAN 0 to HW filter on device bond5 [ 914.593802][T30603] 8021q: adding VLAN 0 to HW filter on device bond6 [ 914.603789][T30603] 8021q: adding VLAN 0 to HW filter on device bond7 [ 914.617561][T30603] 8021q: adding VLAN 0 to HW filter on device bond8 [ 914.628400][T30603] 8021q: adding VLAN 0 to HW filter on device bond9 [ 914.648867][T30603] 8021q: adding VLAN 0 to HW filter on device bond10 [ 914.658470][T30603] 8021q: adding VLAN 0 to HW filter on device bond11 [ 914.676936][T30603] 8021q: adding VLAN 0 to HW filter on device bond12 [ 914.689156][T30603] 8021q: adding VLAN 0 to HW filter on device bond13 [ 914.708746][T30603] veth7: left promiscuous mode [ 914.718429][T30603] 8021q: adding VLAN 0 to HW filter on device bond14 [ 914.727124][T30603] 8021q: adding VLAN 0 to HW filter on device bond15 [ 914.736555][T30603] 8021q: adding VLAN 0 to HW filter on device bond16 [ 914.746709][T30603] 8021q: adding VLAN 0 to HW filter on device bond17 [ 914.757972][T30603] 8021q: adding VLAN 0 to HW filter on device bond19 [ 914.769350][T30603] 8021q: adding VLAN 0 to HW filter on device bond20 [ 914.807873][ T7448] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 914.828050][ T7448] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 914.940369][ T5648] Bluetooth: hci5: command tx timeout [ 915.003678][T30598] wg1 speed is unknown, defaulting to 1000 [ 915.010122][ T7448] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 915.037929][ T7448] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 915.056957][ T7448] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 915.074494][ T7448] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 915.103398][ T7448] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 915.125425][ T7448] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 915.240234][ T101] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 915.351350][T30633] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 915.702923][T30480] bridge0: port 1(bridge_slave_0) entered blocking state [ 915.731493][T30480] bridge0: port 1(bridge_slave_0) entered disabled state [ 915.759066][T30480] bridge_slave_0: entered allmulticast mode [ 915.785652][T30480] bridge_slave_0: entered promiscuous mode [ 915.820829][T30480] bridge0: port 2(bridge_slave_1) entered blocking state [ 915.844314][T30480] bridge0: port 2(bridge_slave_1) entered disabled state [ 915.862541][T30480] bridge_slave_1: entered allmulticast mode [ 915.877554][T30480] bridge_slave_1: entered promiscuous mode [ 915.895251][T30626] wg1 speed is unknown, defaulting to 1000 [ 916.180665][T30480] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 916.219372][T30480] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 916.424218][T30480] team0: Port device team_slave_0 added [ 916.447212][T30480] team0: Port device team_slave_1 added [ 916.544279][T30480] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 916.554192][T30480] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 916.610598][T30480] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 916.661777][T30480] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 916.693667][T30480] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 916.760766][T30480] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 916.793571][T30649] RDS: rds_bind could not find a transport for ::ffff:100.1.1.1, load rds_tcp or rds_rdma? [ 916.882176][T30650] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6139'. [ 917.095348][T30480] hsr_slave_0: entered promiscuous mode [ 917.115791][T30480] hsr_slave_1: entered promiscuous mode [ 917.137230][T30480] debugfs: 'hsr0' already exists in 'hsr' [ 917.154051][T30480] Cannot create hsr debugfs directory [ 918.582631][T30674] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6148'. [ 919.098035][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 919.418191][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 920.586564][T30480] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 920.621009][T30480] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 920.633524][T30717] netlink: 'syz.1.6158': attribute type 1 has an invalid length. [ 920.647255][T30480] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 920.656507][T30717] netlink: 276 bytes leftover after parsing attributes in process `syz.1.6158'. [ 920.691035][T30480] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 920.729067][T30480] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 920.765234][T30480] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 920.792181][T30480] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 920.832784][T30480] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 920.941504][T30722] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6160'. [ 921.216222][T30737] netlink: 92 bytes leftover after parsing attributes in process `syz.4.6163'. [ 921.340701][T30735] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6161'. [ 921.446654][T30480] 8021q: adding VLAN 0 to HW filter on device bond0 [ 921.521378][T30480] 8021q: adding VLAN 0 to HW filter on device team0 [ 921.599623][ T7448] bridge0: port 1(bridge_slave_0) entered blocking state [ 921.606862][ T7448] bridge0: port 1(bridge_slave_0) entered forwarding state [ 921.663412][ T7448] bridge0: port 2(bridge_slave_1) entered blocking state [ 921.670711][ T7448] bridge0: port 2(bridge_slave_1) entered forwarding state [ 921.811553][T30746] pim6reg: entered allmulticast mode [ 921.871130][T30745] pim6reg: left allmulticast mode [ 922.693122][T30765] wg1 speed is unknown, defaulting to 1000 [ 922.879050][T30772] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6173'. [ 923.903616][T30480] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 924.074822][T30480] veth0_vlan: entered promiscuous mode [ 924.116416][T30480] veth1_vlan: entered promiscuous mode [ 924.238024][T30480] veth0_macvtap: entered promiscuous mode [ 924.305316][T30480] veth1_macvtap: entered promiscuous mode [ 924.400295][T30480] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 924.456437][T30480] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 924.502747][ T101] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.569787][ T101] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.598288][ T101] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.637224][ T101] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 924.960873][T30812] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6184'. [ 924.980090][T26394] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 924.996379][T26394] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 925.013349][T30812] netlink: 'syz.4.6184': attribute type 2 has an invalid length. [ 925.046487][T30812] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6184'. [ 925.082735][T30821] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6186'. [ 925.237229][T30812] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 925.237229][T30812] Please contact the netfilter-devel mailing list or update your nftables rules. [ 925.279937][T30826] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6187'. [ 925.366582][T30812] tipc: Resetting bearer [ 925.386118][T11918] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 925.410093][T11918] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 926.538096][ T5648] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 926.545170][ T5650] Bluetooth: hci2: command 0x0405 tx timeout [ 926.612772][T30840] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 927.097979][ C0] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 927.129034][T30873] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6199'. [ 927.213630][ T5650] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 927.235447][ T5650] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 927.247243][ T5650] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 927.262053][ T5650] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 927.277148][ T5650] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 927.341885][ T30] audit: type=1804 audit(1778687690.337:30): pid=30873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.6199" name="/newroot/1/cgroup.controllers" dev="tmpfs" ino=23 res=1 errno=0 [ 927.393985][ T30] audit: type=1800 audit(1778687690.377:31): pid=30873 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.6199" name="cgroup.controllers" dev="tmpfs" ino=23 res=0 errno=0 [ 927.843996][T30890] wg1 speed is unknown, defaulting to 1000 [ 928.070903][T30900] tipc: Enabled bearer , priority 5 [ 928.464395][ T7455] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 928.525674][ T7455] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 929.014762][ T7455] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 929.048108][ T7455] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 929.243124][T30921] IPVS: Error connecting to the multicast addr [ 929.304942][ T10] tipc: Node number set to 4269801491 [ 929.339185][ T5648] Bluetooth: hci3: command tx timeout [ 929.537824][ T7455] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 929.555728][ T7455] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 929.880986][ T7455] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 929.919753][ T7455] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 929.960703][T30876] wg1 speed is unknown, defaulting to 1000 [ 930.614573][ T7455] bond2: left allmulticast mode [ 930.644501][ T7455] dvmrp8: left allmulticast mode [ 930.949421][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 931.428050][ T5648] Bluetooth: hci3: command tx timeout [ 931.591836][ T1318] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 931.975152][ T7455] bond0 (unregistering): Released all slaves [ 931.990213][ T7455] bond1 (unregistering): Released all slaves [ 932.014346][ T7455] bond2 (unregistering): Released all slaves [ 932.033838][ T7455] bond3 (unregistering): Released all slaves [ 932.064590][ T7455] bond4 (unregistering): Released all slaves [ 932.090244][ T7455] bond5 (unregistering): Released all slaves [ 932.120102][ T7455] bond6 (unregistering): Released all slaves [ 932.140657][ T7455] bond7 (unregistering): Released all slaves [ 932.161475][ T7455] bond8 (unregistering): Released all slaves [ 932.199306][ T7455] bond9 (unregistering): Released all slaves [ 932.221617][ T7455] bond10 (unregistering): Released all slaves [ 932.241283][ T7455] bond11 (unregistering): Released all slaves [ 932.261863][ T7455] bond12 (unregistering): Released all slaves [ 932.283100][ T7455] bond13 (unregistering): Released all slaves [ 932.320801][ T7455] bond14 (unregistering): Released all slaves [ 932.341471][ T7455] bond15 (unregistering): Released all slaves [ 932.364090][ T7455] bond16 (unregistering): Released all slaves [ 932.397898][ T7455] bond17 (unregistering): Released all slaves [ 932.423003][ T7455] bond18 (unregistering): Released all slaves [ 932.446912][ T7455] bond19 (unregistering): (slave lo): Releasing backup interface [ 932.461284][ T7455] bond19 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 932.475806][ T7455] bond19 (unregistering): Released all slaves [ 932.501020][ T7455] bond20 (unregistering): Released all slaves [ 932.525206][ T7455] bond21 (unregistering): Released all slaves [ 932.546006][ T7455] bond22 (unregistering): Released all slaves [ 932.623237][ T5291] 8021q: adding VLAN 0 to HW filter on device eth1 [ 932.979764][ T7455] : left promiscuous mode [ 933.116570][ T7455] hm3): left promiscuous mode [ 933.299560][ T7455] 5: left promiscuous mode [ 933.396792][ T7455] tipc: Left network mode [ 933.514783][ T5648] Bluetooth: hci3: command tx timeout [ 933.758615][T30876] bridge0: port 1(bridge_slave_0) entered blocking state [ 933.765950][T30876] bridge0: port 1(bridge_slave_0) entered disabled state [ 933.773439][T30876] bridge_slave_0: entered allmulticast mode [ 933.792688][T30876] bridge_slave_0: entered promiscuous mode [ 933.864179][T30876] bridge0: port 2(bridge_slave_1) entered blocking state [ 933.882440][T30876] bridge0: port 2(bridge_slave_1) entered disabled state [ 933.892857][T30876] bridge_slave_1: entered allmulticast mode [ 933.902877][T30876] bridge_slave_1: entered promiscuous mode [ 934.070824][ T5291] 8021q: adding VLAN 0 to HW filter on device eth2 [ 934.105453][T30876] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 934.124382][T30876] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 934.210402][T30876] team0: Port device team_slave_0 added [ 934.223559][T30876] team0: Port device team_slave_1 added [ 934.274264][T30876] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 934.295306][T30876] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 934.321985][T30876] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 934.355067][T30876] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 934.363741][T30876] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 934.390950][T30876] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 934.591770][T30876] hsr_slave_0: entered promiscuous mode [ 934.607242][T30876] hsr_slave_1: entered promiscuous mode [ 934.621562][T30876] debugfs: 'hsr0' already exists in 'hsr' [ 934.637813][T30876] Cannot create hsr debugfs directory [ 935.353844][ T7455] veth1_macvtap: left promiscuous mode [ 935.364217][ T7455] veth0_macvtap: left promiscuous mode [ 935.369979][ T7455] veth1_vlan: left promiscuous mode [ 935.375569][ T7455] veth0_vlan: left promiscuous mode [ 935.586307][ T5648] Bluetooth: hci3: command tx timeout [ 936.698127][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 938.999617][ T5291] 8021q: adding VLAN 0 to HW filter on device eth3 [ 939.410083][ T7455] IPVS: stop unused estimator thread 0... [ 939.768423][T30876] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 939.792077][T30876] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 939.801317][T30876] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 939.814305][T30876] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 939.830010][T30876] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 939.842826][T30876] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 939.851886][T30876] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 939.864583][T30876] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 939.980327][T30876] 8021q: adding VLAN 0 to HW filter on device bond0 [ 940.009340][T30876] 8021q: adding VLAN 0 to HW filter on device team0 [ 940.025151][ T7455] bridge0: port 1(bridge_slave_0) entered blocking state [ 940.032672][ T7455] bridge0: port 1(bridge_slave_0) entered forwarding state [ 940.051518][ T101] bridge0: port 2(bridge_slave_1) entered blocking state [ 940.058900][ T101] bridge0: port 2(bridge_slave_1) entered forwarding state [ 940.655301][T30876] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 940.725097][T30876] veth0_vlan: entered promiscuous mode [ 940.742454][T30876] veth1_vlan: entered promiscuous mode [ 940.802092][T30876] veth0_macvtap: entered promiscuous mode [ 940.813739][T30876] veth1_macvtap: entered promiscuous mode [ 940.840675][T30876] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 940.861780][T30876] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 940.884958][T11917] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.919241][T11917] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.952283][T11917] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 940.966315][T11917] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 941.078816][T11917] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 941.103826][T11917] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 941.145628][T11917] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 941.155186][T11917] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 943.898069][ T5648] Bluetooth: hci2: command 0x0405 tx timeout [ 953.150882][T31098] pimreg0: tun_chr_ioctl cmd 1074025681 [ 953.177416][T31094] netlink: 'syz.4.6218': attribute type 1 has an invalid length. [ 953.604263][T31123] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6225'. [ 953.882807][T31106] netlink: 108 bytes leftover after parsing attributes in process `syz.1.6219'. [ 953.950099][T31107] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6219'. [ 953.977190][T31134] wg1 speed is unknown, defaulting to 1000 [ 954.879490][T31177] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6236'. [ 955.312540][T31188] sctp: [Deprecated]: syz.1.6237 (pid 31188) Use of struct sctp_assoc_value in delayed_ack socket option. [ 955.312540][T31188] Use struct sctp_sack_info instead [ 955.344759][T31188] sctp: [Deprecated]: syz.1.6237 (pid 31188) Use of struct sctp_assoc_value in delayed_ack socket option. [ 955.344759][T31188] Use struct sctp_sack_info instead [ 955.424751][T31192] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6238'. [ 955.461540][T31192] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6238'. [ 955.784901][T31203] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input7 [ 956.413887][T31234] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6247'. [ 956.496752][ T5650] block nbd0: Receive control failed (result -32) [ 956.580239][T31249] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6252'. [ 956.598806][T31247] netlink: 128 bytes leftover after parsing attributes in process `syz.3.6250'. [ 956.659895][T31247] nbd0: detected capacity change from 0 to 896 [ 956.701183][T31247] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6250'. [ 956.765195][T31183] block nbd0: Dead connection, failed to find a fallback [ 956.787928][T31183] block nbd0: shutting down sockets [ 956.806485][T31183] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 956.834474][T31183] Buffer I/O error on dev nbd0, logical block 0, async page read [ 956.866749][T31183] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 956.917382][T31183] Buffer I/O error on dev nbd0, logical block 0, async page read [ 956.959473][T31183] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 956.969387][T31183] Buffer I/O error on dev nbd0, logical block 0, async page read [ 956.980240][T31183] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 956.990101][T31183] Buffer I/O error on dev nbd0, logical block 0, async page read [ 956.998431][T31183] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 957.007994][T31183] Buffer I/O error on dev nbd0, logical block 0, async page read [ 957.016193][T31183] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 957.025722][T31183] Buffer I/O error on dev nbd0, logical block 0, async page read [ 957.034012][T31183] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 957.043538][T31183] Buffer I/O error on dev nbd0, logical block 0, async page read [ 957.057947][T31183] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 957.072110][T31183] Buffer I/O error on dev nbd0, logical block 0, async page read [ 957.101781][T31183] ldm_validate_partition_table(): Disk read failed. [ 957.127395][T31183] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 957.169248][T31183] Buffer I/O error on dev nbd0, logical block 0, async page read [ 957.188241][T31183] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 957.214944][T31183] Buffer I/O error on dev nbd0, logical block 0, async page read [ 957.262636][T31183] Dev nbd0: unable to read RDB block 0 [ 957.273807][T31183] nbd0: unable to read partition table [ 957.283696][T31278] netlink: 'syz.1.6259': attribute type 5 has an invalid length. [ 957.336417][T31282] bond23: option lp_interval: invalid value (0) [ 957.341954][T31183] ldm_validate_partition_table(): Disk read failed. [ 957.351455][T31282] bond23: option lp_interval: allowed values 1 - 2147483647 [ 957.363193][T31183] Dev nbd0: unable to read RDB block 0 [ 957.378233][T31183] nbd0: unable to read partition table [ 957.409579][T31282] bond23 (unregistering): Released all slaves [ 957.531814][T31278] x_tables: duplicate underflow at hook 1 [ 958.032550][T31319] netlink: 'syz.4.6270': attribute type 6 has an invalid length. [ 958.072546][T31311] sctp: [Deprecated]: syz.3.6268 (pid 31311) Use of struct sctp_assoc_value in delayed_ack socket option. [ 958.072546][T31311] Use struct sctp_sack_info instead [ 958.118333][T31311] sctp: [Deprecated]: syz.3.6268 (pid 31311) Use of struct sctp_assoc_value in delayed_ack socket option. [ 958.118333][T31311] Use struct sctp_sack_info instead [ 958.667364][T31340] mac80211_hwsim hwsim64 wlan0: entered promiscuous mode [ 958.684250][T31340] mac80211_hwsim hwsim64 wlan0: entered allmulticast mode [ 958.704160][T31340] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 959.698461][T31392] vlan2: entered promiscuous mode [ 959.707796][T31392] bridge0: entered promiscuous mode [ 959.865283][T31392] netlink: 'syz.1.6293': attribute type 4 has an invalid length. [ 960.022681][T31388] wg1 speed is unknown, defaulting to 1000 [ 960.109745][T31408] __nla_validate_parse: 8 callbacks suppressed [ 960.110249][T31408] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6296'. [ 960.457266][T31421] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6300'. [ 960.493000][T31421] netlink: 'syz.2.6300': attribute type 11 has an invalid length. [ 960.762180][T31422] [ 960.764594][T31422] ====================================================== [ 960.771636][T31422] WARNING: possible circular locking dependency detected [ 960.778688][T31422] syzkaller #0 Not tainted [ 960.783136][T31422] ------------------------------------------------------ [ 960.790164][T31422] syz.0.6301/31422 is trying to acquire lock: [ 960.796240][T31422] ffffffff8ea85520 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_node_noprof+0x4a/0x690 [ 960.806110][T31422] [ 960.806110][T31422] but task is already holding lock: [ 960.813579][T31422] ffff888033009d60 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_close+0x1d/0x110 [ 960.822435][T31422] [ 960.822435][T31422] which lock already depends on the new lock. [ 960.822435][T31422] [ 960.832855][T31422] [ 960.832855][T31422] the existing dependency chain (in reverse order) is: [ 960.841882][T31422] [ 960.841882][T31422] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 960.849741][T31422] lock_sock_nested+0x41/0x100 [ 960.855061][T31422] inet_shutdown+0x6a/0x390 [ 960.860120][T31422] nbd_mark_nsock_dead+0x2e9/0x560 [ 960.865860][T31422] recv_work+0x1c2e/0x1d40 [ 960.870823][T31422] process_scheduled_works+0xb5d/0x1860 [ 960.876967][T31422] worker_thread+0xa53/0xfc0 [ 960.882125][T31422] kthread+0x388/0x470 [ 960.886770][T31422] ret_from_fork+0x514/0xb70 [ 960.891961][T31422] ret_from_fork_asm+0x1a/0x30 [ 960.897286][T31422] [ 960.897286][T31422] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 960.904966][T31422] __mutex_lock+0x1a3/0x1550 [ 960.910106][T31422] nbd_queue_rq+0x37b/0x1100 [ 960.915245][T31422] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 960.921535][T31422] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 960.928465][T31422] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 960.935007][T31422] blk_mq_run_hw_queue+0x348/0x4f0 [ 960.940677][T31422] blk_mq_dispatch_list+0xd16/0xe10 [ 960.946426][T31422] blk_mq_flush_plug_list+0x48d/0x570 [ 960.952346][T31422] __blk_flush_plug+0x3ed/0x4d0 [ 960.957841][T31422] __submit_bio+0x28d/0x580 [ 960.962895][T31422] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 960.969075][T31422] block_read_full_folio+0x7b7/0x830 [ 960.974935][T31422] filemap_read_folio+0x137/0x3b0 [ 960.980531][T31422] do_read_cache_folio+0x358/0x590 [ 960.986184][T31422] read_part_sector+0xb6/0x2b0 [ 960.991572][T31422] adfspart_check_ICS+0xb1/0x960 [ 960.997059][T31422] bdev_disk_changed+0x817/0x1770 [ 961.002631][T31422] blkdev_get_whole+0x380/0x510 [ 961.008515][T31422] bdev_open+0x31e/0xd30 [ 961.013303][T31422] blkdev_open+0x470/0x610 [ 961.018270][T31422] do_dentry_open+0x785/0x14e0 [ 961.023579][T31422] vfs_open+0x3b/0x340 [ 961.028185][T31422] path_openat+0x2e08/0x3860 [ 961.033406][T31422] do_file_open+0x23e/0x4a0 [ 961.038454][T31422] do_sys_openat2+0x113/0x200 [ 961.043672][T31422] __x64_sys_openat+0x138/0x170 [ 961.049103][T31422] do_syscall_64+0x15f/0xf80 [ 961.054257][T31422] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.060711][T31422] [ 961.060711][T31422] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 961.067960][T31422] __mutex_lock+0x1a3/0x1550 [ 961.073105][T31422] nbd_queue_rq+0xc6/0x1100 [ 961.078240][T31422] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 961.084333][T31422] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 961.091245][T31422] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 961.098041][T31422] blk_mq_run_hw_queue+0x348/0x4f0 [ 961.103706][T31422] blk_mq_dispatch_list+0xd16/0xe10 [ 961.109455][T31422] blk_mq_flush_plug_list+0x48d/0x570 [ 961.115393][T31422] __blk_flush_plug+0x3ed/0x4d0 [ 961.120899][T31422] __submit_bio+0x28d/0x580 [ 961.125944][T31422] submit_bio_noacct_nocheck+0x2f4/0xa40 [ 961.132120][T31422] block_read_full_folio+0x7b7/0x830 [ 961.137950][T31422] filemap_read_folio+0x137/0x3b0 [ 961.143517][T31422] do_read_cache_folio+0x358/0x590 [ 961.149201][T31422] read_part_sector+0xb6/0x2b0 [ 961.154517][T31422] adfspart_check_ICS+0xb1/0x960 [ 961.160000][T31422] bdev_disk_changed+0x817/0x1770 [ 961.165571][T31422] blkdev_get_whole+0x380/0x510 [ 961.170969][T31422] bdev_open+0x31e/0xd30 [ 961.175763][T31422] blkdev_open+0x470/0x610 [ 961.180720][T31422] do_dentry_open+0x785/0x14e0 [ 961.186020][T31422] vfs_open+0x3b/0x340 [ 961.190649][T31422] path_openat+0x2e08/0x3860 [ 961.195795][T31422] do_file_open+0x23e/0x4a0 [ 961.200842][T31422] do_sys_openat2+0x113/0x200 [ 961.206057][T31422] __x64_sys_openat+0x138/0x170 [ 961.211443][T31422] do_syscall_64+0x15f/0xf80 [ 961.216565][T31422] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.222995][T31422] [ 961.222995][T31422] -> #3 (set->srcu){.+.+}-{0:0}: [ 961.230143][T31422] __synchronize_srcu+0xca/0x300 [ 961.235624][T31422] elevator_switch+0x1e8/0x7a0 [ 961.240934][T31422] elevator_change+0x2cc/0x450 [ 961.246243][T31422] elevator_set_default+0x36c/0x430 [ 961.252068][T31422] blk_register_queue+0x3e9/0x4e0 [ 961.257626][T31422] __add_disk+0x677/0xd50 [ 961.262495][T31422] add_disk_fwnode+0xfb/0x480 [ 961.267710][T31422] nbd_dev_add+0x72c/0xb50 [ 961.272669][T31422] nbd_init+0x168/0x1f0 [ 961.277579][T31422] do_one_initcall+0x250/0x870 [ 961.282889][T31422] do_initcall_level+0x104/0x190 [ 961.288408][T31422] do_initcalls+0x59/0xa0 [ 961.293284][T31422] kernel_init_freeable+0x2a6/0x3e0 [ 961.299214][T31422] kernel_init+0x1d/0x1d0 [ 961.304187][T31422] ret_from_fork+0x514/0xb70 [ 961.309336][T31422] ret_from_fork_asm+0x1a/0x30 [ 961.314646][T31422] [ 961.314646][T31422] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 961.322769][T31422] __mutex_lock+0x1a3/0x1550 [ 961.327915][T31422] elevator_change+0x1b3/0x450 [ 961.333231][T31422] elevator_set_none+0xb5/0x140 [ 961.338628][T31422] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 961.345089][T31422] nbd_start_device+0x17f/0xb10 [ 961.350481][T31422] nbd_genl_connect+0x165b/0x1cf0 [ 961.356043][T31422] genl_family_rcv_msg_doit+0x22a/0x330 [ 961.362128][T31422] genl_rcv_msg+0x61c/0x7a0 [ 961.367167][T31422] netlink_rcv_skb+0x232/0x4b0 [ 961.372478][T31422] genl_rcv+0x28/0x40 [ 961.376999][T31422] netlink_unicast+0x75c/0x8e0 [ 961.382391][T31422] netlink_sendmsg+0x813/0xb40 [ 961.387704][T31422] ____sys_sendmsg+0x972/0x9f0 [ 961.393027][T31422] ___sys_sendmsg+0x2a5/0x360 [ 961.398249][T31422] __x64_sys_sendmsg+0x1bd/0x2a0 [ 961.403735][T31422] do_syscall_64+0x15f/0xf80 [ 961.408859][T31422] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.415289][T31422] [ 961.415289][T31422] -> #1 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 961.423921][T31422] blk_alloc_queue+0x546/0x680 [ 961.429237][T31422] __blk_mq_alloc_disk+0x197/0x390 [ 961.434975][T31422] nbd_dev_add+0x499/0xb50 [ 961.440195][T31422] nbd_init+0x168/0x1f0 [ 961.444899][T31422] do_one_initcall+0x250/0x870 [ 961.450304][T31422] do_initcall_level+0x104/0x190 [ 961.455786][T31422] do_initcalls+0x59/0xa0 [ 961.460676][T31422] kernel_init_freeable+0x2a6/0x3e0 [ 961.466426][T31422] kernel_init+0x1d/0x1d0 [ 961.471300][T31422] ret_from_fork+0x514/0xb70 [ 961.476435][T31422] ret_from_fork_asm+0x1a/0x30 [ 961.482004][T31422] [ 961.482004][T31422] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 961.489241][T31422] __lock_acquire+0x15a5/0x2cf0 [ 961.494629][T31422] lock_acquire+0x106/0x350 [ 961.499935][T31422] fs_reclaim_acquire+0x71/0x100 [ 961.505422][T31422] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 961.511771][T31422] __alloc_skb+0x1d0/0x7d0 [ 961.516823][T31422] tcp_send_active_reset+0x8a/0x550 [ 961.522643][T31422] __tcp_close+0x4c5/0xfe0 [ 961.527608][T31422] tcp_close+0x28/0x110 [ 961.532313][T31422] inet_release+0x143/0x190 [ 961.537349][T31422] sock_close+0xc3/0x240 [ 961.542126][T31422] __fput+0x44f/0xa60 [ 961.546646][T31422] task_work_run+0x1d9/0x270 [ 961.551785][T31422] exit_to_user_mode_loop+0xed/0x480 [ 961.557605][T31422] do_syscall_64+0x33e/0xf80 [ 961.562744][T31422] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.569175][T31422] [ 961.569175][T31422] other info that might help us debug this: [ 961.569175][T31422] [ 961.579415][T31422] Chain exists of: [ 961.579415][T31422] fs_reclaim --> &nsock->tx_lock --> sk_lock-AF_INET6 [ 961.579415][T31422] [ 961.592225][T31422] Possible unsafe locking scenario: [ 961.592225][T31422] [ 961.599774][T31422] CPU0 CPU1 [ 961.605166][T31422] ---- ---- [ 961.610541][T31422] lock(sk_lock-AF_INET6); [ 961.615068][T31422] lock(&nsock->tx_lock); [ 961.622021][T31422] lock(sk_lock-AF_INET6); [ 961.629059][T31422] lock(fs_reclaim); [ 961.633060][T31422] [ 961.633060][T31422] *** DEADLOCK *** [ 961.633060][T31422] [ 961.641210][T31422] 2 locks held by syz.0.6301/31422: [ 961.646421][T31422] #0: ffff888086151a40 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 961.656637][T31422] #1: ffff888033009d60 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_close+0x1d/0x110 [ 961.665896][T31422] [ 961.665896][T31422] stack backtrace: [ 961.671798][T31422] CPU: 0 UID: 0 PID: 31422 Comm: syz.0.6301 Not tainted syzkaller #0 PREEMPT(full) [ 961.671820][T31422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 961.671832][T31422] Call Trace: [ 961.671841][T31422] [ 961.671850][T31422] dump_stack_lvl+0xe8/0x150 [ 961.671873][T31422] print_circular_bug+0x2e1/0x300 [ 961.671900][T31422] check_noncircular+0x12e/0x150 [ 961.671927][T31422] __lock_acquire+0x15a5/0x2cf0 [ 961.671948][T31422] ? __lock_acquire+0x6b5/0x2cf0 [ 961.671972][T31422] ? do_raw_spin_lock+0x12b/0x2f0 [ 961.671997][T31422] ? inet_unhash+0x1fe/0xab0 [ 961.672023][T31422] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 961.672047][T31422] lock_acquire+0x106/0x350 [ 961.672065][T31422] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 961.672090][T31422] ? lock_acquire+0x106/0x350 [ 961.672112][T31422] fs_reclaim_acquire+0x71/0x100 [ 961.672138][T31422] ? kmem_cache_alloc_node_noprof+0x4a/0x690 [ 961.672163][T31422] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 961.672187][T31422] ? __alloc_skb+0x1d0/0x7d0 [ 961.672211][T31422] ? __local_bh_enable_ip+0xd0/0x130 [ 961.672231][T31422] __alloc_skb+0x1d0/0x7d0 [ 961.672255][T31422] ? __pfx_skb_attempt_defer_free+0x10/0x10 [ 961.672285][T31422] tcp_send_active_reset+0x8a/0x550 [ 961.672306][T31422] __tcp_close+0x4c5/0xfe0 [ 961.672333][T31422] tcp_close+0x28/0x110 [ 961.672356][T31422] inet_release+0x143/0x190 [ 961.672374][T31422] sock_close+0xc3/0x240 [ 961.672393][T31422] ? __pfx_sock_close+0x10/0x10 [ 961.672412][T31422] __fput+0x44f/0xa60 [ 961.672438][T31422] task_work_run+0x1d9/0x270 [ 961.672465][T31422] ? __pfx_task_work_run+0x10/0x10 [ 961.672493][T31422] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.672511][T31422] exit_to_user_mode_loop+0xed/0x480 [ 961.672529][T31422] ? rcu_is_watching+0x15/0xb0 [ 961.672550][T31422] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.672569][T31422] do_syscall_64+0x33e/0xf80 [ 961.672587][T31422] ? clear_bhb_loop+0x40/0x90 [ 961.672607][T31422] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 961.672625][T31422] RIP: 0033:0x7f03b699ce59 [ 961.672648][T31422] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 961.672664][T31422] RSP: 002b:00007ffc23cfc798 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 961.672683][T31422] RAX: 0000000000000000 RBX: 00007ffc23cfc880 RCX: 00007f03b699ce59 [ 961.672696][T31422] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 961.672707][T31422] RBP: 00000000000ea7ea R08: 0000000000000001 R09: 0000000000000000 [ 961.672718][T31422] R10: 0000001b2c520000 R11: 0000000000000246 R12: 00007ffc23cfc8c0 [ 961.672731][T31422] R13: 00007f03b6c15fac R14: 00000000000ea8d7 R15: 00007f03b6c15fa0 [ 961.672752][T31422] [ 969.338681][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured!