last executing test programs: 2.142849058s ago: executing program 4 (id=11866): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1}}, 0x40) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) recvmsg(r8, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000000)=r1, 0x4) 2.017295877s ago: executing program 3 (id=11870): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c000180"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r0 = socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0xa, 0x4e24, 0x1000, @mcast2, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="2000000000000000290000000400000037012c0005000c00"], 0x20}, 0x800) 1.858878663s ago: executing program 3 (id=11874): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x8) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @local}, 0x1c) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @remote}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100), 0x4) syz_emit_ethernet(0x4a, &(0x7f0000000200)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x40, @remote, @local, {[], {{0x4e22, 0x4e22, 0x0, 0x41424344, 0x0, 0x0, 0x5, 0x18, 0x1001}}}}}}}, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454da, &(0x7f0000000080)={'batadv0\x00'}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) r2 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet(r2, &(0x7f0000003700)={&(0x7f0000000100)={0x2, 0x4e23, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000003640)=ANY=[@ANYBLOB="1400000000000000000000000600000089032e0000000000"], 0x18}, 0x20010090) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x5, 0x7}, @window={0x3, 0xfffb, 0x7}, @mss={0x2, 0x8008}, @window={0x3, 0x0, 0xb}, @sack_perm, @timestamp, @timestamp, @sack_perm], 0x8) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='cdg', 0x3) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000), 0x4) sendto$inet(r1, &(0x7f0000000080)='<', 0xffffffffffffffef, 0x4805, 0x0, 0xfe8d) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'dvmrp1\x00', 0x1}) 1.176789102s ago: executing program 4 (id=11888): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) syz_emit_ethernet(0x7e, &(0x7f00000000c0)={@link_local={0x3}, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0xa3, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x1, 0x0, 0x12, 0x4, 0x3f18, {0x15, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, @remote, @loopback, {[@timestamp_addr={0x44, 0x34, 0xd2, 0x1, 0xe, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@loopback, 0x3371}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0xfffffff9}, {@empty, 0x9}, {@empty, 0x80}, {@broadcast, 0x5}]}, @generic={0x7, 0x2}, @generic={0x82, 0x7, "ec0e0ec0f0"}]}}}}}}}, 0x0) 1.070538381s ago: executing program 2 (id=11890): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @none, 0x0, 0x2}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0xf, &(0x7f0000000380), 0x4) 1.067723928s ago: executing program 4 (id=11891): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000004680)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000280)=""/138, 0x8a}, {&(0x7f0000000340)=""/205, 0xcd}, {&(0x7f0000001640)=""/4082, 0xff2}], 0x3}, 0x2}], 0x1, 0x0, 0x0) 1.018108176s ago: executing program 0 (id=11892): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f0000005fc0)={@remote, @mcast2, @mcast2, 0x4, 0x8000, 0x40, 0x0, 0x1000, 0x10c0014}) 1.017851293s ago: executing program 1 (id=11893): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x14, 0x3, 0x8, 0x101, 0x0, 0x0, {0x7, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x20004004}, 0x0) socket$inet(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=@newtfilter={0x48, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0xfff3, 0xfff3}, {0x0, 0xfff3}, {0xd, 0x8}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_INDEV={0x14, 0x2, 'vxcan1\x00'}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20041004}, 0x0) 971.580472ms ago: executing program 1 (id=11894): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000196000/0x1000)=nil, 0x1000, 0x0, 0x840000000000a132, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) mmap(&(0x7f0000215000/0x1000)=nil, 0x1000, 0x0, 0x6011, r2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000496000/0x2000)=nil, 0x2000, 0x0, 0x12, r3, 0x0) mmap(&(0x7f00004f1000/0x3000)=nil, 0x3000, 0x2000006, 0x12, r3, 0x913e0000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r5, 0x0) mmap(&(0x7f0000707000/0x2000)=nil, 0x2000, 0x3, 0x12, r4, 0xc3ceb000) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r6, 0x0) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x3, 0x28011, r3, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r7, 0x0) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r7, 0x1000) mmap(&(0x7f00005d3000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0xfffff000) mmap(&(0x7f00008b7000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) mmap(&(0x7f0000071000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) 941.742432ms ago: executing program 4 (id=11895): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x68, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x58, 0x2, 0x0, 0x1, [@NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0xf}, @NFTA_INNER_NUM={0x8}, @NFTA_INNER_EXPR={0x34, 0x5, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x56}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0xb9}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xc0}}, 0x0) 901.969726ms ago: executing program 3 (id=11896): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a09040000000000000000020000000900020073797a32000000000900010073797a300000000070000000080a01010000000000000000020000000900010073797a30000000000900020073797a32000000002c00058008000140000000000800024000000000080001400000000608000140000000f9080001400000005c0800094000000002"], 0xc4}}, 0x0) 901.226749ms ago: executing program 2 (id=11897): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r0) sendmsg$NLBL_MGMT_C_ADDDEF(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x44, r1, 0x1, 0x70bd37, 0x0, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @remote}}]}, 0x44}}, 0x0) 857.766437ms ago: executing program 0 (id=11898): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0xc0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0xc0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a540500000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000028050380180000800c00018006000100d10300000800034000000001"], 0x57c}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) 807.58881ms ago: executing program 4 (id=11899): syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000040000000400000000200000000000000000000060400000000000000000000010500000008000000000000000000000300000000010000000200000004000000000000000000000b"], 0x0, 0x5a}, 0x28) socket$alg(0x26, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x28, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) socket$kcm(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/mnt\x00') recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=[@rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x70}, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x800, 0x0) socket$rds(0x15, 0x5, 0x0) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r2, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x3e8, 0xf, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68888a887", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 806.586563ms ago: executing program 1 (id=11900): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={&(0x7f0000000480)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x70}, 0x1, 0x0, 0x0, 0x80}, 0x0) 703.782813ms ago: executing program 0 (id=11901): sendmmsg$alg(0xffffffffffffffff, &(0x7f0000008d80)=[{0x0, 0x0, &(0x7f0000002d40)=[{&(0x7f0000000a80)="425353a621d4155be4a3b5c2e2c03e80194d06c6b75079d35241da5e2a8e1be44d3b1e366ab3a5589411c31a551e8be2f166752092991bf5fe6161636b6b217ea734f9cc4249cf8e5b7d66196cc50878d8a75dc085fcc09e8bef4e2dcfd1f66782bf78799d9e4a16a7a3f1201ec3150c7288e662eb95406dce28a9fff95036597f8916ae2669716c5e5cbbb198ed0a4dd0da7731989b270810da177a9d507c1a8b1ab9614b534140c4f3ab78c673f1140246cc32337841797b40f1fbae93d522752be038447982b047681b38ac4ad965ed2692f311b1f173094352d315fea052c6cf8e8351e4b02d8b0304ba855ba98114def46b250831bab98ed21e0f8231b3d7459b49f0242a9a911e68dd93ac971ddb303ac94e86115014cbd092cc41c040c8ab756450cdefccdcf384641581b69739ecd81c90b241f138aa5f0441373ecf626a687b65350116f2a152e251624df3efdde1b210229531211df488bb6d3f99e5e5cf9bd087b4ab2462ccaa247f32a469fa1509722a179213c858d29588a1f7180ce308c09b3dac4bd2e53896da0f7fb1196dd11ba473b445ba6e4951fc9eacbc1a464a9e8bae4aecb22f530fa9b07c39ea3ce0fa959cb131e2f65cc39f46c40c4567d81b290080c08eedcf72ee83865ca1167cf6d6a6b9e8b9cbc5617d015be4c6e3e0dca8345b8a9ff0597da1edb6f36b6a0c2b45cbf8d2bc6afd490e27bfa9ed1558c5c7b6d144a4441b19b4d12cd37c157affe56e40c39bd6872dcf321e0ea6badd192733be5cd358959cc500b9eeb678eeeca844389bc989538acf703744279cfec6ba4f7ce723735da6df1ae50c7a9dcbbec16dbb69d14fadaecd85904642840286257e7ad5d7e0d648f9ed59e6ecab86eb4a5b06ecfec0f7393f6380df87307fbd1882aba4d6e3adf0216a935d8d2c75a1dc903c0dad3651a4b758b7b4abe6b01bea33cf32acd3db0e5a7577531adacc475f2a393a3adffe240511333cb263d97f44ac435523031520d8abb84cf3a8536e5b96cea96a8ee61fa848020f72503ce568430515a46b64b36ccbd2355cf87c7c04b14536a11a8eaafabc79d1adcdb5606d8590ec7e3531703a232905762049d007403112369ff3afefd74757b3b45af48296b5a8dfd483d207341f44a199cc8e0b9a3d02afa76d943c17c7897d39c9d29dd6d03b9f840faf345185163993c206f875080aba4182df", 0x35d}, {0x0}, {0x0}], 0x3, &(0x7f0000008ec0)=[@iv={0x60, 0x117, 0x2, 0x47, "079d2c3941988979b99ab058e2aa161effd0bcfe4befa4ba0cd3982f93b9ba2435c5789ef56429a6017d3e037e7ad39475c27dfbf41d7ab515093079553f2c145b9332434c3f78"}, @op={0x18}], 0x78, 0x80}], 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="230000000c00000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280), &(0x7f0000000340), 0x7ff, r0}, 0x38) 684.027772ms ago: executing program 2 (id=11902): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="2c0000001300050000000000feffffff07000000", @ANYRES32=r1, @ANYBLOB="00300000000000000c001a80080005800400038000"], 0x2c}}, 0xc0) 683.27763ms ago: executing program 3 (id=11903): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r1, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r0], 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x10) 593.604875ms ago: executing program 1 (id=11904): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@bridge_dellink={0x2c, 0x13, 0x5, 0x1000000, 0xfffffffe, {0x7, 0x0, 0x0, r1, 0x2e42e, 0x100}, [@IFLA_AF_SPEC={0xc, 0x1a, 0x0, 0x1, [@AF_INET={0x8, 0x4, 0x0, 0x1, {0x4, 0x8}}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x800c000}, 0x0) 522.998362ms ago: executing program 3 (id=11905): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0x0) recvmmsg(r0, &(0x7f0000003c80)=[{{0x0, 0x0, 0x0}, 0xffffffff}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000001500)=""/4112, 0x1010}, {&(0x7f0000000040)=""/212, 0xd4}], 0x2}, 0x400000}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x400800}], 0x4, 0x20000, 0x0) 517.69642ms ago: executing program 0 (id=11906): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd21, 0xfbffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x400) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet6(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000800)=@newtfilter={0x44, 0x2c, 0xd3f, 0x70b524, 0x25dfdbfa, {0x0, 0x0, 0x0, r8, {0xe, 0xffe0}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x152d7}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4008848}, 0xc884) sendmsg$kcm(r1, &(0x7f0000000440)={&(0x7f0000000380)=@xdp={0x2c, 0x7, 0x0, 0x25}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000180)="ac", 0x1}], 0x1}, 0x20008884) 498.951667ms ago: executing program 2 (id=11907): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000000100)={&(0x7f00000004c0)={0x2, 0x4e24, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000003a00)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x2a}, @remote}}}], 0x20}, 0x48000) sendmsg$inet(r0, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x56}}, 0x10, 0x0}, 0x700000000000000) 442.382345ms ago: executing program 1 (id=11908): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)) write(r0, &(0x7f0000000280)="c021", 0x2) 373.633581ms ago: executing program 2 (id=11909): sendmsg$AUDIT_TTY_GET(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x10, 0x3f8, 0x20, 0x70bd2d, 0x25dfdbfb, "", ["", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x20044851}, 0x8000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r0, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[@ANYBLOB="200000000a06030000000000000000000a00000209000200"], 0x20}, 0x1, 0x0, 0x0, 0x48091}, 0x20040000) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040), 0x6) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_TIMEOUT(r2, 0x0, 0x48a, &(0x7f0000000140)={0x3, 0x7}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=@newtaction={0x64, 0x30, 0x9e54f29ff072a93b, 0x0, 0x25dfdbfc, {}, [{0x50, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x4}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x64}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001280)=@newqdisc={0xcd0, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xf, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}, @qdisc_kind_options=@q_tbf={{0x8}, {0xc98, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xaa8b36ad51ae9f4b}, @TCA_TBF_PTAB={0x404, 0x3, [0x4, 0x1, 0x1, 0x1, 0x658, 0x5, 0x0, 0xe9af, 0xfffffff7, 0x2, 0x5, 0x5, 0xc1, 0x8, 0x3, 0x0, 0x33, 0x6, 0x7, 0x1, 0xffff8000, 0x7, 0x8001, 0x5, 0x7, 0x2, 0x4, 0x20, 0x81, 0x322e3858, 0xfffffff7, 0x4, 0xc, 0xfffffffe, 0x5f67b472, 0xf, 0x5, 0xffff, 0x200, 0x9, 0x6, 0x3, 0x4, 0x1, 0x2, 0x7, 0x80000000, 0x5, 0xa, 0x1, 0x1, 0x8, 0x3, 0x3, 0x5, 0x4000000, 0x6, 0x0, 0x5, 0x7dd, 0x0, 0x0, 0x9, 0xac4f, 0x4, 0x4, 0x2, 0x5, 0x6, 0x100, 0x1, 0xa71, 0x1, 0x4, 0x1, 0xfffffff7, 0x3f6e, 0x4, 0x40, 0x28b9, 0x40, 0x495e, 0x96eb, 0x5, 0x4, 0xe, 0x6, 0x3, 0x4, 0x0, 0x84a5, 0xa, 0x9, 0x1, 0x9, 0x1, 0x200, 0x2, 0xfe, 0x0, 0x6f03, 0x0, 0x3, 0x4, 0x1, 0x7fff, 0x7, 0xffffffff, 0x5f57, 0x5, 0x6, 0x8a1a, 0x7, 0xfffffffb, 0x7, 0xab, 0x6, 0x843, 0x5ff79757, 0x4, 0xcc5, 0x6, 0x8, 0x1, 0x7, 0x1000, 0xb, 0xb, 0xffff0000, 0x0, 0x5, 0x3ff, 0x1, 0x1, 0x7, 0x3, 0xb, 0x100, 0x1ff, 0x681d815b, 0xb, 0x8, 0xe2, 0xe, 0x400, 0x80000001, 0x1, 0x401, 0x41, 0x1f, 0x3fe0, 0x8001, 0x0, 0xc, 0x7, 0xfff, 0x1f01, 0x1, 0x3, 0xffffff01, 0x0, 0x1ba0, 0x7, 0x4, 0x5, 0x1, 0x80000001, 0x6, 0xffffffff, 0x7, 0x0, 0x200, 0x1, 0x7, 0x0, 0x8, 0x4, 0x3, 0x5, 0xfffffffb, 0x2, 0xe, 0x6, 0xe0, 0x1000, 0x8, 0xd3, 0x0, 0x6a9968fa, 0x0, 0x1806, 0x74, 0x40a0e419, 0x9, 0x6, 0x4, 0x2c, 0x3, 0x81, 0xdea8, 0x3, 0x400, 0x0, 0x0, 0x1, 0x1, 0x9, 0x8000, 0x7, 0x7, 0x3f75, 0x2, 0x0, 0x14, 0x0, 0x3, 0x2, 0x9, 0x7fff, 0x6, 0xfffffffc, 0x10, 0x5, 0x0, 0xe01, 0x9, 0x7, 0x4, 0x3, 0x4, 0x9, 0x7f, 0x3, 0x1, 0x80000000, 0x4, 0x5, 0x400, 0xa9e, 0xd6a890d3, 0x3, 0x0, 0x3, 0x8, 0x3, 0xfee0, 0x5, 0xe13a, 0x7, 0x80, 0x80000001, 0x1, 0x0, 0x472, 0x18000, 0x9]}, @TCA_TBF_PBURST={0x8, 0x7, 0x1816}, @TCA_TBF_PARMS={0x28, 0x1, {{0x2, 0x2, 0x80, 0x8, 0xae, 0x80}, {0x2, 0x0, 0xe0, 0x6, 0x5, 0x5}, 0x15, 0xf50, 0x3e4}}, @TCA_TBF_RATE64={0xc, 0x4, 0xb3cbaac8d083173b}, @TCA_TBF_PTAB={0x404, 0x3, [0x5, 0x7, 0x6, 0x3, 0x79, 0xdd, 0xe, 0x5, 0x0, 0xb, 0x7, 0x4, 0x4, 0x401, 0xf, 0x10000, 0x8, 0x9550, 0x7, 0x9, 0xe, 0xd3, 0xb91c, 0x31bb, 0x6, 0xffffffff, 0x98c, 0x8, 0x1, 0xa92, 0xf3, 0x200, 0x3, 0x8, 0x4, 0xff, 0x400, 0x7, 0x5, 0x1, 0x8, 0x2, 0x1233, 0x400, 0xc00000, 0x9, 0x8, 0x96, 0x5, 0x4, 0x80, 0x4, 0x400, 0x7, 0x129, 0x31, 0xc0ea, 0x9, 0x9b6, 0x1, 0x1, 0x0, 0x172c478f, 0xe, 0x8, 0x7f, 0x3, 0x7, 0x1, 0xfdc9, 0x6, 0x8, 0x6, 0x80, 0xe, 0x6, 0x0, 0xffffffff, 0x771, 0x5, 0x46, 0x6, 0xa, 0x401, 0x988, 0x1, 0x9, 0x8, 0x3ff, 0x8, 0x3, 0x33, 0x400, 0x0, 0x40, 0xac, 0x1, 0xc5, 0x6f16, 0x422c, 0x7, 0x5, 0x5, 0x6, 0x84, 0xffffffff, 0x4d, 0x4, 0x401, 0x3, 0x101, 0x7, 0x8, 0x1, 0xa8, 0x7, 0xffff, 0x4, 0x6, 0x9, 0x7, 0x2, 0xfffffff9, 0x3, 0x3, 0x8, 0x4811, 0x3ff, 0x80, 0x2, 0x9, 0xff, 0x4, 0x266, 0x8dd, 0x6, 0x800, 0x7, 0x1, 0x0, 0x8, 0x8, 0x7, 0x9, 0x4e, 0x800, 0x5, 0x8, 0x940, 0x10001, 0x7, 0x3, 0x9, 0xfffffffc, 0x21, 0x10001, 0x2, 0xbb2, 0x6241, 0x81, 0x4, 0x8, 0x2eac, 0xfffffffe, 0x1, 0xfffffff9, 0xfffffff0, 0x9, 0x1, 0x7, 0x49a3, 0x4, 0x6, 0x0, 0x5, 0xffffffff, 0x2, 0x4, 0x7, 0x0, 0x1, 0x100, 0x40000000, 0x4, 0x800, 0x5, 0x1000, 0x203, 0x700, 0x4, 0x9, 0xa9bd, 0x4, 0x5, 0x1, 0x9, 0x1e76, 0xfff, 0x8, 0x2, 0x7, 0x80, 0xe9d8, 0x5, 0x1, 0xffff57f0, 0x3, 0x2, 0xfffeffff, 0x4, 0x7, 0x7, 0x6, 0x9, 0x6, 0x8, 0x0, 0x80000001, 0xe31, 0x5, 0x7fffffff, 0xf, 0x1, 0x9, 0x2, 0xc89, 0x9, 0x7fff, 0x244, 0x3, 0x1a000000, 0xfff, 0xfffffffb, 0x4, 0x0, 0x9, 0x3ff, 0x6790, 0x6, 0x3, 0x9, 0x9, 0x3, 0x9, 0xe4, 0x7, 0x1, 0xc19d, 0x6, 0x4, 0x2, 0x80, 0x1, 0x4, 0x10, 0x7]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x2, 0x6, 0x0, 0x1, 0x845}, {0x4, 0x2, 0x2, 0x466b, 0x3, 0x2}, 0x7fffffff, 0x200, 0x1660}}, @TCA_TBF_RATE64={0xc, 0x4, 0xca38b7a6a7daf84f}, @TCA_TBF_PRATE64={0xc, 0x5, 0x571cd9c95fcd5116}, @TCA_TBF_RTAB={0x404, 0x2, [0x7, 0x11, 0x10000, 0xfffff001, 0x1, 0x134c8287, 0x5, 0x1, 0x1, 0x800, 0xe, 0xfffffbff, 0x9f9, 0xdc94, 0x0, 0x7, 0x9, 0x20000003, 0x9, 0x8, 0x5, 0x10000, 0x7, 0x9, 0x3, 0x5, 0x7, 0xb59, 0xfffffff7, 0x3, 0x0, 0x466d, 0x4, 0x2, 0xc, 0xfffffffe, 0x3, 0x438, 0x7fffffff, 0x5, 0xfffff309, 0x40, 0xfffffff8, 0xff, 0x0, 0x10001, 0x9, 0xfffffffa, 0x8e, 0x2, 0x6, 0x6, 0x2, 0x9, 0x3, 0x5, 0x1, 0x5, 0x6, 0x101, 0x5, 0x2f8e, 0x7, 0x81, 0xe4e, 0x3, 0x99a, 0x1, 0x9, 0x96, 0x0, 0x8, 0xffff, 0xb, 0x101, 0x2, 0x0, 0xff1e, 0x3, 0x128, 0x10, 0x1, 0x100, 0x57, 0x5, 0xdb01, 0x4, 0x7, 0xec0, 0x2, 0xccd, 0x0, 0x7fff, 0xb, 0x0, 0x1e5, 0x5, 0x401, 0x900000, 0x8000, 0x4, 0x10000, 0x100000, 0x4ca, 0x40, 0x2, 0x7, 0x4, 0x7, 0x6, 0x6, 0x40, 0x6, 0xfffff320, 0x1000, 0xfffff1b4, 0x7, 0x0, 0x1, 0x6, 0x3, 0xae, 0x3, 0x3, 0x7, 0x2, 0x5, 0x40, 0x6, 0x1f127034, 0x5, 0x2fad, 0x6c4, 0x9, 0x0, 0x0, 0xd0, 0x1, 0x6, 0xffff, 0x7, 0xfff, 0x6, 0x8, 0x1, 0x1, 0x9, 0x6e, 0x5, 0x7, 0x8001, 0x80000000, 0x7fffffff, 0x8, 0x2d, 0x8, 0x2, 0x3, 0x1, 0x2, 0xfffffff7, 0x8, 0xf2, 0xdd35, 0x0, 0x0, 0x4, 0xffff, 0xdd3d, 0x1, 0xd6, 0xf02, 0x2, 0x9, 0x92f6, 0x5, 0x2, 0xd4, 0x4, 0x9, 0x7, 0x3, 0x2, 0x9e, 0x4, 0xe6fe, 0xfffffffc, 0xff, 0x10001, 0x2, 0x7, 0x54f2, 0x4, 0x3, 0x8, 0xd167, 0x6, 0x6452cdd4, 0x1, 0x7, 0x4, 0x8, 0x9, 0x3, 0x3, 0x0, 0x8001, 0x7, 0x5, 0x80000000, 0x10000, 0x1, 0x4, 0x7fff, 0x1f6d, 0x66c8, 0x5, 0xd679, 0x3, 0x10, 0x4, 0xb5, 0x4, 0xfffffffe, 0x5, 0x7, 0x6, 0x9, 0x6, 0x0, 0x0, 0xe2a0, 0x7a, 0x52, 0x4, 0x0, 0xe, 0xfffffff8, 0x8, 0x7fff, 0x800, 0xf, 0x9, 0x4, 0x200, 0x5, 0x8, 0x101, 0xffff0001, 0x121, 0x7, 0x7, 0x9, 0x8, 0x9, 0x7fff]}]}}]}, 0xcd0}}, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) socket$kcm(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000f00)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000050900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000000d0a010300000000000000000a0000010900020073797a31000000000900010073797a31"], 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) close(r8) recvmsg(r9, &(0x7f0000002240)={0x0, 0x0, 0x0}, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, 0x0, 0x0) 276.490943ms ago: executing program 3 (id=11910): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_ID={0x0, 0x9, 0x1, 0x0, 0x1}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x6c}}, 0x20000080) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x0, 0x5, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0xfffffffffffffffd, 0xa9, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x1ca8, 0xa00, 0x40800000000000, 0x800000000000000}}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x0, 0x3c}, 0x0, @in=@broadcast, 0x0, 0x0, 0x3}]}]}, 0xfc}}, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0xcc, 0x21, 0x1, 0x70bd27, 0xfffffffe, {{@in6=@private2, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0xdffc, 0x0, 0x0, 0x0, 0xa, 0xe0}, 0x2}, [@migrate={0x50, 0x11, [{@in6=@dev={0xfe, 0x80, '\x00', 0x11}, @in=@local, @in=@local, @in6=@remote, 0x3c, 0x0, 0x0, 0x0, 0xa, 0xa}]}, @user_kmaddress={0x2c, 0x13, {@in6=@dev={0xfe, 0x80, '\x00', 0x2b}, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x2}}]}, 0xcc}, 0x1, 0x0, 0x0, 0x800}, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) r5 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000100)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x33, 0xffff5257, 0x22e2e, 0x100, 0x7, 0x3, 0x0, 0x0, 0xffff}}) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000880)={&(0x7f00000006c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x92, 0x92, 0x3, [@enum64={0xb, 0x2, 0x0, 0x13, 0x0, 0x3, [{0x1, 0x8, 0xfffffffe}, {0x10, 0x4664d9fd, 0xaae}]}, @datasec={0x3, 0x7, 0x0, 0xf, 0x2, [{0x4, 0x9, 0x7}, {0x4, 0x6, 0x81}, {0x1, 0x6, 0xa000000}, {0x1, 0xbc72, 0xeb68}, {0x5, 0x5, 0x2}, {0x4, 0x6, 0x6}, {0x3, 0x7, 0x9}], "14d9"}, @type_tag={0xf, 0x0, 0x0, 0x12, 0x2}]}, {0x0, [0x2e]}}, &(0x7f0000000780)=""/242, 0xaf, 0xf2, 0x1, 0x4, 0x10000}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x1c, 0x4, &(0x7f0000000080)=ANY=[@ANYRES16=r4, @ANYRES8=0x0, @ANYBLOB="000000000000000005000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @fallback=0x35, r6}, 0x94) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000200)={'team_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffffffb, {0x0, 0x0, 0x0, r9, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x2}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r7, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f0000000040), 0x1e) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "dce02de9d7bd466b", "72e64b3892cb7025848c9f40363cf916", "cfff3c66", "e2b768b4bb9e0d9b"}, 0x28) sendto$inet6(r7, &(0x7f0000000100)='0', 0xfffffffffffffdcd, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@delqdisc={0x20c, 0x25, 0x61e, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0xfff2, 0xfff1}, {0xa, 0xffe0}, {0xc, 0x23c669388fa82ae4}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x7}, @TCA_STAB={0x1b0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x96, 0x6, 0xf, 0x8, 0x0, 0x5, 0x120000, 0x4}}, {0xc, 0x2, [0x3d6, 0x2, 0x2, 0x7f]}}, {{0x1c, 0x1, {0x3, 0x8, 0x6, 0x27, 0x2, 0x1, 0x6, 0x6}}, {0x10, 0x2, [0x0, 0x6, 0xff, 0xfffe, 0x956, 0x6b8]}}, {{0x1c, 0x1, {0x4, 0x4, 0x9, 0x1000, 0x2, 0x8000, 0x3, 0x3}}, {0xa, 0x2, [0xcb92, 0x2, 0x40]}}, {{0x1c, 0x1, {0x9, 0xa, 0x7, 0x3, 0x0, 0x7, 0x63, 0x5}}, {0xe, 0x2, [0xffff, 0xfff7, 0x4, 0x9, 0x444]}}, {{0x1c, 0x1, {0x7f, 0x6, 0x1, 0x401, 0x0, 0x0, 0x4, 0x1}}, {0x6, 0x2, [0x3ff]}}, {{0x1c, 0x1, {0xfc, 0x7, 0x10, 0x6, 0x0, 0x0, 0x1, 0x7}}, {0x12, 0x2, [0x6, 0x9, 0xa0, 0x5, 0x80, 0x8d4b, 0x2]}}, {{0x1c, 0x1, {0x40, 0xd, 0xe, 0x0, 0x0, 0x3f, 0xc, 0x5}}, {0xe, 0x2, [0x29, 0xfa9e, 0x6, 0xd, 0x1e64]}}, {{0x1c, 0x1, {0x3, 0x7, 0x7a, 0x4, 0x2, 0x80, 0xe0, 0x4}}, {0xc, 0x2, [0xffff, 0x7, 0x4, 0xa7b9]}}, {{0x1c, 0x1, {0x81, 0x3, 0xb, 0xa9fc, 0x2, 0x4, 0x5, 0x7}}, {0x12, 0x2, [0x8, 0x32, 0x8, 0xff96, 0x68aa, 0x4, 0x9]}}, {{0x1c, 0x1, {0x2, 0x6, 0x4a, 0x10000, 0x2, 0xd7f2, 0x5, 0x5}}, {0xe, 0x2, [0x7ff, 0x7, 0x7, 0xd, 0x5]}}]}, @TCA_RATE={0x6, 0x5, {0x63, 0x3}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x6, 0x1, 0x0, 0x400, 0x1, 0x6, 0x735, 0x2}}, {0x8, 0x2, [0x1ff, 0x2]}}]}]}, 0x20c}}, 0x4014) 232.50179ms ago: executing program 4 (id=11911): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e22, 0x2, @loopback, 0x5}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000540), 0x3c) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000000)=@gcm_256={{0x304}, '\x00', "e8582491a0c4050000000000f6542a9b6800000000000000003967d2daa45b4e", "61241765", "9b1f80001b00"}, 0x38) r2 = socket$kcm(0x29, 0x7, 0x0) shutdown(r2, 0x1) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0x34}, [@ldst={0x3, 0x0, 0x3, 0x1c10a1, 0x0, 0x2e}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[], 0x100}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWTABLE={0x28, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}], {0x14}}, 0x9c}, 0x1, 0x0, 0x0, 0x20004000}, 0x0) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, r0, 0x215eb000) syz_emit_ethernet(0x6a, &(0x7f00000000c0)={@broadcast, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @redirect={0x5, 0x1, 0x0, @multicast1, {0x10, 0x4, 0x2, 0x35, 0x9, 0x67, 0x1, 0x5, 0x6c, 0x8, @rand_addr=0x64010102, @loopback, {[@timestamp_prespec={0x44, 0x14, 0x9f, 0x3, 0x9, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3}, {@multicast1, 0x7fffffff}]}, @lsrr={0x83, 0x17, 0x5b, [@dev={0xac, 0x14, 0x14, 0x32}, @multicast2, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2]}]}}}}}}}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000040)="f4a99edc197b347539f134b45dcaeae8779d4cd6edf7afffd56d50caf6eed90bda06db5b5fe0e681aaffde2557343a1b03fd1ed44065548d7cf229c6a4", 0x3d, 0x200008d0, 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000007c0)={0x0, &(0x7f0000000740)=""/83, 0x0, 0x53, 0x1, 0xb0}, 0x20) ioctl$ifreq_SIOCGIFINDEX_team(r4, 0x8933, &(0x7f0000000080)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x30}}, 0x4000080) sendmsg$NL80211_CMD_SET_MPATH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x2400c890}, 0x40000) setsockopt$IPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x41, &(0x7f0000000440)={'security\x00', 0x2, [{}, {}]}, 0x48) sendto$inet(0xffffffffffffffff, &(0x7f0000000800)="6d2215c29dfb90f688d7d4880bfeec9e76ca240301ae28b06980daf296be5944d938069a2bd37267e8dedcbfb8013821a478642806d886046ef8ae49c21a7d3977d280f7ee39684e9c20e4221bf2162c0c7444062aa93d3f09d04c7e724f4b93be7dcd0a3a86a08cc85c66302028d051143e22fee9e8daf910fcf2a2bbbfbd142d04e84c61e5ea3c135ff2166659949a4b7cb917e091d7d56d2dc61f3077f1fab1b29be6d757f53f5b633d0d24962237c40aa94b02b50f664595bd9043b9279e91b898e27c9b445f916ffac0c49af5242298b08a2c95a185df97a55bc65af7f42d3f844097428846c9054f5553a50de1e59ad9f0b99e090b16a3caf189d40a811960188d1d6ba9c683791b3d023147eaa4fe953e4b1fdccde1a007d02476f2c3c6880a1420e4b63211082df5a74c32056712657dea5d8417b3d781b84d2c8c797ece3112f46d204275239c83947729c781b13c4c485a3269ab40204a16245c7d22b5b139afc88657ba3d468670a704a85ea96645a7865d8d84775b3b9e70f3c740ed4afc05c44339d9f77d9ca299e414496720ec4a7fba2ba268ed6f0990203875ee4485c87161f971fbbb75be45cd6b924cd78e1275847ed553b3b2f5cf962e3da101cb59e241f8e11c448bf970372afa520ea9f0c7acee726739cc2b02323cca862f0e35a5f42de127372739c2e6dcbb24fb186b130889a139182f26efa9f04ad338437786aaf76e869d2e11cc1301918eb8d804a084f6e5c7de69d36600f25114354ccf1761fa1dfeac96d889ae6ec142b86dce6137a302b5a13c59bf3f4f0a5769e9b1f7eb96af1d615866d7bcb786bfea96ff0e01766fc101af99e1c397ea9674d947d950bb4080c82c4802c2d24847b8b3e8d779f0d79530dd45caebdde16444911919ee466c6137143dd6929740a51651d58bc8b232874140b61fd25ce6ca5e0e26b3cd564b878a096120bc2cadbaf56e2f06b06acabe7a2ec509d88ce960561215b2014dda3b84d3dac621aa6d60a0ebb334db52f5d3bfff4bb685642ee29f6f8fdb04c04e657ea026bf9c7db8839e109f0c7a615ba747689e2bbd978e560ad26f605263ecde463cc548276efaf31f3af886edf08c2b17e0e8396ba5b92971357348001666df87a303c98a228a029f61e2709d4092c25a73f0cf7edcae458350b056a700a9520af4e267a024e9e4472387bb0302397a0fea2d7158d6189f4d0701a9d584f08bfe04e0e0cc68957fd5bff824a6315b4850eda33ac5895b525cd9989e0a8af9048ad82a77cf53ef46e12fee9e30a11ded198540ca50116672b70abef5ce3ed6ce0bd6b7e0e7540d2217a768581d79976cd1a12dbd9ddfe25ff3a437b55d6ba81045ebd5c9b237354fa5fe98734086c436772244ce8e6198b75ca5aff66db54a736f619930cbcfcc4fcfeaee4a06a7283bd4883046f8126cfd0967810106ec5d161c05ad6c974fe366e41d47f4de28b79f903c0c5b77650ffcbe791c3a7fce0cd0b710511f6465f7c8d361fd2036737e9fabb3a5360555a9ba10d406d69e7e68c9e99336d6ac3900aa5dee63b8e0483ac18131e48b57eaf82127bfa932b27189d6a821b74173e964d07751a8869fba4bcff4d26ae0d21e7ccbcca4d6591fc33008de287751a987cb14bf2a3acf410c3f9a41e49769c7daaa59309326da34e0bf7e46805cfd81d7d05008b719bf6c3effd77da5b77a77d1eb81fb5f81b9145df95f981aa4f090e6269b12dc7cb0a63400d9ee8ab5c0a6939b79e1bf1787b9ace7fc4ab5f8d666ce06ae09313178a8a03d8bb326816b8cb2992b5df59dbca0522eb34435a8ec73a6cd616c386d326bd0abd744e10e86f880af3a79fad04941b9633b736b022d05e4c5afe771adf88c74a1ccd003c7d78492489737633d01e085d8fd3fd17342b4bed948cab0e18137f925af3188bff36d3b8f0b7ccd4fb51bcc2781fe467a0cfa52de185c204596223f9ca0b7915b22e62d13d606ea99a99c0599d372f89bf5035d201c2cae157499b1868a7ccef8f52d58cc4f646f81e2d0ea5f4a8e234b378eb0bef27cb74f2adc6d5ace6973f1b5d399761d580a60ee445cc9fddb5e8683e20d51c041f48427eb6fa54a4d3b546a79eb388374aa7a863a9f398bb11802851396d97ca8cf5d4828d69a01828b7f49e7cc40beb8c72700b77e6f48616b0768bf99d5b0d2c64eba3637bf005471f346cb5505c106a3eeca9e13e1f0c319abc0bd2dd05538116d10d006f0db5db73a918e9e9b225597681baed6e7102d693393a650e2178226ad43a809c0ac856f186c5520bbe2af4cb1e86d941042b4dff5564251a27429c4c12eddd26cb8bd0aa2f171094e9d91795ac5642f1054b109b1bf88def5e637030bd01c1aa44587182ea14aac1831f13385b3f2027b701eb2a5a52e2e02293ec827612a0bace07b73afa32286d2e5b126ea029b664403f020b4649f3869ed6f009000a98f2bbed0463f58a15fd81e65184da3eb1b788472c48dfef14500f8adaf7abc937a397b6f4882c95fbeef090fcfaa9228e855e081de890020b81d4976d187933eb656ecee18e57f3aab1bd10f538062182f97581af961832cf2f0189d825394ff9feccf7a78da515458a7b1144f9926bdb8033b91568ea05f944ca454871011bbeb629b37afd5bf46407b400c1fe34e96d7bc05e22e5b8b122282271b1c7f1db8186c5424c365edd7f28b1b6ef90e03e7410de024c037a8d537b9360f3e72e63906fbe15779e03552d0752c4a7404eb55f518e417fa5be25f23f4e2e2d2b5bdac17b1adf8dda512e0bd3a7ff78d7d432e528caa27f57fa9f6009f2e05f7bc0d413807fb944b439a91b20e6fd808a92d0543639eb66b3b42b6c27c05cc7a8ce75472a6f4536bbabb56bd9464672f914ba7f2c4c89fbb80107a1db06cc15ef987ff83b7be5473945c9997d67553d7c0cbef08b4324b749cc88c8b6c5cc5937b6bd2be79e5946f63da6f647565c318098d34392a9ee87cfdeee72dd550817297c1fd58b985c7109f766ca053056c7b87c7902a34c3063e1795581bf04e065bda198655d71176d57427e118e389ca0ae71d319a092f6ecf84231ba847c42ddc0adf0ad81d6a975e51c64671590fcd775920bd2116294a8a0d878634e7f753f7b8acf516a19d542f67b0031b06a42f93bb2351bc59658ced33e86483326343b9bc5b159a0b49b5c9e6f1b3459e30a860bc213c518cb804450acb7887994672e4d9c648aa88eab7e50d86efcef46d39522e7ee9d0e2c4a6f810e9e958e7d22c8f90bb5653d2403b4f5fa2974c036192ab6094ed4486a7df08d8339503854575e4d7695b1bc684788acd3e2865a9d175133767864a43ecaa216e541f6f5d22143ed49c086db49ae66a465dacd737e4202c04c0aa52383b645010c02e89eac9d6f30ec67ee61722dcecbd514074ec00a287bdf3481daef20ad859a119d231800b1d9fe6bd1e6a83a84820d87bc35a5c14c602c8970e13aec026feb15b9216ae96de89150c1fbd4ed8204a53c70274f41736454f84b11b84cbafbb7ad2864321c0aeb1743cbe117d29f2db0bdaef9ea05c52bca49d237b2f0aec71bc286d7bad6f1a46f6273833e432e57b5c9ceeb3e3bb77cf2ebb608e9fe512c76daae4b1d640ee0fdb959b7ddba24c0bf0a723d7de60aad2bf0ee2fef936baf955a3367b09594fb9a2cdf43f1bf223a369e6a4735e4d1f11dcacbeba7cf0b4cd8301a46b764c01fa8cda2d3f965764dcc412b4d4c452a5897c8ecd355456667bc07b5d44f84319b3044361118caef8adaa5704ff3ea097bffece3319639678b54addacd1b2941ef290b2c20342626db3c8068e37f49815abd320e8bc5200a63708055113dccfab8800205193dabe609c6a52ae9882291ea5194040e3c38cf0b5a36eb8507b4ff24fcba55cc3915940d79c92b50f0d2ba8cce20e45ee7f4dad15f6b322b4cc7c6731c77cbb8d128d5cb3b72d827c4925c93a04183e627d6e3f6d029183e607db7424c4455cfde2cf4dc3cb88b088e06afb116198ef010ac9d5347074d9861b981d06e85a192cb3c31dacac9a416623691571f6f459ad4461fdef1cf080eae64226e5598635a97161fd3abc52f512a4c97a80e45cbcf1e58f674dc51dfa870154e361dfcf610d70a3b509130c7ebfd6a4a4aea148ca08f195862c43aedd49742277001b1a95b891ed63b7ddb0877e46c5cc8579dbf5afad63d0c2d33863b14c336db1b440d582a3bd4603e4df3c363308d46c3252588cf82bcf21caf43c776f7638e524005863bfb04a42f6175bb8f3020ce698e9534fce6ab3e2f06fc4361b2bca8e890078c996c86d8591b90d7fc8927f2fc9d58f6a4e398c0d0e4a44301227aede4724d58c3b9eb89234040577fe3d20c4a87660e0c9928ac79551cbd2498f1b6f4e1fa96d2afca4e00f601279e36e54c1a40bd54936a034d9d51915efd63db00c982e273ddf2adc5a8b0ba463a65e1155a0ba15d58f84296ae4a004cc5393d855167fda9893319b58f4e9f4d9e8ac27a26fc1cd5b442b9d0bad49888818265d467b9688e6fb1438f012e7223b97943454add9d411a945bae7b8821bfecb48bf585fa61a8b07114095d4870c2803f1bce940817629d90a39067e412335794dbcd8b09364e53bf1d87a78cff37a18063637b45719bbfa38659420a3e80d4d11f49d985bec95b13b1d7be87fa7b9ce30d79eaf71bdcbc93dff758ae2cde94f741a7f4f1a696a29afd5f75fbde3c75a31cdc81f870798192c545b01ec5580c6f18ceb69043af23a0a69275a4b60d9fef15bfe7e930e29bad7129b933114def64a9f1c3d5f99e8d79253ec0757965e149f78b524d691a5ac1f97deeb0ff1ab3e1b82d69afdb7f8a5dc47f4f39529e5364ea539ed0581e46169660bcccd70107105b210fc89ed811e61d74aa5efb0abf22e97533ad543cd47f90455e192d2097dbe798ddbe3834673a67f773aad94bfc745c8a4b41c98001b6f5f05b2cf0e0d7de7539bb9a18fe7cd8e134c13fd00fad91efb5d217a9c557bc11d1c295619689c900751524910aaa95eef4244a8212ed219976d788d0a99f982fef0b34b30f3ec3be28bdf84f460891040e355c71801f123e04dd2a8a76195f8d09feb9b35523e9316f1c878ebc748636e4a735ca54882d3d724d5bd53085cedec5a971e817b05c880e4fff75ca5f1285ca355a1b1dc71757a68f1cdc9e82163a062374c88a986c27ebfdaf963cd4365b2cce3f186f0e95fdf2b4dfbde818a2fa3dd45be67727452bef3589773abe0064a756bdf47537fc6c6571cd2d22421533bac63bbde86e8a23a3082621323f724538f6086f678678f131a47f0b912ca9d1164173e79e7539f9bde248fb42b32b6c854efa7a8f7b9a489c35c87fcd3126b99c1959b851821366577f3a960986ab4b230034b91b1fcd0e4b52b265bb9f06445a7c460a7ec779271f613931811ab3917d377c07434e5a825220d55aecd6ac217bf2579fc924eaefc90e1378ee2536e73496fdf164d5874caca49e233e5ffadf88fed5b69f35977706f80c15305437969d4d9", 0xf5e, 0x41, &(0x7f0000001800)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10) 145.653173ms ago: executing program 0 (id=11912): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd21, 0xfbffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x400) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000001c0)=@newtfilter={0x98, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xfff2, 0xf}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x64, 0x2, [@TCA_MATCHALL_ACT={0x60, 0x2, [@m_ife={0x5c, 0x1, 0x0, 0x0, {{0x8}, {0x34, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x92, 0x4, 0x7, 0xffeffffc}, 0x1}}, @TCA_IFE_METALST={0x14, 0x6, [@IFE_META_SKBMARK={0x8, 0x1, @val=0x6}, @IFE_META_PRIO={0x8, 0x3, @val=0x3}]}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x98}}, 0x4800) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet6(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r6, 0x3f}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\r', 0x1}], 0x1}, 0x4) 145.314701ms ago: executing program 2 (id=11913): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0xc0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0xc0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a540500000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000028050380180000800c00018006000100d10300000800034000000001"], 0x57c}, 0x1, 0x0, 0x0, 0x4000851}, 0x40) 98.050852ms ago: executing program 1 (id=11914): r0 = socket(0x2d, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x2d, 0x0, 0x1f, 0x800}, 0xc, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x40000c8}, 0x4040001) 0s ago: executing program 0 (id=11915): r0 = socket(0x2b, 0x80801, 0x1) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x10000, @loopback, 0x1}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x1e, &(0x7f0000000080)=0x3ff, 0x4) kernel console output (not intermixed with test programs): 20899] tipc: Enabled bearer , priority 10 [ 413.589686][T20903] netlink: 'syz.3.7176': attribute type 2 has an invalid length. [ 414.936782][T20979] veth0: entered promiscuous mode [ 414.960691][T20979] veth0: left promiscuous mode [ 416.772215][T21077] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7256'. [ 416.950008][T21092] netlink: 'syz.3.7263': attribute type 3 has an invalid length. [ 417.871745][T21134] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7282'. [ 418.356755][T21162] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7296'. [ 418.665699][T21176] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7302'. [ 418.826538][T21176] macvtap1: entered promiscuous mode [ 418.832407][T21176] vlan0: entered promiscuous mode [ 418.839039][T21176] macvtap1: entered allmulticast mode [ 418.844791][T21176] vlan0: entered allmulticast mode [ 418.850740][T21176] veth0_vlan: entered allmulticast mode [ 419.656649][T21210] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7318'. [ 419.716208][T21214] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7318'. [ 420.201227][T21241] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7331'. [ 420.849443][T21280] TCP: TCP_TX_DELAY enabled [ 421.368834][T21306] openvswitch: netlink: IPv4 tunnel dst address is zero [ 421.383891][T21306] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 421.446837][T21308] netlink: 'syz.0.7362': attribute type 21 has an invalid length. [ 421.472520][T21308] netlink: 128 bytes leftover after parsing attributes in process `syz.0.7362'. [ 421.503411][T21311] netlink: 'syz.0.7362': attribute type 21 has an invalid length. [ 421.526085][T21308] netlink: 'syz.0.7362': attribute type 4 has an invalid length. [ 421.554231][T21308] netlink: 'syz.0.7362': attribute type 5 has an invalid length. [ 421.566517][T21311] netlink: 128 bytes leftover after parsing attributes in process `syz.0.7362'. [ 421.572609][T21308] netlink: 3 bytes leftover after parsing attributes in process `syz.0.7362'. [ 421.585672][T21316] netlink: 84 bytes leftover after parsing attributes in process `syz.4.7364'. [ 421.603620][T21311] netlink: 'syz.0.7362': attribute type 4 has an invalid length. [ 421.637172][T21311] netlink: 'syz.0.7362': attribute type 5 has an invalid length. [ 421.692347][T21311] netlink: 3 bytes leftover after parsing attributes in process `syz.0.7362'. [ 422.075346][ T5631] block nbd0: Receive control failed (result -32) [ 422.700719][ T5631] block nbd1: Receive control failed (result -32) [ 423.049427][T21393] pim6reg: entered allmulticast mode [ 423.385964][T21410] __nla_validate_parse: 8 callbacks suppressed [ 423.385987][T21410] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7410'. [ 423.438906][T21410] netlink: 'syz.2.7410': attribute type 1 has an invalid length. [ 423.455825][T21410] netlink: 'syz.2.7410': attribute type 2 has an invalid length. [ 423.664336][T21422] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7417'. [ 423.926123][T21440] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7425'. [ 424.275050][T21459] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7436'. [ 424.324544][T21461] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7435'. [ 424.368247][T21461] netlink: 2 bytes leftover after parsing attributes in process `syz.1.7435'. [ 424.448905][T21470] sctp: [Deprecated]: syz.2.7441 (pid 21470) Use of struct sctp_assoc_value in delayed_ack socket option. [ 424.448905][T21470] Use struct sctp_sack_info instead [ 424.613884][T21479] IPv6: NLM_F_CREATE should be specified when creating new route [ 424.784797][T21488] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7449'. [ 424.860241][T21488] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7449'. [ 425.082027][T21505] netlink: 104 bytes leftover after parsing attributes in process `syz.0.7458'. [ 425.096384][T21508] openvswitch: netlink: IP tunnel dst address not specified [ 425.096439][T21508] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 425.478133][T21525] netlink: 'syz.0.7467': attribute type 4 has an invalid length. [ 425.490643][T21528] netlink: 68 bytes leftover after parsing attributes in process `syz.2.7469'. [ 426.355442][T21572] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 426.373764][T21572] syzkaller1: linktype set to 823 [ 426.547124][T21585] netlink: 'syz.3.7496': attribute type 83 has an invalid length. [ 426.574438][T21588] tipc: Invalid UDP bearer configuration [ 426.574491][T21588] tipc: Enabling of bearer rejected, failed to enable media [ 428.542650][T21695] __nla_validate_parse: 6 callbacks suppressed [ 428.542671][T21695] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7547'. [ 428.560775][T21693] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7546'. [ 429.305190][T21739] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7567'. [ 429.972718][T21761] h: entered promiscuous mode [ 430.161613][T21771] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7582'. [ 430.237555][T21775] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7584'. [ 430.474310][T21781] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 430.502406][T21787] netlink: 232 bytes leftover after parsing attributes in process `syz.0.7590'. [ 431.639110][T21850] tipc: Started in network mode [ 431.653254][T21850] tipc: Node identity ac14140f, cluster identity 4711 [ 431.670195][T21850] tipc: New replicast peer: 255.255.255.255 [ 431.690760][T21850] tipc: Enabled bearer , priority 10 [ 432.316651][T21885] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7637'. [ 432.331891][T21890] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7640'. [ 432.488459][T21895] gtp0: entered promiscuous mode [ 432.509322][T21895] gtp0: entered allmulticast mode [ 432.512712][T21899] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7644'. [ 432.571408][T21899] 8021q: adding VLAN 0 to HW filter on device macsec0 [ 432.809959][T17729] tipc: Node number set to 2886997007 [ 432.836442][T21919] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7652'. [ 433.088824][T21927] tap0: tun_chr_ioctl cmd 2148553947 [ 433.247051][T21941] IPv6: Can't replace route, no match found [ 433.275724][T21941] IPv6: Can't replace route, no match found [ 434.141292][T21976] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7680'. [ 434.705176][T22004] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7692'. [ 434.744709][T22004] bond0: (slave team0): Releasing backup interface [ 434.813647][T22004] team0 (unregistering): Port device team_slave_0 removed [ 434.867296][T22004] team0 (unregistering): Port device team_slave_1 removed [ 435.587606][T22055] netlink: 'syz.3.7715': attribute type 1 has an invalid length. [ 435.607619][T22055] netlink: 'syz.3.7715': attribute type 2 has an invalid length. [ 435.626488][T22055] netlink: 'syz.3.7715': attribute type 1 has an invalid length. [ 435.660981][T22055] netlink: 'syz.3.7715': attribute type 2 has an invalid length. [ 435.988394][T22076] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7724'. [ 436.124189][T22083] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7727'. [ 436.144232][T22083] block nbd2: Unsupported socket: should be TCP or UNIX. [ 436.439929][T22100] hsr_slave_0: left promiscuous mode [ 436.450191][T22100] hsr_slave_1: left promiscuous mode [ 436.491786][T22104] erspan0: entered promiscuous mode [ 436.977291][T22132] veth0: entered promiscuous mode [ 436.983383][T22132] veth0: left promiscuous mode [ 437.591903][T22168] netlink: 'syz.4.7769': attribute type 1 has an invalid length. [ 437.628158][T22168] netlink: 'syz.4.7769': attribute type 2 has an invalid length. [ 438.397492][T22218] openvswitch: netlink: IP tunnel dst address not specified [ 438.406211][T22218] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 438.580614][T22228] openvswitch: netlink: Missing key (keys=c0, expected=480) [ 438.856370][T22244] netlink: 244 bytes leftover after parsing attributes in process `syz.4.7805'. [ 439.251126][T22271] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7818'. [ 439.958876][T22310] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7837'. [ 440.060684][T22316] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7839'. [ 440.091839][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.099956][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.176067][T22322] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7841'. [ 440.397687][T22332] netlink: 'syz.2.7846': attribute type 4 has an invalid length. [ 440.836011][T22362] Bluetooth: hci1: too big key_count value 32778 [ 441.634090][T22411] tunl0: entered promiscuous mode [ 441.646541][T22411] netlink: 'syz.3.7885': attribute type 4 has an invalid length. [ 441.660245][T22411] netlink: 9 bytes leftover after parsing attributes in process `syz.3.7885'. [ 441.960793][T22426] netlink: 108 bytes leftover after parsing attributes in process `syz.4.7890'. [ 442.126915][T22431] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7894'. [ 442.161063][T22435] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7895'. [ 442.194169][T22435] netlink: 176 bytes leftover after parsing attributes in process `syz.0.7895'. [ 442.218763][T22435] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7895'. [ 442.701175][T22457] netlink: 'syz.2.7906': attribute type 14 has an invalid length. [ 443.022329][T22471] syz.2.7910: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 443.052504][T22471] CPU: 1 UID: 0 PID: 22471 Comm: syz.2.7910 Not tainted syzkaller #0 PREEMPT(full) [ 443.052537][T22471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 443.052559][T22471] Call Trace: [ 443.052649][T22471] [ 443.052720][T22471] dump_stack_lvl+0xe8/0x150 [ 443.052905][T22471] warn_alloc+0x24c/0x270 [ 443.052961][T22471] ? stack_depot_save_flags+0x33/0x800 [ 443.053107][T22471] ? __pfx_warn_alloc+0x10/0x10 [ 443.053138][T22471] ? kasan_save_track+0x3e/0x80 [ 443.053184][T22471] ? __kasan_kmalloc+0x93/0xb0 [ 443.053216][T22471] ? xsk_setsockopt+0x52a/0x960 [ 443.053311][T22471] ? do_sock_setsockopt+0x17c/0x1b0 [ 443.053413][T22471] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 443.053434][T22471] ? do_syscall_64+0x174/0x580 [ 443.053503][T22471] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.053553][T22471] __vmalloc_node_range_noprof+0x12c/0x1730 [ 443.053614][T22471] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 443.053646][T22471] ? __kasan_kmalloc+0x93/0xb0 [ 443.053679][T22471] ? __kmalloc_cache_noprof+0x32d/0x660 [ 443.053714][T22471] ? __kmalloc_cache_noprof+0x150/0x660 [ 443.053746][T22471] vmalloc_user_noprof+0xad/0xe0 [ 443.053778][T22471] ? xskq_create+0xbf/0x170 [ 443.053802][T22471] xskq_create+0xbf/0x170 [ 443.053828][T22471] xsk_init_queue+0x8a/0xe0 [ 443.053853][T22471] xsk_setsockopt+0x52a/0x960 [ 443.053873][T22471] ? __fget_files+0x2a/0x420 [ 443.053920][T22471] ? __pfx_xsk_setsockopt+0x10/0x10 [ 443.053979][T22471] ? __pfx_aa_sk_perm+0x10/0x10 [ 443.054062][T22471] ? aa_sock_opt_perm+0xff/0x1a0 [ 443.054090][T22471] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 443.054138][T22471] ? __pfx_xsk_setsockopt+0x10/0x10 [ 443.054174][T22471] do_sock_setsockopt+0x17c/0x1b0 [ 443.054202][T22471] __x64_sys_setsockopt+0x13d/0x1b0 [ 443.054235][T22471] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.054259][T22471] do_syscall_64+0x174/0x580 [ 443.054283][T22471] ? trace_irq_disable+0x3b/0x140 [ 443.054327][T22471] ? clear_bhb_loop+0x40/0x90 [ 443.054355][T22471] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.054377][T22471] RIP: 0033:0x7fb26f79de99 [ 443.054426][T22471] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 443.054445][T22471] RSP: 002b:00007fb27058b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 443.054500][T22471] RAX: ffffffffffffffda RBX: 00007fb26fa25fa0 RCX: 00007fb26f79de99 [ 443.054516][T22471] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 443.054530][T22471] RBP: 00007fb26f833eaf R08: 0000000000000004 R09: 0000000000000000 [ 443.054543][T22471] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 443.054557][T22471] R13: 00007fb26fa26038 R14: 00007fb26fa25fa0 R15: 00007fff9b7dbf58 [ 443.054594][T22471] [ 443.056643][T22471] Mem-Info: [ 443.359823][T22471] active_anon:5626 inactive_anon:0 isolated_anon:0 [ 443.359823][T22471] active_file:1 inactive_file:43175 isolated_file:0 [ 443.359823][T22471] unevictable:768 dirty:322 writeback:0 [ 443.359823][T22471] slab_reclaimable:11165 slab_unreclaimable:104767 [ 443.359823][T22471] mapped:29182 shmem:1662 pagetables:1149 [ 443.359823][T22471] sec_pagetables:0 bounce:0 [ 443.359823][T22471] kernel_misc_reclaimable:0 [ 443.359823][T22471] free:1317333 free_pcp:10703 free_cma:0 [ 443.430946][T22471] Node 0 active_anon:20904kB inactive_anon:0kB active_file:4kB inactive_file:172496kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116728kB dirty:1288kB writeback:0kB shmem:3712kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:12732kB pagetables:4452kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 443.479200][T22471] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:144kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 443.513339][T22471] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 443.555989][T22471] lowmem_reserve[]: 0 2488 2489 2489 2489 [ 443.569691][T22471] Node 0 DMA32 free:1312316kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:20904kB inactive_anon:0kB active_file:4kB inactive_file:172496kB unevictable:1536kB writepending:1288kB zspages:0kB present:3129332kB managed:2548576kB mlocked:0kB bounce:0kB free_pcp:44520kB local_pcp:24908kB free_cma:0kB [ 443.605669][T22471] lowmem_reserve[]: 0 0 0 0 0 [ 443.611883][T22471] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:260kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 443.656856][T22471] lowmem_reserve[]: 0 0 0 0 0 [ 443.667128][T22471] Node 1 Normal free:3941656kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 443.727756][T22471] lowmem_reserve[]: 0 0 0 0 0 [ 443.740554][T22471] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 443.757125][T22471] Node 0 DMA32: 452*4kB (UM) 237*8kB (UM) 489*16kB (UM) 358*32kB (UME) 71*64kB (UME) 96*128kB (UME) 37*256kB (UME) 7*512kB (UM) 4*1024kB (UME) 1*2048kB (E) 306*4096kB (UM) = 1312392kB [ 443.789426][T22471] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 443.812478][T22471] Node 1 Normal: 2*4kB (UM) 6*8kB (UM) 6*16kB (UM) 6*32kB (UM) 7*64kB (UM) 4*128kB (UM) 4*256kB (UM) 2*512kB (M) 2*1024kB (UM) 0*2048kB 961*4096kB (UM) = 3941656kB [ 443.861138][T22471] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 443.887680][T22471] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 443.936430][T22471] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 443.979116][T22471] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 444.010597][T22471] 45279 total pagecache pages [ 444.016084][T22471] 0 pages in swap cache [ 444.027473][T22471] Free swap = 124996kB [ 444.037285][T22471] Total swap = 124996kB [ 444.055993][T22471] 2097051 pages RAM [ 444.064319][T22471] 0 pages HighMem/MovableOnly [ 444.078109][T22471] 428227 pages reserved [ 444.090827][T22471] 0 pages cma reserved [ 444.270177][T22505] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7925'. [ 444.328337][T22507] netlink: 104 bytes leftover after parsing attributes in process `syz.1.7927'. [ 444.905080][T22545] block nbd0: Unsupported socket: should be TCP or UNIX. [ 445.176351][T22562] netlink: 68 bytes leftover after parsing attributes in process `syz.3.7952'. [ 445.600419][T22587] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7963'. [ 445.851939][T22602] netlink: 'syz.2.7970': attribute type 11 has an invalid length. [ 446.401092][T22633] netlink: 'syz.4.7984': attribute type 4 has an invalid length. [ 446.593326][T22647] netlink: 'syz.0.7989': attribute type 1 has an invalid length. [ 446.623803][T22647] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.7989'. [ 446.641286][T22647] netlink: 'syz.0.7989': attribute type 1 has an invalid length. [ 446.680040][T22647] netlink: 2016 bytes leftover after parsing attributes in process `syz.0.7989'. [ 447.044725][T22670] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8000'. [ 447.184521][T22677] bond1 (unregistering): Released all slaves [ 447.655487][T22710] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8020'. [ 448.016711][T22731] sctp: [Deprecated]: syz.2.8031 (pid 22731) Use of int in max_burst socket option. [ 448.016711][T22731] Use struct sctp_assoc_value instead [ 448.331317][T22749] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 448.452909][T22756] netlink: 108 bytes leftover after parsing attributes in process `syz.3.8043'. [ 448.468652][T22760] netlink: 16402 bytes leftover after parsing attributes in process `syz.0.8042'. [ 448.607212][T22769] hsr_slave_0: left promiscuous mode [ 448.620152][T22769] hsr_slave_1: left promiscuous mode [ 448.798730][T22773] netlink: 'syz.3.8052': attribute type 3 has an invalid length. [ 448.951880][T22783] 8021q: adding VLAN 0 to HW filter on device bond3 [ 448.962415][T22783] bond0: (slave bond3): Enslaving as an active interface with a down link [ 449.221339][T22801] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 449.229644][T22801] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 449.295920][T22803] __nla_validate_parse: 4 callbacks suppressed [ 449.295939][T22803] netlink: 248 bytes leftover after parsing attributes in process `syz.3.8064'. [ 449.343748][ T187] IPVS: starting estimator thread 0... [ 449.420488][T22810] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8067'. [ 449.448372][T22806] IPVS: using max 30 ests per chain, 72000 per kthread [ 449.501050][T22813] netlink: 71 bytes leftover after parsing attributes in process `syz.3.8068'. [ 449.799291][T22832] netlink: 168 bytes leftover after parsing attributes in process `syz.1.8077'. [ 450.031316][T22846] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8084'. [ 450.058960][T22846] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8084'. [ 450.143386][T22850] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8086'. [ 450.332419][T22866] ip6gre0: Master is either lo or non-ether device [ 450.490559][T22873] team0: Device gtp0 is of different type [ 451.070135][T22910] netlink: 236 bytes leftover after parsing attributes in process `syz.4.8115'. [ 451.079593][T22910] netlink: 236 bytes leftover after parsing attributes in process `syz.4.8115'. [ 451.131108][T22913] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8116'. [ 451.851461][T22954] netlink: 'syz.1.8134': attribute type 1 has an invalid length. [ 451.880713][T22954] netlink: 'syz.1.8134': attribute type 2 has an invalid length. [ 452.484286][ T5631] block nbd2: Receive control failed (result -32) [ 452.491636][ T50] block nbd2: Receive control failed (result -32) [ 455.928412][T23175] __nla_validate_parse: 6 callbacks suppressed [ 455.928433][T23175] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8237'. [ 455.990264][T23175] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8237'. [ 456.256023][T23190] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8246'. [ 456.275431][T23190] netlink: 'syz.2.8246': attribute type 30 has an invalid length. [ 456.295217][T23190] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8246'. [ 456.722529][T23224] netlink: 'syz.2.8259': attribute type 30 has an invalid length. [ 457.074317][T23242] tap0: tun_chr_ioctl cmd 1074025672 [ 457.084290][T23242] tap0: ignored: set checksum disabled [ 457.814844][T23282] netlink: 196 bytes leftover after parsing attributes in process `syz.1.8287'. [ 458.266996][T23294] netlink: 'syz.3.8292': attribute type 4 has an invalid length. [ 458.673607][T23312] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8298'. [ 458.857719][T23321] tipc: Started in network mode [ 458.880236][T23321] tipc: Node identity ac14140f, cluster identity 4711 [ 458.916104][T23321] tipc: New replicast peer: 255.255.255.255 [ 458.937546][T23321] tipc: Enabled bearer , priority 10 [ 459.056289][T23330] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8309'. [ 459.139897][T23338] netlink: 52 bytes leftover after parsing attributes in process `syz.2.8312'. [ 459.160880][T23339] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8310'. [ 459.325898][T23350] netlink: 'syz.3.8317': attribute type 19 has an invalid length. [ 459.922095][T23387] netlink: 10 bytes leftover after parsing attributes in process `syz.3.8335'. [ 460.048051][ T9] tipc: Node number set to 2886997007 [ 461.076688][T23436] __nla_validate_parse: 1 callbacks suppressed [ 461.076710][T23436] netlink: 576 bytes leftover after parsing attributes in process `syz.4.8357'. [ 461.125819][T23437] netlink: 60 bytes leftover after parsing attributes in process `syz.2.8356'. [ 461.332401][T23446] netlink: 32 bytes leftover after parsing attributes in process `syz.1.8362'. [ 461.720318][T23467] bond3: entered promiscuous mode [ 461.899539][T23483] sch_tbf: peakrate 4 is lower than or equals to rate 24576 ! [ 461.983691][T23486] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8382'. [ 462.123416][T23496] netlink: 104 bytes leftover after parsing attributes in process `syz.0.8388'. [ 462.259742][T23504] netlink: 'syz.0.8391': attribute type 1 has an invalid length. [ 462.290100][T23504] netlink: 'syz.0.8391': attribute type 3 has an invalid length. [ 462.310383][T23504] netlink: 'syz.0.8391': attribute type 7 has an invalid length. [ 462.330363][T23504] netlink: 'syz.0.8391': attribute type 8 has an invalid length. [ 462.350609][T23504] netlink: 184 bytes leftover after parsing attributes in process `syz.0.8391'. [ 462.371717][T23504] NCSI netlink: No device for ifindex 131092 [ 462.440973][T23516] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8395'. [ 462.659292][T23530] netlink: 'syz.0.8404': attribute type 4 has an invalid length. [ 463.988674][T23613] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8443'. [ 464.008801][T23613] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8443'. [ 464.116213][T23620] netlink: 44 bytes leftover after parsing attributes in process `syz.1.8445'. [ 464.305583][T23633] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 464.312971][T23633] IPv6: NLM_F_CREATE should be set when creating new route [ 464.320303][T23633] IPv6: NLM_F_CREATE should be set when creating new route [ 464.356207][T23633] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 466.071168][T23744] netlink: 'syz.1.8502': attribute type 10 has an invalid length. [ 466.124799][T23744] team0: Port device dummy0 added [ 466.650044][T23778] __nla_validate_parse: 4 callbacks suppressed [ 466.650066][T23778] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8520'. [ 467.140520][T23811] openvswitch: netlink: Message has 12 unknown bytes. [ 467.147569][T23811] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 467.183342][T23814] mac80211_hwsim hwsim4 wlan0: entered promiscuous mode [ 467.205838][T23814] batman_adv: batadv0: Adding interface: wlan0 [ 467.226044][T23814] batman_adv: batadv0: The MTU of interface wlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 467.267697][T23814] batman_adv: batadv0: Interface activated: wlan0 [ 467.506152][T23826] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 468.076516][T23850] netlink: 27 bytes leftover after parsing attributes in process `syz.0.8551'. [ 468.219941][T23855] netlink: 16178 bytes leftover after parsing attributes in process `syz.0.8554'. [ 469.490337][T23937] netlink: 'syz.4.8593': attribute type 11 has an invalid length. [ 469.852685][T23954] syzkaller1: tun_chr_ioctl cmd 1074025678 [ 469.868068][T23954] syzkaller1: group set to 0 [ 469.992539][ T30] audit: type=1804 audit(1785320437.983:6): pid=23964 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.8604" name="/newroot/1696/cgroup.controllers" dev="tmpfs" ino=8526 res=1 errno=0 [ 470.049234][T23967] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8607'. [ 470.056345][ T30] audit: type=1800 audit(1785320437.983:7): pid=23964 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.8604" name="cgroup.controllers" dev="tmpfs" ino=8526 res=0 errno=0 [ 470.630580][ T5824] IPVS: starting estimator thread 0... [ 470.728258][T24003] IPVS: using max 29 ests per chain, 69600 per kthread [ 471.282559][T24039] sctp: [Deprecated]: syz.0.8637 (pid 24039) Use of int in max_burst socket option deprecated. [ 471.282559][T24039] Use struct sctp_assoc_value instead [ 471.370613][T24045] bridge0: port 3(dummy0) entered blocking state [ 471.391198][T24045] bridge0: port 3(dummy0) entered disabled state [ 471.401661][T24045] dummy0: entered allmulticast mode [ 471.437261][T24045] dummy0: entered promiscuous mode [ 471.686891][T24059] xt_hashlimit: size too large, truncated to 1048576 [ 472.148533][T24082] netlink: 'syz.2.8658': attribute type 1 has an invalid length. [ 472.176697][T24082] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8658'. [ 472.692465][T24117] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8676'. [ 474.504520][T24229] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8729'. [ 475.187795][T24272] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 475.194420][T24272] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 475.552751][T24293] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8759'. [ 475.952864][T24316] netlink: 'syz.4.8771': attribute type 83 has an invalid length. [ 476.128659][T24328] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8775'. [ 476.655625][T24363] tipc: Can't add remote ip to TIPC UDP multicast bearer [ 476.702921][T24366] batman_adv: batadv0: Interface deactivated: wlan0 [ 477.366862][T24405] veth1_vlan (unregistering): left allmulticast mode [ 477.506043][T24405] vlan1 (unregistering): left allmulticast mode [ 477.512509][T24405] veth0_vlan (unregistering): left allmulticast mode [ 477.650904][T24413] syzkaller1: entered promiscuous mode [ 477.656649][T24413] syzkaller1: entered allmulticast mode [ 477.763480][T24421] sctp: [Deprecated]: syz.3.8815 (pid 24421) Use of struct sctp_assoc_value in delayed_ack socket option. [ 477.763480][T24421] Use struct sctp_sack_info instead [ 477.898105][T24427] geneve3: entered promiscuous mode [ 477.910757][ T3329] netdevsim netdevsim3 netdevsim0: set [1, 1] type 2 family 0 port 60493 - 0 [ 477.988881][ T3329] netdevsim netdevsim3 netdevsim1: set [1, 1] type 2 family 0 port 60493 - 0 [ 478.014828][ T3329] netdevsim netdevsim3 netdevsim2: set [1, 1] type 2 family 0 port 60493 - 0 [ 478.409351][ C1] vcan0: j1939_tp_rxtimer: 0xffff888033185000: rx timeout, send abort [ 478.420934][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888033185000: 0x40000: (3) A timeout occurred and this is the connection abort to close the session. [ 479.291118][T24505] veth0: entered promiscuous mode [ 479.314472][T24509] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8853'. [ 479.331221][T24502] veth0: left promiscuous mode [ 479.363226][ T30] audit: type=1800 audit(1785320447.363:8): pid=24511 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.8854" name="memory.events" dev="tmpfs" ino=8753 res=0 errno=0 [ 479.844096][T24534] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8865'. [ 479.941933][T24541] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8869'. [ 480.060019][T24546] syzkaller1: entered promiscuous mode [ 480.074680][T24546] syzkaller1: entered allmulticast mode [ 480.200623][T24554] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8874'. [ 480.891237][T24601] syzkaller1: entered promiscuous mode [ 480.910228][T24601] syzkaller1: entered allmulticast mode [ 481.402836][T24627] IPVS: wrr: UDP 224.0.0.2:0 - no destination available [ 481.893038][T24656] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8921'. [ 481.923235][T24656] netlink: 'syz.1.8921': attribute type 10 has an invalid length. [ 481.939217][T24656] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8921'. [ 482.425964][T24695] openvswitch: netlink: ct_state flags ffffffff unsupported [ 482.624889][T24705] netlink: 'syz.4.8941': attribute type 63 has an invalid length. [ 482.654109][T24705] netlink: 'syz.4.8941': attribute type 63 has an invalid length. [ 482.682292][T24709] netlink: 144 bytes leftover after parsing attributes in process `syz.3.8943'. [ 483.536925][T24757] IPv6: NLM_F_CREATE should be specified when creating new route [ 483.559982][T24757] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 483.567321][T24757] IPv6: NLM_F_CREATE should be set when creating new route [ 483.702115][T24764] smc: net device lo erased user defined pnetid SYZ0 [ 483.837133][T24766] 8021q: adding VLAN 0 to HW filter on device bond0 [ 483.850958][T24766] 8021q: adding VLAN 0 to HW filter on device team0 [ 483.866175][T24766] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 483.959562][T24766] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 483.969993][T24766] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 483.996305][T17729] lo speed is unknown, defaulting to 1000 [ 484.005491][ T93] bridge0: port 1(1¾x9ÿ) entered blocking state [ 484.012053][ T93] bridge0: port 1(1¾x9ÿ) entered forwarding state [ 484.021260][T17729] syú2: Port: 1 Link ACTIVE [ 484.046396][ T93] bridge0: port 2(bridge_slave_1) entered blocking state [ 484.053687][ T93] bridge0: port 2(bridge_slave_1) entered forwarding state [ 484.100707][T24773] netlink: 'syz.4.8972': attribute type 12 has an invalid length. [ 484.121780][T24773] netlink: 'syz.4.8972': attribute type 29 has an invalid length. [ 484.136872][T24773] netlink: 148 bytes leftover after parsing attributes in process `syz.4.8972'. [ 484.159378][T24773] netlink: 'syz.4.8972': attribute type 3 has an invalid length. [ 484.183163][T24773] netlink: 'syz.4.8972': attribute type 2 has an invalid length. [ 484.204661][T24773] netlink: 35 bytes leftover after parsing attributes in process `syz.4.8972'. [ 484.825819][T24812] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8989'. [ 484.857220][T24812] macsec2: entered promiscuous mode [ 484.862792][T24812] bridge0: entered promiscuous mode [ 484.869112][T24812] macsec2: entered allmulticast mode [ 484.875436][T24812] bridge0: entered allmulticast mode [ 484.882931][T24812] bridge0: port 1(macsec2) entered blocking state [ 484.893221][T24812] bridge0: port 1(macsec2) entered disabled state [ 484.912652][T24812] bridge0: left allmulticast mode [ 484.942574][ T9] bridge0: left promiscuous mode [ 485.042353][T24819] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8993'. [ 485.783779][T24858] xt_hashlimit: size too large, truncated to 1048576 [ 485.855209][T24861] netlink: 45349 bytes leftover after parsing attributes in process `syz.4.9011'. [ 485.902072][T24861] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 485.941104][T24861] 0ªX¹¦Dö»: entered allmulticast mode [ 486.368950][T24881] af_packet: tpacket_rcv: packet too big, clamped from 39 to 4294967272. macoff=96 [ 487.155070][T24930] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9041'. [ 487.182117][T24930] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9041'. [ 487.235004][T24935] batadv_slave_0: entered allmulticast mode [ 487.266681][T24936] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9046'. [ 487.338824][ T50] block nbd3: Receive control failed (result -107) [ 487.471038][T24940] netlink: 'syz.1.9049': attribute type 3 has an invalid length. [ 487.808384][T24966] netlink: 40 bytes leftover after parsing attributes in process `syz.4.9057'. [ 488.199289][T24989] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9066'. [ 488.400305][T24998] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9071'. [ 488.497843][T25007] netlink: 36 bytes leftover after parsing attributes in process `syz.1.9074'. [ 488.715462][T25018] netlink: 'syz.3.9079': attribute type 1 has an invalid length. [ 489.751434][T25078] block nbd4: NBD_DISCONNECT [ 490.068332][T25094] lo: left allmulticast mode [ 490.076604][T25094] tunl0: left allmulticast mode [ 490.091875][T25094] gre0: left allmulticast mode [ 490.102244][T25094] gretap0: left allmulticast mode [ 490.112379][T25094] erspan0: left allmulticast mode [ 490.124288][T25094] ip_vti0: left allmulticast mode [ 490.135301][T25094] ip6_vti0: left allmulticast mode [ 490.146983][T25094] sit0: left allmulticast mode [ 490.167387][T25094] ip6tnl0: left allmulticast mode [ 490.175856][T25094] ip6gre0: left allmulticast mode [ 490.182154][T25094] syz_tun: left allmulticast mode [ 491.124676][T25094] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 491.149487][T25101] syz_tun: entered allmulticast mode [ 491.159386][T25101] syz_tun: left allmulticast mode [ 491.184660][T25113] bond0: invalid NS target ff00:: specified for addition [ 491.198377][T25113] bond0: option ns_ip6_target: invalid value (18446744073709551615) [ 491.210860][ T5824] xfrm0 speed is unknown, defaulting to 1000 [ 491.218863][ T36] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 491.243279][ T5817] syz1: Port: 1 Link DOWN [ 491.250903][ T5824] syz2: Port: 1 Link DOWN [ 491.260648][ T36] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 491.309094][ T36] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 491.358088][ T36] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 491.827018][T25152] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 491.848751][T18692] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 492.217909][T25171] __nla_validate_parse: 10 callbacks suppressed [ 492.217931][T25171] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9148'. [ 492.461210][T18692] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 492.954968][T25217] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9171'. [ 492.984433][T25217] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9171'. [ 493.251974][T25238] syzkaller1: entered promiscuous mode [ 493.258563][T25238] syzkaller1: entered allmulticast mode [ 494.075940][T25286] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 494.115175][T25290] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9204'. [ 494.146753][T25290] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 494.247769][T25290] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 494.882462][T25335] sctp: [Deprecated]: syz.4.9221 (pid 25335) Use of int in max_burst socket option deprecated. [ 494.882462][T25335] Use struct sctp_assoc_value instead [ 495.100876][T25344] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9229'. [ 495.121887][T25344] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9229'. [ 495.662671][T25378] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9243'. [ 495.848741][T25387] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9246'. [ 495.869396][T25390] sctp: [Deprecated]: syz.0.9249 (pid 25390) Use of int in max_burst socket option. [ 495.869396][T25390] Use struct sctp_assoc_value instead [ 495.923039][ T50] block nbd4: Receive control failed (result -107) [ 496.180302][T25404] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9255'. [ 496.205504][T25404] netlink: 24 bytes leftover after parsing attributes in process `syz.2.9255'. [ 496.267234][T25410] netlink: 'syz.1.9258': attribute type 1 has an invalid length. [ 496.733505][T25437] netlink: 'syz.3.9270': attribute type 2 has an invalid length. [ 496.757959][T25437] netlink: 'syz.3.9270': attribute type 2 has an invalid length. [ 496.954150][T25447] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 497.428944][T25471] __nla_validate_parse: 5 callbacks suppressed [ 497.428966][T25471] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9285'. [ 497.654815][T25479] syzkaller1: entered allmulticast mode [ 497.681259][T25481] netlink: 'syz.0.9290': attribute type 17 has an invalid length. [ 497.690649][T25481] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9290'. [ 497.701237][T25481] netlink: 28 bytes leftover after parsing attributes in process `syz.0.9290'. [ 497.779821][T25481] gretap0: entered promiscuous mode [ 497.803987][T25481] gretap0: left promiscuous mode [ 497.973005][T25499] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9299'. [ 497.982587][T25499] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9299'. [ 498.328083][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 498.642304][T25533] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9314'. [ 498.653837][T25533] netlink: 65011 bytes leftover after parsing attributes in process `syz.0.9314'. [ 498.744702][T25539] netlink: 64 bytes leftover after parsing attributes in process `syz.4.9317'. [ 498.916145][T25549] netlink: 20 bytes leftover after parsing attributes in process `syz.2.9321'. [ 499.627153][T25590] blkio.reset_stats is deprecated [ 500.353576][ T5824] xfrm0 speed is unknown, defaulting to 1000 [ 500.800963][T25661] IPVS: Scheduler module ip_vs_sip not found [ 501.350731][T25698] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 501.362729][T25698] gretap3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 501.371885][T25698] gretap3: entered promiscuous mode [ 501.377576][T25698] gretap3: entered allmulticast mode [ 501.531339][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.538797][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.226742][T25746] sctp: [Deprecated]: syz.0.9409 (pid 25746) Use of struct sctp_assoc_value in delayed_ack socket option. [ 502.226742][T25746] Use struct sctp_sack_info instead [ 502.360134][T25753] netlink: 27 bytes leftover after parsing attributes in process `syz.1.9411'. [ 502.572196][T25761] erspan0: left allmulticast mode [ 502.590725][T25761] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9413'. [ 502.679069][T25764] syzkaller1: entered promiscuous mode [ 502.685897][T25764] syzkaller1: entered allmulticast mode [ 502.802375][T25770] syzkaller1: entered promiscuous mode [ 502.808918][T25770] syzkaller1: entered allmulticast mode [ 503.217248][T25794] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9427'. [ 503.349302][T25800] block nbd3: reconnected socket [ 503.372622][ T50] block nbd3: Receive control failed (result -32) [ 503.412300][T25805] netlink: 68 bytes leftover after parsing attributes in process `syz.4.9431'. [ 503.537105][T25813] netlink: 12 bytes leftover after parsing attributes in process `syz.3.9436'. [ 503.546484][T25813] block nbd5: Unsupported socket: should be TCP or UNIX. [ 503.807174][T25830] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9445'. [ 504.070049][T25844] tipc: Started in network mode [ 504.078295][T25844] tipc: Node identity ac14142f, cluster identity 4711 [ 504.085714][T25844] tipc: New replicast peer: 172.20.20.170 [ 504.092588][T25844] tipc: Enabled bearer , priority 10 [ 504.103036][T25844] tipc: New replicast peer: 0.0.0.0 [ 504.393985][T25861] netlink: 'syz.1.9459': attribute type 1 has an invalid length. [ 504.432343][T25861] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9459'. [ 504.607454][T25877] netlink: 256 bytes leftover after parsing attributes in process `syz.3.9467'. [ 504.616958][T25877] netlink: 256 bytes leftover after parsing attributes in process `syz.3.9467'. [ 505.001811][T25897] syzkaller1: entered promiscuous mode [ 505.007704][T25897] syzkaller1: entered allmulticast mode [ 505.094058][T17729] tipc: Node number set to 2886997039 [ 505.428797][T25917] xt_hashlimit: size too large, truncated to 1048576 [ 505.825812][T25941] netlink: 68 bytes leftover after parsing attributes in process `syz.1.9495'. [ 505.836735][T25941] netlink: 12 bytes leftover after parsing attributes in process `syz.1.9495'. [ 505.865328][T25944] netlink: 'syz.0.9496': attribute type 64 has an invalid length. [ 505.875282][T25944] netlink: 'syz.0.9496': attribute type 64 has an invalid length. [ 505.946705][T25946] veth0: entered promiscuous mode [ 505.966408][T25945] veth0: left promiscuous mode [ 506.867196][T26000] smc: removing net device team0 with user defined pnetid SYZ2 [ 506.884438][T26000] team0 (unregistering): Port device team_slave_0 removed [ 506.910391][T26000] team0 (unregistering): Port device team_slave_1 removed [ 507.109284][T26017] netlink: 'syz.3.9531': attribute type 8 has an invalid length. [ 508.329372][T26088] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9564'. [ 508.344478][T26088] netlink: 'syz.0.9564': attribute type 10 has an invalid length. [ 508.377968][T26088] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9564'. [ 508.581989][T26100] netlink: 2 bytes leftover after parsing attributes in process `syz.0.9569'. [ 509.343503][T26140] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9588'. [ 509.433358][T26145] siw: device registration error -23 [ 509.495148][T26147] netlink: 'syz.1.9591': attribute type 39 has an invalid length. [ 509.661408][T26159] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9596'. [ 509.670794][T26159] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9596'. [ 509.964921][T26172] netlink: 84 bytes leftover after parsing attributes in process `syz.2.9598'. [ 510.289158][T26190] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 511.183654][T26246] netlink: 104 bytes leftover after parsing attributes in process `syz.4.9631'. [ 511.387120][T26260] veth1_to_bond: entered allmulticast mode [ 511.420872][T26260] veth1_to_bond: entered promiscuous mode [ 511.493718][T26260] veth1_to_bond: left promiscuous mode [ 511.503876][T26260] veth1_to_bond: left allmulticast mode [ 511.919400][T26286] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 512.564721][T26319] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 512.591993][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 512.679326][T26326] veth1_to_bond: entered allmulticast mode [ 512.698319][T26325] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9664'. [ 512.710616][T26326] veth1_to_bond: entered promiscuous mode [ 512.740799][T26326] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9663'. [ 512.846708][T26326] veth1_to_bond (unregistering): left allmulticast mode [ 512.858158][T26326] veth1_to_bond (unregistering): left promiscuous mode [ 512.894130][T26326] bond0: (slave bond_slave_1): Releasing backup interface [ 513.248377][ C1] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 513.340371][T26352] netlink: 'syz.2.9675': attribute type 1 has an invalid length. [ 513.478530][T26352] 8021q: adding VLAN 0 to HW filter on device bond4 [ 513.513164][T26354] bond4: (slave geneve3): making interface the new active one [ 513.523225][T26354] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 513.638088][ T93] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 513.704532][ T93] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 513.749214][ T3329] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 513.767431][ T3329] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 513.824484][T26370] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9684'. [ 514.124651][T26392] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9693'. [ 514.145241][T26392] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9693'. [ 514.212660][T26392] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9693'. [ 514.228207][ T755] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 514.246947][T26392] netlink: 12 bytes leftover after parsing attributes in process `syz.2.9693'. [ 514.253252][ T755] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 514.277298][ T755] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 514.319466][ T755] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 514.328638][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 514.430506][T26405] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9700'. [ 514.679644][T26420] netlink: 'syz.0.9706': attribute type 14 has an invalid length. [ 514.697496][T26423] netlink: 'syz.2.9708': attribute type 11 has an invalid length. [ 514.716043][T26420] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9706'. [ 514.749170][T26420] netlink: 'syz.0.9706': attribute type 14 has an invalid length. [ 514.771464][T26420] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9706'. [ 515.084516][T26441] bond0: invalid NS target :: specified for addition [ 515.112164][T26441] bond0: option ns_ip6_target: invalid value (18446744073709551615) [ 515.262689][T26446] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9720'. [ 515.320467][T26456] ip6gre1: entered promiscuous mode [ 515.350597][T26456] ip6gre1: entered allmulticast mode [ 516.259773][T26510] netlink: 40 bytes leftover after parsing attributes in process `syz.2.9747'. [ 516.287166][T26512] netlink: 'syz.0.9748': attribute type 21 has an invalid length. [ 516.295250][T26512] netlink: 'syz.0.9748': attribute type 22 has an invalid length. [ 516.303634][T26512] netlink: 'syz.0.9748': attribute type 23 has an invalid length. [ 516.312207][T26512] netlink: 'syz.0.9748': attribute type 25 has an invalid length. [ 516.320717][T26512] netlink: 'syz.0.9748': attribute type 26 has an invalid length. [ 516.390177][T26516] netlink: 'syz.0.9750': attribute type 7 has an invalid length. [ 516.417907][T26516] netlink: 'syz.0.9750': attribute type 7 has an invalid length. [ 516.428110][ T755] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.439687][ T755] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.462982][ T755] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.479623][ T755] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 516.553101][T26521] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 516.560259][T26521] syzkaller1: Refused to change device type [ 517.396166][T26547] trusted_key: syz.2.9762 sent an empty control message without MSG_MORE. [ 518.924493][T26605] netlink: 'syz.0.9788': attribute type 1 has an invalid length. [ 519.200333][T26605] bond4: entered promiscuous mode [ 519.229825][T26605] 8021q: adding VLAN 0 to HW filter on device bond4 [ 519.395766][T26625] __nla_validate_parse: 3 callbacks suppressed [ 519.395785][T26625] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9797'. [ 519.431494][T26625] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9797'. [ 519.697072][T26644] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9804'. [ 519.758836][T26637] "syz.1.9802" (26637) uses obsolete ecb(arc4) skcipher [ 520.035034][T26659] netlink: 20 bytes leftover after parsing attributes in process `syz.1.9810'. [ 520.513149][T26682] netlink: 4 bytes leftover after parsing attributes in process `syz.1.9820'. [ 520.724793][T26695] netlink: 8 bytes leftover after parsing attributes in process `syz.1.9823'. [ 520.743943][T26694] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9824'. [ 521.215041][T26718] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9832'. [ 521.225010][T26718] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9832'. [ 521.234449][T26718] netlink: 'syz.0.9832': attribute type 15 has an invalid length. [ 521.289527][T26718] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9832'. [ 521.299097][ T93] netdevsim netdevsim0 netdevsim3: set [0, 1] type 1 family 0 port 256 - 0 [ 521.309197][ T93] netdevsim netdevsim0 netdevsim2: set [0, 1] type 1 family 0 port 256 - 0 [ 521.319577][T26718] netlink: 'syz.0.9832': attribute type 15 has an invalid length. [ 521.330057][ T93] netdevsim netdevsim0 netdevsim1: set [0, 1] type 1 family 0 port 256 - 0 [ 521.340256][ T93] netdevsim netdevsim0 netdevsim0: set [0, 1] type 1 family 0 port 256 - 0 [ 521.887028][T26752] syz_tun: entered allmulticast mode [ 521.894943][T26751] syz_tun: left allmulticast mode [ 522.855586][T26804] netlink: 'syz.4.9864': attribute type 1 has an invalid length. [ 523.240539][T26804] 8021q: adding VLAN 0 to HW filter on device bond1 [ 523.264024][T26808] bond1: (slave gretap0): making interface the new active one [ 523.273276][T26808] bond1: (slave gretap0): Enslaving as an active interface with an up link [ 523.283814][T26801] syzkaller1: entered promiscuous mode [ 523.290784][T26801] syzkaller1: entered allmulticast mode [ 523.500031][T26822] netlink: 'syz.4.9871': attribute type 1 has an invalid length. [ 523.523305][T26822] netlink: 'syz.4.9871': attribute type 2 has an invalid length. [ 523.763372][T26831] netlink: 'syz.0.9875': attribute type 13 has an invalid length. [ 523.772039][T26831] netlink: 'syz.0.9875': attribute type 13 has an invalid length. [ 524.622844][T26858] batadv_slave_0: left allmulticast mode [ 525.474009][T26892] __nla_validate_parse: 16 callbacks suppressed [ 525.474029][T26892] netlink: 4 bytes leftover after parsing attributes in process `syz.4.9905'. [ 525.863908][T26914] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9915'. [ 525.898185][T26914] netlink: 'syz.3.9915': attribute type 6 has an invalid length. [ 525.922014][T26914] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9915'. [ 525.942435][T26914] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9915'. [ 525.952082][T26914] netlink: 'syz.3.9915': attribute type 6 has an invalid length. [ 525.960961][T26914] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9915'. [ 526.023617][ T30] audit: type=1800 audit(1785320494.013:9): pid=26922 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.9918" name=4996AE17DFFC2E43C8174B54B620636894AAACF28FF62616363C70A440AEC4014CAF28C0ADC04308 dev="tmpfs" ino=10342 res=0 errno=0 [ 526.382627][T26943] netlink: 28 bytes leftover after parsing attributes in process `syz.1.9929'. [ 526.437541][T26947] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9931'. [ 527.066758][T26981] netlink: 8 bytes leftover after parsing attributes in process `syz.2.9947'. [ 527.082319][T26981] netlink: 'syz.2.9947': attribute type 10 has an invalid length. [ 527.097998][T26981] netlink: 4 bytes leftover after parsing attributes in process `syz.2.9947'. [ 527.232774][T26989] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 527.240115][T26989] IPv6: NLM_F_CREATE should be set when creating new route [ 527.348884][T26995] netlink: 4 bytes leftover after parsing attributes in process `syz.0.9953'. [ 527.663985][T27016] netlink: 'syz.3.9964': attribute type 15 has an invalid length. [ 527.736620][T27016] netlink: 'syz.3.9964': attribute type 15 has an invalid length. [ 527.788213][ T3329] netdevsim netdevsim3 netdevsim0: set [0, 1] type 1 family 0 port 2816 - 0 [ 527.813156][ T3329] netdevsim netdevsim3 netdevsim2: set [0, 1] type 1 family 0 port 2816 - 0 [ 527.858186][ T57] netdevsim netdevsim3 netdevsim1: set [0, 1] type 1 family 0 port 2816 - 0 [ 527.917247][T27022] netlink: 'syz.4.9967': attribute type 10 has an invalid length. [ 528.071943][T27039] netlink: 'syz.2.9974': attribute type 4 has an invalid length. [ 528.107439][T27039] netlink: 'syz.2.9974': attribute type 4 has an invalid length. [ 529.831740][T27135] syzkaller1: entered promiscuous mode [ 529.837522][T27135] syzkaller1: entered allmulticast mode [ 530.231060][T27153] dummy0 (unregistering): left allmulticast mode [ 530.261643][T27153] dummy0 (unregistering): left promiscuous mode [ 530.280540][T27153] bridge0: port 3(dummy0) entered disabled state [ 530.325931][ T30] audit: type=1800 audit(1785320498.313:10): pid=27159 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.10027" name=0A dev="tmpfs" ino=9903 res=0 errno=0 [ 530.650026][T27175] syzkaller1: entered allmulticast mode [ 530.759540][T27180] __nla_validate_parse: 10 callbacks suppressed [ 530.759562][T27180] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10038'. [ 530.993875][T27196] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10044'. [ 531.003806][T27196] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10044'. [ 531.027259][T27194] bridge2: entered promiscuous mode [ 531.049904][T27194] bridge2: entered allmulticast mode [ 531.190192][T27204] gretap4: entered promiscuous mode [ 531.211918][T27204] batman_adv: batadv0: Adding interface: gretap4 [ 531.230382][T27204] batman_adv: batadv0: The MTU of interface gretap4 is too small (1462) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1500. [ 531.257210][T27214] netlink: 27 bytes leftover after parsing attributes in process `syz.2.10046'. [ 531.260331][T27204] batman_adv: batadv0: Not using interface gretap4 (retrying later): interface not active [ 531.660425][T27231] block nbd0: Unsupported socket: should be TCP or UNIX. [ 531.821220][T27243] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10061'. [ 532.466272][T27278] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10075'. [ 532.573510][T27285] netlink: 'syz.4.10080': attribute type 12 has an invalid length. [ 532.583084][T27285] netlink: 'syz.4.10080': attribute type 29 has an invalid length. [ 532.592550][T27285] netlink: 148 bytes leftover after parsing attributes in process `syz.4.10080'. [ 532.602938][T27285] netlink: 'syz.4.10080': attribute type 3 has an invalid length. [ 532.612409][T27285] netlink: 43 bytes leftover after parsing attributes in process `syz.4.10080'. [ 532.760555][ T30] audit: type=1800 audit(1785320500.753:11): pid=27292 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.10082" name=680B20 dev="tmpfs" ino=10041 res=0 errno=0 [ 533.526405][T27333] netlink: 'syz.3.10099': attribute type 12 has an invalid length. [ 533.538279][T27333] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10099'. [ 533.559015][T27333] netlink: 'syz.3.10099': attribute type 12 has an invalid length. [ 533.567836][T27333] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10099'. [ 533.641708][T27337] netlink: 'syz.3.10102': attribute type 1 has an invalid length. [ 533.682931][T27337] 8021q: adding VLAN 0 to HW filter on device bond5 [ 533.759546][T27342] netlink: 'syz.1.10103': attribute type 9 has an invalid length. [ 533.775501][T27342] netlink: 'syz.1.10103': attribute type 9 has an invalid length. [ 533.854255][T27348] batadv_slave_0: entered promiscuous mode [ 533.861458][T27348] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 533.929757][T27348] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 534.921923][T27411] tls_set_device_offload: netdev not found [ 535.733915][T27451] netlink: 'syz.2.10139': attribute type 2 has an invalid length. [ 535.851037][T27457] __nla_validate_parse: 3 callbacks suppressed [ 535.851063][T27457] netlink: 32 bytes leftover after parsing attributes in process `syz.4.10147'. [ 535.896163][T27432] netlink: 'syz.2.10139': attribute type 2 has an invalid length. [ 535.914726][T27432] netlink: 67 bytes leftover after parsing attributes in process `syz.2.10139'. [ 535.957825][T27459] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10150'. [ 536.120812][T27467] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10152'. [ 536.356150][T27484] netlink: 40 bytes leftover after parsing attributes in process `syz.1.10159'. [ 536.515176][T27484] : entered promiscuous mode [ 536.846967][T27507] ipip4: entered promiscuous mode [ 536.863310][T27507] ipip4: entered allmulticast mode [ 537.020912][T27513] block nbd0: reconnected socket [ 537.027553][ T50] block nbd0: Receive control failed (result -107) [ 537.044998][T27510] syzkaller1: entered promiscuous mode [ 537.075260][T27510] syzkaller1: entered allmulticast mode [ 537.218893][T27522] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10175'. [ 537.236063][T27522] vlan0: entered promiscuous mode [ 537.241695][T27522] bond0: entered promiscuous mode [ 537.247992][T27522] bond3: entered promiscuous mode [ 537.645093][T27544] tls_set_device_offload_rx: netdev not found [ 537.658521][T27540] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 538.313254][T27572] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10193'. [ 538.730915][T27601] validate_nla: 2 callbacks suppressed [ 538.730979][T27601] netlink: 'syz.1.10207': attribute type 16 has an invalid length. [ 538.745907][T27601] netlink: 20 bytes leftover after parsing attributes in process `syz.1.10207'. [ 538.853491][T27605] syzkaller1: entered promiscuous mode [ 538.870605][T27605] syzkaller1: entered allmulticast mode [ 539.406090][T27639] netlink: 'syz.2.10225': attribute type 4 has an invalid length. [ 540.012712][T27675] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10242'. [ 540.139881][T27675] hsr_slave_1 (unregistering): left promiscuous mode [ 540.206195][T27682] Unsupported xt match [ 540.206216][T27682] unable to load match [ 540.389600][T27698] netlink: 'syz.3.10248': attribute type 1 has an invalid length. [ 540.524930][T27698] 8021q: adding VLAN 0 to HW filter on device bond6 [ 540.562029][T27700] bond6: (slave geneve4): making interface the new active one [ 540.583997][T27700] bond6: (slave geneve4): Enslaving as an active interface with an up link [ 540.601440][T27704] netlink: 8 bytes leftover after parsing attributes in process `syz.1.10253'. [ 540.860997][T27714] syzkaller1: entered promiscuous mode [ 540.877079][T27714] syzkaller1: entered allmulticast mode [ 541.460360][T27753] syzkaller1: entered promiscuous mode [ 541.476549][T27753] syzkaller1: entered allmulticast mode [ 541.727248][T27766] macvlan4: entered promiscuous mode [ 541.746394][T27766] macvlan4: entered allmulticast mode [ 542.626855][T27804] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 542.906551][T27816] policy can only be matched on NF_INET_PRE_ROUTING [ 542.906574][T27816] unable to load match [ 543.081553][T27828] netlink: 'syz.2.10300': attribute type 21 has an invalid length. [ 543.092833][T27828] netlink: 'syz.2.10300': attribute type 22 has an invalid length. [ 543.101497][T27828] netlink: 'syz.2.10300': attribute type 23 has an invalid length. [ 543.127128][T27828] netlink: 'syz.2.10300': attribute type 25 has an invalid length. [ 543.139325][T27828] netlink: 96 bytes leftover after parsing attributes in process `syz.2.10300'. [ 544.395110][T27884] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10324'. [ 544.491803][T27895] v: renamed from veth0_vlan (while UP) [ 544.814511][T27909] bridge2: entered promiscuous mode [ 544.966818][T27913] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 545.241142][T27920] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10338'. [ 545.869843][T27937] netlink: 'syz.2.10345': attribute type 1 has an invalid length. [ 545.888515][T27937] netlink: 'syz.2.10345': attribute type 4 has an invalid length. [ 545.898731][T27937] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.10345'. [ 546.538927][T27966] netlink: 'syz.4.10356': attribute type 1 has an invalid length. [ 546.683013][T27966] 8021q: adding VLAN 0 to HW filter on device bond2 [ 546.779743][T27970] bond2: (slave geneve2): making interface the new active one [ 546.804952][T27970] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 546.968106][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 547.207241][T27997] vcan1: entered promiscuous mode [ 547.213296][T27997] vcan1: entered allmulticast mode [ 547.267479][T28002] sctp: [Deprecated]: syz.1.10369 (pid 28002) Use of int in maxseg socket option. [ 547.267479][T28002] Use struct sctp_assoc_value instead [ 547.500255][T28011] netlink: 'syz.3.10376': attribute type 2 has an invalid length. [ 547.522409][T28011] netlink: 'syz.3.10376': attribute type 2 has an invalid length. [ 547.542065][T28011] netlink: 27 bytes leftover after parsing attributes in process `syz.3.10376'. [ 547.674433][T28018] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1514) ! [ 548.791341][T28081] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10407'. [ 548.833428][T28083] xt_CT: You must specify a L4 protocol and not use inversions on it [ 549.305801][T28105] bridge0: port 2(bridge_slave_1) entered disabled state [ 550.460784][T28157] syzkaller1: entered promiscuous mode [ 550.471683][T28157] syzkaller1: entered allmulticast mode [ 551.353321][T28211] GUP no longer grows the stack in syz.2.10460 (28211): 200000003000-20000000a000 (200000001000) [ 551.365904][T28211] CPU: 0 UID: 0 PID: 28211 Comm: syz.2.10460 Not tainted syzkaller #0 PREEMPT(full) [ 551.365959][T28211] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 551.365976][T28211] Call Trace: [ 551.365989][T28211] [ 551.365996][T28211] dump_stack_lvl+0xe8/0x150 [ 551.366030][T28211] __get_user_pages+0x238c/0x2720 [ 551.366075][T28211] ? __gup_longterm_locked+0xc3b/0x15c0 [ 551.366136][T28211] __gup_longterm_locked+0xd52/0x15c0 [ 551.366157][T28211] ? lock_acquire+0x106/0x350 [ 551.366230][T28211] gup_fast_fallback+0x1d8c/0x20e0 [ 551.366273][T28211] ? __pfx_gup_fast_fallback+0x10/0x10 [ 551.366298][T28211] ? is_valid_gup_args+0x11f/0x200 [ 551.366317][T28211] ? get_user_pages_fast+0x4d/0xb0 [ 551.366336][T28211] __iov_iter_get_pages_alloc+0x378/0xa40 [ 551.366429][T28211] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 551.366450][T28211] iov_iter_get_pages2+0x5e/0xa0 [ 551.366477][T28211] __se_sys_vmsplice+0x7b5/0x1660 [ 551.366517][T28211] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 551.366542][T28211] ? __pfx_futex_wait+0x10/0x10 [ 551.366646][T28211] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.366673][T28211] do_syscall_64+0x174/0x580 [ 551.366706][T28211] ? clear_bhb_loop+0x40/0x90 [ 551.366735][T28211] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.366751][T28211] RIP: 0033:0x7fb26f79de99 [ 551.366767][T28211] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 551.366780][T28211] RSP: 002b:00007fb27058b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 551.366800][T28211] RAX: ffffffffffffffda RBX: 00007fb26fa25fa0 RCX: 00007fb26f79de99 [ 551.366812][T28211] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000005 [ 551.366821][T28211] RBP: 00007fb26f833eaf R08: 0000000000000000 R09: 0000000000000000 [ 551.366831][T28211] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 551.366841][T28211] R13: 00007fb26fa26038 R14: 00007fb26fa25fa0 R15: 00007fff9b7dbf58 [ 551.366867][T28211] [ 552.118236][T28238] netlink: 240 bytes leftover after parsing attributes in process `syz.2.10465'. [ 552.191293][T28243] netlink: 24 bytes leftover after parsing attributes in process `syz.1.10470'. [ 553.375286][T28285] netlink: 16 bytes leftover after parsing attributes in process `syz.1.10486'. [ 553.652838][T28303] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10495'. [ 553.739473][T28303] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10495'. [ 553.902321][T28310] bridge3: entered promiscuous mode [ 553.907700][T28310] bridge3: entered allmulticast mode [ 553.953449][T28310] team0: Port device bridge3 added [ 553.993128][T28313] bridge0: port 3(team0) entered blocking state [ 554.019207][T28313] bridge0: port 3(team0) entered disabled state [ 554.040954][T28313] team0: entered allmulticast mode [ 554.055616][T28313] team_slave_0: entered allmulticast mode [ 554.074025][T28313] team_slave_1: entered allmulticast mode [ 554.091230][T28313] dummy0: entered allmulticast mode [ 554.137616][T28313] team0: entered promiscuous mode [ 554.152402][T28313] team_slave_0: entered promiscuous mode [ 554.186317][T28313] team_slave_1: entered promiscuous mode [ 554.204146][T28313] dummy0: entered promiscuous mode [ 554.220582][T28313] bridge0: port 3(team0) entered blocking state [ 554.230002][T28313] bridge0: port 3(team0) entered forwarding state [ 554.397502][T28329] netlink: 'syz.2.10502': attribute type 1 has an invalid length. [ 554.581885][T28329] bond5: entered promiscuous mode [ 554.607064][T28329] 8021q: adding VLAN 0 to HW filter on device bond5 [ 554.705461][T28339] 8021q: adding VLAN 0 to HW filter on device bond5 [ 554.734903][T28339] bond5: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 554.755559][T28339] bond5: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 554.773915][T28339] bond5: (slave ip6gre2): making interface the new active one [ 554.786536][T28339] ip6gre2: entered promiscuous mode [ 554.797029][T28339] bond5: (slave ip6gre2): Enslaving as an active interface with an up link [ 555.947236][T28396] netlink: 'syz.2.10521': attribute type 1 has an invalid length. [ 556.185657][T28400] bond6: (slave bridge7): making interface the new active one [ 556.206794][T28400] bond6: (slave bridge7): Enslaving as an active interface with an up link [ 557.002362][T28438] syzkaller1: entered promiscuous mode [ 557.035921][T28438] syzkaller1: entered allmulticast mode [ 558.575247][ T93] bond0: (slave bond_slave_0): link status definitely down, disabling slave [ 558.795698][T28519] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 558.819342][T28519] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 559.478520][T28550] iwpm_parse_nlmsg: Invalid NULL attribute (msg type Remote Mapping info ret = -22) [ 559.491360][T28553] xfrm0 speed is unknown, defaulting to 1000 [ 559.504730][T28553] lo speed is unknown, defaulting to 1000 [ 559.825616][T28571] netlink: 16 bytes leftover after parsing attributes in process `syz.0.10587'. [ 561.703352][T28645] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 561.820783][T28655] syzkaller1: entered promiscuous mode [ 561.848335][T28655] syzkaller1: entered allmulticast mode [ 562.178689][T28670] netlink: 8 bytes leftover after parsing attributes in process `syz.3.10623'. [ 562.342314][T28680] veth0: entered promiscuous mode [ 562.392214][T28680] veth0: left promiscuous mode [ 562.970138][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.984299][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.052905][T28708] netlink: 'syz.3.10636': attribute type 15 has an invalid length. [ 563.677727][T28736] netlink: 'syz.1.10644': attribute type 1 has an invalid length. [ 563.767349][T28736] 8021q: adding VLAN 0 to HW filter on device bond3 [ 563.785495][T28741] bridge0: port 3(team0) entered disabled state [ 563.804972][T28741] team0: left allmulticast mode [ 563.810453][T28741] team_slave_0: left allmulticast mode [ 563.820561][T28741] team_slave_1: left allmulticast mode [ 563.830713][T28741] dummy0: left allmulticast mode [ 563.851203][T28741] team0: left promiscuous mode [ 563.876121][T28741] team_slave_0: left promiscuous mode [ 563.908287][T28741] team_slave_1: left promiscuous mode [ 563.935786][T28741] dummy0: left promiscuous mode [ 563.946451][T28741] bridge0: port 3(team0) entered disabled state [ 563.986759][T28741] 8021q: adding VLAN 0 to HW filter on device team0 [ 564.032561][T28741] bond3: (slave team0): Enslaving as a backup interface with an up link [ 565.589557][T28830] syzkaller1: entered promiscuous mode [ 565.596688][T28830] syzkaller1: entered allmulticast mode [ 566.543314][T28875] syzkaller1: entered promiscuous mode [ 566.563945][T28875] syzkaller1: entered allmulticast mode [ 566.745311][T28885] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10690'. [ 566.902811][T28891] bond3: (slave vti0): The slave device specified does not support setting the MAC address [ 566.931955][T28891] bond3: (slave vti0): Error -95 calling set_mac_address [ 567.430786][T28908] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10698'. [ 567.624061][T28924] netlink: 4 bytes leftover after parsing attributes in process `syz.1.10706'. [ 567.721200][T28924] hsr_slave_1 (unregistering): left promiscuous mode [ 568.207140][T28959] netlink: 92 bytes leftover after parsing attributes in process `syz.1.10720'. [ 568.550954][T28980] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10725'. [ 568.615480][T28983] netlink: 8 bytes leftover after parsing attributes in process `syz.0.10725'. [ 569.297474][T29013] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10740'. [ 569.340517][T29013] netlink: 28 bytes leftover after parsing attributes in process `syz.0.10740'. [ 569.363699][T29015] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10741'. [ 569.405998][T29018] tipc: Failed to remove unknown binding: 66,1,1/2886997039:3794983964/3794983966 [ 569.559523][T29020] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10741'. [ 570.097029][T29052] syzkaller0: entered promiscuous mode [ 570.103814][T29052] syzkaller0: entered allmulticast mode [ 572.655532][T29062] only policy match revision 0 supported [ 572.655548][T29062] unable to load match [ 572.837639][T29083] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10768'. [ 572.842524][T29084] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10767'. [ 572.990391][T29088] bridge0: port 3(vlan3) entered blocking state [ 573.008061][T29088] bridge0: port 3(vlan3) entered disabled state [ 573.019269][T29088] vlan3: entered allmulticast mode [ 573.030968][T29088] geneve0: entered allmulticast mode [ 573.060567][T29088] vlan3: entered promiscuous mode [ 573.079440][T29088] geneve0: entered promiscuous mode [ 573.101566][T29098] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 573.135398][T29098] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 573.503248][T29118] netlink: 24 bytes leftover after parsing attributes in process `syz.2.10781'. [ 573.952876][T29128] netlink: 193 bytes leftover after parsing attributes in process `syz.4.10785'. [ 574.122011][T29134] netlink: 'syz.2.10786': attribute type 1 has an invalid length. [ 574.319019][T29134] 8021q: adding VLAN 0 to HW filter on device bond7 [ 574.425552][T29135] bond7: (slave gretap3): Enslaving as a backup interface with an up link [ 574.439813][T29145] netlink: 'syz.4.10790': attribute type 1 has an invalid length. [ 574.448438][ T3329] bond7: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 574.478150][T29145] netlink: 'syz.4.10790': attribute type 4 has an invalid length. [ 574.522716][T29145] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.10790'. [ 574.643020][T29149] syzkaller1: entered promiscuous mode [ 574.667429][T29149] syzkaller1: entered allmulticast mode [ 574.716019][T29158] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10795'. [ 575.146961][T29172] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10800'. [ 575.220339][T29175] netlink: 12 bytes leftover after parsing attributes in process `syz.1.10802'. [ 575.394747][T29184] netlink: 'syz.3.10805': attribute type 4 has an invalid length. [ 575.452379][T17729] lo speed is unknown, defaulting to 1000 [ 575.472490][T17729] syú2: Port: 1 Link DOWN [ 575.480230][T29184] netlink: 'syz.3.10805': attribute type 4 has an invalid length. [ 575.513694][T17729] lo speed is unknown, defaulting to 1000 [ 575.521893][T17729] syú2: Port: 1 Link ACTIVE [ 575.672279][T29196] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10812'. [ 575.861178][T29202] xt_hashlimit: size too large, truncated to 1048576 [ 576.238997][T29219] sctp: [Deprecated]: syz.2.10822 (pid 29219) Use of int in maxseg socket option. [ 576.238997][T29219] Use struct sctp_assoc_value instead [ 576.400568][T29222] scsi_nl_rcv_msg: discarding partial skb [ 576.530057][T29228] netlink: 24 bytes leftover after parsing attributes in process `syz.4.10825'. [ 576.906939][T29244] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 577.074329][T29244] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 577.262275][T29251] 0ªX¹¦Dö»: left allmulticast mode [ 577.479516][T29251] bridge0: port 2(bridge_slave_1) entered disabled state [ 577.487011][T29251] bridge0: port 1(bridge_slave_0) entered disabled state [ 577.907182][T29251] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 577.973827][T29251] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 578.172939][T29251] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 578.211056][T29251] veth3: left promiscuous mode [ 578.216725][T29251] ip6tnl1: left allmulticast mode [ 578.225895][T29251] gretap1: left promiscuous mode [ 578.232565][T29251] gretap1: left allmulticast mode [ 578.281423][T29251] ip6gre1: left promiscuous mode [ 578.286889][T29251] ip6gre1: left allmulticast mode [ 578.382611][T29251] ipip4: left promiscuous mode [ 578.396759][T29251] ipip4: left allmulticast mode [ 578.448295][ T12] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.460732][ T12] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.568680][ T57] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.578550][ T57] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 578.810320][T29294] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 579.241384][T29309] __nla_validate_parse: 1 callbacks suppressed [ 579.241405][T29309] netlink: 12 bytes leftover after parsing attributes in process `syz.0.10847'. [ 579.266550][T29311] netlink: 16 bytes leftover after parsing attributes in process `syz.4.10848'. [ 579.664945][T29326] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10853'. [ 579.785438][T29331] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10855'. [ 580.012881][T29341] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10858'. [ 580.060132][T29343] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 580.085327][T29343] xt_hashlimit: size too large, truncated to 1048576 [ 580.568996][T29361] netlink: 4 bytes leftover after parsing attributes in process `syz.0.10864'. [ 580.750004][T29364] syzkaller1: entered promiscuous mode [ 580.764565][T29364] syzkaller1: entered allmulticast mode [ 581.525702][T29394] netlink: 8 bytes leftover after parsing attributes in process `syz.2.10875'. [ 581.685545][T29406] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10880'. [ 581.972141][T29419] netlink: 'syz.4.10886': attribute type 1 has an invalid length. [ 582.003954][T29419] netlink: 'syz.4.10886': attribute type 4 has an invalid length. [ 582.017095][T29419] netlink: 9462 bytes leftover after parsing attributes in process `syz.4.10886'. [ 582.657745][T29458] xt_nfacct: accounting object `syz1' does not exist [ 583.492335][T29492] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10914'. [ 584.608481][T29542] netlink: 59 bytes leftover after parsing attributes in process `syz.2.10934'. [ 584.860404][T29551] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 585.712319][T29593] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 585.780490][T29588] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 585.811238][T29588] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 587.090950][T29630] netlink: 16 bytes leftover after parsing attributes in process `syz.3.10963'. [ 587.534135][T29647] syz_tun: entered allmulticast mode [ 587.566137][T29646] syz_tun: left allmulticast mode [ 587.704497][T29655] netlink: 4 bytes leftover after parsing attributes in process `syz.4.10975'. [ 587.724958][T29655] netlink: 12 bytes leftover after parsing attributes in process `syz.4.10975'. [ 587.844713][T29661] netlink: 24 bytes leftover after parsing attributes in process `syz.3.10977'. [ 588.761887][T29683] netlink: 12 bytes leftover after parsing attributes in process `syz.3.10985'. [ 588.799090][T29683] 8021q: adding VLAN 0 to HW filter on device bond8 [ 588.885060][T29685] 8021q: adding VLAN 0 to HW filter on device macvlan0 [ 589.018319][T29695] netlink: 9 bytes leftover after parsing attributes in process `syz.1.10986'. [ 589.073309][T29692] netlink: 5 bytes leftover after parsing attributes in process `syz.1.10986'. [ 589.096229][T29695] gretap0: entered promiscuous mode [ 589.150086][T29692] 0ªî{X¹¦: renamed from gretap0 [ 589.173870][T29700] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 589.205795][T29692] 0ªî{X¹¦: left promiscuous mode [ 589.222864][T29692] 0ªî{X¹¦: entered allmulticast mode [ 589.233398][T29692] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 589.486854][T29717] netlink: 4 bytes leftover after parsing attributes in process `syz.3.10990'. [ 589.605905][T29720] netlink: 8 bytes leftover after parsing attributes in process `syz.4.10995'. [ 590.512165][T29740] mac80211_hwsim hwsim2 wlan0: entered promiscuous mode [ 590.726896][T29745] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.0.11005:29745 [ 591.818651][T29774] syzkaller1: entered promiscuous mode [ 591.829253][T29774] syzkaller1: entered allmulticast mode [ 591.942519][T29782] netlink: 9 bytes leftover after parsing attributes in process `syz.1.11017'. [ 591.994144][T29782] netlink: 9 bytes leftover after parsing attributes in process `syz.1.11017'. [ 592.147503][T29792] netlink: 'syz.0.11022': attribute type 1 has an invalid length. [ 592.201973][T29792] 8021q: adding VLAN 0 to HW filter on device bond5 [ 592.219401][T29794] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11023'. [ 592.327096][T29804] netlink: 'syz.0.11022': attribute type 10 has an invalid length. [ 592.347813][T29804] netlink: 40 bytes leftover after parsing attributes in process `syz.0.11022'. [ 592.412844][T29800] RDS: rds_bind could not find a transport for fe80::bb, load rds_tcp or rds_rdma? [ 592.504103][T29792] bond5: (slave dummy0): Enslaving as a backup interface with an up link [ 592.532465][T29805] netlink: 32 bytes leftover after parsing attributes in process `syz.1.11023'. [ 592.555704][T29804] dummy0: entered promiscuous mode [ 592.559214][ T12] bond5: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 592.587434][T29804] bond5: (slave dummy0): Removing an active aggregator [ 592.609586][T29804] bond5: (slave dummy0): Releasing backup interface [ 593.196669][T29830] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11033'. [ 593.235176][T29826] netlink: 'syz.3.11032': attribute type 5 has an invalid length. [ 593.531649][T29837] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 593.588351][T29837] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 593.629866][T29840] netlink: 'syz.1.11037': attribute type 1 has an invalid length. [ 594.399698][T29850] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11040'. [ 594.624798][T29856] netlink: 'syz.3.11043': attribute type 1 has an invalid length. [ 595.994872][T29843] bond5: (slave veth11): Enslaving as an active interface with a down link [ 596.016836][T29845] 8021q: adding VLAN 0 to HW filter on device bond5 [ 596.033657][T29856] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 596.084951][T29867] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11045'. [ 598.452298][T29876] erspan0: entered promiscuous mode [ 598.468250][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 598.497168][T29876] 8021q: adding VLAN 0 to HW filter on device team0 [ 598.513433][T29876] dummy0: left promiscuous mode [ 598.542006][ T755] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 598.550957][ T755] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 598.582007][T29882] netlink: 'syz.2.11050': attribute type 1 has an invalid length. [ 598.619644][T29876] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 598.741469][T29886] netlink: 32 bytes leftover after parsing attributes in process `syz.1.11053'. [ 598.752949][T29878] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode [ 598.765298][T29878] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 598.786368][T29890] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 598.915124][T29882] 8021q: adding VLAN 0 to HW filter on device bond8 [ 598.926391][T18692] xfrm0 speed is unknown, defaulting to 1000 [ 598.936282][T18692] syz2: Port: 1 Link ACTIVE [ 598.948629][T29884] bond8: (slave batadv1): Opening slave failed [ 598.970600][T29889] netlink: 36 bytes leftover after parsing attributes in process `syz.4.11052'. [ 598.987034][T29889] netlink: 36 bytes leftover after parsing attributes in process `syz.4.11052'. [ 599.013948][T29889] netlink: 31 bytes leftover after parsing attributes in process `syz.4.11052'. [ 599.048248][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 599.538331][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 599.575334][T29927] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11065'. [ 599.623068][T29927] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11065'. [ 600.088132][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 600.863107][T29954] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11076'. [ 601.108131][T29974] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11082'. [ 601.127105][T29974] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11082'. [ 601.136430][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 601.404999][T29987] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11086'. [ 601.552521][T29998] netlink: 'syz.4.11090': attribute type 1 has an invalid length. [ 601.590036][T29998] 8021q: adding VLAN 0 to HW filter on device bond4 [ 601.691478][T29998] bond4: (slave veth9): Enslaving as a backup interface with a down link [ 601.751437][T29998] netlink: 'syz.4.11090': attribute type 10 has an invalid length. [ 602.168009][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.512414][T30031] syzkaller1: entered promiscuous mode [ 602.522894][T30031] syzkaller1: entered allmulticast mode [ 603.843837][T30074] netlink: 'syz.4.11119': attribute type 1 has an invalid length. [ 603.931270][ T57] net_ratelimit: 2 callbacks suppressed [ 603.931383][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.956609][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.258112][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 605.298076][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.147091][T30074] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 606.328102][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.354815][T30093] __nla_validate_parse: 5 callbacks suppressed [ 606.354836][T30093] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11124'. [ 606.524902][T30093] netlink: 68 bytes leftover after parsing attributes in process `syz.1.11124'. [ 606.717354][T30106] netlink: 'syz.2.11127': attribute type 13 has an invalid length. [ 607.229799][T30120] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 607.368222][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 607.377343][T30135] netlink: 'syz.2.11139': attribute type 1 has an invalid length. [ 607.425518][T30135] 8021q: adding VLAN 0 to HW filter on device bond9 [ 607.491172][T30135] bond9: (slave geneve4): making interface the new active one [ 607.504035][T30135] bond9: (slave geneve4): Enslaving as an active interface with an up link [ 607.742255][T30142] bond6: entered promiscuous mode [ 607.773411][T30142] macvlan4: entered promiscuous mode [ 607.782646][T30142] macvlan4: entered allmulticast mode [ 607.790558][T30142] bond6: (slave macvlan4): Opening slave failed [ 608.418288][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.534614][T30173] 0: reclassify loop, rule prio 0, protocol 03 [ 608.702837][T30178] tipc: Enabled bearer , priority 0 [ 608.797801][T30178] syzkaller0: entered promiscuous mode [ 608.803473][T30178] syzkaller0: entered allmulticast mode [ 608.812621][T30178] tipc: Resetting bearer [ 608.833961][T30186] mac80211_hwsim hwsim9 syzkaller0: left promiscuous mode [ 608.843516][T30186] mac80211_hwsim hwsim9 syzkaller0: left allmulticast mode [ 608.882286][T30177] tipc: Resetting bearer [ 609.458098][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 609.694895][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 609.714719][ T93] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.251768][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.492489][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.293593][T30177] tipc: Disabling bearer [ 611.444229][T30200] netlink: 'syz.3.11164': attribute type 1 has an invalid length. [ 611.513174][T30208] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11165'. [ 611.538005][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.543875][T30200] 8021q: adding VLAN 0 to HW filter on device bond9 [ 611.575551][T30200] netlink: 'syz.3.11164': attribute type 10 has an invalid length. [ 611.590230][T30208] macvlan1: entered promiscuous mode [ 611.619316][T30208] macvlan1: entered allmulticast mode [ 611.630943][T30200] netlink: 40 bytes leftover after parsing attributes in process `syz.3.11164'. [ 611.796563][T30225] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11169'. [ 611.836734][T30227] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11171'. [ 612.200745][T30240] netlink: 14 bytes leftover after parsing attributes in process `syz.0.11177'. [ 612.570127][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 612.694666][T30257] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11184'. [ 612.889571][T30267] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11189'. [ 612.921339][T30267] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11189'. [ 612.948992][T30267] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11189'. [ 613.242881][T30280] netlink: 20 bytes leftover after parsing attributes in process `syz.3.11194'. [ 613.608191][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 613.774065][T30307] syzkaller1: entered promiscuous mode [ 613.782390][T30307] syzkaller1: entered allmulticast mode [ 613.820097][T30309] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 613.844652][T30309] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 613.967377][T30311] netlink: 'syz.3.11210': attribute type 1 has an invalid length. [ 614.168638][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 614.492151][T30339] syzkaller0: entered promiscuous mode [ 614.507406][T30339] syzkaller0: entered allmulticast mode [ 614.540065][T30344] dvmrp8: entered allmulticast mode [ 614.648128][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.728948][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.855231][T30359] netlink: 'syz.1.11231': attribute type 1 has an invalid length. [ 614.865102][T30359] netlink: 'syz.1.11231': attribute type 1 has an invalid length. [ 614.975095][T30365] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.990352][T30365] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 615.078263][T30369] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 615.451210][ T755] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 615.688032][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 615.764635][T30397] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 615.842202][T30402] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 615.925883][T30402] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 616.730156][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 616.738591][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 617.769709][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.094225][T30495] tipc: Failed to remove unknown binding: 66,0,0/0:568371418/568371419 [ 620.107212][T30495] tipc: Failed to remove unknown binding: 66,0,0/0:568371418/568371419 [ 621.431330][ T5824] xfrm0 speed is unknown, defaulting to 1000 [ 621.450557][ T5824] syz2: Port: 1 Link DOWN [ 621.462533][ T12] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 621.483090][ T12] netdevsim netdevsim0 netdevsim3: unset [0, 1] type 1 family 0 port 256 - 0 [ 621.503696][ T12] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 621.529695][ T12] netdevsim netdevsim0 netdevsim2: unset [0, 1] type 1 family 0 port 256 - 0 [ 621.567659][ T12] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 621.590058][ T12] netdevsim netdevsim0 netdevsim1: unset [0, 1] type 1 family 0 port 256 - 0 [ 621.623317][ T12] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 621.654004][ T12] netdevsim netdevsim0 netdevsim0: unset [0, 1] type 1 family 0 port 256 - 0 [ 621.880534][T30520] syzkaller0: entered promiscuous mode [ 621.886313][T30520] syzkaller0: entered allmulticast mode [ 624.417479][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.427311][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.629859][T30531] __nla_validate_parse: 8 callbacks suppressed [ 624.629878][T30531] netlink: 76 bytes leftover after parsing attributes in process `syz.3.11284'. [ 624.983462][T30566] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11294'. [ 625.324648][T30580] netlink: 'syz.3.11300': attribute type 8 has an invalid length. [ 625.333093][T30580] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11300'. [ 625.349872][T30580] bridge0: port 1(1¾x9ÿ) entered disabled state [ 625.739655][ T30] audit: type=1800 audit(1785320593.733:12): pid=30592 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.11303" name="memory.events" dev="tmpfs" ino=11209 res=0 errno=0 [ 625.829695][T30597] bridge0: port 4(syz_tun) entered blocking state [ 625.840547][T30597] bridge0: port 4(syz_tun) entered disabled state [ 625.851123][T30597] syz_tun: entered allmulticast mode [ 625.868240][T30597] syz_tun: entered promiscuous mode [ 625.881708][T30597] bridge0: port 4(syz_tun) entered blocking state [ 625.888387][T30597] bridge0: port 4(syz_tun) entered listening state [ 625.918125][ C0] bridge0: port 4(syz_tun) neighbor 0000.00:00:00:00:00:00 lost [ 625.929114][ C0] bridge0: topology change detected, propagating [ 626.010295][T30604] vlan3: entered promiscuous mode [ 626.015429][T30604] hsr0: entered promiscuous mode [ 626.020796][T30604] vlan3: entered allmulticast mode [ 626.025995][T30604] hsr0: entered allmulticast mode [ 626.031552][T30604] hsr_slave_0: entered allmulticast mode [ 626.174565][T30613] netlink: 'syz.4.11312': attribute type 4 has an invalid length. [ 626.192054][T30613] netlink: 'syz.4.11312': attribute type 4 has an invalid length. [ 626.729503][T17400] bridge0: port 4(syz_tun) entered disabled state [ 626.929650][T30640] netlink: 'syz.1.11321': attribute type 27 has an invalid length. [ 626.939551][T30640] netlink: 'syz.1.11321': attribute type 4 has an invalid length. [ 626.947552][T30640] netlink: 140 bytes leftover after parsing attributes in process `syz.1.11321'. [ 627.214921][T30648] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11325'. [ 627.405507][T30648] 8021q: adding VLAN 0 to HW filter on device bond8 [ 627.439698][T30648] bond8 (unregistering): Released all slaves [ 627.456137][T30655] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11326'. [ 627.497439][T30657] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11327'. [ 627.727465][T30663] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 627.744001][T30663] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 627.759358][T30661] syzkaller0: entered promiscuous mode [ 627.771010][T30661] syzkaller0: entered allmulticast mode [ 628.072936][T30687] mac80211_hwsim hwsim9 syzkaller0: left promiscuous mode [ 628.080572][T30687] mac80211_hwsim hwsim9 syzkaller0: left allmulticast mode [ 628.471077][T30690] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 628.490110][T30690] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 628.582263][T30693] netlink: 'syz.2.11340': attribute type 4 has an invalid length. [ 628.701086][T30698] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11342'. [ 628.793116][T30704] syzkaller0: entered promiscuous mode [ 628.804555][T30704] syzkaller0: entered allmulticast mode [ 629.125144][T30723] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11353'. [ 629.184637][T30726] netlink: 'syz.4.11351': attribute type 25 has an invalid length. [ 629.366528][T30736] netlink: 36 bytes leftover after parsing attributes in process `syz.1.11357'. [ 630.367558][T30785] netlink: 'syz.4.11377': attribute type 1 has an invalid length. [ 630.448649][T30785] bond5: entered promiscuous mode [ 630.454332][T30785] 8021q: adding VLAN 0 to HW filter on device bond5 [ 630.525086][T30793] tipc: Enabled bearer , priority 0 [ 630.547920][T30785] bond5: (slave bridge6): making interface the new active one [ 630.555564][T30785] bridge6: entered promiscuous mode [ 630.566767][T30785] bridge6: left promiscuous mode [ 630.607489][T30793] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 630.630922][T30793] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 630.922482][T30811] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 631.066384][T30816] tipc: Started in network mode [ 631.071886][T30816] tipc: Node identity ae6b68259a54, cluster identity 4711 [ 631.072714][T30821] __nla_validate_parse: 1 callbacks suppressed [ 631.072740][T30821] netlink: 256 bytes leftover after parsing attributes in process `syz.3.11390'. [ 631.084413][T30816] tipc: Enabled bearer , priority 0 [ 631.189711][T30816] syzkaller0: entered promiscuous mode [ 631.195370][T30816] syzkaller0: entered allmulticast mode [ 631.202124][T30816] tipc: Resetting bearer [ 631.244215][T30815] tipc: Resetting bearer [ 631.346678][T30833] netlink: 'syz.3.11394': attribute type 2 has an invalid length. [ 633.878439][T30815] tipc: Disabling bearer [ 633.907095][T30849] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 633.922402][T30853] team0: Port device syz_tun added [ 633.999368][T17729] tipc: Node number set to 876570661 [ 634.334637][T30888] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 634.353729][T30888] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 634.718756][T30901] netlink: 24 bytes leftover after parsing attributes in process `syz.3.11412'. [ 634.995476][T30911] netlink: 'syz.0.11414': attribute type 1 has an invalid length. [ 635.059353][T30914] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11415'. [ 635.098291][T30914] netlink: 8 bytes leftover after parsing attributes in process `syz.4.11415'. [ 635.142400][T30911] 8021q: adding VLAN 0 to HW filter on device bond6 [ 635.188782][T30918] bond6: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 635.231117][T30918] bond6: entered allmulticast mode [ 635.310836][T30920] bond6: (slave ip6gretap1): Enslaving as an active interface with an up link [ 635.615664][T30936] tipc: Enabled bearer , priority 0 [ 635.702964][T30936] syzkaller0: entered promiscuous mode [ 635.708800][T30936] syzkaller0: entered allmulticast mode [ 635.715297][T30936] tipc: Resetting bearer [ 635.774376][T30935] tipc: Resetting bearer [ 635.922287][T30952] net_ratelimit: 1 callbacks suppressed [ 635.922310][T30952] IPv4: Oversized IP packet from 127.202.26.0 [ 636.338152][T30969] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11433'. [ 638.946590][T30935] tipc: Disabling bearer [ 639.173349][T30999] syzkaller0: entered promiscuous mode [ 639.191268][T30999] syzkaller0: entered allmulticast mode [ 639.591172][T31019] syzkaller0: entered promiscuous mode [ 639.603124][T31019] syzkaller0: entered allmulticast mode [ 641.149981][T31069] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11458'. [ 642.682787][T31067] tipc: Enabling of bearer rejected, already enabled [ 642.698803][T31069] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 642.702951][T31071] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 642.894429][T31081] netlink: 'syz.0.11463': attribute type 1 has an invalid length. [ 642.995351][T31087] bond7: (slave bridge4): Enslaving as a backup interface with an up link [ 643.007313][T31090] netlink: 'syz.2.11460': attribute type 2 has an invalid length. [ 643.051777][T31093] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 643.075900][T31093] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 643.091715][T31081] macvlan2: entered promiscuous mode [ 643.097112][T31081] macvlan2: entered allmulticast mode [ 643.110942][T31093] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 643.123970][T31081] bond7: entered promiscuous mode [ 643.133038][T31093] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 643.150978][T31093] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 643.156200][T31081] bridge4: entered promiscuous mode [ 643.169526][T31081] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 643.180220][T31081] bond7: left promiscuous mode [ 643.189382][T31081] bridge4: left promiscuous mode [ 643.201074][T31093] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 643.234366][T31093] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 643.250659][T31093] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 643.268555][T31093] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 643.283729][T31093] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 643.335172][T31096] syzkaller0: entered promiscuous mode [ 643.349804][T31096] syzkaller0: entered allmulticast mode [ 643.422688][T31098] netlink: 76 bytes leftover after parsing attributes in process `syz.0.11468'. [ 643.442225][T31102] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11467'. [ 643.634070][T31106] tipc: Enabling of bearer rejected, already enabled [ 643.711811][T31108] syzkaller0: entered promiscuous mode [ 643.724807][T31108] syzkaller0: entered allmulticast mode [ 643.873822][T31117] syzkaller0: entered promiscuous mode [ 643.891412][T31117] syzkaller0: entered allmulticast mode [ 644.185608][T31130] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11479'. [ 644.218684][T31121] syzkaller0: entered promiscuous mode [ 644.224230][T31121] syzkaller0: entered allmulticast mode [ 644.414713][T31141] netlink: 'syz.4.11484': attribute type 1 has an invalid length. [ 646.626972][T31141] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 646.641067][T31146] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 646.676797][T31156] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 646.906123][T31169] syzkaller0: entered promiscuous mode [ 646.937026][T31169] syzkaller0: entered allmulticast mode [ 647.021832][T31174] syzkaller0: entered promiscuous mode [ 647.034039][T31174] syzkaller0: entered allmulticast mode [ 647.198331][T31179] openvswitch: netlink: Key type 31 is not supported [ 648.148675][T31196] syzkaller0: entered promiscuous mode [ 648.154239][T31196] syzkaller0: entered allmulticast mode [ 651.139618][T31248] syzkaller0: entered promiscuous mode [ 651.157677][T31248] syzkaller0: entered allmulticast mode [ 651.398708][T31259] syzkaller0: entered promiscuous mode [ 651.417052][T31259] syzkaller0: entered allmulticast mode [ 651.515712][T31265] tipc: Enabled bearer , priority 0 [ 651.534736][T31267] netlink: 'syz.1.11511': attribute type 1 has an invalid length. [ 651.602697][T31258] tipc: Resetting bearer [ 651.652428][T31258] tipc: Disabling bearer [ 651.692497][T31271] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11511'. [ 651.780318][T31267] bond8: (slave geneve2): making interface the new active one [ 651.817198][T31267] bond8: (slave geneve2): Enslaving as an active interface with an up link [ 651.859708][T31271] 8021q: adding VLAN 0 to HW filter on device bond8 [ 651.913876][ T3329] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 652.028625][ T93] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 652.047114][ T93] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 652.074229][ T93] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 652.333199][T31293] syzkaller0: entered promiscuous mode [ 652.344557][T31293] syzkaller0: entered allmulticast mode [ 652.459168][T31297] syzkaller0: entered promiscuous mode [ 652.465690][T31297] syzkaller0: entered allmulticast mode [ 652.552323][T31303] syzkaller0: entered promiscuous mode [ 652.558254][T31303] syzkaller0: entered allmulticast mode [ 652.864211][T31314] syzkaller0: entered promiscuous mode [ 652.878571][T31314] syzkaller0: entered allmulticast mode [ 653.047261][T31324] netlink: 48 bytes leftover after parsing attributes in process `syz.3.11534'. [ 653.171130][T31331] netlink: 12 bytes leftover after parsing attributes in process `syz.3.11537'. [ 653.253786][T31334] syzkaller0: entered promiscuous mode [ 653.259672][T31334] syzkaller0: entered allmulticast mode [ 653.267086][T31331] bond10: entered promiscuous mode [ 653.277564][T31331] bond10: entered allmulticast mode [ 653.856149][T31362] syzkaller0: entered promiscuous mode [ 653.870503][T31362] syzkaller0: entered allmulticast mode [ 654.030452][T31368] syzkaller0: entered promiscuous mode [ 654.042167][T31368] syzkaller0: entered allmulticast mode [ 654.148398][T31372] syzkaller0: entered promiscuous mode [ 654.157626][T31372] syzkaller0: entered allmulticast mode [ 654.480702][T31388] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11558'. [ 654.921939][T31407] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11562'. [ 655.129211][T31398] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 655.747046][T31433] syzkaller0: entered promiscuous mode [ 655.762674][T31433] syzkaller0: entered allmulticast mode [ 655.807390][T31437] netlink: 'syz.3.11573': attribute type 1 has an invalid length. [ 655.909969][T31437] bond11: entered promiscuous mode [ 655.915678][T31437] 8021q: adding VLAN 0 to HW filter on device bond11 [ 655.971792][T31437] bond11: (slave bridge6): making interface the new active one [ 655.980852][T31437] bridge6: entered promiscuous mode [ 655.988434][T31437] bond11: (slave bridge6): Enslaving as an active interface with an up link [ 656.022651][T31441] syzkaller0: entered promiscuous mode [ 656.053026][T31441] syzkaller0: entered allmulticast mode [ 656.155090][T31447] syzkaller0: entered promiscuous mode [ 656.169132][T31447] syzkaller0: entered allmulticast mode [ 656.463502][T31459] syzkaller0: entered promiscuous mode [ 656.474024][T31459] syzkaller0: entered allmulticast mode [ 656.624630][T31462] syzkaller0: entered promiscuous mode [ 656.641228][T31462] syzkaller0: entered allmulticast mode [ 656.669368][T31463] syzkaller0: entered promiscuous mode [ 656.685887][T31463] syzkaller0: entered allmulticast mode [ 656.803559][ T30] audit: type=1804 audit(1785320624.793:13): pid=31471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.11588" name="/newroot/2373/cgroup.controllers" dev="tmpfs" ino=11971 res=1 errno=0 [ 656.847927][ T30] audit: type=1800 audit(1785320624.793:14): pid=31471 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.11588" name="cgroup.controllers" dev="tmpfs" ino=11971 res=0 errno=0 [ 657.030731][T31467] syzkaller0: entered promiscuous mode [ 657.044321][T31467] syzkaller0: entered allmulticast mode [ 657.146118][T31481] netlink: 'syz.2.11591': attribute type 1 has an invalid length. [ 659.855723][T31481] macvtap1: entered allmulticast mode [ 659.884677][T31492] macvtap2: entered allmulticast mode [ 659.920045][T31494] bond11: (slave bridge9): making interface the new active one [ 659.933384][T31494] bond11: (slave bridge9): Enslaving as an active interface with an up link [ 660.018503][T31521] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11601'. [ 660.136327][T31521] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11601'. [ 660.308321][T31531] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11604'. [ 660.368342][T31531] netlink: 32 bytes leftover after parsing attributes in process `syz.4.11604'. [ 660.732017][T31552] syzkaller0: entered promiscuous mode [ 660.738535][T31552] syzkaller0: entered allmulticast mode [ 660.841165][T31553] syzkaller0: entered promiscuous mode [ 660.856387][T31553] syzkaller0: entered allmulticast mode [ 661.256169][T31565] bridge0: port 1(1¾x9ÿ) entered blocking state [ 661.262805][T31565] bridge0: port 1(1¾x9ÿ) entered forwarding state [ 661.271447][T18692] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 661.307465][T31570] syzkaller0: entered promiscuous mode [ 661.315642][T31570] syzkaller0: entered allmulticast mode [ 661.538377][T18692] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 661.597202][T31592] netlink: 'syz.4.11618': attribute type 1 has an invalid length. [ 661.648413][T31595] netlink: 60 bytes leftover after parsing attributes in process `syz.0.11617'. [ 661.669138][T31596] netlink: 20 bytes leftover after parsing attributes in process `syz.4.11618'. [ 661.693241][T31592] 8021q: adding VLAN 0 to HW filter on device bond6 [ 661.728667][T31595] netlink: 76 bytes leftover after parsing attributes in process `syz.0.11617'. [ 662.215044][T31596] veth11: entered allmulticast mode [ 662.273539][T31596] bond6: (slave veth11): Enslaving as an active interface with a down link [ 662.301139][T31595] netlink: 60 bytes leftover after parsing attributes in process `syz.0.11617'. [ 662.331139][T19674] IPVS: ip_vs_send_async error -1 [ 662.337129][T31592] bond6: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 662.404254][T31603] macvlan2: entered promiscuous mode [ 662.411269][T31603] macvlan2: entered allmulticast mode [ 662.417594][T31603] bond6: entered promiscuous mode [ 662.425019][T31603] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 662.450069][T31603] bond6: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 662.466726][T31603] bond6: left promiscuous mode [ 662.840204][T31622] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11626'. [ 663.574929][T31647] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11633'. [ 663.745129][T31658] syzkaller0: entered promiscuous mode [ 663.758719][T31660] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 664.223080][T31675] syzkaller0: entered promiscuous mode [ 664.235972][T31675] syzkaller0: entered allmulticast mode [ 664.502767][T31687] syzkaller0: entered promiscuous mode [ 664.510934][T31687] syzkaller0: entered allmulticast mode [ 664.631977][T31690] syzkaller0: entered promiscuous mode [ 664.648737][T31690] syzkaller0: entered allmulticast mode [ 664.741070][T31698] syzkaller0: entered promiscuous mode [ 664.758498][T31698] syzkaller0: entered allmulticast mode [ 664.894299][T31705] syzkaller0: entered promiscuous mode [ 664.902849][T31705] syzkaller0: entered allmulticast mode [ 665.111648][T31713] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode [ 665.136795][T31713] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 665.169093][T31707] netlink: 'syz.1.11654': attribute type 1 has an invalid length. [ 665.185485][T31715] syzkaller0: entered promiscuous mode [ 665.193986][T31715] syzkaller0: entered allmulticast mode [ 665.466129][T31722] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 665.496746][T31725] netlink: 'syz.1.11661': attribute type 1 has an invalid length. [ 665.519018][T31722] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 665.815721][T31725] bridge7: entered promiscuous mode [ 665.905359][T31725] bond9: (slave bridge7): making interface the new active one [ 665.914544][T31725] bond9: (slave bridge7): Enslaving as an active interface with an up link [ 665.951008][T31729] bridge8: entered promiscuous mode [ 665.963510][T31729] bond9: (slave bridge8): Enslaving as a backup interface with an up link [ 665.977512][T31737] syzkaller0: entered promiscuous mode [ 665.990899][T31737] syzkaller0: entered allmulticast mode [ 666.036257][T31736] syzkaller0: entered promiscuous mode [ 666.056032][T31736] syzkaller0: entered allmulticast mode [ 666.580061][T31760] syzkaller0: entered promiscuous mode [ 666.592683][T31760] syzkaller0: entered allmulticast mode [ 666.655689][T31763] syzkaller0: entered promiscuous mode [ 666.661438][T31763] syzkaller0: entered allmulticast mode [ 666.673220][T31764] syzkaller0: entered promiscuous mode [ 666.680384][T31764] syzkaller0: entered allmulticast mode [ 666.782144][T31771] tipc: Failed to remove unknown binding: 66,0,0/876570661:704647039/704647041 [ 666.793677][T31771] tipc: Failed to remove unknown binding: 66,0,0/876570661:704647039/704647040 [ 666.804807][T31771] tipc: Failed to remove unknown binding: 66,0,0/876570661:704647039/704647041 [ 666.837098][T31771] tipc: Failed to remove unknown binding: 66,0,0/876570661:704647039/704647040 [ 666.986054][T31773] syzkaller0: entered promiscuous mode [ 666.999248][T31773] syzkaller0: entered allmulticast mode [ 667.231897][T31784] netlink: 'syz.1.11680': attribute type 1 has an invalid length. [ 667.356627][T31779] syz.2.11678 (31779) used greatest stack depth: 18312 bytes left [ 667.398534][T31784] bond11: entered promiscuous mode [ 667.410175][T31784] 8021q: adding VLAN 0 to HW filter on device bond11 [ 667.486866][T31793] macvtap2: entered allmulticast mode [ 667.529483][T19674] IPVS: ip_vs_send_async error -1 [ 667.673899][T31798] macvtap3: entered allmulticast mode [ 667.719240][T31784] bond11: (slave bridge9): making interface the new active one [ 667.733249][T31784] bridge9: entered promiscuous mode [ 667.743556][T31784] bond11: (slave bridge9): Enslaving as an active interface with an up link [ 667.860697][T31810] syzkaller0: entered promiscuous mode [ 667.872107][T31810] syzkaller0: entered allmulticast mode [ 671.094663][T31814] syzkaller0: entered promiscuous mode [ 671.100623][T31814] syzkaller0: entered allmulticast mode [ 674.041650][T31878] syzkaller0: entered promiscuous mode [ 674.047460][T31878] syzkaller0: entered allmulticast mode [ 674.681367][ T30] audit: type=1804 audit(1785320642.673:15): pid=31906 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.11705" name="/newroot/2397/cgroup.controllers" dev="tmpfs" ino=12098 res=1 errno=0 [ 674.750708][ T30] audit: type=1800 audit(1785320642.673:16): pid=31906 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.11705" name="cgroup.controllers" dev="tmpfs" ino=12098 res=0 errno=0 [ 675.676049][T31942] syzkaller0: entered promiscuous mode [ 675.702605][T31942] syzkaller0: entered allmulticast mode [ 678.877329][T31954] mac80211_hwsim hwsim9 syzkaller0: left promiscuous mode [ 678.885330][T31954] mac80211_hwsim hwsim9 syzkaller0: left allmulticast mode [ 679.061665][T31967] mac80211_hwsim hwsim3 syzkaller0: left promiscuous mode [ 679.071555][T31967] mac80211_hwsim hwsim3 syzkaller0: left allmulticast mode [ 679.080439][T31968] syzkaller0: entered promiscuous mode [ 679.087676][T31968] syzkaller0: entered allmulticast mode [ 679.243966][T31974] __nla_validate_parse: 1 callbacks suppressed [ 679.243989][T31974] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11721'. [ 679.339858][T31980] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 679.463301][T31983] syzkaller0: entered promiscuous mode [ 679.473347][T31983] syzkaller0: entered allmulticast mode [ 679.594562][T31992] ¾x9ÿ: left allmulticast mode [ 679.606186][T31992] ¾x9ÿ: left promiscuous mode [ 679.613744][ T5824] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 679.639555][T31992] bridge0: port 1(1¾x9ÿ) entered disabled state [ 679.675364][T31992] bridge_slave_1: left allmulticast mode [ 679.688192][T31992] bridge0: port 2(bridge_slave_1) entered disabled state [ 679.747015][T31992] bond0: (slave bond_slave_0): Releasing backup interface [ 679.774861][T31992] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 679.795227][T31992] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 679.827273][T31992] bond6: (slave geneve4): Releasing active interface [ 679.875394][T31992] bond11: (slave bridge6): Releasing backup interface [ 679.896330][T31992] bridge6: left promiscuous mode [ 680.090649][T32005] syzkaller0: entered promiscuous mode [ 680.123454][T32005] syzkaller0: entered allmulticast mode [ 680.168145][ T5824] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 680.231950][T32015] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11733'. [ 680.399691][T32019] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11734'. [ 680.616188][T32027] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 680.630385][T32027] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 680.761896][T32034] syzkaller0: entered promiscuous mode [ 680.788236][T32034] syzkaller0: entered allmulticast mode [ 680.796210][T32040] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11743'. [ 680.849907][T32034] tipc: Enabled bearer , priority 0 [ 680.896506][T32034] tipc: Resetting bearer [ 680.934556][T32033] tipc: Resetting bearer [ 680.992884][T32033] tipc: Disabling bearer [ 681.083849][T32045] netlink: 'syz.4.11744': attribute type 12 has an invalid length. [ 681.172749][T32054] netlink: 56 bytes leftover after parsing attributes in process `syz.4.11744'. [ 681.214960][T32045] bond7: option primary_reselect: invalid value (255) [ 681.230422][T32045] bond7 (unregistering): Released all slaves [ 681.270819][T32056] mac80211_hwsim hwsim9 syzkaller0: left promiscuous mode [ 681.283221][T32056] mac80211_hwsim hwsim9 syzkaller0: left allmulticast mode [ 681.478300][T32068] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11749'. [ 681.666989][T32073] syzkaller0: entered promiscuous mode [ 681.678434][T32073] syzkaller0: entered allmulticast mode [ 681.700359][T32073] TC_ACT_REPEAT abuse ? [ 681.713175][T32080] netlink: 28 bytes leftover after parsing attributes in process `syz.0.11754'. [ 681.816458][T32082] smc: net device lo applied user defined pnetid SYZ0 [ 681.890302][T32084] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 682.036820][T32093] bridge_slave_1: left allmulticast mode [ 682.072510][T32093] bridge_slave_1: left promiscuous mode [ 682.091354][T32093] bridge0: port 2(bridge_slave_1) entered disabled state [ 682.166683][T32093] bridge_slave_0: left allmulticast mode [ 682.219849][T32093] bridge_slave_0: left promiscuous mode [ 682.231614][T32093] bridge0: port 1(bridge_slave_0) entered disabled state [ 682.657273][T32113] mac80211_hwsim hwsim9 syzkaller0: entered promiscuous mode [ 682.669343][T32113] mac80211_hwsim hwsim9 syzkaller0: entered allmulticast mode [ 683.476246][T32143] netlink: 'syz.1.11774': attribute type 21 has an invalid length. [ 683.506912][T32143] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11774'. [ 684.073876][T32165] openvswitch: netlink: Key 6 has unexpected len 234 expected 2 [ 684.331002][T32172] syzkaller0: entered promiscuous mode [ 684.354497][T32172] syzkaller0: entered allmulticast mode [ 684.372970][T32175] tipc: Enabling of bearer rejected, already enabled [ 684.479485][T32175] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 684.588846][T32172] tipc: Enabled bearer , priority 0 [ 684.648144][T32175] tipc: Resetting bearer [ 684.667092][T32171] tipc: Resetting bearer [ 684.733264][T32171] tipc: Disabling bearer [ 684.894542][T32199] mac80211_hwsim hwsim3 syzkaller0: entered promiscuous mode [ 684.937201][T32199] mac80211_hwsim hwsim3 syzkaller0: entered allmulticast mode [ 685.047375][T32205] tipc: Enabling of bearer rejected, already enabled [ 685.158946][T32213] syzkaller0: entered promiscuous mode [ 685.190560][T32213] syzkaller0: entered allmulticast mode [ 685.453958][T32228] netlink: zone id is out of range [ 685.471904][T32228] netlink: set zone limit has 4 unknown bytes [ 685.655494][T32238] ip_tables: iptables: counters copy to user failed while replacing table [ 685.739633][T32243] syz_tun: refused to change device tx_queue_len [ 685.851465][ T1317] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.534314][T32278] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 686.656503][T32277] team0: Port device syz_tun removed [ 687.522591][T32314] ieee802154 phy1 wpan1: encryption failed: -22 [ 687.549147][T32312] nbd0: detected capacity change from 0 to 87 [ 687.573727][ T1636] block nbd0: Dead connection, failed to find a fallback [ 687.869608][T32331] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 688.224229][T32351] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 688.244149][T32351] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 688.644981][T32369] bridge_slave_0: default FDB implementation only supports local addresses [ 688.661093][ T1636] block nbd0: shutting down sockets [ 688.668691][ T1636] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 688.682599][ T1636] Buffer I/O error on dev nbd0, logical block 0, async page read [ 688.695190][ T1636] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 688.704863][ T1636] Buffer I/O error on dev nbd0, logical block 1, async page read [ 688.713101][ T1636] Buffer I/O error on dev nbd0, logical block 2, async page read [ 688.721260][ T1636] Buffer I/O error on dev nbd0, logical block 3, async page read [ 688.734563][ T1636] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 688.744546][ T1636] Buffer I/O error on dev nbd0, logical block 0, async page read [ 688.752620][ T1636] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 688.762302][ T1636] Buffer I/O error on dev nbd0, logical block 1, async page read [ 688.770576][ T1636] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 688.780179][ T1636] Buffer I/O error on dev nbd0, logical block 2, async page read [ 688.788236][ T1636] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 688.799640][ T1636] Buffer I/O error on dev nbd0, logical block 3, async page read [ 688.807648][ T1636] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 688.817372][ T1636] Buffer I/O error on dev nbd0, logical block 0, async page read [ 688.825446][ T1636] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 688.835135][ T1636] Buffer I/O error on dev nbd0, logical block 1, async page read [ 688.843301][ T1636] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 688.853149][ T1636] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 688.864697][T32145] ldm_validate_partition_table(): Disk read failed. [ 688.874037][T32145] Dev nbd0: unable to read RDB block 0 [ 688.882780][T32145] nbd0: unable to read partition table [ 688.900484][T32145] ldm_validate_partition_table(): Disk read failed. [ 688.913232][T32145] Dev nbd0: unable to read RDB block 0 [ 688.920550][T32145] nbd0: unable to read partition table [ 689.022582][T32379] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 689.180085][T32384] vlan1: entered allmulticast mode [ 689.191165][T32391] netlink: get zone limit has 4 unknown bytes [ 689.220545][T32389] bridge_slave_1: vlans aren't supported yet for dev_uc|mc_add() [ 689.440432][T32404] netlink: 104 bytes leftover after parsing attributes in process `syz.0.11869'. [ 690.323396][T32450] netlink: 12 bytes leftover after parsing attributes in process `syz.2.11889'. [ 690.659941][T32469] netlink: 16 bytes leftover after parsing attributes in process `syz.3.11896'. [ 691.113150][T32483] mac80211_hwsim hwsim9 syzkaller0: left promiscuous mode [ 691.143101][T32483] mac80211_hwsim hwsim9 syzkaller0: left allmulticast mode [ 691.313292][T32499] netlink: 48 bytes leftover after parsing attributes in process `syz.3.11910'. [ 691.362160][T32499] netdevsim netdevsim3: Direct firmware load for .. failed with error -2 [ 691.386803][T32499] netdevsim netdevsim3: Falling back to sysfs fallback for: .. [ 691.446418][T32505] [ 691.448836][T32505] ====================================================== [ 691.455886][T32505] WARNING: possible circular locking dependency detected [ 691.463085][T32505] syzkaller #0 Not tainted [ 691.467547][T32505] ------------------------------------------------------ [ 691.474673][T32505] syz.3.11910/32505 is trying to acquire lock: [ 691.480861][T32505] ffffffff8ec848a0 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x15b/0x650 [ 691.490272][T32505] [ 691.490272][T32505] but task is already holding lock: [ 691.497674][T32505] ffff888034e269b8 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 691.507236][T32505] [ 691.507236][T32505] which lock already depends on the new lock. [ 691.507236][T32505] [ 691.517674][T32505] [ 691.517674][T32505] the existing dependency chain (in reverse order) is: [ 691.526809][T32505] [ 691.526809][T32505] -> #7 (&mm->mmap_lock){++++}-{4:4}: [ 691.534552][T32505] __might_fault+0xcb/0x130 [ 691.539634][T32505] _copy_from_user+0x28/0xb0 [ 691.544889][T32505] csum_and_copy_from_iter_full+0x210/0x1fb0 [ 691.551522][T32505] ip_generic_getfrag+0x149/0x2d0 [ 691.557224][T32505] __ip6_append_data+0x3b26/0x40c0 [ 691.563080][T32505] ip6_append_data+0x108/0x270 [ 691.568443][T32505] rawv6_sendmsg+0x1298/0x18c0 [ 691.573875][T32505] sock_sendmsg_nosec+0x10e/0x180 [ 691.579476][T32505] ____sys_sendmsg+0x54e/0x850 [ 691.584810][T32505] ___sys_sendmsg+0x2a5/0x360 [ 691.590099][T32505] __x64_sys_sendmsg+0x1b1/0x290 [ 691.595610][T32505] do_syscall_64+0x174/0x580 [ 691.600778][T32505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.607241][T32505] [ 691.607241][T32505] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 691.615016][T32505] lock_sock_nested+0x41/0x100 [ 691.620437][T32505] inet_shutdown+0x6a/0x390 [ 691.625577][T32505] nbd_mark_nsock_dead+0x2cb/0x550 [ 691.631382][T32505] recv_work+0x1cee/0x1e10 [ 691.636371][T32505] process_scheduled_works+0xa8e/0x14e0 [ 691.642532][T32505] worker_thread+0xa47/0xfb0 [ 691.647691][T32505] kthread+0x388/0x470 [ 691.652333][T32505] ret_from_fork+0x514/0xb70 [ 691.657549][T32505] ret_from_fork_asm+0x1a/0x30 [ 691.662878][T32505] [ 691.662878][T32505] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 691.670577][T32505] __mutex_lock+0x19d/0x1550 [ 691.675844][T32505] nbd_queue_rq+0x373/0x1150 [ 691.680999][T32505] blk_mq_dispatch_rq_list+0x499/0x1990 [ 691.687224][T32505] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 691.694233][T32505] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 691.700796][T32505] blk_mq_run_work_fn+0x16c/0x300 [ 691.706394][T32505] process_scheduled_works+0xa8e/0x14e0 [ 691.712514][T32505] worker_thread+0xa47/0xfb0 [ 691.717678][T32505] kthread+0x388/0x470 [ 691.722323][T32505] ret_from_fork+0x514/0xb70 [ 691.727526][T32505] ret_from_fork_asm+0x1a/0x30 [ 691.732845][T32505] [ 691.732845][T32505] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 691.740093][T32505] __mutex_lock+0x19d/0x1550 [ 691.745237][T32505] nbd_queue_rq+0xc1/0x1150 [ 691.750278][T32505] blk_mq_dispatch_rq_list+0x499/0x1990 [ 691.756382][T32505] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 691.763260][T32505] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 691.769795][T32505] blk_mq_run_work_fn+0x16c/0x300 [ 691.775386][T32505] process_scheduled_works+0xa8e/0x14e0 [ 691.781474][T32505] worker_thread+0xa47/0xfb0 [ 691.786608][T32505] kthread+0x388/0x470 [ 691.791223][T32505] ret_from_fork+0x514/0xb70 [ 691.796360][T32505] ret_from_fork_asm+0x1a/0x30 [ 691.801667][T32505] [ 691.801667][T32505] -> #3 (set->srcu){.+.+}-{0:0}: [ 691.808815][T32505] __synchronize_srcu+0xc9/0x2f0 [ 691.814429][T32505] elevator_switch+0x1e8/0x7b0 [ 691.819805][T32505] elevator_change+0x2fa/0x480 [ 691.825111][T32505] elevator_set_default+0x375/0x440 [ 691.830853][T32505] blk_register_queue+0x3f3/0x4e0 [ 691.836517][T32505] __add_disk+0x6cb/0xe30 [ 691.841389][T32505] add_disk_fwnode+0x100/0x3a0 [ 691.846692][T32505] nbd_dev_add+0x733/0xb60 [ 691.851645][T32505] nbd_init+0x15f/0x1e0 [ 691.856487][T32505] do_one_initcall+0x250/0x870 [ 691.861799][T32505] do_initcall_level+0x10a/0x1a0 [ 691.867323][T32505] do_initcalls+0x59/0xa0 [ 691.872295][T32505] kernel_init_freeable+0x29d/0x3e0 [ 691.878072][T32505] kernel_init+0x1d/0x1d0 [ 691.882979][T32505] ret_from_fork+0x514/0xb70 [ 691.888122][T32505] ret_from_fork_asm+0x1a/0x30 [ 691.893431][T32505] [ 691.893431][T32505] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 691.901277][T32505] __mutex_lock+0x19d/0x1550 [ 691.906416][T32505] elevator_change+0x1af/0x480 [ 691.911728][T32505] elevator_set_none+0xb5/0x140 [ 691.917131][T32505] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 691.923478][T32505] nbd_start_device+0x189/0xb30 [ 691.928872][T32505] nbd_genl_connect+0x1597/0x1c10 [ 691.934439][T32505] genl_family_rcv_msg_doit+0x233/0x340 [ 691.940637][T32505] genl_rcv_msg+0x614/0x7a0 [ 691.945688][T32505] netlink_rcv_skb+0x226/0x4a0 [ 691.950993][T32505] genl_rcv+0x28/0x40 [ 691.955525][T32505] netlink_unicast+0x7bb/0x940 [ 691.960827][T32505] netlink_sendmsg+0x813/0xb40 [ 691.966136][T32505] sock_sendmsg_nosec+0x13a/0x180 [ 691.971707][T32505] ____sys_sendmsg+0x54e/0x850 [ 691.977009][T32505] ___sys_sendmsg+0x2a5/0x360 [ 691.982227][T32505] __x64_sys_sendmsg+0x1b1/0x290 [ 691.987735][T32505] do_syscall_64+0x174/0x580 [ 691.992871][T32505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 691.999306][T32505] [ 691.999306][T32505] -> #1 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 692.007983][T32505] blk_alloc_queue+0x544/0x690 [ 692.013395][T32505] __blk_mq_alloc_disk+0x194/0x390 [ 692.019061][T32505] nbd_dev_add+0x494/0xb60 [ 692.024018][T32505] nbd_init+0x15f/0x1e0 [ 692.028714][T32505] do_one_initcall+0x250/0x870 [ 692.034025][T32505] do_initcall_level+0x10a/0x1a0 [ 692.039509][T32505] do_initcalls+0x59/0xa0 [ 692.044386][T32505] kernel_init_freeable+0x29d/0x3e0 [ 692.050130][T32505] kernel_init+0x1d/0x1d0 [ 692.055016][T32505] ret_from_fork+0x514/0xb70 [ 692.060164][T32505] ret_from_fork_asm+0x1a/0x30 [ 692.065470][T32505] [ 692.065470][T32505] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 692.072716][T32505] __lock_acquire+0x1520/0x2cf0 [ 692.078137][T32505] lock_acquire+0x106/0x350 [ 692.083196][T32505] fs_reclaim_acquire+0x71/0x100 [ 692.088683][T32505] prepare_alloc_pages+0x15b/0x650 [ 692.094338][T32505] __alloc_frozen_pages_noprof+0x12f/0x380 [ 692.100695][T32505] alloc_pages_mpol+0x212/0x380 [ 692.106103][T32505] folio_alloc_mpol_noprof+0x39/0x160 [ 692.112034][T32505] shmem_alloc_and_add_folio+0x43e/0xf60 [ 692.118279][T32505] shmem_get_folio_gfp+0x5da/0x16d0 [ 692.124020][T32505] shmem_fault+0x179/0x390 [ 692.128973][T32505] __do_fault+0x138/0x2a0 [ 692.133847][T32505] do_pte_missing+0x2215/0x34b0 [ 692.139240][T32505] handle_mm_fault+0x1b36/0x3080 [ 692.144722][T32505] do_user_addr_fault+0x744/0x1340 [ 692.150411][T32505] exc_page_fault+0x6a/0xc0 [ 692.155462][T32505] asm_exc_page_fault+0x26/0x30 [ 692.160860][T32505] rep_movs_alternative+0x4a/0xa0 [ 692.166541][T32505] _copy_from_iter+0x21b/0x1660 [ 692.171951][T32505] sk_msg_memcopy_from_iter+0x35e/0x700 [ 692.178320][T32505] tls_sw_sendmsg+0x1a49/0x2860 [ 692.183795][T32505] sock_sendmsg_nosec+0x90/0x180 [ 692.189310][T32505] __sys_sendto+0x408/0x5a0 [ 692.194382][T32505] __x64_sys_sendto+0xde/0x100 [ 692.199687][T32505] do_syscall_64+0x174/0x580 [ 692.204827][T32505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.211266][T32505] [ 692.211266][T32505] other info that might help us debug this: [ 692.211266][T32505] [ 692.221512][T32505] Chain exists of: [ 692.221512][T32505] fs_reclaim --> sk_lock-AF_INET6 --> &mm->mmap_lock [ 692.221512][T32505] [ 692.234141][T32505] Possible unsafe locking scenario: [ 692.234141][T32505] [ 692.241733][T32505] CPU0 CPU1 [ 692.247174][T32505] ---- ---- [ 692.252570][T32505] rlock(&mm->mmap_lock); [ 692.257014][T32505] lock(sk_lock-AF_INET6); [ 692.264057][T32505] lock(&mm->mmap_lock); [ 692.270926][T32505] lock(fs_reclaim); [ 692.274995][T32505] [ 692.274995][T32505] *** DEADLOCK *** [ 692.274995][T32505] [ 692.283152][T32505] 3 locks held by syz.3.11910/32505: [ 692.288455][T32505] #0: ffff8880523464e8 (&ctx->tx_lock){+.+.}-{4:4}, at: tls_sw_sendmsg+0x13c/0x2860 [ 692.298054][T32505] #1: ffff8880523fb860 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tls_sw_sendmsg+0x161/0x2860 [ 692.307869][T32505] #2: ffff888034e269b8 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 692.317821][T32505] [ 692.317821][T32505] stack backtrace: [ 692.323741][T32505] CPU: 0 UID: 0 PID: 32505 Comm: syz.3.11910 Not tainted syzkaller #0 PREEMPT(full) [ 692.323763][T32505] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 692.323775][T32505] Call Trace: [ 692.323783][T32505] [ 692.323791][T32505] dump_stack_lvl+0xe8/0x150 [ 692.323821][T32505] print_circular_bug+0x2e1/0x300 [ 692.323842][T32505] check_noncircular+0x12e/0x150 [ 692.323863][T32505] __lock_acquire+0x1520/0x2cf0 [ 692.323894][T32505] ? is_bpf_text_address+0x26/0x2b0 [ 692.323928][T32505] ? prepare_alloc_pages+0x15b/0x650 [ 692.323951][T32505] lock_acquire+0x106/0x350 [ 692.323975][T32505] ? prepare_alloc_pages+0x15b/0x650 [ 692.324001][T32505] ? is_bpf_text_address+0x26/0x2b0 [ 692.324026][T32505] ? __bfs+0x153/0x290 [ 692.324050][T32505] ? __pfx_hlock_conflict+0x10/0x10 [ 692.324069][T32505] fs_reclaim_acquire+0x71/0x100 [ 692.324093][T32505] ? prepare_alloc_pages+0x15b/0x650 [ 692.324116][T32505] prepare_alloc_pages+0x15b/0x650 [ 692.324151][T32505] __alloc_frozen_pages_noprof+0x12f/0x380 [ 692.324179][T32505] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 692.324207][T32505] ? __pfx_policy_nodemask+0x10/0x10 [ 692.324238][T32505] alloc_pages_mpol+0x212/0x380 [ 692.324268][T32505] folio_alloc_mpol_noprof+0x39/0x160 [ 692.324298][T32505] shmem_alloc_and_add_folio+0x43e/0xf60 [ 692.324319][T32505] ? filemap_get_entry+0xcd/0x3f0 [ 692.324342][T32505] ? __pfx_filemap_get_entry+0x10/0x10 [ 692.324361][T32505] ? __pfx_shmem_alloc_and_add_folio+0x10/0x10 [ 692.324382][T32505] ? shmem_allowable_huge_orders+0x628/0x6c0 [ 692.324404][T32505] shmem_get_folio_gfp+0x5da/0x16d0 [ 692.324429][T32505] shmem_fault+0x179/0x390 [ 692.324452][T32505] __do_fault+0x138/0x2a0 [ 692.324476][T32505] ? do_pte_missing+0x140c/0x34b0 [ 692.324499][T32505] do_pte_missing+0x2215/0x34b0 [ 692.324528][T32505] ? handle_mm_fault+0xec/0x3080 [ 692.324549][T32505] handle_mm_fault+0x1b36/0x3080 [ 692.324574][T32505] ? handle_mm_fault+0xec/0x3080 [ 692.324597][T32505] ? __pfx_handle_mm_fault+0x10/0x10 [ 692.324623][T32505] ? __lock_acquire+0x683/0x2cf0 [ 692.324651][T32505] ? lock_mm_and_find_vma+0xa7/0x340 [ 692.324674][T32505] do_user_addr_fault+0x744/0x1340 [ 692.324709][T32505] exc_page_fault+0x6a/0xc0 [ 692.324730][T32505] asm_exc_page_fault+0x26/0x30 [ 692.324748][T32505] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 692.324776][T32505] Code: 61 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 692.324791][T32505] RSP: 0018:ffffc900104177b8 EFLAGS: 00050206 [ 692.324807][T32505] RAX: 00007ffffffff001 RBX: ffff888031d20005 RCX: 0000000000002100 [ 692.324820][T32505] RDX: 0000000000000001 RSI: 0000200000002000 RDI: ffff888031d21f05 [ 692.324832][T32505] RBP: ffffc90010417918 R08: ffff888031d24004 R09: 1ffff110063a4800 [ 692.324846][T32505] R10: dffffc0000000000 R11: ffffed10063a4801 R12: ffffc90010417dd8 [ 692.324859][T32505] R13: 0000200000000100 R14: 0000000000004000 R15: 1ffff92002082fbb [ 692.324881][T32505] _copy_from_iter+0x21b/0x1660 [ 692.324913][T32505] ? __pfx__copy_from_iter+0x10/0x10 [ 692.324942][T32505] ? sk_msg_clone+0xcec/0xd90 [ 692.324960][T32505] sk_msg_memcopy_from_iter+0x35e/0x700 [ 692.324985][T32505] tls_sw_sendmsg+0x1a49/0x2860 [ 692.325031][T32505] ? __pfx_tls_sw_sendmsg+0x10/0x10 [ 692.325059][T32505] ? __pfx_aa_sk_perm+0x10/0x10 [ 692.325077][T32505] ? sock_rps_record_flow+0x19/0x350 [ 692.325187][T32505] ? inet_send_prepare+0x5b/0x260 [ 692.325203][T32505] ? inet6_sendmsg+0x101/0x120 [ 692.325225][T32505] ? __pfx_inet6_sendmsg+0x10/0x10 [ 692.325244][T32505] sock_sendmsg_nosec+0x90/0x180 [ 692.325270][T32505] __sys_sendto+0x408/0x5a0 [ 692.325285][T32505] ? __local_bh_enable_ip+0xd0/0x130 [ 692.325318][T32505] ? __pfx___sys_sendto+0x10/0x10 [ 692.325347][T32505] ? rcu_is_watching+0x15/0xb0 [ 692.325366][T32505] __x64_sys_sendto+0xde/0x100 [ 692.325383][T32505] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.325400][T32505] do_syscall_64+0x174/0x580 [ 692.325420][T32505] ? trace_irq_disable+0x3b/0x140 [ 692.325443][T32505] ? clear_bhb_loop+0x40/0x90 [ 692.325462][T32505] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 692.325480][T32505] RIP: 0033:0x7f949a79de99 [ 692.325496][T32505] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 692.325511][T32505] RSP: 002b:00007f949b675028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 692.325528][T32505] RAX: ffffffffffffffda RBX: 00007f949aa26090 RCX: 00007f949a79de99 [ 692.325541][T32505] RDX: fffffffffffffdcd RSI: 0000200000000100 RDI: 0000000000000008 [ 692.325552][T32505] RBP: 00007f949a833eaf R08: 0000000000000000 R09: 0000000000000000 [ 692.325563][T32505] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 692.325574][T32505] R13: 00007f949aa26128 R14: 00007f949aa26090 R15: 00007ffc87cbee78 [ 692.325595][T32505]