last executing test programs: 4.514382064s ago: executing program 0 (id=7374): bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xd, 0x5, 0x0, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000300), 0x8) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x70}}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(0xffffffffffffffff, 0x2) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000340)={0x0, 0xf}, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 4.372544207s ago: executing program 0 (id=7376): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e22, @empty}], 0x10) listen(r1, 0x3) sendmsg$inet6(r0, &(0x7f0000001dc0)={&(0x7f0000000840)={0xa, 0x4e22, 0x906, @loopback, 0x7}, 0x1c, &(0x7f0000001d40)=[{&(0x7f0000000880)="fa", 0x1}], 0x1}, 0x40085) (fail_nth: 1) 4.231469515s ago: executing program 4 (id=7377): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010027bd7000fcdbdf2517000000500006804c0004"], 0x64}, 0x1, 0x0, 0x28}, 0x48c0) 3.930725519s ago: executing program 0 (id=7379): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200000009"], 0x7c}}, 0x10) r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000540)={&(0x7f00000005c0)={0xa, 0x4e21, 0xffffffff, @mcast2, 0x4}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="120000000000000011000000"], 0x25}, 0x8000) sendmsg$inet(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="a9030000000012000000", 0xa}], 0x1}, 0x4000841) 3.929384559s ago: executing program 2 (id=7380): r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0xff, @remote, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="10000000000000002900000000000000f2559c1eaf7c86eca5b2ad4dc5bd85314d3d92d74905e7c5fb83c2ba15c2b35403e472096c4e86c08b"], 0x10}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x101, 0x0, 0xf, 0x0, 0x0}) r3 = socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0xc}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="340000003e0007010300000000000000027c00000400428011000100686d616328736861323234"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'lblcr\x00', 0x1, 0x80005, 0x6f}, 0x2c) setsockopt$RDS_RECVERR(r2, 0x114, 0x5, &(0x7f0000000540), 0x4) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$sock(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000b40)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002cbd7000ffdbdf250c000000200001801400020076657468315f746f5f6873720000000008000300030000001400038010000380"], 0x48}, 0x1, 0x0, 0x0, 0x818}, 0x20000004) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x3261e) sendmsg$NFNL_MSG_ACCT_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20200}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="20000000010703000000000000000000020000050c000340000000000000000356be2b9c3aac2f554d63f0c1125aab3f2692bc3a8f0f9ae71f0732c286c51a5cb3a469a890df1e7e2a9c2ea0118f627f2e0000fbc5b1cebca181feda7be6d214a8c6abee4d5f616cb02fe66e52c78b4ef601d2888f47cb223de86f"], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x880) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000200)="ad56b6c5820f92ea54c757ac915d564c90c200cb93ac36238d7f3f336b18de11a543ea4045082b3d7d5069a14454b765408c9f326a336831d0ecd060547c485b20b55c62f039dab7c080c5b6c4ecf519f0edb09aa6b69f0769714db6aa1635545df14632be2849eb97bd9f71eb2798bb9037ce05ab1a94c566c0e29e128be0f69609fdd02cbabdf173f6355829865c3899f5f32a04795e2792fec6bdbcc7116df21cdba1b8c9cf5869099b40fc1faa92c1b92a52ef77c1410298d83e8a0f5fb4ec7e352c983d0900"/215, 0xd7) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000380)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000940)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x28044854}], 0x1, 0x40800) 3.727664515s ago: executing program 4 (id=7383): r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a80)=ANY=[@ANYBLOB="280000001000010023bd7000fddbdf2500000000", @ANYRES32=r2, @ANYBLOB="01000000030000785a105b3dc90f0005"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) sendmsg$key(r0, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x1, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @loopback}}, @sadb_x_sa2={0x2, 0x13, 0x3}]}, 0x50}}, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000480)=@buf={0x2c, &(0x7f0000000440)="2b64dc034339b81fafc8312b4479bb5e03491ee186f00669da7f2782451c3d89fa3d2cb8dd2fd8f4f52a12b5"}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRES16, @ANYRES32=r3], 0x38}, 0x1, 0x0, 0x0, 0x8000}, 0x20000000) sendmsg$nl_route(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="940000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0300000000000000640012800b0001006970366772650000540002800800150061db0a0008000100", @ANYRES32, @ANYBLOB="14000700fe8000000000000000000000000000aa08000d005fe1ffff060010004e22000008000500200c000014000600fc"], 0x94}}, 0x0) r4 = socket(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000400)={'wpan3\x00'}) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="24000000031401002cbd7000fcdbdf250900020073797a3200000000080041"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x810) r7 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x38, 0x6, 0xa, 0x600, 0x0, 0x0, {0x2, 0x0, 0xfffd}, [@NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x60}}, 0x0) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000850000009e00000095"], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x3a) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0x4002}) r11 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r11, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x2, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @loopback}}]}, 0x50}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @random="08c82553c54d", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010102, @local}, {{0x1, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x0, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "b3e480a7613088fd71106c027deb3b11"}]}}}}}}}, 0x0) r12 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_MOD(r12, 0x3, r3, &(0x7f00000004c0)={0x2003}) writev(r8, &(0x7f0000000140)=[{&(0x7f0000000080)="0bc3a6168654", 0x6}, {&(0x7f0000000a80)='\x00\x00\x00egS!\x00', 0x8}], 0x2) sendmsg$DEVLINK_CMD_SB_POOL_SET(r4, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000180)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="00012bbd7000fddbdf25100000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00ffffffff06001100ff7f0000080013000500000005001400010000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00400000000600110008000000080013000080000005001400010000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00080000000600110002000000080013000500000005001400010000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b000800000006001100ff00000008001300060000000500140001000000"], 0x114}, 0x1, 0x0, 0x0, 0x4}, 0x8010) 3.727281019s ago: executing program 0 (id=7384): r0 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r0, &(0x7f0000001c00)={&(0x7f0000000000)={0xa, 0xa, 0x7, @mcast2}, 0x1c, &(0x7f00000004c0)=[{&(0x7f0000000040)="671723d7c6012c", 0x7}, {0x0}, {&(0x7f0000000200)='\x00\x00\x00\x00\x00', 0x5}, {&(0x7f0000000840)="418a", 0x2}], 0x4}, 0x20008b88) 3.714349272s ago: executing program 2 (id=7385): openat$ppp(0xffffffffffffff9c, 0x0, 0xc0802, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000009c0)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x1}, 0x3}}, @TCA_MPLS_PROTO={0x6}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="1c00000e01000b00000014"], 0x36) 3.611949248s ago: executing program 3 (id=7386): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000040)={'veth0_to_bond\x00', @random="0200ac7f7f00"}) 3.569624555s ago: executing program 0 (id=7387): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7ffe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=@newtfilter={0x44, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {}, {0x8, 0x1}}, [@filter_kind_options=@f_flow={{0x9}, {0x14, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x884}, 0x2) close(r1) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r3, 0x42}, 0x80, 0x0}, 0x4005) 3.458878544s ago: executing program 3 (id=7388): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000100000000000000000000818110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000070000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000030000009500"], 0x0, 0x6, 0x0, 0x0, 0x40f00, 0x62, '\x00', 0x0, @fallback=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000640)={r0}, 0x4) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$sock_SIOCSIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8983, &(0x7f00000007c0)={0x3, 'vlan1\x00'}) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{0x0}, {0x0}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb4", 0x2e}, {&(0x7f0000000900)}], 0x4}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000ac0)}, {&(0x7f0000000580)}], 0x2}}], 0x2, 0x20000044) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) socket$kcm(0x10, 0x2, 0x10) 3.405839235s ago: executing program 2 (id=7389): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) close(r0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x80, &(0x7f00000002c0)="140000000900", 0x6) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) sendto$inet6(r1, &(0x7f00000004c0)="b0", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e23, 0x7, @loopback, 0x4}, 0x1c) 3.213869431s ago: executing program 1 (id=7391): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0e000000040000000800"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000003000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xe, 0x0, &(0x7f00000003c0)="eb1ef98073e4ba21ffa3cf1050f0", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x38) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000380)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16, @ANYBLOB="0100000010651fbe347b322b00000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x4010}, 0x0) 3.09158161s ago: executing program 3 (id=7392): syz_emit_ethernet(0xbe, &(0x7f0000000100)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @private, @empty}, {0x0, 0x17c1, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "0b86c107cddd39d10e870794ae120f860174b07efe05336d54f519ebba5a2b26", "5e5992c2209db5127a4a84d3d6e03d081a4118a2bbd22f0ca038289c45b30eca6703476382c29175c40096a9c60c3cce", "6a9f3a451dd7eb4523e02c2a4a00f81073727f3ac9f91e284b975a32", {"8f865412904b133eebafc6eb170fb006", "21144ab13a642475fc21552dce5cda9c"}}}}}}}, 0x0) r0 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000040)=@o_path={&(0x7f0000000000)='./file0\x00', 0x0, 0x10}, 0x18) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r1, &(0x7f0000000080), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x10}, 0x94) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'batadv0\x00', 0x0}) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000380)={0xffffffffffffffff, 0x5, 0x10}, 0xc) ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f00000004c0)={0xffffffffffffffff, &(0x7f00000003c0)='\xaa\xaa\xaa\xaa\xaa', 0x8000, &(0x7f0000000400)={@_ha_fsid={[0xd761, 0x5]}, {0x723, 0x800, 0xd13, 0x4}}, 0x0, &(0x7f0000000440)={@_ha_fsid}, &(0x7f0000000480)=0x9}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000580)={0x6, 0x15, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xe}, [@map_val={0x18, 0xa, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0x3}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @map_idx={0x18, 0x7, 0x5, 0x0, 0x9}, @exit]}, &(0x7f0000000280)='syzkaller\x00', 0x3, 0x3, &(0x7f00000002c0)=""/3, 0x40f00, 0x1, '\x00', r2, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x8, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000500)=[r3, r4], &(0x7f0000000540)=[{0x0, 0x2, 0x4, 0x8}, {0x2, 0x5, 0x9, 0x1}], 0x10, 0x5}, 0x94) 3.066687192s ago: executing program 4 (id=7393): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r0, 0x8b1b, &(0x7f0000000040)) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x80, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x6c, 0x1, [@m_tunnel_key={0x68, 0x1, 0x0, 0x0, {{0xf}, {0x38, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0xd, @empty=0x1000000}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @loopback}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @broadcast}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x80}}, 0x0) 3.062346898s ago: executing program 1 (id=7394): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x7a05, 0x1700) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000140)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x11) (fail_nth: 1) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) 2.96988534s ago: executing program 3 (id=7395): r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0xff, @remote, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="10000000000000002900000000000000f2559c1eaf7c86eca5b2ad4dc5bd85314d3d92d74905e7c5fb83c2ba15c2b35403e472096c4e86c08b"], 0x10}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000000)='cgroup\x00', 0x101, 0x0, 0xf, 0x0, 0x0}) r3 = socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0x12, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @initr0={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, @exit, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa, 0x0, 0xfffd}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0xc}, 0x94) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="340000003e0007010300000000000000027c00000400428011000100686d616328736861323234"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r5 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e22, 0x3, 'lblcr\x00', 0x1, 0x80005, 0x6f}, 0x2c) setsockopt$RDS_RECVERR(r2, 0x114, 0x5, &(0x7f0000000540), 0x4) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x2, 0xcd}}, 0x44) sendmsg$sock(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@in6={0x2, 0x4e21, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000b40)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="01002cbd7000ffdbdf250c000000200001801400020076657468315f746f5f6873720000000008000300030000001400038010000380"], 0x48}, 0x1, 0x0, 0x0, 0x818}, 0x20000004) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x3261e) sendmsg$NFNL_MSG_ACCT_GET(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20200}, 0xc, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="20000000010703000000000000000000020000050c000340000000000000000356be2b9c3aac2f554d63f0c1125aab3f2692bc3a8f0f9ae71f0732c286c51a5cb3a469a890df1e7e2a9c2ea0118f627f2e0000fbc5b1cebca181feda7be6d214a8c6abee4d5f616cb02fe66e52c78b4ef601d2888f47cb223de86f"], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x880) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000200)="ad56b6c5820f92ea54c757ac915d564c90c200cb93ac36238d7f3f336b18de11a543ea4045082b3d7d5069a14454b765408c9f326a336831d0ecd060547c485b20b55c62f039dab7c080c5b6c4ecf519f0edb09aa6b69f0769714db6aa1635545df14632be2849eb97bd9f71eb2798bb9037ce05ab1a94c566c0e29e128be0f69609fdd02cbabdf173f6355829865c3899f5f32a04795e2792fec6bdbcc7116df21cdba1b8c9cf5869099b40fc1faa92c1b92a52ef77c1410298d83e8a0f5fb4ec7e352c983d0900"/215, 0xd7) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000380)=[{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}], 0x1, &(0x7f0000000940)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x28044854}], 0x1, 0x40800) 2.968634325s ago: executing program 2 (id=7396): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x38, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x4, 0x5}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048091}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x149540, 0x0) close(r8) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r9 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r9, &(0x7f00000001c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r10, 0x31}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x5dc}], 0x1}, 0x4) 2.059827938s ago: executing program 1 (id=7397): r0 = socket(0xa, 0x3, 0xff) sendmsg$inet6(r0, &(0x7f0000001c00)={&(0x7f0000000000)={0xa, 0xa, 0x7, @mcast2}, 0x1c, &(0x7f00000004c0)=[{&(0x7f0000000040)="671723d7c6012c", 0x7}, {0x0}, {&(0x7f0000000200)='\x00\x00\x00\x00\x00', 0x5}, {&(0x7f0000000840)="418a", 0x2}], 0x4}, 0x20008b88) 2.026380525s ago: executing program 1 (id=7398): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574000000000c0007800800", @ANYRES16=r0], 0x5c}}, 0x20084884) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x300, 0x0, 0x10040003}, 0x0) 1.973309363s ago: executing program 1 (id=7399): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000400)={0x0, &(0x7f0000000340)}, 0x10) socket$packet(0x11, 0xa, 0x300) r1 = socket$alg(0x26, 0x5, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x45) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3c00000029000304000000000000000000000400", @ANYRES32=0x0, @ANYBLOB="00030000428000001400128009000100766c616e000000000400028008000500", @ANYRES32=0x0, @ANYBLOB="b9b61f8dc03c57f01f374b99854e5e6ad095592390f04e6080feec206831d6607a93805f854996d15440fc017e678886e63fd140446e176d283f5fee224ef71cca71e1d4f61433269ae8e711a8a562161df50815e8906cddb89290802c427332bdc1bbad03796764f6be8458a4d8c2f28d64e9b9e0f639223c796bf02ffff43a0fb55fd84c7c6d52c42ba1d616f7c3edc42116e9612f66eaa13cd23d55cb08fa45f4eeac256fc9f52cf7d785f2fa3d054df3cfc05d9e67bb7cb2917622d5bfb845066690656f866f257c6f45bad98d20ae11bde1e72065fcec89aebc1d3295f13d12954d556a27136a77edaba2fa549dc4fa81516cdeac5ca7c31bfff0b823e1903833a273f8925dde8cf299b2609f264e168fa23c1df52c6080b0af6226fc1830a913505c5ccf58577907a8de0231a77951a2143b72b9012781b3ff50a29a8ebab90fc6252e336ed7d8704ba0e92a7bc0f2454b152cad511f678de3df35f563a93a40a7f10111fc074edf6a42682302fb9302e7e3844522b7addaedafa9e55b00cc5a9eec7c086535edddeb28ddd6798cca7f83cd"], 0x3c}}, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, &(0x7f0000000000)=0x63, 0x2) r4 = accept4(r1, 0x0, 0x0, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) ioctl$AUTOFS_IOC_PROTOVER(r5, 0x80049363, &(0x7f0000000040)) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), r0) sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x24000}, 0xc, &(0x7f0000000380)={&(0x7f00000002c0)={0x14, r6, 0x100, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x4000011}, 0x8044) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000100)=0x3, 0x4) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @mss={0x2, 0xfff}, @window={0x3, 0x0, 0x401}, @window], 0x20000000000000e4) r7 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000500)={r0, 0x58, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, 0x1021, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_MTU={0x8, 0x4, 0x7c3}]}, 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r5, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r5, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 269.332558ms ago: executing program 0 (id=7400): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e22, @empty}], 0x10) listen(r1, 0x3) sendmsg$inet6(r0, &(0x7f0000001dc0)={&(0x7f0000000840)={0xa, 0x4e22, 0x906, @loopback, 0x7}, 0x1c, &(0x7f0000001d40)=[{&(0x7f0000000880)="fa", 0x1}], 0x1}, 0x40085) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600004e22590000a2bc5603ca", 0x24}], 0x1) 268.964007ms ago: executing program 4 (id=7401): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000900)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300"], 0x54}}, 0x0) 265.434291ms ago: executing program 3 (id=7402): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'veth1_macvtap\x00', 0x0}) r2 = socket(0x11, 0xa, 0x0) ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRES32=r1, @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x24040894}, 0x20000000) r3 = socket(0x10, 0x803, 0x2) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000240)=ANY=[@ANYRES64=r3, @ANYBLOB="60bfba57f325329efb114f2a3a329a33d1c5a798f614a1dbc2c1893628c0b5e0088683a0309160824f0d507e4e55c11fe7f15beda47fec5b63ac69812ddb58508322e8d63c04c87f45b2fa2c7db30213ba6cf2e43b5511b3"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x1747f440622111d0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="100000001614016a61"], 0x10}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'syz_tun\x00'}) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0xf4, 0x0, 0xfffffffe}, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1800000052000164f274e7b7c53ab2001c000000040003"], 0x18}}, 0x0) unshare(0x20020400) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_procs(r7, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) sendfile(r8, r8, 0x0, 0x9) setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r5, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000200)=0x4d5e, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r5, &(0x7f00000005c0)="5e243f7f2d451690bf07e8b4c19c490dc80713cef5923f6de811aef49708d43f508bb8dd14", 0x25, 0x4c804, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @window={0x3, 0x9, 0x105}, @window={0x3, 0xfffe}, @sack_perm], 0x8) setsockopt$inet_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r5, 0x0, 0x0, 0x805, 0x0, 0x0) syz_emit_ethernet(0xd2, 0x0, 0x0) 256.601889ms ago: executing program 1 (id=7403): r0 = socket$packet(0x11, 0x3, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r1}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, r4, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0x3, 0x0, 0x3}}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000004c0)={r5, 0x3, 0x6, @remote}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r5, 0x1, 0x6, @random="790c7edd3d8d"}, 0x10) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0x0, 0x2000001, {0x0, 0x0, 0x0, r5, {0x7}, {0xd, 0xc}, {0xf, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) socket$packet(0x11, 0x3, 0x300) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) (async) bpf$ENABLE_STATS(0x20, 0x0, 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) (async) bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r1}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, r4, 0x25, 0x2, @void}, 0x10) (async) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x9, 0x6, '\x00', 0x14, 0x6, 0xff, @dev={0xfe, 0x80, '\x00', 0x39}, @local, {[], {{0x4e22, 0x4e24, 0x41424344, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0x3, 0x0, 0x3}}}}}}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0\x00'}) (async) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f00000004c0)={r5, 0x3, 0x6, @remote}, 0x10) (async) socket$nl_route(0x10, 0x3, 0x0) (async) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000000)={r5, 0x1, 0x6, @random="790c7edd3d8d"}, 0x10) (async) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=@getchain={0x24, 0x11, 0x1, 0x0, 0x2000001, {0x0, 0x0, 0x0, r5, {0x7}, {0xd, 0xc}, {0xf, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x20048054) (async) 109.038625ms ago: executing program 2 (id=7404): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000000) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0e0000000400000008000000"], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000003000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xe, 0x0, &(0x7f00000003c0)="eb1ef98073e4ba21ffa3cf1050f0", 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x38) sendmsg$ETHTOOL_MSG_PAUSE_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000380)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16, @ANYBLOB="0100000010651fbe347b322b00000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x4010}, 0x0) 107.227505ms ago: executing program 4 (id=7405): bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xd, 0x5, 0x0, &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000300), 0x8) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x70}}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(0xffffffffffffffff, 0x2) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000680)={&(0x7f0000000540)={0x14, r1, 0x1, 0x70bd2a, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x48000}, 0x40000) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r2 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x2}]}}}}}}}}, 0x0) 52.253909ms ago: executing program 3 (id=7406): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000200)={'veth1_macvtap\x00', 0x0}) r2 = socket(0x11, 0xa, 0x0) ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRES32=r1, @ANYRES32=r1], 0x3c}, 0x1, 0x0, 0x0, 0x24040894}, 0x20000000) socket(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000240)=ANY=[], &(0x7f00000001c0)='syzkaller\x00'}, 0x94) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="100000001614016a61"], 0x10}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'syz_tun\x00'}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x47) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000200)=0x4d5e, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r4, &(0x7f00000005c0)="5e243f7f2d451690bf07e8b4c19c490dc80713cef5923f6de811aef49708d43f508bb8dd14", 0x25, 0x4c804, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000340)=[@timestamp, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x2000000000000061) setsockopt$inet_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r4, 0x0, 0x0, 0x805, 0x0, 0x0) syz_emit_ethernet(0xd2, 0x0, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x4000810) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) 8.691371ms ago: executing program 2 (id=7407): sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="340000000009010800000000000000000000000108000540e3ff001c0900010073797a310000000300"/52], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x2000000) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x4008091}, 0xc004) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCETHTOOL(r2, 0x8954, 0x0) connect$802154_dgram(r1, &(0x7f0000000040)={0x24, @long={0x2}}, 0x8) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010014000000000000000200e70308000300", @ANYRES32=r5, @ANYBLOB="0c00990000000000000000000800a0002616000008009f0005000000080026000816"], 0x40}}, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000180)="a401", 0x2, 0x4, &(0x7f0000000000)={0xa, 0x0, 0x20000, @mcast2, 0x4}, 0x1c) 0s ago: executing program 4 (id=7408): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x240}, 0xe) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000009e149798b0e23034"], 0x3c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_NEW_INTERFACE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="4400eaef", @ANYRES16, @ANYBLOB="010028b6296be141526b7e00000008000300", @ANYBLOB='\f'], 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) sendmsg$nl_generic(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c00000046000701fcffffff0200000001"], 0x1c}, 0x1, 0x0, 0x0, 0x488c4}, 0xc000) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000000)={0x2, 0x8}, 0x2) kernel console output (not intermixed with test programs): h: hci3: command tx timeout [ 537.603418][T19879] tipc: Resetting bearer [ 537.640951][T19781] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.654744][T19781] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 537.683177][T19874] tipc: Resetting bearer [ 537.731690][T19874] tipc: Disabling bearer [ 537.799778][ T5751] tipc: Node number set to 235304205 [ 537.958731][T19781] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 537.983351][T19781] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 538.301686][ T50] Bluetooth: hci3: command tx timeout [ 538.388353][T19920] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4394'. [ 538.758464][T19934] netlink: 'syz.2.4401': attribute type 2 has an invalid length. [ 538.772630][T19934] netlink: 19 bytes leftover after parsing attributes in process `syz.2.4401'. [ 538.806488][T19781] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 538.837192][T19781] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 538.966595][T19781] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 538.981690][T19781] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 538.996736][T19781] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 539.017280][T19781] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 539.042021][T19781] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 539.056469][T19949] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4406'. [ 539.078940][T19781] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 539.363668][T19964] bridge8: entered promiscuous mode [ 539.426659][T19971] netlink: 'syz.0.4413': attribute type 2 has an invalid length. [ 539.449545][T19781] 8021q: adding VLAN 0 to HW filter on device bond0 [ 539.460282][T19971] netlink: 19 bytes leftover after parsing attributes in process `syz.0.4413'. [ 539.522606][T19781] 8021q: adding VLAN 0 to HW filter on device team0 [ 539.561834][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 539.569006][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 539.664341][ T6458] bridge0: port 2(bridge_slave_1) entered blocking state [ 539.671692][ T6458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 540.033520][T20000] netlink: 'syz.3.4427': attribute type 2 has an invalid length. [ 540.041296][T20000] netlink: 19 bytes leftover after parsing attributes in process `syz.3.4427'. [ 540.936812][T19781] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 541.103992][ T57] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 541.110474][ T57] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 541.181250][T19781] veth0_vlan: entered promiscuous mode [ 541.226718][T19781] veth1_vlan: entered promiscuous mode [ 541.300922][T19781] veth0_macvtap: entered promiscuous mode [ 541.311370][T19781] veth1_macvtap: entered promiscuous mode [ 541.330666][T19781] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 541.352634][T19781] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 541.370829][ T1166] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 541.400384][ T1166] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 541.423890][ T1166] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 541.435302][ T1166] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 541.722314][T20073] netlink: 216 bytes leftover after parsing attributes in process `syz.2.4456'. [ 541.734675][T10264] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 541.759766][T10264] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 541.851320][ T57] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 541.871268][T20076] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4460'. [ 541.874989][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 542.008634][T20084] netlink: 'syz.4.4463': attribute type 1 has an invalid length. [ 542.050428][T20084] netlink: 152 bytes leftover after parsing attributes in process `syz.4.4463'. [ 542.282696][T20097] netlink: 1372 bytes leftover after parsing attributes in process `syz.1.4344'. [ 542.392436][T20102] netlink: 'syz.0.4471': attribute type 29 has an invalid length. [ 542.422300][T20102] netlink: 'syz.0.4471': attribute type 29 has an invalid length. [ 542.758803][ T5636] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 542.785948][ T5636] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 542.794142][ T5636] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 542.857689][ T5636] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 542.870708][ T5636] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 543.007618][T20121] sch_tbf: burst 0 is lower than device 0¾x9ÿ mtu (1514) ! [ 543.200549][T20124] netlink: 'syz.1.4481': attribute type 6 has an invalid length. [ 543.208448][T20124] netlink: 3936 bytes leftover after parsing attributes in process `syz.1.4481'. [ 543.217602][T20124] netlink: 'syz.1.4481': attribute type 1 has an invalid length. [ 543.226417][T20124] block nbd2: Unsupported socket: should be TCP or UNIX. [ 543.461598][T20140] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.4485'. [ 543.657343][T20146] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4487'. [ 543.688097][T20146] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4487'. [ 543.983645][T20111] lo speed is unknown, defaulting to 1000 [ 544.045410][T20164] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4495'. [ 544.434842][T20180] netlink: 'syz.2.4505': attribute type 23 has an invalid length. [ 544.942458][ T5636] Bluetooth: hci1: command tx timeout [ 545.016433][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 545.096793][T20211] netlink: set zone limit has 4 unknown bytes [ 545.177424][T20216] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4518'. [ 545.815603][T20111] bridge0: port 1(bridge_slave_0) entered blocking state [ 545.824630][T20111] bridge0: port 1(bridge_slave_0) entered disabled state [ 545.834947][T20111] bridge_slave_0: entered allmulticast mode [ 545.853369][T20111] bridge_slave_0: entered promiscuous mode [ 545.908313][T20233] syzkaller0: entered promiscuous mode [ 545.915792][T20233] syzkaller0: entered allmulticast mode [ 545.929755][T20246] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.4530'. [ 545.942626][T20111] bridge0: port 2(bridge_slave_1) entered blocking state [ 545.953160][T20111] bridge0: port 2(bridge_slave_1) entered disabled state [ 545.960721][T20111] bridge_slave_1: entered allmulticast mode [ 545.969299][T20111] bridge_slave_1: entered promiscuous mode [ 546.139967][T20257] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4534'. [ 546.868411][ T35] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 546.874841][ T35] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 547.032225][ T5636] Bluetooth: hci1: command tx timeout [ 547.511842][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 548.636139][T20111] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 548.663531][T20111] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 548.867467][T20111] team0: Port device team_slave_0 added [ 548.928782][T20111] team0: Port device team_slave_1 added [ 549.067843][T20111] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 549.095673][T20111] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 549.129252][T20111] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 549.134722][ T5636] Bluetooth: hci1: command tx timeout [ 549.147086][T20111] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 549.224817][T20111] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 549.263020][T20111] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 549.426727][T20111] hsr_slave_0: entered promiscuous mode [ 549.437848][T20111] hsr_slave_1: entered promiscuous mode [ 549.444541][T20111] debugfs: 'hsr0' already exists in 'hsr' [ 549.450422][T20111] Cannot create hsr debugfs directory [ 549.698267][T20270] Bluetooth: hci4: Opcode 0x0401 failed: -4 [ 549.819016][T20298] TCP: TCP_TX_DELAY enabled [ 549.955196][T20305] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4555'. [ 550.057690][T20308] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4557'. [ 550.359942][T20323] netlink: 'syz.1.4560': attribute type 29 has an invalid length. [ 550.368103][T20315] netlink: 'syz.1.4560': attribute type 29 has an invalid length. [ 550.381720][T20315] netlink: 'syz.1.4560': attribute type 29 has an invalid length. [ 550.425442][T20328] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4565'. [ 550.922417][ T5636] Bluetooth: hci4: command 0x0406 tx timeout [ 551.196115][T20111] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 551.206661][T20111] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 551.214463][T20111] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 551.223728][T20111] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 551.238248][ T5636] Bluetooth: hci1: command tx timeout [ 551.256534][T20111] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 551.294485][T20111] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 551.304254][T20111] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 551.316117][T20111] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 551.430184][T20111] 8021q: adding VLAN 0 to HW filter on device bond0 [ 551.456636][T20111] 8021q: adding VLAN 0 to HW filter on device team0 [ 551.477773][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 551.485089][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 551.512165][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 551.519352][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 552.628629][T10264] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 552.635122][T10264] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 552.716961][T20406] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4590'. [ 552.760721][T20406] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4590'. [ 552.936270][T20111] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 553.190796][T20431] syzkaller1: entered promiscuous mode [ 553.197231][T20431] syzkaller1: entered allmulticast mode [ 553.393370][T20440] netlink: 'syz.0.4602': attribute type 3 has an invalid length. [ 553.622258][T20111] veth0_vlan: entered promiscuous mode [ 553.673277][T20111] veth1_vlan: entered promiscuous mode [ 553.683472][T20450] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4606'. [ 553.717807][T20111] veth0_macvtap: entered promiscuous mode [ 553.729745][T20111] veth1_macvtap: entered promiscuous mode [ 553.772076][T20111] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 553.801735][T20111] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 553.851978][T10264] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.869511][T10264] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.889268][T20452] syzkaller1: entered promiscuous mode [ 553.897943][T20452] syzkaller1: entered allmulticast mode [ 553.954489][T10264] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 553.974817][T10264] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 554.010699][T20459] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4612'. [ 554.019929][T20459] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4612'. [ 554.131127][T20463] netlink: 'syz.2.4613': attribute type 3 has an invalid length. [ 554.169393][ T1166] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 554.177312][ T1166] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 554.249407][T10264] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 554.290831][T10264] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 554.602009][T20483] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4622'. [ 554.611004][T20483] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4622'. [ 554.637660][T20487] netlink: 'syz.3.4624': attribute type 3 has an invalid length. [ 554.729077][T20489] syzkaller1: entered promiscuous mode [ 554.784243][T20489] syzkaller1: entered allmulticast mode [ 554.939440][T20494] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 555.049311][T20500] __nla_validate_parse: 1 callbacks suppressed [ 555.049329][T20500] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4630'. [ 555.073868][T20502] netlink: 308 bytes leftover after parsing attributes in process `syz.4.4631'. [ 555.133828][T20500] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4630'. [ 555.148093][T20502] netlink: 308 bytes leftover after parsing attributes in process `syz.4.4631'. [ 555.163031][ T50] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 555.216124][ T50] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 555.225146][ T50] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 555.236047][ T50] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 555.244013][ T50] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 555.497516][ T5632] bridge0: port 3(syz_tun) entered disabled state [ 555.593323][ T5632] syz_tun (unregistering): left allmulticast mode [ 555.599803][ T5632] syz_tun (unregistering): left promiscuous mode [ 555.606223][ T5632] bridge0: port 3(syz_tun) entered disabled state [ 555.905174][T20535] syzkaller1: entered promiscuous mode [ 555.910706][T20535] syzkaller1: entered allmulticast mode [ 556.036734][T20503] lo speed is unknown, defaulting to 1000 [ 556.818667][T20574] netlink: 144 bytes leftover after parsing attributes in process `syz.3.4655'. [ 556.839223][T20571] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4654'. [ 557.264680][T20503] bridge0: port 1(bridge_slave_0) entered blocking state [ 557.302909][T20503] bridge0: port 1(bridge_slave_0) entered disabled state [ 557.328362][T20503] bridge_slave_0: entered allmulticast mode [ 557.342096][ T5636] Bluetooth: hci2: command tx timeout [ 557.343251][T20503] bridge_slave_0: entered promiscuous mode [ 557.447154][T20503] bridge0: port 2(bridge_slave_1) entered blocking state [ 557.454316][T20503] bridge0: port 2(bridge_slave_1) entered disabled state [ 557.461572][T20503] bridge_slave_1: entered allmulticast mode [ 557.469373][T20503] bridge_slave_1: entered promiscuous mode [ 557.517525][T20601] syzkaller1: entered promiscuous mode [ 557.523041][T20601] syzkaller1: entered allmulticast mode [ 558.340903][T20503] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 558.390334][ T57] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 558.396877][ T57] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 558.409629][T20503] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 558.626469][T20503] team0: Port device team_slave_0 added [ 558.660783][T20503] team0: Port device team_slave_1 added [ 558.727520][T20503] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 558.745057][T20503] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 558.789225][T20503] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 558.817526][T20503] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 558.826541][T20503] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 558.890964][T20503] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 559.077750][T20638] syzkaller1: entered promiscuous mode [ 559.086500][T20638] syzkaller1: entered allmulticast mode [ 559.132842][T20503] hsr_slave_0: entered promiscuous mode [ 559.164596][T20503] hsr_slave_1: entered promiscuous mode [ 559.184028][T20503] debugfs: 'hsr0' already exists in 'hsr' [ 559.201783][T20503] Cannot create hsr debugfs directory [ 559.421667][ T5636] Bluetooth: hci2: command tx timeout [ 560.185741][T20503] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 560.228179][T20503] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 560.329487][T20668] netlink: 'syz.1.4695': attribute type 2 has an invalid length. [ 560.370507][T20668] netlink: 19 bytes leftover after parsing attributes in process `syz.1.4695'. [ 560.617303][T20503] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 560.651586][T20503] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 560.937291][T20503] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 560.973414][T20503] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.181353][T20503] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 561.193857][T20503] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 561.266117][T20713] netlink: 'syz.4.4712': attribute type 2 has an invalid length. [ 561.285876][T20713] netlink: 19 bytes leftover after parsing attributes in process `syz.4.4712'. [ 561.503041][ T5636] Bluetooth: hci2: command tx timeout [ 561.704063][T20503] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 562.179146][T20503] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 562.206837][T20738] netlink: 'syz.4.4724': attribute type 2 has an invalid length. [ 562.219145][T20503] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 562.234363][T20738] netlink: 19 bytes leftover after parsing attributes in process `syz.4.4724'. [ 562.300263][T20503] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 562.327312][T20503] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 562.353049][T20503] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 562.362508][T20503] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 562.395620][T20503] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 562.685273][T20503] 8021q: adding VLAN 0 to HW filter on device bond0 [ 562.717481][T20503] 8021q: adding VLAN 0 to HW filter on device team0 [ 562.733900][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 562.740996][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 562.760082][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 562.767319][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 562.922898][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.930639][ T1313] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 563.504447][T20781] syzkaller0: entered promiscuous mode [ 563.510218][T20781] syzkaller0: entered allmulticast mode [ 563.534836][T20781] TC_ACT_REPEAT abuse ? [ 563.583349][ T5636] Bluetooth: hci2: command tx timeout [ 563.731356][T20786] bond1: (slave lo): Releasing backup interface [ 563.740006][T20786] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 563.757761][T20786] syz_tun: left allmulticast mode [ 563.763632][T20786] syz_tun: left promiscuous mode [ 563.768919][T20786] bridge0: port 3(syz_tun) entered disabled state [ 563.784005][T20786] bridge_slave_0: left allmulticast mode [ 563.790089][T20786] bridge0: port 1(bridge_slave_0) entered disabled state [ 563.840856][T20786] bridge_slave_1: left allmulticast mode [ 563.851225][T20786] bridge_slave_1: left promiscuous mode [ 563.864998][T20786] bridge0: port 2(bridge_slave_1) entered disabled state [ 563.914403][T20786] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 563.934819][T20786] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 563.968285][T20786] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 563.978952][T20786] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 563.994171][T20786] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 564.104799][T20791] bridge0: port 1(syz_tun) entered blocking state [ 564.142769][ T193] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 564.149222][ T193] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 564.155642][T20791] bridge0: port 1(syz_tun) entered disabled state [ 564.189019][T20791] syz_tun: entered allmulticast mode [ 564.211216][T20791] syz_tun: entered promiscuous mode [ 564.318757][T20798] syzkaller0: entered promiscuous mode [ 564.324371][T20798] syzkaller0: entered allmulticast mode [ 564.351404][T20503] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 565.933235][T20840] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4758'. [ 566.233127][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806883f800: rx timeout, send abort [ 566.733298][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806883e400: rx timeout, send abort [ 566.849445][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806883f800: abort rx timeout. Force session deactivation [ 567.242436][ C1] vcan0: j1939_tp_rxtimer: 0xffff88806883e400: abort rx timeout. Force session deactivation [ 567.677137][T20503] veth0_vlan: entered promiscuous mode [ 567.756556][T20503] veth1_vlan: entered promiscuous mode [ 567.868018][T20852] syzkaller0: entered promiscuous mode [ 567.875105][T20852] syzkaller0: entered allmulticast mode [ 568.243926][T20503] veth0_macvtap: entered promiscuous mode [ 568.394936][T20503] veth1_macvtap: entered promiscuous mode [ 568.450433][T20503] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 568.489921][T20503] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 568.519834][ T6459] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.532867][ T6459] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.557897][ T6459] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.618685][ T6459] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 568.934562][ T135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 568.948386][ T135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 569.066180][ T6454] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 569.100857][ T6454] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 569.816765][ T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 569.832134][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 569.886030][ T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 569.906401][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 569.917027][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 569.938992][T20927] bridge0: port 3(syz_tun) entered blocking state [ 569.966189][ T6454] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 569.972735][ T6454] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 569.992148][T20927] bridge0: port 3(syz_tun) entered disabled state [ 569.998809][T20927] syz_tun: entered allmulticast mode [ 570.067127][T20927] syz_tun: entered promiscuous mode [ 570.075152][T20927] bridge0: port 3(syz_tun) entered blocking state [ 570.081770][T20927] bridge0: port 3(syz_tun) entered forwarding state [ 570.341585][ T5622] syz_tun (unregistering): left allmulticast mode [ 570.348251][ T5622] syz_tun (unregistering): left promiscuous mode [ 570.354727][ T5622] bridge0: port 1(syz_tun) entered disabled state [ 570.716479][T20963] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4805'. [ 570.738935][T20963] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4805'. [ 570.875941][T20971] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4808'. [ 571.011926][T20922] lo speed is unknown, defaulting to 1000 [ 571.183803][T20986] syzkaller0: entered promiscuous mode [ 571.217737][T20986] syzkaller0: entered allmulticast mode [ 571.461169][T20995] syzkaller0: entered promiscuous mode [ 571.466753][T20995] syzkaller0: entered allmulticast mode [ 571.522921][T20988] lo speed is unknown, defaulting to 1000 [ 571.886912][T21005] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4820'. [ 571.982034][ T50] Bluetooth: hci4: command tx timeout [ 572.358031][T20922] bridge0: port 1(bridge_slave_0) entered blocking state [ 572.365200][T20922] bridge0: port 1(bridge_slave_0) entered disabled state [ 572.372975][T20922] bridge_slave_0: entered allmulticast mode [ 572.381477][T20922] bridge_slave_0: entered promiscuous mode [ 572.445222][T21013] syzkaller1: entered promiscuous mode [ 572.473076][T21013] syzkaller1: entered allmulticast mode [ 572.492931][T21026] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4827'. [ 572.502228][T20922] bridge0: port 2(bridge_slave_1) entered blocking state [ 572.523703][T20922] bridge0: port 2(bridge_slave_1) entered disabled state [ 572.535764][T20922] bridge_slave_1: entered allmulticast mode [ 572.553449][T20922] bridge_slave_1: entered promiscuous mode [ 572.826899][T20922] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 572.880275][T20922] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 572.970005][T20922] team0: Port device team_slave_0 added [ 573.015040][T20922] team0: Port device team_slave_1 added [ 573.042908][T20922] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 573.049888][T20922] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 573.096036][T20922] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 573.127103][T20922] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 573.134084][T20922] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 573.160042][T20922] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 573.249516][T20922] hsr_slave_0: entered promiscuous mode [ 573.256232][T20922] hsr_slave_1: entered promiscuous mode [ 573.263663][T20922] debugfs: 'hsr0' already exists in 'hsr' [ 573.269474][T20922] Cannot create hsr debugfs directory [ 573.547784][T20922] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 573.576960][T20922] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 573.732645][T21044] syzkaller0: entered promiscuous mode [ 573.738305][T21044] syzkaller0: entered allmulticast mode [ 573.928023][T21057] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4839'. [ 574.063422][ T50] Bluetooth: hci4: command tx timeout [ 574.460520][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 575.663434][ T35] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 575.669912][ T35] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 576.145876][ T50] Bluetooth: hci4: command tx timeout [ 576.575855][T20922] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 576.587731][T20922] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 576.747940][T21076] netlink: 88 bytes leftover after parsing attributes in process `syz.0.4846'. [ 576.855172][T20922] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 576.867544][T20922] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 577.115689][T21086] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4852'. [ 577.141870][T21089] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4853'. [ 577.179861][T21086] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4852'. [ 577.522402][T21099] netlink: 88 bytes leftover after parsing attributes in process `syz.4.4858'. [ 577.608648][T21102] netlink: 'syz.0.4860': attribute type 10 has an invalid length. [ 577.714936][T21102] bridge0: port 3(syz_tun) entered disabled state [ 577.766552][T21102] syz_tun: left allmulticast mode [ 577.778594][T21102] syz_tun: left promiscuous mode [ 577.785960][T21102] bridge0: port 3(syz_tun) entered disabled state [ 577.820096][T21102] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 577.911066][T21119] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4865'. [ 577.930892][T21105] 8021q: adding VLAN 0 to HW filter on device bond1 [ 577.954470][T21114] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 577.966967][T21114] bond1: (slave macvlan2): unknown ethtool speed (30000) for port 1 (set it to 0) [ 577.976517][T21114] bond1: (slave macvlan2): speed changed to 0 on port 1 [ 577.986698][T21114] bond1: (slave macvlan2): Enslaving as a backup interface with an up link [ 578.012754][T14414] bond_slave_0: entered promiscuous mode [ 578.020639][T14414] bond_slave_1: entered promiscuous mode [ 578.026321][T14414] syz_tun: entered promiscuous mode [ 578.222977][ T50] Bluetooth: hci4: command tx timeout [ 578.638409][T21111] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 578.669434][T20922] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 578.692882][T20922] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 578.715213][T20922] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 578.741416][T20922] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 578.749432][T20922] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 578.794058][T20922] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 578.802081][T20922] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 578.822054][T20922] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 579.019576][T20922] 8021q: adding VLAN 0 to HW filter on device bond0 [ 579.039887][T20922] 8021q: adding VLAN 0 to HW filter on device team0 [ 579.054039][ T57] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.061205][ T57] bridge0: port 1(bridge_slave_0) entered forwarding state [ 579.176623][ T193] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.183859][ T193] bridge0: port 2(bridge_slave_1) entered forwarding state [ 579.265367][T21149] syzkaller0: entered promiscuous mode [ 579.271724][T21149] syzkaller0: entered allmulticast mode [ 579.605555][T21170] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4884'. [ 579.759279][T21176] syzkaller1: entered promiscuous mode [ 579.765423][T21176] syzkaller1: entered allmulticast mode [ 580.172688][T20922] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 580.208179][T21198] netlink: 1372 bytes leftover after parsing attributes in process `syz.1.4894'. [ 580.248094][T20922] veth0_vlan: entered promiscuous mode [ 580.278525][T20922] veth1_vlan: entered promiscuous mode [ 580.339738][T20922] veth0_macvtap: entered promiscuous mode [ 580.406099][T20922] veth1_macvtap: entered promiscuous mode [ 580.492181][T20922] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 580.570920][T20922] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 580.578527][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807cff1000: rx timeout, send abort [ 580.626419][T10264] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.636464][T10264] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.647719][T10264] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.682859][T10264] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 580.787232][ T6454] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 580.794539][ T6454] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 580.937564][ T135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 580.955353][ T135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 581.046826][ T135] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 581.065691][ T135] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 581.078646][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807cff1000: abort rx timeout. Force session deactivation [ 581.090249][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807cff3c00: rx timeout, send abort [ 581.599351][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807cff3c00: abort rx timeout. Force session deactivation [ 582.021046][T21243] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 582.040323][ C0] Unknown status report in ack skb [ 582.332009][ C0] vcan0: j1939_tp_rxtimer: 0xffff888043aff000: rx timeout, send abort [ 582.832386][ C0] vcan0: j1939_tp_rxtimer: 0xffff888043afec00: rx timeout, send abort [ 582.840931][ C0] vcan0: j1939_tp_rxtimer: 0xffff888043aff000: abort rx timeout. Force session deactivation [ 582.912626][T21275] netlink: 1372 bytes leftover after parsing attributes in process `syz.2.4927'. [ 583.340659][ C0] vcan0: j1939_tp_rxtimer: 0xffff888043afec00: abort rx timeout. Force session deactivation [ 584.027608][T21310] netlink: 1372 bytes leftover after parsing attributes in process `syz.2.4942'. [ 584.103441][ C0] vcan0: j1939_tp_rxtimer: 0xffff888058698000: rx timeout, send abort [ 584.603480][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807fc90c00: rx timeout, send abort [ 584.612952][ C0] vcan0: j1939_tp_rxtimer: 0xffff888058698000: abort rx timeout. Force session deactivation [ 585.112771][ C0] vcan0: j1939_tp_rxtimer: 0xffff88807fc90c00: abort rx timeout. Force session deactivation [ 586.556082][T10264] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 586.563419][T10264] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 586.626246][T21340] netlink: 1372 bytes leftover after parsing attributes in process `syz.0.4954'. [ 587.210318][T21349] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4958'. [ 588.701114][T21375] netlink: 1372 bytes leftover after parsing attributes in process `syz.0.4967'. [ 588.846539][T21377] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4968'. [ 589.030308][T21377] vlan2: entered promiscuous mode [ 589.056448][T21377] batadv0: entered promiscuous mode [ 589.093882][T21382] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4970'. [ 590.150376][T21415] netlink: 1372 bytes leftover after parsing attributes in process `syz.1.4980'. [ 590.804283][T21430] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4988'. [ 590.919153][T21436] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4991'. [ 591.223440][T21444] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4993'. [ 591.522885][T21450] netlink: 1372 bytes leftover after parsing attributes in process `syz.4.4996'. [ 591.561953][T21456] syzkaller0: entered promiscuous mode [ 591.567564][T21456] syzkaller0: entered allmulticast mode [ 591.826334][T21466] tipc: Enabled bearer , priority 7 [ 592.207168][T21476] netlink: 56 bytes leftover after parsing attributes in process `syz.3.5004'. [ 592.401509][ T6454] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 592.410487][ T6454] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 592.468463][T21490] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5009'. [ 593.947497][T21543] __nla_validate_parse: 4 callbacks suppressed [ 593.947517][T21543] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5029'. [ 594.013326][T21552] syzkaller1: entered promiscuous mode [ 594.018872][T21552] syzkaller1: entered allmulticast mode [ 594.248907][T21560] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5035'. [ 594.275667][T21558] syzkaller0: entered promiscuous mode [ 594.281189][T21558] syzkaller0: entered allmulticast mode [ 594.308209][T21560] netlink: 1372 bytes leftover after parsing attributes in process `syz.1.5035'. [ 594.999254][T21588] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5048'. [ 595.039254][T21588] netlink: 1372 bytes leftover after parsing attributes in process `syz.4.5048'. [ 595.247651][T21599] syzkaller1: entered promiscuous mode [ 595.253249][T21599] syzkaller1: entered allmulticast mode [ 595.850036][T21618] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5062'. [ 595.902774][T21619] netlink: 1372 bytes leftover after parsing attributes in process `syz.2.5063'. [ 595.931320][T21620] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 596.100904][T21627] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5068'. [ 596.336608][T21633] syzkaller1: entered promiscuous mode [ 596.342133][T21633] syzkaller1: entered allmulticast mode [ 596.404678][T21637] syzkaller1: entered promiscuous mode [ 596.410216][T21637] syzkaller1: entered allmulticast mode [ 596.718051][T21648] netlink: 1372 bytes leftover after parsing attributes in process `syz.4.5076'. [ 596.792271][T21649] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 596.930323][T21651] syzkaller0: entered promiscuous mode [ 596.935848][T21651] syzkaller0: entered allmulticast mode [ 597.051792][T21659] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5081'. [ 597.284617][T21665] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 597.387803][T21667] syzkaller1: entered promiscuous mode [ 597.398510][T21667] syzkaller1: entered allmulticast mode [ 597.433160][T21671] syzkaller1: entered promiscuous mode [ 597.438750][T21671] syzkaller1: entered allmulticast mode [ 597.621016][ C0] wlan1: beacon TX faster than countdown (channel/color switch) completion [ 598.015346][T21691] netlink: 'syz.2.5090': attribute type 1 has an invalid length. [ 598.062727][ T135] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 598.080818][ T135] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 599.241218][T21680] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 599.274049][T21680] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 599.372474][T21680] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 599.378494][T21680] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 599.534401][T21680] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 599.540346][T21680] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 599.636634][T21680] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 599.642935][T21680] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 599.763994][T21680] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 599.822828][T21680] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 600.197847][T21748] __nla_validate_parse: 4 callbacks suppressed [ 600.197901][T21748] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5102'. [ 600.548735][T21751] syzkaller0: entered promiscuous mode [ 600.554267][T21751] syzkaller0: entered allmulticast mode [ 600.643563][T21757] netlink: 1372 bytes leftover after parsing attributes in process `syz.0.5104'. [ 601.024894][T21770] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 601.389391][T21783] netlink: 88 bytes leftover after parsing attributes in process `syz.3.5109'. [ 603.863639][T10264] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 603.870102][T10264] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 605.590295][T21838] netlink: 1372 bytes leftover after parsing attributes in process `syz.1.5117'. [ 606.206526][T21863] tipc: Enabling of bearer rejected, failed to enable media [ 607.374037][T21890] syzkaller0: entered promiscuous mode [ 607.379565][T21890] syzkaller0: entered allmulticast mode [ 607.426535][T14410] IPVS: starting estimator thread 0... [ 607.464022][T21909] netlink: 1372 bytes leftover after parsing attributes in process `syz.3.5132'. [ 607.771834][T21910] IPVS: using max 31 ests per chain, 74400 per kthread [ 607.929032][T21923] syzkaller0: entered promiscuous mode [ 607.997381][T21923] syzkaller0: entered allmulticast mode [ 608.436326][T14412] IPVS: starting estimator thread 0... [ 608.753707][T21942] IPVS: using max 32 ests per chain, 76800 per kthread [ 608.788386][T21949] netlink: 1372 bytes leftover after parsing attributes in process `syz.1.5144'. [ 609.655859][ T6459] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 609.662675][ T6459] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 612.090274][T21979] syzkaller0: entered promiscuous mode [ 612.095851][T21979] syzkaller0: entered allmulticast mode [ 612.338339][T14410] IPVS: starting estimator thread 0... [ 612.432106][T21988] IPVS: using max 30 ests per chain, 72000 per kthread [ 612.537611][T21992] netlink: 1372 bytes leftover after parsing attributes in process `syz.0.5155'. [ 613.038772][T22015] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5164'. [ 613.126642][T22014] syzkaller0: entered promiscuous mode [ 613.155941][T22014] syzkaller0: entered allmulticast mode [ 613.317619][T22019] syzkaller0: entered promiscuous mode [ 613.323140][T22019] syzkaller0: entered allmulticast mode [ 613.397616][T22030] netlink: 1372 bytes leftover after parsing attributes in process `syz.3.5172'. [ 613.977413][T22049] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5181'. [ 614.300905][T22053] netlink: 1372 bytes leftover after parsing attributes in process `syz.3.5183'. [ 614.371235][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802af4d400: rx timeout, send abort [ 614.782848][ T6459] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 614.790142][ T6459] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 614.824230][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802af4cc00: rx timeout, send abort [ 614.943403][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802af4d400: abort rx timeout. Force session deactivation [ 615.400341][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802af4cc00: abort rx timeout. Force session deactivation [ 617.181442][T22071] syzkaller0: entered promiscuous mode [ 617.186954][T22071] syzkaller0: entered allmulticast mode [ 617.473365][T22077] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 617.698603][T22085] netlink: 1372 bytes leftover after parsing attributes in process `syz.0.5194'. [ 617.959824][T22090] syzkaller0: entered promiscuous mode [ 617.981933][T22090] syzkaller0: entered allmulticast mode [ 620.465983][ T35] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 620.472883][ T35] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 622.146186][T22162] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 622.228898][T22167] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5216'. [ 622.527910][T22178] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5220'. [ 622.734421][T22181] syzkaller0: entered promiscuous mode [ 622.739948][T22181] syzkaller0: entered allmulticast mode [ 622.871191][T22192] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5228'. [ 624.378339][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.399811][ T1313] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 626.093860][T22194] syzkaller0: entered promiscuous mode [ 626.099392][T22194] syzkaller0: entered allmulticast mode [ 626.228703][ T193] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 626.236013][ T193] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 626.359687][T22227] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5235'. [ 626.640650][T22238] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5240'. [ 626.651117][T22238] batadv_slave_0: entered promiscuous mode [ 626.735914][T22241] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5242'. [ 627.038459][T22250] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5245'. [ 629.494900][T22359] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5291'. [ 631.183830][T22400] syzkaller0: entered promiscuous mode [ 631.358284][T22400] syzkaller0: entered allmulticast mode [ 632.092946][ T6454] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 632.100320][ T6454] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 634.577271][T22430] tap0: tun_chr_ioctl cmd 1074025672 [ 634.582618][T22430] tap0: ignored: set checksum enabled [ 635.747843][T22461] syzkaller0: entered promiscuous mode [ 635.753425][T22461] syzkaller0: entered allmulticast mode [ 637.746281][ T6459] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 637.753710][ T6459] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 639.526484][T22517] syzkaller1: entered promiscuous mode [ 639.532015][T22517] syzkaller1: entered allmulticast mode [ 639.575323][T22524] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5358'. [ 639.714171][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 640.344896][T22547] syzkaller0: entered promiscuous mode [ 640.350820][T22547] syzkaller0: entered allmulticast mode [ 640.430161][T22554] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5372'. [ 642.787726][ T135] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 642.795250][ T135] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 644.021079][T22593] syzkaller1: entered promiscuous mode [ 644.023237][T22595] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5384'. [ 644.027233][T22593] syzkaller1: entered allmulticast mode [ 644.614394][T22610] netlink: 1372 bytes leftover after parsing attributes in process `syz.2.5391'. [ 644.932314][T22623] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5395'. [ 647.986481][ T6459] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 647.993219][T22648] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5402'. [ 648.003851][ T6459] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 648.306386][T22660] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5408'. [ 648.366120][T22662] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5409'. [ 648.401146][T22662] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5409'. [ 648.411160][T22662] netlink: 23 bytes leftover after parsing attributes in process `syz.3.5409'. [ 648.470616][T22664] xt_hashlimit: size too large, truncated to 1048576 [ 648.629134][T22674] netlink: 64 bytes leftover after parsing attributes in process `syz.0.5414'. [ 648.865105][T22680] syzkaller1: entered promiscuous mode [ 648.870628][T22680] syzkaller1: entered allmulticast mode [ 649.008688][T22682] syzkaller1: entered promiscuous mode [ 649.016887][T22682] syzkaller1: entered allmulticast mode [ 649.137899][T22690] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5420'. [ 650.102576][T22720] syzkaller1: entered promiscuous mode [ 650.116447][T22720] syzkaller1: entered allmulticast mode [ 650.210987][T22724] syzkaller1: entered promiscuous mode [ 650.216501][T22724] syzkaller1: entered allmulticast mode [ 650.982757][T22752] syzkaller1: entered promiscuous mode [ 650.994580][T22752] syzkaller1: entered allmulticast mode [ 651.162824][T22756] syzkaller0: entered promiscuous mode [ 651.168354][T22756] syzkaller0: entered allmulticast mode [ 651.217744][T22762] syzkaller1: entered promiscuous mode [ 651.223341][T22762] syzkaller1: entered allmulticast mode [ 654.929247][T22803] xt_hashlimit: size too large, truncated to 1048576 [ 655.441857][T22825] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5479'. [ 655.555309][T22828] syzkaller0: entered promiscuous mode [ 655.560833][T22828] syzkaller0: entered allmulticast mode [ 656.166580][T22845] x_tables: ip6_tables: socket match: used from hooks OUTPUT, but only valid from PREROUTING/INPUT [ 656.573076][T22857] netlink: 1372 bytes leftover after parsing attributes in process `syz.3.5490'. [ 657.583962][ T135] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 657.590901][ T135] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 659.730728][T22867] tipc: Resetting bearer [ 659.767098][T22867] bridge0: port 2(bridge_slave_1) entered disabled state [ 659.774848][T22867] bridge0: port 1(bridge_slave_0) entered disabled state [ 659.842062][T22867] bond_slave_0: left promiscuous mode [ 659.848004][T22867] bond_slave_1: left promiscuous mode [ 660.465284][T22867] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 660.527471][T22867] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 661.076265][T22877] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 661.176296][T22915] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5505'. [ 661.246033][T22915] bridge0: port 2(bridge_slave_1) entered disabled state [ 661.298161][ T6461] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 661.344937][ T6461] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 661.387169][ T6461] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 661.420633][ T6461] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 662.074899][T22951] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5520'. [ 662.589731][T22978] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5528'. [ 662.689790][T22983] netlink: 136 bytes leftover after parsing attributes in process `syz.1.5532'. [ 662.698981][T22983] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5532'. [ 663.341950][ T6454] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 663.348405][ T6454] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 663.587826][T23020] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5546'. [ 664.009564][T23035] netlink: 1372 bytes leftover after parsing attributes in process `syz.3.5552'. [ 664.457251][T23058] netlink: 92 bytes leftover after parsing attributes in process `syz.1.5561'. [ 664.808422][T23078] netlink: 1372 bytes leftover after parsing attributes in process `syz.2.5567'. [ 664.845898][T23083] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5569'. [ 665.043413][T23089] syzkaller0: entered promiscuous mode [ 665.066685][T23089] syzkaller0: entered allmulticast mode [ 666.200476][T23137] __nla_validate_parse: 3 callbacks suppressed [ 666.200512][T23137] netlink: 84 bytes leftover after parsing attributes in process `syz.0.5593'. [ 666.244019][T23134] syzkaller0: entered promiscuous mode [ 666.261653][T23134] syzkaller0: entered allmulticast mode [ 667.132290][T23162] netlink: 'syz.1.5602': attribute type 3 has an invalid length. [ 668.227425][T23190] batadv_slave_1: entered promiscuous mode [ 668.238535][T23188] batadv_slave_1: left promiscuous mode [ 668.799851][T23203] syzkaller0: entered promiscuous mode [ 668.805378][T23203] syzkaller0: entered allmulticast mode [ 669.177254][T10264] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 669.183710][T10264] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 672.854588][T23255] netlink: 1372 bytes leftover after parsing attributes in process `syz.1.5632'. [ 673.041744][T23262] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5635'. [ 673.571088][T23288] netlink: 1372 bytes leftover after parsing attributes in process `syz.4.5644'. [ 674.242851][ T6454] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 674.249316][ T6454] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 677.346066][T23316] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 677.353977][T23316] syzkaller1: linktype set to 778 [ 677.400391][ T6454] team0: left allmulticast mode [ 677.412968][ T6454] vlan0: left allmulticast mode [ 677.419570][ T6454] veth0_vlan: left allmulticast mode [ 677.471570][ T6454] team0: left promiscuous mode [ 677.482315][ T6454] vlan0: left promiscuous mode [ 677.494707][ T6454] bridge0: port 2(team0) entered disabled state [ 677.506175][ T6454] gretap0: left allmulticast mode [ 677.511244][ T6454] gretap0: left promiscuous mode [ 677.516387][ T6454] bridge0: port 1(gretap0) entered disabled state [ 677.777737][ T6454] dvmrp0: left allmulticast mode [ 677.782839][ T6454] pimreg: left allmulticast mode [ 678.589875][ T6454] bond2 (unregistering): (slave ip6gre1): Releasing backup interface [ 678.598066][ T6454] ip6gre1 (unregistering): left promiscuous mode [ 678.807718][ T6454] bond6 (unregistering): (slave geneve0): Releasing active interface [ 678.851152][ T6454] bridge0 (unregistering): left allmulticast mode [ 680.635281][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 680.865221][ T6454] bond7 (unregistering): (slave bridge10): Releasing active interface [ 681.086728][ T6454] team0: Port device bridge11 removed [ 681.206622][ T6454] bond0 (unregistering): Released all slaves [ 681.220538][ T6454] bond1 (unregistering): Released all slaves [ 681.239774][ T6454] bond2 (unregistering): Released all slaves [ 681.260556][ T6454] bond3 (unregistering): Released all slaves [ 681.281777][ T6454] bond4 (unregistering): Released all slaves [ 681.320124][ T6454] bond5 (unregistering): Released all slaves [ 681.339387][ T6454] bond6 (unregistering): Released all slaves [ 681.357292][ T6454] bond7 (unregistering): Released all slaves [ 681.490529][T23365] syzkaller0: entered promiscuous mode [ 681.496047][T23365] syzkaller0: entered allmulticast mode [ 681.803110][ T6454] : left promiscuous mode [ 682.115774][ T6454] tipc: Left network mode [ 682.902493][T23435] netlink: 256 bytes leftover after parsing attributes in process `syz.4.5684'. [ 682.970701][T23435] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5684'. [ 683.127072][T23441] syzkaller0: entered promiscuous mode [ 683.132591][T23441] syzkaller0: entered allmulticast mode [ 683.727410][T23469] Bluetooth: MGMT ver 1.23 [ 684.749290][T23488] syzkaller0: entered promiscuous mode [ 684.755684][T23488] syzkaller0: entered allmulticast mode [ 685.127159][T23507] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5707'. [ 685.761657][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.772509][ T1313] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 685.895873][ T6454] hsr_slave_0: left promiscuous mode [ 685.935194][ T6454] hsr_slave_1: left promiscuous mode [ 685.985798][ T6454] veth1_vlan: left allmulticast mode [ 685.997852][ T6454] veth1_macvtap: left promiscuous mode [ 686.005916][ T6454] veth1_vlan: left promiscuous mode [ 686.020107][ T6454] veth0_vlan: left promiscuous mode [ 686.332375][ T6454] team0 (unregistering): Port device vlan0 removed [ 689.447987][T23515] syzkaller0: entered promiscuous mode [ 689.455100][T23515] syzkaller0: entered allmulticast mode [ 689.937798][T23546] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5719'. [ 690.146012][ T6454] IPVS: stop unused estimator thread 0... [ 690.351286][T23559] IPv6: Can't replace route, no match found [ 690.369902][T23559] IPv6: Can't replace route, no match found [ 690.449520][ T6454] bridge_slave_1: left allmulticast mode [ 690.468279][ T6454] bridge_slave_1: left promiscuous mode [ 690.483774][ T6454] bridge0: port 2(bridge_slave_1) entered disabled state [ 690.510266][ T6454] bridge_slave_0: left allmulticast mode [ 690.524049][ T6454] bridge0: port 1(bridge_slave_0) entered disabled state [ 690.615939][ T6454] pimreg3: left allmulticast mode [ 691.583304][T23590] netlink: 216 bytes leftover after parsing attributes in process `syz.1.5737'. [ 691.594826][T23590] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5737'. [ 691.616765][ T6454] bond5 (unregistering): (slave geneve2): Releasing backup interface [ 691.760493][ T6454] bond2 (unregistering): (slave bridge1): Releasing backup interface [ 691.808023][ T6454] bond3 (unregistering): (slave bridge2): Releasing backup interface [ 691.816499][ T6454] bridge2 (unregistering): left promiscuous mode [ 692.107572][ T6454] .`¹ (unregistering): (slave bond_slave_0): Releasing backup interface [ 692.118629][ T6454] bond_slave_0: left allmulticast mode [ 692.127186][ T6454] .`¹ (unregistering): (slave bond_slave_1): Releasing backup interface [ 692.136948][ T6454] bond_slave_1: left allmulticast mode [ 692.146803][ T6454] .`¹ (unregistering): Released all slaves [ 692.161162][ T6454] bond1 (unregistering): (slave lo): Releasing backup interface [ 692.169661][ T6454] bond1 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 692.181336][ T6454] bond1 (unregistering): Released all slaves [ 692.210751][ T6454] bond0 (unregistering): Released all slaves [ 692.233555][ T6454] bond2 (unregistering): Released all slaves [ 692.262354][ T6454] bond3 (unregistering): Released all slaves [ 692.282286][ T6454] bond4 (unregistering): Released all slaves [ 692.313638][ T6454] bond5 (unregistering): Released all slaves [ 692.334790][ T6454] bond6 (unregistering): Released all slaves [ 692.703679][ T6454] : left promiscuous mode [ 693.335467][T23629] No such timeout policy "syz0" [ 693.580070][T23640] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5756'. [ 694.095255][T23651] tipc: Started in network mode [ 694.111002][T23651] tipc: Node identity de33ee570841, cluster identity 4711 [ 694.138991][T23651] tipc: Enabled bearer , priority 0 [ 694.190716][T23658] syzkaller0: entered promiscuous mode [ 694.216546][T23658] syzkaller0: entered allmulticast mode [ 694.403698][T23658] tipc: Resetting bearer [ 694.478600][T23650] tipc: Resetting bearer [ 694.547817][T23650] tipc: Disabling bearer [ 695.096910][T23683] netlink: 'syz.2.5774': attribute type 1 has an invalid length. [ 695.139384][T23683] netlink: 256 bytes leftover after parsing attributes in process `syz.2.5774'. [ 695.830547][T23710] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5785'. [ 695.866093][T23710] openvswitch: netlink: Key 0 has unexpected len 2 expected 0 [ 696.764762][ T6454] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 696.788716][ T6454] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 696.824158][ T6454] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 696.858813][ T6454] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 696.924851][ T6454] veth1_vlan: left promiscuous mode [ 696.951019][ T6454] veth0_vlan: left promiscuous mode [ 697.327743][T23747] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5799'. [ 697.565142][T23753] netlink: 'syz.0.5801': attribute type 1 has an invalid length. [ 697.936712][ T6454] team0 (unregistering): Port device team_slave_1 removed [ 698.001822][ T6454] team0 (unregistering): Port device team_slave_0 removed [ 698.400909][T23753] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 698.960597][T23797] syzkaller0: entered promiscuous mode [ 699.003998][T23797] syzkaller0: entered allmulticast mode [ 699.216585][T23797] tipc: Enabled bearer , priority 0 [ 699.259132][T23795] tipc: Resetting bearer [ 699.389526][T23795] tipc: Disabling bearer [ 699.490870][ T6454] IPVS: stop unused estimator thread 0... [ 699.759887][T23829] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5820'. [ 699.796508][T23829] openvswitch: netlink: IPv4 frag type 127 is out of range max 2 [ 700.008199][T23836] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5825'. [ 702.017220][T23905] netlink: 68 bytes leftover after parsing attributes in process `syz.1.5846'. [ 702.716847][T23935] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5856'. [ 703.749778][T23968] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5863'. [ 704.129140][T23977] No such timeout policy "syz0" [ 704.233368][T23985] syzkaller0: entered promiscuous mode [ 704.252178][T23985] syzkaller0: entered allmulticast mode [ 705.125152][T24018] No such timeout policy "syz0" [ 706.027945][T24040] syzkaller0: entered promiscuous mode [ 706.048730][T24040] syzkaller0: entered allmulticast mode [ 706.463303][ T6459] bridge_slave_1: left allmulticast mode [ 706.487280][ T6459] bridge_slave_1: left promiscuous mode [ 706.531817][ T6459] bridge0: port 2(bridge_slave_1) entered disabled state [ 706.597306][ T6459] ¾x9ÿ: left allmulticast mode [ 706.624841][ T6459] ¾x9ÿ: left promiscuous mode [ 706.636040][ T6459] bridge0: port 1(0¾x9ÿ) entered disabled state [ 706.742090][ T6459] dvmrp0: left allmulticast mode [ 706.756976][ T6459] pimreg: left allmulticast mode [ 707.405879][ T6459] bond7 (unregistering): (slave ip6gretap1): Releasing active interface [ 708.924740][ T6459] bond5 (unregistering): (slave bridge6): Releasing backup interface [ 709.005845][ T6459] bond6 (unregistering): (slave bridge7): Releasing active interface [ 709.076522][ T6459] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 709.110834][ T6459] bond0 (unregistering): Released all slaves [ 709.176377][ T6459] bond1 (unregistering): (slave lo): Releasing backup interface [ 709.209732][ T6459] bond1 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 709.247034][ T6459] bond1 (unregistering): Released all slaves [ 709.309475][ T6459] bond2 (unregistering): Released all slaves [ 709.360105][ T6459] bond3 (unregistering): Released all slaves [ 709.405095][ T6459] bond4 (unregistering): Released all slaves [ 709.455789][ T6459] bond5 (unregistering): Released all slaves [ 709.523663][ T6459] bond6 (unregistering): Released all slaves [ 709.577528][ T6459] bond7 (unregistering): Released all slaves [ 709.606584][ T6459] bond8 (unregistering): Released all slaves [ 709.632534][T24051] lo speed is unknown, defaulting to 1000 [ 709.641630][T24072] netlink: 'syz.0.5900': attribute type 1 has an invalid length. [ 709.661828][T24072] netlink: 256 bytes leftover after parsing attributes in process `syz.0.5900'. [ 709.769282][T24090] team0 (unregistering): Port device team_slave_0 removed [ 709.832343][T24090] team0 (unregistering): Port device team_slave_1 removed [ 709.954315][T14410] lo speed is unknown, defaulting to 1000 [ 709.972584][T14410] syz0: Port: 1 Link DOWN [ 709.999964][T14417] lo speed is unknown, defaulting to 1000 [ 711.512977][T24169] xt_hashlimit: size too large, truncated to 1048576 [ 712.960092][T24210] netlink: 7064 bytes leftover after parsing attributes in process `syz.3.5943'. [ 712.991135][T24210] openvswitch: netlink: Missing key (keys=40, expected=80) [ 713.720368][T24243] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5957'. [ 714.785937][T24269] xt_HMARK: proto mask must be zero with L3 mode [ 714.800693][T24269] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5969'. [ 715.548113][T24293] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5979'. [ 716.260190][T24312] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5988'. [ 718.995402][T24313] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 719.006171][T24313] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 719.015911][T24313] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 721.939010][T24323] tipc: Enabling of bearer rejected, failed to enable media [ 721.952955][T24332] netlink: 44 bytes leftover after parsing attributes in process `syz.1.5991'. [ 722.289764][T24361] lo speed is unknown, defaulting to 1000 [ 722.383130][T24366] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6003'. [ 726.223996][T24405] syzkaller1: entered promiscuous mode [ 726.256930][T24405] syzkaller1: entered allmulticast mode [ 726.834512][T24446] IPv6: Can't replace route, no match found [ 726.858611][T24446] netlink: 60 bytes leftover after parsing attributes in process `syz.1.6025'. [ 727.589188][T24468] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6033'. [ 729.843145][T24488] lo speed is unknown, defaulting to 1000 [ 730.075789][T24497] netlink: 'syz.0.6042': attribute type 1 has an invalid length. [ 730.227131][T24497] bond2: entered promiscuous mode [ 730.248043][T24497] 8021q: adding VLAN 0 to HW filter on device bond2 [ 730.318263][T24500] 8021q: adding VLAN 0 to HW filter on device bond2 [ 730.332028][T24500] bond2: (slave vcan0): The slave device specified does not support setting the MAC address [ 730.342380][T24500] bond2: (slave vcan0): Setting fail_over_mac to active for active-backup mode [ 730.367720][T24500] bond2: (slave vcan0): making interface the new active one [ 730.386671][T24500] vcan0: entered promiscuous mode [ 730.402218][T24500] bond2: (slave vcan0): Enslaving as an active interface with an up link [ 730.748784][T24532] netlink: 'syz.0.6057': attribute type 16 has an invalid length. [ 730.854188][T24536] syzkaller0: entered promiscuous mode [ 730.874091][T24536] syzkaller0: entered allmulticast mode [ 730.957789][T24543] netlink: 'syz.0.6063': attribute type 1 has an invalid length. [ 731.185728][T24543] bond3: entered promiscuous mode [ 731.192671][T24543] 8021q: adding VLAN 0 to HW filter on device bond3 [ 731.259418][T24547] 8021q: adding VLAN 0 to HW filter on device bond3 [ 731.287787][T24547] bond3: (slave vcan1): The slave device specified does not support setting the MAC address [ 731.308553][T24547] bond3: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 731.342909][T24547] bond3: (slave vcan1): making interface the new active one [ 731.368360][T24547] vcan1: entered promiscuous mode [ 731.377472][T24547] bond3: (slave vcan1): Enslaving as an active interface with an up link [ 731.530563][T24567] Bluetooth: MGMT ver 1.23 [ 731.804730][T24580] syzkaller0: entered promiscuous mode [ 731.810249][T24580] syzkaller0: entered allmulticast mode [ 732.364230][T24594] netlink: 'syz.4.6085': attribute type 1 has an invalid length. [ 734.436020][T24594] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 734.582785][T24609] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6091'. [ 735.164077][T24638] lo speed is unknown, defaulting to 1000 [ 737.190799][T24701] netlink: 'syz.3.6128': attribute type 14 has an invalid length. [ 737.210807][T24701] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6128'. [ 737.233145][T24701] bond0: option xmit_hash_policy: invalid value (191) [ 737.562892][T24715] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6133'. [ 737.742487][T24718] syzkaller0: entered promiscuous mode [ 737.759424][T24718] syzkaller0: entered allmulticast mode [ 737.851791][T24724] netlink: 220 bytes leftover after parsing attributes in process `syz.1.6136'. [ 737.930777][T24725] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6136'. [ 738.811085][T24748] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6147'. [ 740.579121][T24776] netlink: 'syz.2.6157': attribute type 1 has an invalid length. [ 741.029352][T24799] syzkaller0: entered promiscuous mode [ 741.037585][T24799] syzkaller0: entered allmulticast mode [ 741.161244][T24814] netlink: 'syz.1.6174': attribute type 1 has an invalid length. [ 743.870520][T24872] syzkaller0: entered promiscuous mode [ 743.876509][T24872] syzkaller0: entered allmulticast mode [ 744.079676][T24877] netlink: 'syz.2.6197': attribute type 1 has an invalid length. [ 744.138811][T24877] bond2: entered promiscuous mode [ 744.145503][T24877] 8021q: adding VLAN 0 to HW filter on device bond2 [ 744.590116][T24899] syzkaller0: entered promiscuous mode [ 744.605617][T24899] syzkaller0: entered allmulticast mode [ 745.061759][T24919] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6216'. [ 745.097088][T24919] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 745.806115][T24941] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6223'. [ 746.714592][T24971] netlink: 'syz.1.6237': attribute type 1 has an invalid length. [ 746.810208][T24971] bond1: entered promiscuous mode [ 746.820242][T24971] 8021q: adding VLAN 0 to HW filter on device bond1 [ 747.182704][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.482980][T24973] bridge0: port 2(bridge_slave_1) entered disabled state [ 747.490463][T24973] bridge0: port 1(bridge_slave_0) entered disabled state [ 747.499233][T24993] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6243'. [ 747.937249][T24973] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 747.967386][T24973] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 748.350024][T24991] tipc: Enabling of bearer rejected, failed to enable media [ 748.389193][T24993] macvtap1: entered promiscuous mode [ 748.396353][T24993] bridge0: entered promiscuous mode [ 748.402339][T24993] macvtap1: entered allmulticast mode [ 748.407872][T24993] bridge0: entered allmulticast mode [ 748.422554][T24998] bridge0: left allmulticast mode [ 748.427726][T24998] bridge0: left promiscuous mode [ 748.443463][ T35] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.482531][ T35] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.529801][ T35] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.562356][ T35] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 748.970813][T25034] syzkaller0: entered promiscuous mode [ 748.984303][T25034] syzkaller0: entered allmulticast mode [ 750.331225][T25068] netlink: 32 bytes leftover after parsing attributes in process `syz.2.6267'. [ 750.398163][T25068] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 750.458870][T25074] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6272'. [ 750.468788][T25074] unsupported nla_type 216 [ 750.477665][T25074] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.6272'. [ 750.514309][ T5744] IPVS: starting estimator thread 0... [ 750.621524][T25078] IPVS: using max 28 ests per chain, 67200 per kthread [ 750.824092][T25090] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6278'. [ 750.884498][T25090] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6278'. [ 750.884636][T10264] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 750.917461][T10264] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 750.934828][T10264] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 750.953407][T10264] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 751.066949][T25094] tipc: Started in network mode [ 751.084850][T25094] tipc: Node identity 5a6171ef4707, cluster identity 4711 [ 751.103118][T25094] tipc: Enabled bearer , priority 0 [ 751.111839][T25094] syzkaller0: entered promiscuous mode [ 751.117354][T25094] syzkaller0: entered allmulticast mode [ 751.268620][T25094] tipc: Resetting bearer [ 751.293037][T25093] tipc: Resetting bearer [ 751.369770][T25093] tipc: Disabling bearer [ 751.577971][T25114] team0: entered promiscuous mode [ 751.607499][T25114] team_slave_0: entered promiscuous mode [ 751.622659][T25114] team_slave_1: entered promiscuous mode [ 753.635092][T25213] netlink: 277 bytes leftover after parsing attributes in process `syz.1.6328'. [ 753.759616][T25221] tc action pedit 'at' offset 6 out of bounds [ 753.897046][T25225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6334'. [ 753.908603][T25225] bond0: option packets_per_slave: invalid value (3151256) [ 753.920237][T25225] bond0: option packets_per_slave: allowed values 0 - 65535 [ 754.143678][T25240] syzkaller0: entered promiscuous mode [ 754.149271][T25240] syzkaller0: entered allmulticast mode [ 754.323203][T25250] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6345'. [ 756.721256][T25379] syzkaller0: entered promiscuous mode [ 756.728054][T25379] syzkaller0: entered allmulticast mode [ 756.735285][T25380] syzkaller1: entered promiscuous mode [ 756.742249][T25380] syzkaller1: entered allmulticast mode [ 757.544938][T25418] syzkaller0: entered promiscuous mode [ 757.562219][T25418] syzkaller0: entered allmulticast mode [ 759.401770][T25480] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6421'. [ 760.890413][T25539] netlink: 'syz.3.6438': attribute type 1 has an invalid length. [ 761.027723][T25539] bond1: entered promiscuous mode [ 761.060334][T25539] 8021q: adding VLAN 0 to HW filter on device bond1 [ 761.709375][T25573] syzkaller0: entered promiscuous mode [ 761.715760][T25573] syzkaller0: entered allmulticast mode [ 762.142243][T25589] netlink: 'syz.2.6456': attribute type 4 has an invalid length. [ 762.189859][T25589] netlink: 'syz.2.6456': attribute type 4 has an invalid length. [ 762.239808][T25589] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6456'. [ 762.276203][T25589] netlink: 44 bytes leftover after parsing attributes in process `syz.2.6456'. [ 762.840639][T25596] syzkaller0: entered promiscuous mode [ 762.858524][T25596] syzkaller0: entered allmulticast mode [ 763.202138][T25608] syzkaller0: entered promiscuous mode [ 763.215728][T25608] syzkaller0: entered allmulticast mode [ 764.767640][T25654] syzkaller0: entered promiscuous mode [ 764.779964][T25654] syzkaller0: entered allmulticast mode [ 765.791203][T25716] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6504'. [ 765.945344][T25722] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6510'. [ 766.025138][T25725] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6511'. [ 769.686352][T25799] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6538'. [ 770.279262][T25823] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6550'. [ 770.496109][T25831] syzkaller0: entered promiscuous mode [ 770.512211][T25831] syzkaller0: entered allmulticast mode [ 770.909851][T25843] syzkaller0: entered promiscuous mode [ 770.934717][T25843] syzkaller0: entered allmulticast mode [ 771.916714][T25890] netlink: 88 bytes leftover after parsing attributes in process `syz.1.6577'. [ 775.270660][T25966] netlink: 72 bytes leftover after parsing attributes in process `syz.3.6609'. [ 775.476635][T25974] syzkaller0: entered promiscuous mode [ 775.482319][T25974] syzkaller0: entered allmulticast mode [ 775.627937][T25982] block nbd2: Unsupported socket: should be TCP or UNIX. [ 776.124429][T26005] syzkaller0: entered promiscuous mode [ 776.139344][T26005] syzkaller0: entered allmulticast mode [ 776.722586][T26044] syzkaller0: entered promiscuous mode [ 776.728268][T26044] syzkaller0: entered allmulticast mode [ 777.001294][T26053] syzkaller0: entered promiscuous mode [ 777.030709][T26053] syzkaller0: entered allmulticast mode [ 777.130125][T26049] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6645'. [ 777.410319][T26074] netlink: 72 bytes leftover after parsing attributes in process `syz.1.6656'. [ 777.970924][T26096] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6667'. [ 777.972374][T26104] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6671'. [ 778.190039][T26114] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6675'. [ 778.213579][T26117] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6676'. [ 778.332986][T26123] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6679'. [ 779.084388][T26159] netlink: 72 bytes leftover after parsing attributes in process `syz.0.6695'. [ 779.705364][T26193] syzkaller0: entered promiscuous mode [ 779.711720][T26193] syzkaller0: entered allmulticast mode [ 780.042943][T26201] ieee802154 phy0 wpan0: encryption failed: -22 [ 782.407883][T26244] ieee802154 phy0 wpan0: encryption failed: -22 [ 782.908098][T26277] ieee802154 phy0 wpan0: encryption failed: -22 [ 782.997807][T26279] tipc: Enabling of bearer rejected, failed to enable media [ 786.101226][T26353] syzkaller0: entered promiscuous mode [ 786.108197][T26353] syzkaller0: entered allmulticast mode [ 786.117181][T26349] syzkaller0: entered promiscuous mode [ 786.124401][T26349] syzkaller0: entered allmulticast mode [ 786.268244][T26354] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6771'. [ 787.567924][T26412] netlink: 'syz.3.6790': attribute type 4 has an invalid length. [ 789.615542][T26422] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6794'. [ 791.336548][T26497] syzkaller0: entered promiscuous mode [ 791.354779][T26497] syzkaller0: entered allmulticast mode [ 791.480299][T26499] syzkaller0: entered promiscuous mode [ 791.501929][T26499] syzkaller0: entered allmulticast mode [ 792.322381][T26531] syzkaller0: entered promiscuous mode [ 792.335667][T26531] syzkaller0: entered allmulticast mode [ 792.423452][T26535] syzkaller0: entered promiscuous mode [ 792.436226][T26535] syzkaller0: entered allmulticast mode [ 793.173126][T26560] block nbd2: Unsupported socket: should be TCP or UNIX. [ 794.114378][T26591] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6856'. [ 797.486359][T26635] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6874'. [ 797.514119][ T807] IPVS: starting estimator thread 0... [ 797.621741][T26654] IPVS: using max 29 ests per chain, 69600 per kthread [ 799.025063][T26712] ieee802154 phy0 wpan0: encryption failed: -22 [ 799.175364][T26725] syzkaller0: entered promiscuous mode [ 799.180961][T26725] syzkaller0: entered allmulticast mode [ 800.005372][T26753] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6915'. [ 800.082896][T26755] syzkaller0: entered promiscuous mode [ 800.125712][T26755] syzkaller0: entered allmulticast mode [ 800.163538][T26751] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6914'. [ 800.806004][T26778] xt_policy: too many policy elements [ 801.313068][T26784] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6927'. [ 804.457380][T26788] 8021q: adding VLAN 0 to HW filter on device bond0 [ 804.467027][T26788] 8021q: adding VLAN 0 to HW filter on device team0 [ 804.479278][T26788] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 804.525390][T26788] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 804.535812][T26788] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 804.595837][ T6458] bridge0: port 1(bridge_slave_0) entered blocking state [ 804.603046][ T6458] bridge0: port 1(bridge_slave_0) entered forwarding state [ 804.615477][ T6458] bridge0: port 2(bridge_slave_1) entered blocking state [ 804.622691][ T6458] bridge0: port 2(bridge_slave_1) entered forwarding state [ 804.995290][T26847] 8021q: adding VLAN 0 to HW filter on device team0 [ 805.195051][T26865] ieee802154 phy0 wpan0: encryption failed: -22 [ 805.490789][T26873] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 805.592364][T26874] xt_policy: too many policy elements [ 808.635049][ T1313] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.198026][T26903] tipc: Enabling of bearer rejected, failed to enable media [ 809.474869][T26930] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6963'. [ 809.509752][T26935] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 809.613820][T26938] xt_policy: too many policy elements [ 809.819226][T26951] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6971'. [ 810.183318][T26962] syzkaller0: entered promiscuous mode [ 810.197250][T26962] syzkaller0: entered allmulticast mode [ 810.272109][T26962] tipc: Enabled bearer , priority 0 [ 810.306708][T26961] tipc: Resetting bearer [ 810.366865][T26961] tipc: Disabling bearer [ 810.502046][T26977] syzkaller0: entered promiscuous mode [ 810.507644][T26977] syzkaller0: entered allmulticast mode [ 810.751762][T26989] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6986'. [ 810.972515][T27004] syzkaller0: entered promiscuous mode [ 810.987189][T27004] syzkaller0: entered allmulticast mode [ 811.014865][T27004] tipc: Started in network mode [ 811.019799][T27004] tipc: Node identity 528dd78ef27a, cluster identity 4711 [ 811.030246][T27004] tipc: Enabled bearer , priority 0 [ 811.048922][T27002] tipc: Resetting bearer [ 811.072758][T27002] tipc: Disabling bearer [ 811.259733][T27017] syzkaller0: entered promiscuous mode [ 811.265580][T27017] syzkaller0: entered allmulticast mode [ 811.408568][T27021] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7001'. [ 811.533783][T27025] bond1: entered promiscuous mode [ 811.539262][T27025] 8021q: adding VLAN 0 to HW filter on device bond1 [ 811.557490][T27025] 8021q: adding VLAN 0 to HW filter on device bond1 [ 811.564814][T27025] bond1: (slave vcan0): The slave device specified does not support setting the MAC address [ 811.575903][T27025] bond1: (slave vcan0): Error -95 calling set_mac_address [ 811.815950][T27040] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 811.955110][T27045] xt_policy: too many policy elements [ 812.223648][T27059] bond2: entered promiscuous mode [ 812.242819][T27059] 8021q: adding VLAN 0 to HW filter on device bond2 [ 812.264632][T27059] 8021q: adding VLAN 0 to HW filter on device bond2 [ 812.271825][T27059] bond2: (slave vcan0): The slave device specified does not support setting the MAC address [ 812.283199][T27059] bond2: (slave vcan0): Error -95 calling set_mac_address [ 812.567216][T27076] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 812.671937][T27079] xt_policy: too many policy elements [ 812.827378][T27085] syzkaller0: entered promiscuous mode [ 812.841433][T27085] syzkaller0: entered allmulticast mode [ 813.060337][T27092] bond2: entered promiscuous mode [ 813.073798][T27092] 8021q: adding VLAN 0 to HW filter on device bond2 [ 813.131234][T27092] 8021q: adding VLAN 0 to HW filter on device bond2 [ 813.139632][T27092] bond2: (slave vcan2): The slave device specified does not support setting the MAC address [ 813.152650][T27092] bond2: (slave vcan2): Error -95 calling set_mac_address [ 813.516364][T27115] xt_hl: Unknown TTL match mode: 255 [ 813.923805][T27130] bond4: entered promiscuous mode [ 813.929398][T27130] 8021q: adding VLAN 0 to HW filter on device bond4 [ 813.978427][T27130] 8021q: adding VLAN 0 to HW filter on device bond4 [ 814.009708][T27130] bond4: (slave vcan2): The slave device specified does not support setting the MAC address [ 814.044746][T27143] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 814.044974][T27130] bond4: (slave vcan2): Error -95 calling set_mac_address [ 814.138374][T27140] xt_policy: too many policy elements [ 814.629646][T27162] syzkaller0: entered promiscuous mode [ 814.645696][T27162] syzkaller0: entered allmulticast mode [ 814.960903][T27175] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7065'. [ 817.264910][T27233] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7080'. [ 819.168352][T27275] ieee802154 phy0 wpan0: encryption failed: -22 [ 820.817934][T27294] netlink: 80 bytes leftover after parsing attributes in process `syz.1.7096'. [ 821.024859][T27307] ieee802154 phy0 wpan0: encryption failed: -22 [ 821.205085][T27311] netlink: 'syz.3.7104': attribute type 1 has an invalid length. [ 821.269941][T27311] bond2: entered promiscuous mode [ 821.275642][T27311] 8021q: adding VLAN 0 to HW filter on device bond2 [ 821.328845][T27311] 8021q: adding VLAN 0 to HW filter on device bond2 [ 821.336105][T27311] bond2: (slave vcan1): The slave device specified does not support setting the MAC address [ 821.348005][T27311] bond2: (slave vcan1): Error -95 calling set_mac_address [ 823.125604][T27383] FAULT_INJECTION: forcing a failure. [ 823.125604][T27383] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 823.139018][T27383] CPU: 0 UID: 0 PID: 27383 Comm: syz.2.7127 Not tainted syzkaller #0 PREEMPT(full) [ 823.139034][T27383] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 823.139041][T27383] Call Trace: [ 823.139046][T27383] [ 823.139051][T27383] dump_stack_lvl+0xe8/0x150 [ 823.139069][T27383] should_fail_ex+0x412/0x560 [ 823.139088][T27383] _copy_from_user+0x2d/0xb0 [ 823.139103][T27383] ___sys_sendmsg+0x1c6/0x360 [ 823.139117][T27383] ? __lock_acquire+0x6b5/0x2cf0 [ 823.139130][T27383] ? __pfx____sys_sendmsg+0x10/0x10 [ 823.139160][T27383] ? __fget_files+0x2a/0x420 [ 823.139172][T27383] ? __fget_files+0x3a0/0x420 [ 823.139188][T27383] __x64_sys_sendmsg+0x1bd/0x2a0 [ 823.139202][T27383] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 823.139220][T27383] ? __pfx_ksys_write+0x10/0x10 [ 823.139239][T27383] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.139250][T27383] do_syscall_64+0x15f/0xf80 [ 823.139263][T27383] ? trace_irq_disable+0x3b/0x140 [ 823.139278][T27383] ? clear_bhb_loop+0x40/0x90 [ 823.139290][T27383] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.139300][T27383] RIP: 0033:0x7f73b659cdd9 [ 823.139311][T27383] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 823.139321][T27383] RSP: 002b:00007f73b47f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 823.139334][T27383] RAX: ffffffffffffffda RBX: 00007f73b6815fa0 RCX: 00007f73b659cdd9 [ 823.139341][T27383] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000004 [ 823.139348][T27383] RBP: 00007f73b47f6090 R08: 0000000000000000 R09: 0000000000000000 [ 823.139354][T27383] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 823.139360][T27383] R13: 00007f73b6816038 R14: 00007f73b6815fa0 R15: 00007fff60645198 [ 823.139375][T27383] [ 823.628634][T27407] FAULT_INJECTION: forcing a failure. [ 823.628634][T27407] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 823.720943][T27407] CPU: 1 UID: 0 PID: 27407 Comm: syz.3.7133 Not tainted syzkaller #0 PREEMPT(full) [ 823.720969][T27407] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 823.720981][T27407] Call Trace: [ 823.720990][T27407] [ 823.720999][T27407] dump_stack_lvl+0xe8/0x150 [ 823.721032][T27407] should_fail_ex+0x412/0x560 [ 823.721059][T27407] _copy_from_user+0x2d/0xb0 [ 823.721086][T27407] ___sys_sendmsg+0x1c6/0x360 [ 823.721116][T27407] ? __pfx____sys_sendmsg+0x10/0x10 [ 823.721160][T27407] ? lockdep_hardirqs_on+0x7a/0x110 [ 823.721200][T27407] ? __x64_sys_sendmsg+0x1a2/0x2a0 [ 823.721231][T27407] __x64_sys_sendmsg+0x1bd/0x2a0 [ 823.721258][T27407] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 823.721293][T27407] ? __pfx_ksys_write+0x10/0x10 [ 823.721324][T27407] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.721344][T27407] do_syscall_64+0x15f/0xf80 [ 823.721366][T27407] ? trace_irq_disable+0x3b/0x140 [ 823.721393][T27407] ? clear_bhb_loop+0x40/0x90 [ 823.721416][T27407] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.721435][T27407] RIP: 0033:0x7fe2a419cdd9 [ 823.721452][T27407] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 823.721468][T27407] RSP: 002b:00007fe2a5058028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 823.721487][T27407] RAX: ffffffffffffffda RBX: 00007fe2a4415fa0 RCX: 00007fe2a419cdd9 [ 823.721501][T27407] RDX: 0000000004000080 RSI: 0000200000000300 RDI: 0000000000000003 [ 823.721514][T27407] RBP: 00007fe2a5058090 R08: 0000000000000000 R09: 0000000000000000 [ 823.721525][T27407] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 823.721536][T27407] R13: 00007fe2a4416038 R14: 00007fe2a4415fa0 R15: 00007ffc0876b228 [ 823.721567][T27407] [ 824.225669][T27420] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 824.238700][T27420] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 824.251766][T27420] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 824.280513][T27420] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 824.288347][T27420] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 824.332843][T27426] FAULT_INJECTION: forcing a failure. [ 824.332843][T27426] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 824.347324][T27426] CPU: 0 UID: 0 PID: 27426 Comm: syz.0.7140 Not tainted syzkaller #0 PREEMPT(full) [ 824.347344][T27426] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 824.347353][T27426] Call Trace: [ 824.347359][T27426] [ 824.347365][T27426] dump_stack_lvl+0xe8/0x150 [ 824.347387][T27426] should_fail_ex+0x412/0x560 [ 824.347409][T27426] _copy_from_user+0x2d/0xb0 [ 824.347429][T27426] ___sys_sendmsg+0x1c6/0x360 [ 824.347446][T27426] ? __lock_acquire+0x6b5/0x2cf0 [ 824.347466][T27426] ? __pfx____sys_sendmsg+0x10/0x10 [ 824.347510][T27426] ? __fget_files+0x2a/0x420 [ 824.347526][T27426] ? __fget_files+0x3a0/0x420 [ 824.347549][T27426] __x64_sys_sendmsg+0x1bd/0x2a0 [ 824.347575][T27426] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 824.347601][T27426] ? __pfx_ksys_write+0x10/0x10 [ 824.347628][T27426] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 824.347644][T27426] do_syscall_64+0x15f/0xf80 [ 824.347663][T27426] ? trace_irq_disable+0x3b/0x140 [ 824.347684][T27426] ? clear_bhb_loop+0x40/0x90 [ 824.347702][T27426] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 824.347717][T27426] RIP: 0033:0x7f243ad9cdd9 [ 824.347741][T27426] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 824.347754][T27426] RSP: 002b:00007f243bb97028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 824.347771][T27426] RAX: ffffffffffffffda RBX: 00007f243b015fa0 RCX: 00007f243ad9cdd9 [ 824.347780][T27426] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 824.347788][T27426] RBP: 00007f243bb97090 R08: 0000000000000000 R09: 0000000000000000 [ 824.347797][T27426] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 824.347805][T27426] R13: 00007f243b016038 R14: 00007f243b015fa0 R15: 00007ffe5d18deb8 [ 824.347827][T27426] [ 824.427163][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 824.545103][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 824.553890][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 824.577742][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 824.592213][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 825.437510][T27416] lo speed is unknown, defaulting to 1000 [ 825.818970][T27494] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7161'. [ 825.948392][T27494] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7161'. [ 825.959070][T27494] netlink: 'syz.2.7161': attribute type 5 has an invalid length. [ 825.967706][T27494] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7161'. [ 826.056335][T27494] geneve2: entered promiscuous mode [ 826.075468][T27494] geneve2: entered allmulticast mode [ 826.178716][ T193] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 256 - 0 [ 826.201085][ T193] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 256 - 0 [ 826.515962][ T193] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 256 - 0 [ 826.589150][ T193] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 256 - 0 [ 826.701632][T27420] Bluetooth: hci0: command tx timeout [ 827.011602][T27416] bridge0: port 1(bridge_slave_0) entered blocking state [ 827.018921][T27416] bridge0: port 1(bridge_slave_0) entered disabled state [ 827.026950][T27416] bridge_slave_0: entered allmulticast mode [ 827.035113][T27416] bridge_slave_0: entered promiscuous mode [ 827.045195][T27416] bridge0: port 2(bridge_slave_1) entered blocking state [ 827.053313][T27416] bridge0: port 2(bridge_slave_1) entered disabled state [ 827.060657][T27416] bridge_slave_1: entered allmulticast mode [ 827.075269][T27416] bridge_slave_1: entered promiscuous mode [ 827.165381][T27416] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 827.202938][T27416] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 827.320493][T27416] team0: Port device team_slave_0 added [ 827.334961][T27416] team0: Port device team_slave_1 added [ 827.414891][T27545] FAULT_INJECTION: forcing a failure. [ 827.414891][T27545] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 827.435973][T27545] CPU: 1 UID: 0 PID: 27545 Comm: syz.4.7174 Not tainted syzkaller #0 PREEMPT(full) [ 827.435998][T27545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 827.436009][T27545] Call Trace: [ 827.436017][T27545] [ 827.436025][T27545] dump_stack_lvl+0xe8/0x150 [ 827.436053][T27545] should_fail_ex+0x412/0x560 [ 827.436081][T27545] _copy_from_user+0x2d/0xb0 [ 827.436107][T27545] ___sys_sendmsg+0x1c6/0x360 [ 827.436131][T27545] ? __lock_acquire+0x6b5/0x2cf0 [ 827.436156][T27545] ? __pfx____sys_sendmsg+0x10/0x10 [ 827.436214][T27545] ? __fget_files+0x2a/0x420 [ 827.436235][T27545] ? __fget_files+0x3a0/0x420 [ 827.436265][T27545] __x64_sys_sendmsg+0x1bd/0x2a0 [ 827.436291][T27545] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 827.436324][T27545] ? __pfx_ksys_write+0x10/0x10 [ 827.436357][T27545] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 827.436377][T27545] do_syscall_64+0x15f/0xf80 [ 827.436399][T27545] ? trace_irq_disable+0x3b/0x140 [ 827.436423][T27545] ? clear_bhb_loop+0x40/0x90 [ 827.436468][T27545] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 827.436484][T27545] RIP: 0033:0x7f2c85b9cdd9 [ 827.436501][T27545] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 827.436517][T27545] RSP: 002b:00007f2c86997028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 827.436534][T27545] RAX: ffffffffffffffda RBX: 00007f2c85e15fa0 RCX: 00007f2c85b9cdd9 [ 827.436547][T27545] RDX: 0000000004040000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 827.436559][T27545] RBP: 00007f2c86997090 R08: 0000000000000000 R09: 0000000000000000 [ 827.436570][T27545] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 827.436581][T27545] R13: 00007f2c85e16038 R14: 00007f2c85e15fa0 R15: 00007ffeea491eb8 [ 827.436615][T27545] [ 827.444250][T27416] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 827.738035][T27416] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 827.772223][T27416] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 827.808515][T27416] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 827.816432][T27416] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 827.850292][T27416] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 827.911207][T27416] hsr_slave_0: entered promiscuous mode [ 827.919239][T27416] hsr_slave_1: entered promiscuous mode [ 828.003233][T27564] syzkaller0: entered promiscuous mode [ 828.009449][T27564] syzkaller0: entered allmulticast mode [ 828.076808][T27564] tipc: Enabled bearer , priority 0 [ 828.112610][T27563] tipc: Resetting bearer [ 828.170109][T27563] tipc: Disabling bearer [ 828.258637][T27416] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 828.272963][T27573] netlink: 'syz.4.7186': attribute type 1 has an invalid length. [ 828.322653][T27573] 8021q: adding VLAN 0 to HW filter on device bond3 [ 828.340606][T27573] netlink: 'syz.4.7186': attribute type 1 has an invalid length. [ 828.394523][T27416] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 828.599143][T27416] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 828.760614][T27416] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 828.781905][T27420] Bluetooth: hci0: command tx timeout [ 829.228271][T27416] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 829.266834][T27416] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 829.293081][T27416] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 829.324903][T27416] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 829.333947][T27416] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 829.356922][T27416] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 829.373951][T27416] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 829.386355][T27416] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 829.582491][T27416] 8021q: adding VLAN 0 to HW filter on device bond0 [ 829.630812][T27416] 8021q: adding VLAN 0 to HW filter on device team0 [ 829.661013][ T193] bridge0: port 1(bridge_slave_0) entered blocking state [ 829.668248][ T193] bridge0: port 1(bridge_slave_0) entered forwarding state [ 829.770321][ T193] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 829.796984][ T193] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 829.823724][ T135] bridge0: port 2(bridge_slave_1) entered blocking state [ 829.830904][ T135] bridge0: port 2(bridge_slave_1) entered forwarding state [ 829.854973][ T193] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 829.864157][ T193] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 830.483054][T27674] ieee802154 phy0 wpan0: encryption failed: -22 [ 830.871488][T27420] Bluetooth: hci0: command tx timeout [ 831.010765][T27697] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 832.944995][T27420] Bluetooth: hci0: command tx timeout [ 833.033544][T27713] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7237'. [ 833.144435][T27715] ieee802154 phy0 wpan0: encryption failed: -22 [ 833.506914][T27704] IPv6: sit1: Disabled Multicast RS [ 833.526869][T27416] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 833.799847][T27416] veth0_vlan: entered promiscuous mode [ 833.836437][T27416] veth1_vlan: entered promiscuous mode [ 833.938714][T27416] veth0_macvtap: entered promiscuous mode [ 833.960994][T27416] veth1_macvtap: entered promiscuous mode [ 833.988437][T27416] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 834.010879][T27416] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 834.028233][ T6454] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 834.057679][ T6454] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 834.410029][T27742] ieee802154 phy0 wpan0: encryption failed: -22 [ 834.591815][ T6454] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 834.605652][ T6454] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 834.617873][T27747] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 834.926994][T10264] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 834.961400][T10264] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 835.086773][ T6454] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 835.122868][ T6454] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 836.741694][T27803] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7272'. [ 836.796958][T27805] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 837.901248][T27839] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7284'. [ 837.929555][T27839] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7284'. [ 838.042955][T27844] syzkaller1: entered promiscuous mode [ 838.048661][T27844] syzkaller1: entered allmulticast mode [ 838.724837][T27860] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 839.154298][T27877] x_tables: duplicate underflow at hook 2 [ 839.216427][T27881] syzkaller0: entered promiscuous mode [ 839.244806][T27881] syzkaller0: entered allmulticast mode [ 839.975420][T27902] FAULT_INJECTION: forcing a failure. [ 839.975420][T27902] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 840.002038][T27902] CPU: 1 UID: 0 PID: 27902 Comm: syz.0.7309 Not tainted syzkaller #0 PREEMPT(full) [ 840.002070][T27902] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 840.002081][T27902] Call Trace: [ 840.002089][T27902] [ 840.002095][T27902] dump_stack_lvl+0xe8/0x150 [ 840.002121][T27902] should_fail_ex+0x412/0x560 [ 840.002148][T27902] _copy_from_user+0x2d/0xb0 [ 840.002181][T27902] ___sys_sendmsg+0x1c6/0x360 [ 840.002205][T27902] ? __lock_acquire+0x6b5/0x2cf0 [ 840.002230][T27902] ? __pfx____sys_sendmsg+0x10/0x10 [ 840.002290][T27902] ? __fget_files+0x2a/0x420 [ 840.002311][T27902] ? __fget_files+0x3a0/0x420 [ 840.002340][T27902] __x64_sys_sendmsg+0x1bd/0x2a0 [ 840.002366][T27902] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 840.002398][T27902] ? __pfx_ksys_write+0x10/0x10 [ 840.002431][T27902] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 840.002451][T27902] do_syscall_64+0x15f/0xf80 [ 840.002473][T27902] ? trace_irq_disable+0x3b/0x140 [ 840.002499][T27902] ? clear_bhb_loop+0x40/0x90 [ 840.002522][T27902] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 840.002541][T27902] RIP: 0033:0x7f243ad9cdd9 [ 840.002558][T27902] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 840.002574][T27902] RSP: 002b:00007f243bb97028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 840.002594][T27902] RAX: ffffffffffffffda RBX: 00007f243b015fa0 RCX: 00007f243ad9cdd9 [ 840.002607][T27902] RDX: 0000000000000080 RSI: 0000200000000280 RDI: 0000000000000005 [ 840.002618][T27902] RBP: 00007f243bb97090 R08: 0000000000000000 R09: 0000000000000000 [ 840.002630][T27902] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 840.002641][T27902] R13: 00007f243b016038 R14: 00007f243b015fa0 R15: 00007ffe5d18deb8 [ 840.002667][T27902] [ 840.837007][T27921] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7316'. [ 840.914990][T27921] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7316'. [ 841.117977][T27930] No such timeout policy "syz0" [ 841.237162][T27931] syzkaller0: entered promiscuous mode [ 841.242832][T27931] syzkaller0: entered allmulticast mode [ 841.472181][T27926] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7318'. [ 841.580837][T27947] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7326'. [ 842.186406][T27972] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7331'. [ 842.197592][T27972] FAULT_INJECTION: forcing a failure. [ 842.197592][T27972] name failslab, interval 1, probability 0, space 0, times 0 [ 842.216570][T27972] CPU: 0 UID: 0 PID: 27972 Comm: syz.3.7331 Not tainted syzkaller #0 PREEMPT(full) [ 842.216595][T27972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 842.216606][T27972] Call Trace: [ 842.216614][T27972] [ 842.216622][T27972] dump_stack_lvl+0xe8/0x150 [ 842.216649][T27972] should_fail_ex+0x412/0x560 [ 842.216678][T27972] should_failslab+0xa8/0x100 [ 842.216708][T27972] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 842.216732][T27972] ? __alloc_skb+0x186/0x7d0 [ 842.216752][T27972] ? __alloc_skb+0x1d0/0x7d0 [ 842.216770][T27972] ? __local_bh_enable_ip+0xd0/0x130 [ 842.216794][T27972] __alloc_skb+0x1d0/0x7d0 [ 842.216813][T27972] ? __lock_acquire+0x6b5/0x2cf0 [ 842.216837][T27972] alloc_skb_with_frags+0xc8/0x760 [ 842.216860][T27972] ? __lock_acquire+0x6b5/0x2cf0 [ 842.216886][T27972] ? __lock_acquire+0x6b5/0x2cf0 [ 842.216908][T27972] sock_alloc_send_pskb+0x878/0x990 [ 842.216949][T27972] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 842.216988][T27972] tun_get_user+0x5df/0x43e0 [ 842.217023][T27972] ? aa_file_perm+0x192/0x15e0 [ 842.217053][T27972] ? aa_file_perm+0x50e/0x15e0 [ 842.217076][T27972] ? __pfx_tun_get_user+0x10/0x10 [ 842.217100][T27972] ? __lock_acquire+0x6b5/0x2cf0 [ 842.217122][T27972] ? kstrtoull+0x12f/0x1d0 [ 842.217150][T27972] ? ref_tracker_alloc+0x35c/0x4c0 [ 842.217177][T27972] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 842.217209][T27972] ? tun_get+0x1c/0x2f0 [ 842.217230][T27972] ? tun_get+0x1c/0x2f0 [ 842.217257][T27972] ? tun_get+0x1c/0x2f0 [ 842.217277][T27972] ? tun_get+0x1c/0x2f0 [ 842.217301][T27972] tun_chr_write_iter+0x113/0x200 [ 842.217326][T27972] vfs_write+0x61d/0xb90 [ 842.217360][T27972] ? __pfx_vfs_write+0x10/0x10 [ 842.217394][T27972] ? __fget_files+0x2a/0x420 [ 842.217423][T27972] ksys_write+0x150/0x270 [ 842.217451][T27972] ? __pfx_ksys_write+0x10/0x10 [ 842.217483][T27972] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 842.217504][T27972] do_syscall_64+0x15f/0xf80 [ 842.217526][T27972] ? trace_irq_disable+0x3b/0x140 [ 842.217550][T27972] ? clear_bhb_loop+0x40/0x90 [ 842.217572][T27972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 842.217590][T27972] RIP: 0033:0x7fe2a415d60e [ 842.217607][T27972] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 842.217622][T27972] RSP: 002b:00007fe2a5057fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 842.217641][T27972] RAX: ffffffffffffffda RBX: 00007fe2a50586c0 RCX: 00007fe2a415d60e [ 842.217654][T27972] RDX: 000000000000fd61 RSI: 0000200000000140 RDI: 00000000000000c8 [ 842.217666][T27972] RBP: 00007fe2a5058090 R08: 0000000000000000 R09: 0000000000000000 [ 842.217677][T27972] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 842.217688][T27972] R13: 00007fe2a4416038 R14: 00007fe2a4415fa0 R15: 00007ffc0876b228 [ 842.217717][T27972] [ 842.591159][T27977] FAULT_INJECTION: forcing a failure. [ 842.591159][T27977] name failslab, interval 1, probability 0, space 0, times 0 [ 842.627523][T27977] CPU: 0 UID: 0 PID: 27977 Comm: syz.3.7332 Not tainted syzkaller #0 PREEMPT(full) [ 842.627549][T27977] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 842.627561][T27977] Call Trace: [ 842.627568][T27977] [ 842.627575][T27977] dump_stack_lvl+0xe8/0x150 [ 842.627603][T27977] should_fail_ex+0x412/0x560 [ 842.627632][T27977] should_failslab+0xa8/0x100 [ 842.627660][T27977] __kmalloc_noprof+0xe8/0x760 [ 842.627686][T27977] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 842.627718][T27977] tomoyo_realpath_from_path+0xe3/0x5d0 [ 842.627745][T27977] ? tomoyo_domain+0xd7/0x130 [ 842.627775][T27977] ? tomoyo_path_number_perm+0x219/0x630 [ 842.627796][T27977] tomoyo_path_number_perm+0x246/0x630 [ 842.627821][T27977] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 842.627840][T27977] ? __lock_acquire+0x6b5/0x2cf0 [ 842.627874][T27977] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 842.627918][T27977] ? __fget_files+0x2a/0x420 [ 842.627943][T27977] ? __fget_files+0x2a/0x420 [ 842.627963][T27977] ? __fget_files+0x3a0/0x420 [ 842.627983][T27977] ? __fget_files+0x2a/0x420 [ 842.628008][T27977] security_file_ioctl+0xc3/0x2a0 [ 842.628030][T27977] __se_sys_ioctl+0x47/0x170 [ 842.628057][T27977] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 842.628077][T27977] do_syscall_64+0x15f/0xf80 [ 842.628099][T27977] ? trace_irq_disable+0x3b/0x140 [ 842.628125][T27977] ? clear_bhb_loop+0x40/0x90 [ 842.628148][T27977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 842.628174][T27977] RIP: 0033:0x7fe2a419cdd9 [ 842.628191][T27977] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 842.628207][T27977] RSP: 002b:00007fe2a5058028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 842.628227][T27977] RAX: ffffffffffffffda RBX: 00007fe2a4415fa0 RCX: 00007fe2a419cdd9 [ 842.628241][T27977] RDX: 0000200000000000 RSI: 0000000000008b34 RDI: 0000000000000003 [ 842.628253][T27977] RBP: 00007fe2a5058090 R08: 0000000000000000 R09: 0000000000000000 [ 842.628265][T27977] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 842.628276][T27977] R13: 00007fe2a4416038 R14: 00007fe2a4415fa0 R15: 00007ffc0876b228 [ 842.628308][T27977] [ 842.628556][T27977] ERROR: Out of memory at tomoyo_realpath_from_path. [ 842.891241][T27985] Bluetooth: MGMT ver 1.23 [ 845.203120][T27999] syzkaller0: entered promiscuous mode [ 845.208681][T27999] syzkaller0: entered allmulticast mode [ 845.578374][T28024] FAULT_INJECTION: forcing a failure. [ 845.578374][T28024] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 845.589466][T28025] tipc: Cannot configure node identity twice [ 845.593072][T28024] CPU: 1 UID: 0 PID: 28024 Comm: syz.2.7345 Not tainted syzkaller #0 PREEMPT(full) [ 845.593097][T28024] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 845.593108][T28024] Call Trace: [ 845.593116][T28024] [ 845.593124][T28024] dump_stack_lvl+0xe8/0x150 [ 845.593150][T28024] should_fail_ex+0x412/0x560 [ 845.593178][T28024] _copy_from_user+0x2d/0xb0 [ 845.593202][T28024] ___sys_sendmsg+0x1c6/0x360 [ 845.593225][T28024] ? __lock_acquire+0x6b5/0x2cf0 [ 845.593248][T28024] ? __pfx____sys_sendmsg+0x10/0x10 [ 845.593302][T28024] ? __fget_files+0x2a/0x420 [ 845.593322][T28024] ? __fget_files+0x3a0/0x420 [ 845.593352][T28024] __x64_sys_sendmsg+0x1bd/0x2a0 [ 845.593377][T28024] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 845.593408][T28024] ? __pfx_ksys_write+0x10/0x10 [ 845.593440][T28024] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.593459][T28024] do_syscall_64+0x15f/0xf80 [ 845.593481][T28024] ? trace_irq_disable+0x3b/0x140 [ 845.593505][T28024] ? clear_bhb_loop+0x40/0x90 [ 845.593527][T28024] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.593544][T28024] RIP: 0033:0x7f73b659cdd9 [ 845.593562][T28024] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 845.593577][T28024] RSP: 002b:00007f73b47f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 845.593596][T28024] RAX: ffffffffffffffda RBX: 00007f73b6815fa0 RCX: 00007f73b659cdd9 [ 845.593608][T28024] RDX: 0000000000044004 RSI: 00002000000000c0 RDI: 0000000000000003 [ 845.593620][T28024] RBP: 00007f73b47f6090 R08: 0000000000000000 R09: 0000000000000000 [ 845.593631][T28024] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 845.593641][T28024] R13: 00007f73b6816038 R14: 00007f73b6815fa0 R15: 00007fff60645198 [ 845.593670][T28024] [ 845.766584][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058175400: rx timeout, send abort [ 845.849194][T28033] FAULT_INJECTION: forcing a failure. [ 845.849194][T28033] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 845.863741][T28033] CPU: 0 UID: 0 PID: 28033 Comm: syz.3.7349 Not tainted syzkaller #0 PREEMPT(full) [ 845.863766][T28033] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 845.863778][T28033] Call Trace: [ 845.863786][T28033] [ 845.863793][T28033] dump_stack_lvl+0xe8/0x150 [ 845.863821][T28033] should_fail_ex+0x412/0x560 [ 845.863849][T28033] _copy_from_user+0x2d/0xb0 [ 845.863882][T28033] do_sys_poll+0x2a3/0x10e0 [ 845.863909][T28033] ? __lock_acquire+0x6b5/0x2cf0 [ 845.863935][T28033] ? __pfx_do_sys_poll+0x10/0x10 [ 845.863953][T28033] ? aa_file_perm+0x192/0x15e0 [ 845.864022][T28033] ? ktime_get_ts64+0xa9/0x410 [ 845.864051][T28033] ? __pfx_timespec64_add_safe+0x10/0x10 [ 845.864068][T28033] __x64_sys_poll+0x190/0x350 [ 845.864080][T28033] ? __pfx___x64_sys_poll+0x10/0x10 [ 845.864095][T28033] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.864106][T28033] do_syscall_64+0x15f/0xf80 [ 845.864118][T28033] ? trace_irq_disable+0x3b/0x140 [ 845.864133][T28033] ? clear_bhb_loop+0x40/0x90 [ 845.864146][T28033] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 845.864156][T28033] RIP: 0033:0x7fe2a419cdd9 [ 845.864166][T28033] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 845.864175][T28033] RSP: 002b:00007fe2a5058028 EFLAGS: 00000246 ORIG_RAX: 0000000000000007 [ 845.864187][T28033] RAX: ffffffffffffffda RBX: 00007fe2a4415fa0 RCX: 00007fe2a419cdd9 [ 845.864195][T28033] RDX: 0000000000000009 RSI: 20000000000000b5 RDI: 0000200000000000 [ 845.864202][T28033] RBP: 00007fe2a5058090 R08: 0000000000000000 R09: 0000000000000000 [ 845.864208][T28033] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 845.864214][T28033] R13: 00007fe2a4416038 R14: 00007fe2a4415fa0 R15: 00007ffc0876b228 [ 845.864230][T28033] [ 846.211129][T28041] syzkaller0: entered promiscuous mode [ 846.217057][T28041] syzkaller0: entered allmulticast mode [ 846.266729][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058176800: rx timeout, send abort [ 846.292799][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058175400: abort rx timeout. Force session deactivation [ 846.434028][T28048] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7356'. [ 846.466045][T28052] FAULT_INJECTION: forcing a failure. [ 846.466045][T28052] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 846.500069][T28053] FAULT_INJECTION: forcing a failure. [ 846.500069][T28053] name failslab, interval 1, probability 0, space 0, times 0 [ 846.501088][T28052] CPU: 1 UID: 0 PID: 28052 Comm: syz.3.7359 Not tainted syzkaller #0 PREEMPT(full) [ 846.501110][T28052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 846.501121][T28052] Call Trace: [ 846.501129][T28052] [ 846.501138][T28052] dump_stack_lvl+0xe8/0x150 [ 846.501164][T28052] should_fail_ex+0x412/0x560 [ 846.501191][T28052] _copy_from_user+0x2d/0xb0 [ 846.501216][T28052] ___sys_sendmsg+0x1c6/0x360 [ 846.501239][T28052] ? __lock_acquire+0x6b5/0x2cf0 [ 846.501262][T28052] ? __pfx____sys_sendmsg+0x10/0x10 [ 846.501320][T28052] ? __fget_files+0x2a/0x420 [ 846.501339][T28052] ? __fget_files+0x3a0/0x420 [ 846.501368][T28052] __x64_sys_sendmsg+0x1bd/0x2a0 [ 846.501393][T28052] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 846.501423][T28052] ? __pfx_ksys_write+0x10/0x10 [ 846.501455][T28052] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 846.501474][T28052] do_syscall_64+0x15f/0xf80 [ 846.501495][T28052] ? trace_irq_disable+0x3b/0x140 [ 846.501520][T28052] ? clear_bhb_loop+0x40/0x90 [ 846.501541][T28052] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 846.501559][T28052] RIP: 0033:0x7fe2a419cdd9 [ 846.501581][T28052] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 846.501597][T28052] RSP: 002b:00007fe2a5058028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 846.501616][T28052] RAX: ffffffffffffffda RBX: 00007fe2a4415fa0 RCX: 00007fe2a419cdd9 [ 846.501628][T28052] RDX: 0000000020008010 RSI: 00002000000004c0 RDI: 0000000000000003 [ 846.501641][T28052] RBP: 00007fe2a5058090 R08: 0000000000000000 R09: 0000000000000000 [ 846.501652][T28052] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 846.501662][T28052] R13: 00007fe2a4416038 R14: 00007fe2a4415fa0 R15: 00007ffc0876b228 [ 846.501690][T28052] [ 846.706597][T28053] CPU: 1 UID: 0 PID: 28053 Comm: syz.1.7357 Not tainted syzkaller #0 PREEMPT(full) [ 846.706623][T28053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 846.706634][T28053] Call Trace: [ 846.706641][T28053] [ 846.706649][T28053] dump_stack_lvl+0xe8/0x150 [ 846.706675][T28053] should_fail_ex+0x412/0x560 [ 846.706702][T28053] should_failslab+0xa8/0x100 [ 846.706730][T28053] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 846.706754][T28053] ? __alloc_skb+0x186/0x7d0 [ 846.706773][T28053] ? __alloc_skb+0x1d0/0x7d0 [ 846.706790][T28053] ? __local_bh_enable_ip+0xd0/0x130 [ 846.706812][T28053] __alloc_skb+0x1d0/0x7d0 [ 846.706831][T28053] ? __lock_acquire+0x6b5/0x2cf0 [ 846.706854][T28053] alloc_skb_with_frags+0xc8/0x760 [ 846.706875][T28053] ? __lock_acquire+0x6b5/0x2cf0 [ 846.706897][T28053] ? __lock_acquire+0x6b5/0x2cf0 [ 846.706915][T28053] sock_alloc_send_pskb+0x878/0x990 [ 846.706957][T28053] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 846.706994][T28053] tun_get_user+0x5df/0x43e0 [ 846.707032][T28053] ? aa_file_perm+0x192/0x15e0 [ 846.707061][T28053] ? aa_file_perm+0x50e/0x15e0 [ 846.707083][T28053] ? __pfx_tun_get_user+0x10/0x10 [ 846.707107][T28053] ? __lock_acquire+0x6b5/0x2cf0 [ 846.707129][T28053] ? kstrtoull+0x12f/0x1d0 [ 846.707157][T28053] ? ref_tracker_alloc+0x35c/0x4c0 [ 846.707183][T28053] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 846.707207][T28053] ? tun_get+0x1c/0x2f0 [ 846.707228][T28053] ? tun_get+0x1c/0x2f0 [ 846.707254][T28053] ? tun_get+0x1c/0x2f0 [ 846.707273][T28053] ? tun_get+0x1c/0x2f0 [ 846.707297][T28053] tun_chr_write_iter+0x113/0x200 [ 846.707319][T28053] vfs_write+0x61d/0xb90 [ 846.707348][T28053] ? __pfx_vfs_write+0x10/0x10 [ 846.707378][T28053] ? __fget_files+0x2a/0x420 [ 846.707403][T28053] ksys_write+0x150/0x270 [ 846.707428][T28053] ? __pfx_ksys_write+0x10/0x10 [ 846.707456][T28053] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 846.707477][T28053] do_syscall_64+0x15f/0xf80 [ 846.707497][T28053] ? trace_irq_disable+0x3b/0x140 [ 846.707521][T28053] ? clear_bhb_loop+0x40/0x90 [ 846.707553][T28053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 846.707572][T28053] RIP: 0033:0x7f9d71f5d60e [ 846.707589][T28053] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 846.707604][T28053] RSP: 002b:00007f9d72dcbfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 846.707622][T28053] RAX: ffffffffffffffda RBX: 00007f9d72dcc6c0 RCX: 00007f9d71f5d60e [ 846.707636][T28053] RDX: 0000000000000d82 RSI: 00002000000009c0 RDI: 00000000000000c8 [ 846.707648][T28053] RBP: 00007f9d72dcc090 R08: 0000000000000000 R09: 0000000000000000 [ 846.707658][T28053] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 846.707668][T28053] R13: 00007f9d72216038 R14: 00007f9d72215fa0 R15: 00007fff4a6bcef8 [ 846.707696][T28053] [ 846.992020][ C1] vcan0: j1939_tp_rxtimer: 0xffff888058176800: abort rx timeout. Force session deactivation [ 847.219995][T28070] netlink: 72 bytes leftover after parsing attributes in process `syz.0.7367'. [ 847.265208][T28073] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7369'. [ 847.607871][T28085] syzkaller0: entered promiscuous mode [ 847.628205][T28085] syzkaller0: entered allmulticast mode [ 847.901415][T27420] Bluetooth: hci0: command tx timeout [ 848.017342][T28095] FAULT_INJECTION: forcing a failure. [ 848.017342][T28095] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 848.074305][T28095] CPU: 1 UID: 0 PID: 28095 Comm: syz.0.7376 Not tainted syzkaller #0 PREEMPT(full) [ 848.074331][T28095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 848.074343][T28095] Call Trace: [ 848.074351][T28095] [ 848.074360][T28095] dump_stack_lvl+0xe8/0x150 [ 848.074388][T28095] should_fail_ex+0x412/0x560 [ 848.074417][T28095] _copy_from_user+0x2d/0xb0 [ 848.074443][T28095] ___sys_sendmsg+0x1c6/0x360 [ 848.074466][T28095] ? __lock_acquire+0x6b5/0x2cf0 [ 848.074490][T28095] ? __pfx____sys_sendmsg+0x10/0x10 [ 848.074547][T28095] ? __fget_files+0x2a/0x420 [ 848.074568][T28095] ? __fget_files+0x3a0/0x420 [ 848.074599][T28095] __x64_sys_sendmsg+0x1bd/0x2a0 [ 848.074633][T28095] ? irqentry_exit+0x218/0x730 [ 848.074658][T28095] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 848.074690][T28095] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 848.074720][T28095] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 848.074739][T28095] do_syscall_64+0x15f/0xf80 [ 848.074761][T28095] ? trace_irq_disable+0x3b/0x140 [ 848.074787][T28095] ? clear_bhb_loop+0x40/0x90 [ 848.074809][T28095] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 848.074828][T28095] RIP: 0033:0x7f243ad9cdd9 [ 848.074848][T28095] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 848.074864][T28095] RSP: 002b:00007f243bb97028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 848.074884][T28095] RAX: ffffffffffffffda RBX: 00007f243b015fa0 RCX: 00007f243ad9cdd9 [ 848.074897][T28095] RDX: 0000000000040085 RSI: 0000200000001dc0 RDI: 0000000000000003 [ 848.074909][T28095] RBP: 00007f243bb97090 R08: 0000000000000000 R09: 0000000000000000 [ 848.074920][T28095] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 848.074931][T28095] R13: 00007f243b016038 R14: 00007f243b015fa0 R15: 00007ffe5d18deb8 [ 848.074961][T28095] [ 848.494381][T28102] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7380'. [ 848.627269][T28111] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7383'. [ 848.712888][T28117] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7383'. [ 848.837492][ T57] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 848.883329][ T5722] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 848.896111][ T57] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 849.026111][T28119] syzkaller0: entered promiscuous mode [ 849.037340][T28119] syzkaller0: entered allmulticast mode [ 849.095851][ T807] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 849.276930][T28138] FAULT_INJECTION: forcing a failure. [ 849.276930][T28138] name failslab, interval 1, probability 0, space 0, times 0 [ 849.321475][T28138] CPU: 1 UID: 0 PID: 28138 Comm: syz.1.7394 Not tainted syzkaller #0 PREEMPT(full) [ 849.321501][T28138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 849.321512][T28138] Call Trace: [ 849.321519][T28138] [ 849.321528][T28138] dump_stack_lvl+0xe8/0x150 [ 849.321555][T28138] should_fail_ex+0x412/0x560 [ 849.321583][T28138] should_failslab+0xa8/0x100 [ 849.321612][T28138] __kmalloc_noprof+0xe8/0x760 [ 849.321636][T28138] ? iovec_from_user+0x87/0x250 [ 849.321665][T28138] iovec_from_user+0x87/0x250 [ 849.321693][T28138] __import_iovec+0x163/0x7e0 [ 849.321727][T28138] import_iovec+0x73/0xa0 [ 849.321755][T28138] vfs_writev+0x1cf/0x990 [ 849.321783][T28138] ? __pfx_vfs_writev+0x10/0x10 [ 849.321816][T28138] ? __fget_files+0x2a/0x420 [ 849.321840][T28138] ? __fget_files+0x3a0/0x420 [ 849.321860][T28138] ? __fget_files+0x2a/0x420 [ 849.321888][T28138] do_writev+0x154/0x2e0 [ 849.321910][T28138] ? __pfx_do_writev+0x10/0x10 [ 849.321937][T28138] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 849.321957][T28138] do_syscall_64+0x15f/0xf80 [ 849.321979][T28138] ? trace_irq_disable+0x3b/0x140 [ 849.322004][T28138] ? clear_bhb_loop+0x40/0x90 [ 849.322027][T28138] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 849.322044][T28138] RIP: 0033:0x7f9d71f9cdd9 [ 849.322061][T28138] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 849.322076][T28138] RSP: 002b:00007f9d72dcc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 849.322095][T28138] RAX: ffffffffffffffda RBX: 00007f9d72215fa0 RCX: 00007f9d71f9cdd9 [ 849.322109][T28138] RDX: 0000000000000011 RSI: 0000200000000200 RDI: 0000000000000003 [ 849.322121][T28138] RBP: 00007f9d72dcc090 R08: 0000000000000000 R09: 0000000000000000 [ 849.322132][T28138] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 849.322143][T28138] R13: 00007f9d72216038 R14: 00007f9d72215fa0 R15: 00007fff4a6bcef8 [ 849.322172][T28138] [ 849.566616][T28141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7395'. [ 849.742829][ T807] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 851.902139][T28139] netlink: 'syz.4.7393': attribute type 13 has an invalid length. [ 852.066492][T28171] netlink: 56 bytes leftover after parsing attributes in process `syz.4.7401'. [ 852.084207][T28172] veth0: entered promiscuous mode [ 852.102611][T28172] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7403'. [ 852.222823][ T6459] unregister_netdevice: waiting for bond1 to become free. Usage count = 2 [ 853.101526][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 861.741510][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured!