last executing test programs: 7.426934062s ago: executing program 3 (id=3787): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r1, &(0x7f0000000e00)=[{{&(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x0, &(0x7f0000000700)=[{&(0x7f0000000100)=""/142}, {&(0x7f0000000200)=""/70}, {&(0x7f0000000340)=""/132}, {&(0x7f00000004c0)=""/147}, {&(0x7f0000000580)=""/176}, {&(0x7f0000000640)=""/190}], 0x0, &(0x7f0000000780)=""/222}, 0x2}, {{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000880)=""/21}, {&(0x7f00000008c0)=""/92}, {&(0x7f0000000940)=""/58}]}, 0xffffffff}, {{&(0x7f00000009c0)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000a40)=""/86}], 0x0, &(0x7f0000000b00)=""/117}, 0x7f}, {{&(0x7f0000000b80)=@rc={0x1f, @fixed}, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000c00)=""/35}, {&(0x7f0000000c40)=""/219}], 0x0, &(0x7f0000000d80)=""/98}, 0x7fff}], 0x300, 0x34000, 0x0) (fail_nth: 17) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x14, r0, 0xfaac4106a1b87a7, 0x70bd27, 0x1, {0xb}}, 0x14}, 0x1, 0x0, 0x0, 0x8814}, 0x880) 7.272126403s ago: executing program 2 (id=3789): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x61}, @printk={@lld, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x9b}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000072"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r2) r3 = socket$kcm(0x2, 0x2, 0x0) sendmsg$NFNL_MSG_ACCT_GET(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000005c0)={0x0}, 0x1, 0x0, 0x0, 0x80}, 0x20008814) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4}, &(0x7f0000000000), &(0x7f0000000080)=r2}, 0x20) recvmsg(r3, &(0x7f0000000580)={0x0, 0x0, 0x0}, 0x2002) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3c0, 0x0, 0x160, 0x1f8, 0x290, 0x328, 0xc8, 0x160, 0x1f8, 0x290, 0x328, 0x6, 0x0, {[{{@uncond, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@unspec=@mark={{0x30}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x420) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) bpf$TOKEN_CREATE(0x24, &(0x7f00000003c0)={0x0, r2}, 0x8) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0x6, 0x3, &(0x7f00000004c0)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r6 = socket$can_raw(0x1d, 0x3, 0x1) recvmsg$can_raw(r6, &(0x7f0000003480)={0x0, 0x0, &(0x7f00000032c0)=[{&(0x7f0000000340)=""/56, 0x38}, {&(0x7f0000000380)=""/35, 0x23}, {&(0x7f0000000ec0)=""/4096, 0x1000}, {&(0x7f0000001ec0)=""/215, 0xd7}, {&(0x7f0000001fc0)=""/170, 0xaa}, {&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000003080)=""/120, 0x78}, {&(0x7f0000003100)=""/182, 0xb6}, {&(0x7f00000031c0)=""/245, 0xf5}], 0x9, &(0x7f0000003380)=""/196, 0xc4}, 0x40000100) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 6.786781456s ago: executing program 3 (id=3790): r0 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@tipc, &(0x7f0000000080)=0x80, 0x80000) bind$llc(r0, &(0x7f00000000c0)={0x1a, 0x33a, 0x7, 0x1, 0x6, 0x3, @remote}, 0x10) (async) ioctl$BTRFS_IOC_GET_FEATURES(r0, 0x80189439, &(0x7f0000000100)) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x8400, 0x0) ioctl$NILFS_IOCTL_GET_SUINFO(r1, 0x80186e84, &(0x7f00000001c0)={&(0x7f0000000180)=[{0x0, 0x4}], 0x1, 0x10, 0x4, 0x4}) (async) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x9, 0x1, &(0x7f0000000200)=@raw=[@call={0x85, 0x0, 0x0, 0xae}], &(0x7f0000000240)='GPL\x00', 0xa, 0x92, &(0x7f0000000280)=""/146, 0x41100, 0x44, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x8, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0x8, 0x7, 0x7fff}, 0x10, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff], 0x0, 0x10, 0x5}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f00000004c0)=r2, 0x4) (async) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000500)={0x6, 0x1, 0xb, 0x1, 0x0}, &(0x7f0000000540)=0x10) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000580)={r3, 0xffffffc0}, &(0x7f00000005c0)=0x8) (async) connect$l2tp(r0, &(0x7f0000000600)={0x2, 0x0, @local, 0x2}, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000740)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x4840}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x34, r4, 0x100, 0x70bd27, 0x25dfdbfe, {{}, {}, {0x18, 0x17, {0x12, 0x8, @udp='udp:syz1\x00'}}}, ["", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x20004004}, 0x40) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000780), r5) (async) ioctl$F2FS_IOC_SET_COMPRESS_OPTION(r2, 0x4002f516, &(0x7f00000007c0)={0x2, 0x6b}) (async) r6 = accept4$inet6(r0, &(0x7f0000000800)={0xa, 0x0, 0x0, @ipv4}, &(0x7f0000000840)=0x1c, 0x81000) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r6, 0x84, 0x12, &(0x7f0000000880)=0x5, 0x4) (async) ioctl$BTRFS_IOC_SUBVOL_SETFLAGS(r0, 0x4008941a, &(0x7f00000008c0)) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000980)={{0x1, 0xffffffffffffffff}, &(0x7f0000000900), &(0x7f0000000940)=r2}, 0x20) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000009c0)={r0, 0xffffffffffffffff}, 0x4) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000a00)=@bloom_filter={0x1e, 0x8, 0x7, 0x80000001, 0x8, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x2, 0x4}, 0x50) ioctl$F2FS_IOC_MOVE_RANGE(r1, 0xc020f509, &(0x7f0000000a80)={r2, 0xff, 0x3, 0xc}) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000ac0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000bc0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000b40), &(0x7f0000000b80)=r2}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000c00)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000f00)={'ip6gre0\x00', &(0x7f0000000e80)={'syztnl0\x00', 0x0, 0x2f, 0x6, 0xc0, 0x2, 0xc07b731097681720, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, 0x87a0, 0x10, 0x7, 0x6}}) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000002000)={0xffffffffffffffff, 0x20, &(0x7f0000001fc0)={&(0x7f0000000f80)=""/4096, 0x1000, 0x0, &(0x7f0000001f80)=""/38, 0x26}}, 0x10) ioctl$XFS_IOC_PATH_TO_HANDLE(r6, 0xc0385869, &(0x7f0000002140)={r1, &(0x7f0000002040)='%^{\x00', 0x80080, &(0x7f0000002080)={@_ha_fsid={[0x332e, 0x3]}, {0x6, 0xffff, 0x1, 0x741}}, 0x2, &(0x7f00000020c0), &(0x7f0000002100)=0x5}) (async) r17 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000002180)={0x1b, 0x0, 0x0, 0x80000001, 0x0, 0x1, 0x8, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000025c0)={0x18, 0x36, &(0x7f0000000c40)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x6}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r7}}, @cb_func={0x18, 0x6, 0x4, 0x0, 0x6}, @tail_call={{0x18, 0x2, 0x1, 0x0, r0}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xff2}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r8}}, @map_val={0x18, 0x4, 0x2, 0x0, r9, 0x0, 0x0, 0x0, 0x7}, @call={0x85, 0x0, 0x0, 0x2d}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r10}}, @map_fd={0x18, 0x5, 0x1, 0x0, r11}, @tail_call={{0x18, 0x2, 0x1, 0x0, r12}}, @snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r13}}]}, &(0x7f0000000e00)='syzkaller\x00', 0x3, 0x32, &(0x7f0000000e40)=""/50, 0x41100, 0x10, '\x00', r14, @fallback=0x2b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000f40)={0x5, 0x6, 0x8, 0x7ff}, 0x10, r15, 0xffffffffffffffff, 0x3, &(0x7f0000002540)=[r16, r17, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r1], &(0x7f0000002580)=[{0x1, 0x2, 0x9, 0x9}, {0x4, 0x1, 0x7, 0x5}, {0x0, 0x3, 0xd, 0xb}], 0x10, 0x7fffffff}, 0x94) 6.343163745s ago: executing program 1 (id=3793): r0 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x2400c804) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) listen(r1, 0x5) r2 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000040)={0x6, 'veth0_virt_wifi\x00', {0x3b}, 0x26}) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x7) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) getsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000200)=""/209, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$netlink(r3, 0x0, 0x0) r4 = socket$inet(0x2, 0x5, 0x0) ioctl$sock_SIOCBRDELBR(r4, 0x89a1, &(0x7f0000000000)='bridge0\x00') ioctl$sock_SIOCBRADDBR(r4, 0x89a0, &(0x7f0000000000)='bridge0\x00') ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x240000c6) nanosleep(0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYRES16=r0, @ANYRES8=r4, @ANYRES32=r3, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000a15ba5d682750000000000000000000000000000000000000000bdd34f8eade78c276b67836d11a4290f1787edd257b9b83be772450cf7059c8472ce5c85ded8fd05279ec9dd000fd0df9eedaa45c6f277ffa0aa6a1e050df45e28e4c0c4584e65b0ea7849a92465b0"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x2, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="180000003f0a0000000000000900000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000006a010200839b8eb95d0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095000000000000005ef1fba18693d3b2956c5853d7f8bd0d2d81c9a82f3177c1174f2f3c96be73b813f468d53bb1125b3ff12e3cc852221f3292f22154f03f2f786b2968c668cb61103927151a0983bb59e846975b3b92e519eac2fbb8c9b6adb870ee2e26c77c502786e2ce07aecf17a51a5d708c7bf1d6c4b21cc58ec8bd592d7333be792ad2bcdd23cd371d99e5d8f92ec4c53f28924e11f301392e0e069fbc102fa60226e1ffaa676496f7742e33f19569dab21940655db734dbbc3315ea0cf6fbe5e4ca6cc8e04ae1582df52ada59225de2734338fe5b3688eb8fdb6509eb82b6dc3036a964b3f9bd9e14aa36611469c4fc5d09463b2420b3e8af436f7c58f5a58fbaa3a101a0803d8b286e24a6190c29de7d7af1504e7665bd2cb2823acbe8e9463de5a3d012959efd5bc6edff54168bbef7b3aacfdcefab4071"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x18, 0xfffffffffffffffc, 0x0, 0x0, '\x00', 0x0, 0x38, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)=ANY=[@ANYRES32=r1], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) close(r1) bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x12) 5.307888454s ago: executing program 0 (id=3794): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000002b40), r2) sendmsg$NLBL_MGMT_C_ADD(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000002c00)={&(0x7f0000000100)={0x14, r3, 0x1, 0x70bd25, 0x25dfdbfe}, 0x14}, 0x1, 0x2000000, 0x0, 0x20000000}, 0x4000080) (async) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000080)={0x68, r1, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x14, 0x3, "322d73355f2d5f74482ee5364c432384"}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "9ea2d3a3a600"/20}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) 5.22360029s ago: executing program 3 (id=3795): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x1}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r1}, &(0x7f0000000080), &(0x7f00000000c0)='%pI4 \x00'}, 0x20) 5.201701867s ago: executing program 2 (id=3796): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x19}}, 0x10) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="1c0000001800011306007000000000000a001400fe04ff06"], 0x1c}}, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000c80)='ns/ipc\x00') r2 = syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/time_for_children\x00') ioctl$NS_GET_USERNS(r2, 0xb701, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r3, 0x84, 0x71, &(0x7f0000000000)="03040000008002ff", 0x8) ioctl$NS_GET_USERNS(r1, 0xb701, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e23, 0x3e7, @private1, 0xb}}, 0xfffffffd, 0x1, 0x1, 0x5984000, 0x60, 0x5, 0x1}, &(0x7f0000000100)=0x9c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000180)={r4, 0x0, &(0x7f0000000140)}, &(0x7f00000001c0)=0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x19}}, 0x10) (async) socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="1c0000001800011306007000000000000a001400fe04ff06"], 0x1c}}, 0x0) (async) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000c80)='ns/ipc\x00') (async) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/time_for_children\x00') (async) ioctl$NS_GET_USERNS(r2, 0xb701, 0x0) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) setsockopt(r3, 0x84, 0x71, &(0x7f0000000000)="03040000008002ff", 0x8) (async) ioctl$NS_GET_USERNS(r1, 0xb701, 0x0) (async) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000040)={0x0, @in6={{0xa, 0x4e23, 0x3e7, @private1, 0xb}}, 0xfffffffd, 0x1, 0x1, 0x5984000, 0x60, 0x5, 0x1}, &(0x7f0000000100)=0x9c) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000180)={r4, 0x0, &(0x7f0000000140)}, &(0x7f00000001c0)=0x10) (async) 5.100100776s ago: executing program 1 (id=3798): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x502, 0x0) socket$kcm(0x11, 0x3, 0x0) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="5c00000015006b03000000d86e6c1d0002117ea6ea6567e71b59000af32c6e020075f800250002000f00000017d34460bc24eab556a705251e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f4d4938037e786a6d0bdd70000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r4 = socket$inet6(0xa, 0x3, 0x84) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000280)={{{@in=@broadcast, @in=@local, 0x0, 0x100, 0x4e26, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x2, 0xfffffffffffffff6, 0x400000002000000, 0x1, 0xfffffffffffffffd}, {0xbad, 0x1, 0x4, 0xffffffffffffff7f}, 0x1, 0x0, 0x2, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x2b}, 0x8, @in=@remote, 0x3504, 0x4, 0x0, 0x0, 0x9, 0x6, 0x4}}, 0xe8) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = socket(0x400000000010, 0x3, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={r1, 0x58, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r5, 0x89f3, &(0x7f0000000500)={'ip6gre0\x00', &(0x7f0000000480)={'ip6tnl0\x00', r6, 0x2f, 0x1, 0x5, 0x0, 0x30, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, 0x20, 0x1, 0x610, 0x7}}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r7, {0x0, 0x7ffe}, {0xffff, 0xffff}, {0x0, 0x4}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x12, 0x2, {{0x6, 0x8, 0xfffffffb, 0x2, 0x2}, 0x5, 0x1, 0x80000000, 0x2, 0x7, 0x17, 0x2, 0x1e, 0x0, 0x800000e, {0x0, 0x7fff, 0x225, 0x3, 0x9, 0x4}}}}]}, 0x78}}, 0x0) 4.947562239s ago: executing program 3 (id=3799): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x800000, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x5, 0xfff1}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x21, 0x0, 0x7, 0x9, 0x2, 0x8, 0x0, 0x1e}}, {0x4}}]}]}, 0x48}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x9, 0x16, 0x8, 0x40, 0x42, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140), 0x1000, r4}, 0x38) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000033c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_DELSETELEM={0x3c, 0xe, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet6_udp(0xa, 0x2, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00'}) (async) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x800000, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x5, 0xfff1}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x21, 0x0, 0x7, 0x9, 0x2, 0x8, 0x0, 0x1e}}, {0x4}}]}]}, 0x48}}, 0x0) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0x9, 0x16, 0x8, 0x40, 0x42, 0x1}, 0x50) (async) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140), 0x1000, r4}, 0x38) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000033c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_DELSETELEM={0x3c, 0xe, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x2}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa0}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) 4.917905502s ago: executing program 0 (id=3800): r0 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r1, &(0x7f0000000e00)=[{{&(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x0, &(0x7f0000000700)=[{&(0x7f0000000100)=""/142}, {&(0x7f0000000200)=""/70}, {&(0x7f0000000340)=""/132}, {&(0x7f00000004c0)=""/147}, {&(0x7f0000000580)=""/176}, {&(0x7f0000000640)=""/190}], 0x0, &(0x7f0000000780)=""/222}, 0x2}, {{0x0, 0x0, &(0x7f0000000980)=[{&(0x7f0000000880)=""/21}, {&(0x7f00000008c0)=""/92}, {&(0x7f0000000940)=""/58}]}, 0xffffffff}, {{&(0x7f00000009c0)=@pppoe={0x18, 0x0, {0x0, @local}}, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000a40)=""/86}], 0x0, &(0x7f0000000b00)=""/117}, 0x7f}, {{&(0x7f0000000b80)=@rc={0x1f, @fixed}, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000c00)=""/35}, {&(0x7f0000000c40)=""/219}], 0x0, &(0x7f0000000d80)=""/98}, 0x7fff}], 0x300, 0x34000, 0x0) (fail_nth: 18) sendmsg$ETHTOOL_MSG_TSINFO_GET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)={0x14, r0, 0xfaac4106a1b87a7, 0x70bd27, 0x1, {0xb}}, 0x14}, 0x1, 0x0, 0x0, 0x8814}, 0x880) 4.731202924s ago: executing program 2 (id=3801): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[], 0x7c}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$alg(0x26, 0x5, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e6574"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x1c, 0x3, 0x6, 0x401, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) bind$alg(r1, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000400)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000840)=@newchain={0x64, 0x64, 0x20, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0xe, 0xffff}, {0x0, 0x2}, {0x9, 0x9}}, [@TCA_CHAIN={0x8, 0xb, 0x5}, @TCA_RATE={0x6, 0x5, {0x2, 0x4}}, @TCA_RATE={0x6, 0x5, {0x8, 0x88}}, @TCA_RATE={0x6, 0x5, {0x6, 0x8}}, @TCA_CHAIN={0x8}, @TCA_CHAIN={0x8, 0xb, 0x6}, @TCA_RATE={0x6, 0x5, {0x8, 0x6}}, @TCA_CHAIN={0x8, 0xb, 0x101}]}, 0x64}, 0x1, 0x0, 0x0, 0x20041090}, 0xc080) r7 = accept4(r1, 0x0, 0x0, 0x800) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c00028005001d00050000000500010004"], 0x4c}}, 0x0) bind$alg(r1, &(0x7f00000002c0)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha1\x00'}, 0x58) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_AUTHENTICATE(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000600)={0x44, r9, 0x1, 0x70bd2a, 0x1, {{}, {@val={0x8, 0x3, r10}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_SSID={0x4}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x6}, @key_params=[@NL80211_ATTR_MAC={0xa, 0x6, @device_b}], @key_params=[@NL80211_ATTR_KEY={0x8, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}]}]]}, 0x44}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r12 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0x468000, 0x0) ioctl$TUNSETVNETBE(r12, 0x400454de, &(0x7f0000000300)=0x1) r13 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x8, 0x4, 0x4, 0x8}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r13}, &(0x7f0000000200), &(0x7f0000000240)=r11}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xe, 0x0, &(0x7f0000000100), &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) 4.322474535s ago: executing program 1 (id=3803): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0xfffc}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xb8}, 0x1, 0x0, 0x0, 0x24000890}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'ip6gre0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000016c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x4000000, {0x0, 0x0, 0x0, r2, {0x0, 0xffe0}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x4}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x240040c4}, 0x0) 3.739962465s ago: executing program 3 (id=3804): r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x4, &(0x7f0000000140)=@framed={{}, [@func={0x85, 0x0, 0x1, 0x0, 0x4}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000001c0)="88"}, 0x48) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.stat\x00', 0x0, 0x0) ioctl$TUNGETVNETLE(r1, 0x800454dd, &(0x7f0000000080)) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x10, @private=0xa010101}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f00000003c0)=[@in6={0xa, 0x4e23, 0xa, @private1={0xfc, 0x1, '\x00', 0x1}, 0x4}]}, &(0x7f0000000040)=0x10) shutdown(r4, 0x2) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000000)={r5, 0x7}, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000280)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r3, 0x84, 0x17, &(0x7f0000000080)={r7, 0x2, 0x1, "fa"}, 0x9) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12000000060000000400000002"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001400)={0x18, 0xf, &(0x7f00000014c0)=@raw=[@map_idx_val={0x18, 0x8, 0x6, 0x0, 0x3, 0x0, 0x0, 0x0, 0x100}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @alu={0x4, 0x1, 0x1, 0x2, 0x6, 0xfffffffffffffff8, 0x4}, @map_idx={0x18, 0x4, 0x5, 0x0, 0x3}, @ringbuf_output], &(0x7f0000000240)='GPL\x00', 0x20c, 0x100f, &(0x7f0000003500)=""/4111, 0x0, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10}, 0x94) socket$inet(0x2, 0xa, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0x13, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c0000000000002020207b1af8ff00000000bfa100000000000007010000daffffffb702000008000000b7030000000000008500000006000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000013c0)=@o_path={&(0x7f00000003c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', r8}, 0x18) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000440)='ns/pid_for_children\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20004450) socket(0x8, 0x1, 0xfffffff8) socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 3.411489298s ago: executing program 0 (id=3806): r0 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000003800)=@newtaction={0x68, 0x30, 0x2, 0x70bd25, 0x25dfdbfe, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x20, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x9, 0x7, 0x1, 0x8, 0xc43}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x50}, 0x801) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x20, 0x4, 0x0, 0xfffff010}, {0x20, 0x0, 0x0, 0xfffff024}, {0x6, 0x0, 0x0, 0x3}]}, 0x10) sendmmsg(r1, &(0x7f0000001c00), 0x400000000000159, 0x40840) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3c0, 0x0, 0x160, 0x1f8, 0x290, 0x328, 0xc8, 0x160, 0x1f8, 0x290, 0x328, 0x6, 0x0, {[{{@uncond, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@unspec=@mark={{0x30}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x420) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 3.338752195s ago: executing program 4 (id=3807): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="380000001014d9"], 0x38}, 0x1, 0x0, 0x0, 0x20004085}, 0x4004080) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000fcffffff0000000080000000850000002f0006001801000020786c2500000000002020207b1bf8fd00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000002850000003000000095"], &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x41000}, 0x94) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f00000004c0)={0x627d, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0}], 0x96, "9f2c2be07b1f81"}) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r3, 0xc) connect$x25(r3, &(0x7f0000000000)={0x9, @remote={'\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc', 0x3}}, 0x12) ioctl$BTRFS_IOC_TREE_SEARCH(r1, 0xd0009411, &(0x7f00000014c0)={{r2, 0x4, 0x1, 0x3, 0x3, 0xf6, 0xffffffffffffffff, 0x4, 0xf, 0x2, 0x1, 0x400, 0x7, 0x7f, 0x7}}) 3.282370599s ago: executing program 1 (id=3808): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x42082, 0x0) socket(0x10, 0x3, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x2, 0x4, 0x1, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x20}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x200}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x6a2e4e0ed11fabf6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r6, 0x1, 0x32, &(0x7f00000000c0)=r8, 0x4) sendmsg$unix(r7, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x34, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0xc, 0xffe0}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_route={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xf, &(0x7f0000000280)=ANY=[@ANYBLOB="180000002500000000f3baea000000000000801811001d633cbd1a232b35413143418de6af9fcb59c47786da2638297b5681bab94ece7090be71b17f0e254e9aba989be9038eaf5adb19ea8d1c442cec752ccb6a2abb2bb27f147e593364d8a518af1c27477c2e721c7e629d50b62bf8045290ba02d68ed09ce459ce03ae263d8fc841fe7a684acbbe5a13ec", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b70300003f0000008500000083000000bf0920000000000055090100000000029500000000000000bf91000000000000b7020000000000408500000085000000b7000000000000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x2, 0x1011, &(0x7f0000000840)=""/4113, 0x41000, 0xc, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) 3.27297958s ago: executing program 2 (id=3809): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000200025a727bd7000fddbdf250a0000cdff0000010200010008000600000000000c001400f6d6c464bf1bb96b"], 0x30}, 0x1, 0x0, 0x0, 0x4040090}, 0x80) (async) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={'rose0\x00', 0x112}) (async) ioctl$sock_inet_SIOCSIFPFLAGS(r1, 0x8934, &(0x7f0000000040)={'sit0\x00', 0x3}) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000), 0x4) 2.958116888s ago: executing program 4 (id=3810): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x3c0, 0x0, 0x160, 0x1f8, 0x290, 0x328, 0xc8, 0x160, 0x1f8, 0x290, 0x328, 0x6, 0x0, {[{{@uncond, 0x0, 0xa0, 0xc8, 0x0, {}, [@common=@unspec=@mark={{0x30}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x420) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b142b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) (fail_nth: 16) 2.199486156s ago: executing program 4 (id=3811): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c00000010000304020000000000000000000400", @ANYRES32=0x0, @ANYBLOB="80030000000000001c0012800b0001000280050016008000"/36], 0x3c}, 0x1, 0x0, 0x0, 0x4}, 0x8044) 2.167404178s ago: executing program 0 (id=3812): syz_emit_ethernet(0x6a, &(0x7f0000000000)={@broadcast, @random="1704b45adbde", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0xe0, 0x0, 0xe000, {0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @multicast2=0xe0001b59, @rand_addr, {[@timestamp_prespec={0x44, 0x2c, 0x0, 0x3, 0x0, [{@private}, {@private}, {@dev}, {@remote}, {@private}]}]}}}}}}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x4e, &(0x7f0000000280)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @link_local, @void, {@llc_tr={0x11, {@llc={0xf4, 0x7e, "3cee", "0c1bc046be61c9e2db01775b8992797b4b6c681f36ce04ff0a0e59a00a15fb83e2a61309ad18630b93f4b88c72dff2260a0e0dcf6e1c682e1c42da1f"}}}}}, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_ifreq(r1, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) ioctl$sock_netdev_private(r1, 0x89f3, &(0x7f0000000000)) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, &(0x7f0000000000)=0x1d, 0x4) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f00000001c0)={0x114, 0x29, 0x1, 0x0, 0x0, "", [@nested={0x103, 0x4, 0x0, 0x1, [@typed={0xc, 0x2, 0x0, 0x0, @u64}, @typed={0x14, 0xb9, 0x0, 0x0, @ipv6=@loopback={0x100000000000000}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8c"]}]}, 0x114}], 0x1, 0x0, 0x0, 0x8081}, 0x0) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="30072bbd70000000000038080000"], 0x14}, 0x1, 0x2}, 0x20000014) 1.988039436s ago: executing program 3 (id=3813): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000100)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r0, &(0x7f00000001c0), 0x12) openat$cgroup_devices(0xffffffffffffffff, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2, 0x3032, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x0, 0xe, &(0x7f00000008c0)=ANY=[@ANYBLOB="b7020000ff0d0000bfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000006f6400000000000045040400010000001704000001000a00b7040000ff0100006a0a00fe0000000085000000bd000000b70000000000000095000000000000009e17f199a68b06d83298a8cdc21ce784909b849d5550ad857d0454d8877a6db61d69f2ffcaa10350e11cb97c8adf1bc9a0c4eeceb9971e43405d621ffbc9ce000000d8ca56b50d0c010d631f6dde53a9a53608c10556e5734eb84049761451ce540c772e2d9f8004e26f7fcc059c062234d5595f6fbaa187b81d1106000000000fd60000fd9ac3d09e29a9d542ca9d85a5c9c88474895d679838def0a83a733dc6a39b63a5ed69d32394c53361d7e43c5cbd80450f859ce8122a79c3e40000b59b0fc46d6cec3c0802882add4e3179bd4a44f231b6d753a7be428ba953df4aece69311687f4122073a236c3a32efa04137d4524847d2638da3261c8162bb7c7824be6195a66d2e17e122040e1100000000928612a29fc691e4f1f7bd053abb885f39381f1759410b1059f05684261f332d606834669b49ec99320ca7712d7e79bd5bf5ed818ecc7640917f6a559a47db608fcf9f6c131b84e41c354c66838f72b9e12d36e996f316f0812ca83efb30c7f6c6d57c4a64590401eec22523dd712c680013e87f649a1ede7142ca9d5d8a8c9f9b440fe4331ad5532c74d9a31a5d737537f7a2caa30581253d14dd3e92af7dc836686365ae01bdec561c0402b67801267a8df97d2f85426a5963d4fa3e26cc05972c162f223f000000d999e80de00fcbcc02d0aed7bb8f7ba337d59c14f39dcd4aad4139ef6425a9367f1bd1467fc6b95a4df7669839771ce9d5788029901e5a79d8b9990ace8f74087f25ad50c46088000000008000"/686], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x6}, 0x10}, 0x94) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000080)={r2, r4, 0x25, 0x0, @val=@tcx}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f00000000c0)=ANY=[], 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) r6 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000280)={'wlan0\x00', 0xb002}) sendmsg$NL80211_CMD_SET_INTERFACE(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000000)={'wlan0\x00', 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x85}, 0x4c040) socket$nl_generic(0x10, 0x3, 0x10) 1.483562826s ago: executing program 2 (id=3814): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="d5648549e83d50b0674d2348f7fc1789622f6fef26b908d7cc40f4edafa3921de9de7b72aec51e56c09ba18fb71b5d94ce8db1092dfebd29cb70ac48e5a6a92fe2dffcf38f7c42bf2e", @ANYRES16=r3, @ANYBLOB="010023010000340200000200000008000100", @ANYRES32=r1, @ANYBLOB], 0x1c}}, 0x0) read$nci(r0, &(0x7f0000000200)=""/100, 0x64) 1.301164727s ago: executing program 4 (id=3815): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) bpf$ENABLE_STATS(0x20, 0x0, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x4e22, 0x401, @private2={0xfc, 0x2, '\x00', 0x1}, 0x6}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC=r0], 0x50) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000000)=ANY=[], 0x38) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa10000000000000701000008000000b702000008000000b703000000000000850000000500000018110000", @ANYRES32=r3, @ANYRES16=r0], &(0x7f0000000240)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000840)={r4}, 0xc) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000340)=0x4030623) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e02, 0xb7, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x1e) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "dce02de9d7bd466b", "72e64b3892cb7025848c9f40363cf916", "cfff3c66", "e2b768b4bb9e0d9b"}, 0x28) sendmsg$ETHTOOL_MSG_WOL_SET(r0, &(0x7f0000001c40)={0x0, 0x0, &(0x7f0000001c00)={&(0x7f0000000140)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000) r5 = socket$inet(0x2, 0x6000000000000001, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x6}]}, 0x10) setsockopt$WPAN_SECURITY(r3, 0x0, 0x1, &(0x7f0000000140)=0x1, 0x4) setsockopt$inet_udp_encap(r5, 0x11, 0x64, &(0x7f0000000080)=0x1, 0x4) bind$inet(r6, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa08004500002000000000001190780000ca910000000000004e20000c907861000001"], 0x0) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x1, 0x11, r5, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r7, &(0x7f0000000080)=[{&(0x7f0000000280)=""/160, 0xa0}, {&(0x7f0000002140)=""/4096, 0x694}], 0x2) 1.280483126s ago: executing program 1 (id=3816): socket$xdp(0x2c, 0x3, 0x0) socket$xdp(0x2c, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x400000000000004) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000005c0)=ANY=[], 0x5c}}, 0x4004804) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000240)="480000001400190d09004beafd0d8c562c84ed7a80ffe05e959126dda8900db462060f000000000000a2bc5603ca00000f7f8900000ec00000000101ff0000000309ff5bffff00c7", 0x48}], 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_DELETE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r2, 0x1, 0x70bd29, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x200488d1}, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet(0x2, 0x3, 0x6) ioctl$sock_inet_SIOCSARP(r4, 0x8955, &(0x7f0000000000)={{0x2, 0x3, @local}, {0x1, @remote}, 0x4a, {0x2, 0x0, @remote}, 'veth1_to_bridge\x00'}) setsockopt$MRT_FLUSH(r4, 0x0, 0xd4, &(0x7f0000000300), 0x4) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x29000, 0x1000, 0xbb}, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'sit0\x00'}) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000000340)=0x800, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r5, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r8 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d002007000000", @ANYRES32=r7, @ANYBLOB="00000000100000001c001a80080002802d00", @ANYRES16=r8, @ANYRES32=r8], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x2000800) 1.171099202s ago: executing program 0 (id=3817): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000680)=@newlink={0x30, 0x10, 0x300, 0xfffffffd, 0x0, {}, [@IFLA_NET_NS_FD={0x8}, @IFLA_TARGET_NETNSID={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x800}, 0x400c89c) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_netdev_private(r3, 0x89fd, &(0x7f0000001a00)="3d42708db802dfcdf50623c0bf9b72a9b52551362846") ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000080)=0x0) bind$nfc_llcp(r1, &(0x7f00000000c0)={0x27, r4, 0x1, 0x7, 0x8, 0xe1, "c171f8af6648de303e39a1ce5b8d47245e30da43201337de55407ebb63f4111c9cafbe52c23106f5123564ec0f7e4dd628792cadab28844962baa427375c65", 0xa}, 0x60) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r5, 0x5452, &(0x7f00000000c0)=0x400) r7 = gettid() ioctl$sock_SIOCSPGRP(r5, 0x8902, &(0x7f0000000000)=r7) bpf$PROG_LOAD(0x5, &(0x7f0000001900)={0xe, 0x13, &(0x7f0000001640)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2619}, {}, {}, [@ldst={0x0, 0x2, 0x1, 0x7, 0x0, 0xffffffffffffffff}, @exit, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001700)='syzkaller\x00', 0x3, 0x17, &(0x7f0000001740)=""/23, 0x41000, 0x48, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x8, &(0x7f0000001780)={0x4, 0x3}, 0x8, 0x10, &(0x7f00000017c0)={0x1, 0x8, 0x7fff, 0xf}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0xa, &(0x7f0000001800)=[0xffffffffffffffff, 0x1], &(0x7f0000001840)=[{0x5, 0x2, 0x0, 0x6}, {0x3, 0x1, 0x2, 0x3}, {0x4, 0x2, 0x5}, {0x8, 0x2, 0xd, 0x3}, {0x3, 0x1, 0x9, 0x1}, {0x3, 0x2, 0xf, 0x4}, {0x5, 0x5, 0xa, 0x1}, {0x4, 0x5, 0x5}, {0x5, 0x2, 0x7414}, {0x0, 0x2, 0x3, 0x3}], 0x10, 0xd3}, 0x94) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000001280)={0x0, 0x0, 0x0}, &(0x7f00000012c0)=0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r12, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000013c0)=0xc) sendmmsg$unix(r11, &(0x7f0000002840)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000010}}, {{&(0x7f0000000840)=@abs={0x1, 0x0, 0x4e22}, 0x6e, 0x0, 0x0, &(0x7f0000001300)=[@cred={{0x1c, 0x1, 0x2, {r13, r14, r15}}}, @rights={{0x14, 0x1, 0x1, [r12]}}], 0x38, 0x40000}}], 0x2, 0x0) sendmsg$unix(r2, &(0x7f0000001a40)={&(0x7f0000001200)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001280), 0x0, &(0x7f00000019c0)=[@cred={{0x1c, 0x1, 0x2, {r8, r9, r10}}}], 0x20, 0x885}, 0x0) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x4c, 0x9, 0x6, 0x201, 0x0, 0x0, {0x1, 0x0, 0x800}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x24, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @dev={0xfe, 0x80, '\x00', 0x23}}}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0x1}]}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}}, 0x800) r16 = socket(0x10, 0x3, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000001ac0)={[{0x2d, 'net'}]}, 0x5) write(r16, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) recvmmsg(r16, &(0x7f0000001500)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000000)=@xdp, 0x80, &(0x7f00000011c0)=[{&(0x7f00000001c0)=""/4096, 0x104f}, {&(0x7f0000000080)=""/236, 0xec}], 0x2, &(0x7f0000002f40)=""/107, 0x61}}, {{&(0x7f00000015c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000001480)=[{&(0x7f0000001300)=""/68, 0x44}, {&(0x7f0000001380)=""/197, 0xc5}], 0x2e3, &(0x7f00000014c0)=""/45, 0x38}}], 0x3, 0x0, 0x0) r17 = socket$nl_netfilter(0x10, 0x3, 0xc) r18 = socket$nl_route(0x10, 0x3, 0x0) r19 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r19, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000180)=ANY=[@ANYBLOB="4c00000047000701feffffffffffffff017c0000380004804e2d", @ANYRESOCT, @ANYBLOB="4506caad0b0c"], 0x4c}, 0x1, 0x0, 0x0, 0x404c011}, 0xc000) ioctl$ifreq_SIOCGIFINDEX_team(r18, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route(r18, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x3c, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dffbfe, {0x0, 0x0, 0x0, 0x0, 0x50a10, 0x33822}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}, @IFLA_MASTER={0x8, 0xa, r20}]}, 0x3c}, 0x1, 0x0, 0x0, 0x480c1}, 0x240408d0) sendmsg$IPCTNL_MSG_EXP_DELETE(r17, &(0x7f00000002c0)={&(0x7f0000000140), 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x34, 0x2, 0x2, 0x5, 0x0, 0x0, {0xa, 0x0, 0x6}, [@CTA_EXPECT_FN={0xa, 0xb, 'Q.931\x00'}, @CTA_EXPECT_FN={0x8, 0xb, 'sip\x00'}, @CTA_EXPECT_HELP_NAME={0x9, 0x6, 'pptp\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000c00}, 0xa0) 496.327917ms ago: executing program 4 (id=3818): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000080)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) pread64(r2, &(0x7f0000000300)=""/148, 0x94, 0x1) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000000)) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f00000001c0)="17000000020001000003d68c5ee1cbbea2002b08020b00fcff3f0200000300000a003f00009afc5ad9485bbb6a880000d6c8db0000c1a6100ac45761407a681f009cee4a5acb3da42200001fb300674f19b44e09f9315033bf79ac2dff0601151b39010000ff030000ea000000000000000009ffff02dfccebf6bb0008400200000000e9055406ff000062f23c63a90d11955600007f712112cef9070000000000000000000000001400000000000000000000000039872202eb5700"/199, 0xc7) socket$inet_smc(0x2b, 0x1, 0x0) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_ro(r1, &(0x7f0000000080)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) (async) pread64(r2, &(0x7f0000000300)=""/148, 0x94, 0x1) (async) ioctl$TUNGETIFF(r2, 0x800454d2, &(0x7f0000000000)) (async) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f00000001c0)="17000000020001000003d68c5ee1cbbea2002b08020b00fcff3f0200000300000a003f00009afc5ad9485bbb6a880000d6c8db0000c1a6100ac45761407a681f009cee4a5acb3da42200001fb300674f19b44e09f9315033bf79ac2dff0601151b39010000ff030000ea000000000000000009ffff02dfccebf6bb0008400200000000e9055406ff000062f23c63a90d11955600007f712112cef9070000000000000000000000001400000000000000000000000039872202eb5700"/199, 0xc7) (async) 429.82974ms ago: executing program 1 (id=3819): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) socket$pppl2tp(0x18, 0x1, 0x1) (async) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}, 0x2, 0x1}}, 0x2e) getsockopt(r3, 0x111, 0x6, 0x0, &(0x7f0000000080)) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8000}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x3b}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x10, 0x1, 0x0, 0x1, @bitwise={{0xc}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xe4}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8000}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x3b}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}]}}}, {0x10, 0x1, 0x0, 0x1, @bitwise={{0xc}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xe4}}, 0x0) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="4400000013000500010000000000000007000000", @ANYRES32=r5, @ANYBLOB="000000000000000024001a80200004801c000180080001000100000008"], 0x44}}, 0x0) (async) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="4400000013000500010000000000000007000000", @ANYRES32=r5, @ANYBLOB="000000000000000024001a80200004801c000180080001000100000008"], 0x44}}, 0x0) 171.725273ms ago: executing program 2 (id=3820): socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1e, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000ff0300000000000000000000850000008c00000085000000a000000095"], &(0x7f00000000c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_lookup=0x24, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 8.958524ms ago: executing program 4 (id=3821): mmap(&(0x7f0000197000/0x4000)=nil, 0x4000, 0x3000004, 0x20010, 0xffffffffffffffff, 0x93ce7000) r0 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000840)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x10}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x80}, 0x1, 0x0, 0x0, 0x4080010}, 0x24000000) setsockopt$sock_int(r0, 0x1, 0x3e, &(0x7f00000000c0)=0xb, 0x4) bind$llc(r0, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x54}, 0x10) socket$netlink(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) unshare(0x28000600) close(0x3) openat$ppp(0xffffffffffffff9c, 0x0, 0x288840, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2000, 0x0) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f00000005c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000600)={'wpan0\x00', 0x0}) getsockopt$llc_int(r0, 0x10c, 0x9, 0xfffffffffffffffc, &(0x7f0000000200)) sendmsg$NL802154_CMD_SET_CHANNEL(r2, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000640)={0x2c, r4, 0xa11, 0x70bd28, 0x25dfdbfd, {}, [@NL802154_ATTR_CHANNEL={0x5, 0x8, 0x12}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}, @NL802154_ATTR_PAGE={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x3, 0xc, &(0x7f0000000040)=ANY=[@ANYBLOB="180200009603000000000000000000008500000027000000180100002020702500000000e31f20207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000170000009500000000000000"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) socketpair$unix(0x1, 0x2, 0x0, 0x0) r7 = socket$netlink(0x10, 0x3, 0x4) write(r7, &(0x7f0000000100)="29000000140005b7ff000000040860eb0101b6ff021596db2d6d6974b5d728aa4b5d02c26ed638eeb7", 0x29) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_int(r8, 0x1, 0x2e, 0x0, &(0x7f0000000000)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1f, 0xb, &(0x7f0000000780)=ANY=[], &(0x7f0000000740)='syzkaller\x00', 0x8, 0xd3, &(0x7f0000000100)=""/211, 0x41000, 0x73, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) 0s ago: executing program 0 (id=3822): ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000640)={{0xffffffffffffffff, &(0x7f0000000040)='\x00', 0x200000, &(0x7f0000000280)={@align=0xfffffffffffffff6, {0x40, 0x2, 0x1df60000, 0x2}}, 0x3, &(0x7f00000002c0), &(0x7f0000000300)=0x1}, {[0x101, 0x10, 0x6, 0x10000]}, 0x9, 0xb7, &(0x7f00000004c0)=""/183}) syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), r0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xa, 0x5, 0x2, 0x9, 0x0, 0x1, 0x10000}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffff7}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0xe}]}, &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r2, r1}, 0xc) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x11, 0x11, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000cf000000000000000500000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000700008500000086000000bf0900000000000055090100000000009500010000000000c500fefffcffffff3d90042200000000bf91000000000000b702000003000000850000002af28398bb3ac100009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x2c}, 0x94) kernel console output (not intermixed with test programs): ooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 755.291921][ T5619] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 756.036017][T19452] nftables ruleset with unbound chain [ 756.118269][T19460] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2993'. [ 756.848477][ T13] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 757.012605][T19462] netdevsim0 speed is unknown, defaulting to 1000 [ 757.017746][T19476] netlink: 'syz.3.2997': attribute type 12 has an invalid length. [ 757.139037][T19485] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2998'. [ 757.220455][T19335] udevd[19335]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 757.406230][ T13] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 757.458498][ T5619] Bluetooth: hci5: command tx timeout [ 757.500787][T19490] batman_adv: batadv0: Adding interface: syzkaller0 [ 757.500808][T19490] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 757.513024][T19490] batman_adv: batadv0: Interface activated: syzkaller0 [ 757.801164][T19487] bridge8: entered promiscuous mode [ 757.801191][T19487] bridge8: entered allmulticast mode [ 757.823608][T19487] team0: Port device bridge8 added [ 757.826886][T19492] bridge0: port 1(team0) entered blocking state [ 757.826983][T19492] bridge0: port 1(team0) entered disabled state [ 757.827138][T19492] team0: entered allmulticast mode [ 757.933975][T19478] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 758.144187][T19478] batman_adv: batadv0: Removing interface: syzkaller0 [ 758.332704][ T13] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 758.614166][ T13] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 758.668592][T19497] netdevsim0 speed is unknown, defaulting to 1000 [ 758.949067][T19431] netdevsim0 speed is unknown, defaulting to 1000 [ 759.040254][T19526] xt_CT: No such helper "snmp_trap" [ 759.133049][T19439] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 759.306096][T19535] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3008'. [ 759.533901][T19439] Bluetooth: hci5: command tx timeout [ 759.606128][T19535] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3008'. [ 760.228253][T19562] netlink: 'syz.4.3013': attribute type 1 has an invalid length. [ 761.012669][ T13] bond10 (unregistering): (slave gretap2): Releasing active interface [ 761.069397][ T13] bond5 (unregistering): (slave gretap1): Releasing active interface [ 761.259268][ T13] bond0 (unregistering): Released all slaves [ 761.277789][ T13] bond1 (unregistering): (slave batadv2): Releasing active interface [ 761.278891][ T13] bond1 (unregistering): Released all slaves [ 761.320207][ T13] bond2 (unregistering): Released all slaves [ 761.355756][ T13] bond3 (unregistering): Released all slaves [ 761.390864][ T13] bond4 (unregistering): Released all slaves [ 761.418756][ T13] bond5 (unregistering): Released all slaves [ 761.456943][ T13] bond6 (unregistering): Released all slaves [ 761.484294][ T13] bond7 (unregistering): Released all slaves [ 761.519689][ T13] bond8 (unregistering): Released all slaves [ 761.547661][ T13] bond9 (unregistering): (slave veth0_to_bond): Releasing backup interface [ 761.549705][ T13] bond9 (unregistering): Released all slaves [ 761.593959][ T13] bond10 (unregistering): Released all slaves [ 761.613084][T19439] Bluetooth: hci5: command tx timeout [ 761.958434][T19562] 8021q: adding VLAN 0 to HW filter on device bond10 [ 762.002408][T19567] macvlan4: entered promiscuous mode [ 762.002435][T19567] macvlan4: entered allmulticast mode [ 762.381509][T19593] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 762.446644][T19593] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3016'. [ 762.489515][T19595] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3016'. [ 762.529845][T19591] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 762.551640][T19591] x_tables: duplicate underflow at hook 1 [ 762.608885][ T13] : left promiscuous mode [ 762.669775][T19591] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 762.729848][T19597] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3017'. [ 763.187199][T19601] macvtap2: entered allmulticast mode [ 763.187223][T19601] veth0_to_bridge: entered allmulticast mode [ 763.242006][T19601] veth0_to_bridge: left allmulticast mode [ 763.695552][T19439] Bluetooth: hci5: command tx timeout [ 763.711267][ T13] : left promiscuous mode [ 763.809188][T19607] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3019'. [ 763.957084][ T13] ovs-s!: left promiscuous mode [ 764.477844][ T13] tipc: Left network mode [ 764.585173][T19625] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3023'. [ 764.787321][T19649] sctp: [Deprecated]: syz.3.3027 (pid 19649) Use of int in max_burst socket option. [ 764.787321][T19649] Use struct sctp_assoc_value instead [ 765.356591][ T5281] 8021q: adding VLAN 0 to HW filter on device eth5 [ 765.359809][T19431] bridge0: port 1(bridge_slave_0) entered blocking state [ 765.360380][T19431] bridge0: port 1(bridge_slave_0) entered disabled state [ 765.360781][T19431] bridge_slave_0: entered allmulticast mode [ 765.383165][T19431] bridge_slave_0: entered promiscuous mode [ 765.470274][T19431] bridge0: port 2(bridge_slave_1) entered blocking state [ 765.470753][T19431] bridge0: port 2(bridge_slave_1) entered disabled state [ 765.471104][T19431] bridge_slave_1: entered allmulticast mode [ 765.520528][T19431] bridge_slave_1: entered promiscuous mode [ 765.734971][T19667] smbdirect: ib_dev[syz1] removed [ 765.890309][T19431] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 765.919756][T19431] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 766.056292][T19687] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3033'. [ 766.426536][T19670] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3030'. [ 766.866677][T19431] team0: Port device team_slave_0 added [ 766.891113][T19431] team0: Port device team_slave_1 added [ 767.368972][T19696] 8021q: adding VLAN 0 to HW filter on device  [ 767.399241][T19696] 8021q: adding VLAN 0 to HW filter on device team0 [ 767.593742][T19696] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 767.650674][T19696] veth1_vlan: left promiscuous mode [ 767.664409][T19696] veth0_vlan: left promiscuous mode [ 767.670176][T19696] veth0_vlan: entered promiscuous mode [ 767.702169][T19696] veth1_vlan: entered promiscuous mode [ 767.737903][T19696] veth0_macvtap: left promiscuous mode [ 767.741120][T19696] veth0_macvtap: entered promiscuous mode [ 767.810848][T19696] 8021q: adding VLAN 0 to HW filter on device bond1 [ 767.848471][T19696] 8021q: adding VLAN 0 to HW filter on device bond2 [ 767.897342][T19696] 8021q: adding VLAN 0 to HW filter on device bond3 [ 767.927257][T19696] mac80211_hwsim hwsim26 wlan0: entered promiscuous mode [ 768.018555][T19696] 8021q: adding VLAN 0 to HW filter on device bond4 [ 768.044435][T19696] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 768.074479][T19696] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 768.078379][T19696] 8021q: adding VLAN 0 to HW filter on device bond0 [ 768.129107][T19696] A link change request failed with some changes committed already. Interface geneve4 may have been left with an inconsistent configuration, please check. [ 768.371906][T19398] bond4: (slave veth5): link status definitely up, 10000 Mbps full duplex [ 769.142097][ T5281] 8021q: adding VLAN 0 to HW filter on device eth6 [ 769.160761][T19431] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 769.160784][T19431] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 769.160827][T19431] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 769.347391][T19754] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3040'. [ 769.368501][ T13] hsr_slave_0: left promiscuous mode [ 769.371758][ T13] hsr_slave_1: left promiscuous mode [ 771.026322][T19431] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 771.026345][T19431] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 771.026375][T19431] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 771.775516][T17609] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.778698][T17609] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.889502][ T134] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.932989][T17609] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 771.968676][T19431] hsr_slave_0: entered promiscuous mode [ 771.969787][T19431] hsr_slave_1: entered promiscuous mode [ 772.002334][T19772] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3044'. [ 772.572021][T19775] veth1_to_team: entered promiscuous mode [ 772.606020][T19775] veth1_to_team: left promiscuous mode [ 777.168036][T19789] syzkaller0: entered promiscuous mode [ 777.168295][T19789] syzkaller0: entered allmulticast mode [ 777.215734][ T13] IPVS: stop unused estimator thread 0... [ 777.569913][ T5281] 8021q: adding VLAN 0 to HW filter on device eth7 [ 777.876976][T19804] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 778.810527][T19829] IPVS: length: 77 != 24 [ 781.382207][T19820] bond11: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 781.408197][T19820] bond11 (unregistering): Released all slaves [ 782.022250][T19858] netlink: 'syz.0.3057': attribute type 1 has an invalid length. [ 783.567217][T19915] netlink: 'syz.4.3064': attribute type 11 has an invalid length. [ 783.636858][T19908] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3063'. [ 783.836482][T19917] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3065'. [ 784.100589][T19917] netlink: 'syz.3.3065': attribute type 1 has an invalid length. [ 784.100616][T19917] netlink: 200 bytes leftover after parsing attributes in process `syz.3.3065'. [ 784.244407][T19923] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 784.248169][T19924] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 784.697354][T19930] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3066'. [ 784.744222][T19935] openvswitch: netlink: Key type 354 is out of range max 32 [ 784.910724][T19927] wlan0 speed is unknown, defaulting to 1000 [ 784.920885][T19927] wlan0 speed is unknown, defaulting to 1000 [ 785.201775][T19938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3067'. [ 785.201802][T19938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3067'. [ 785.201818][T19938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3067'. [ 785.201832][T19938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3067'. [ 785.201847][T19938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3067'. [ 785.201862][T19938] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3067'. [ 785.317171][T19927] wlan0 speed is unknown, defaulting to 1000 [ 785.357508][T19927] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 785.357552][T19927] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 785.357598][T19927] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 785.460619][T19927] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 785.844037][T19927] wlan0 speed is unknown, defaulting to 1000 [ 785.845385][T19431] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 785.897919][T19431] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 785.992644][T19927] wlan0 speed is unknown, defaulting to 1000 [ 786.002526][T19431] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 786.065505][T19431] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 786.087252][T19927] wlan0 speed is unknown, defaulting to 1000 [ 786.090631][T19431] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 786.248849][T19431] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 786.252296][T19927] wlan0 speed is unknown, defaulting to 1000 [ 786.278215][T19431] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 786.341346][T19431] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 786.347420][T19927] wlan0 speed is unknown, defaulting to 1000 [ 786.969057][T19996] ip_tables: iptables: counters copy to user failed while replacing table [ 787.121043][T19431] 8021q: adding VLAN 0 to HW filter on device bond0 [ 787.192153][T20006] syzkaller0: left promiscuous mode [ 787.192183][T20006] syzkaller0: left allmulticast mode [ 787.240686][T19431] 8021q: adding VLAN 0 to HW filter on device team0 [ 787.260050][T20009] tipc: Invalid UDP bearer configuration [ 787.260104][T20009] tipc: Enabling of bearer rejected, failed to enable media [ 787.305095][ T134] bridge0: port 1(bridge_slave_0) entered blocking state [ 787.305210][ T134] bridge0: port 1(bridge_slave_0) entered forwarding state [ 787.374208][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 787.374326][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 788.987631][T20062] bond11 (unregistering): Released all slaves [ 789.358345][T20063] bond11 (unregistering): Released all slaves [ 789.890151][T20097] netlink: 'syz.4.3089': attribute type 11 has an invalid length. [ 790.230839][T20113] netlink: 'syz.0.3092': attribute type 10 has an invalid length. [ 790.253088][T20113] syz_tun: entered promiscuous mode [ 790.528307][T19431] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 790.776846][T20133] __nla_validate_parse: 13 callbacks suppressed [ 790.776871][T20133] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3094'. [ 790.776887][T20133] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3094'. [ 790.882300][T19431] veth0_vlan: entered promiscuous mode [ 790.947788][T19431] veth1_vlan: entered promiscuous mode [ 791.205940][T19431] veth0_macvtap: entered promiscuous mode [ 791.249567][T19431] veth1_macvtap: entered promiscuous mode [ 791.418423][T19431] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 791.443693][T20150] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3098'. [ 791.701127][T20155] netlink: ct family unspecified [ 791.701183][T20155] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 791.725528][T19431] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 791.854262][ T134] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 791.863055][ T3322] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 791.863107][ T3322] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 791.863145][ T3322] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 792.350745][T20163] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3100'. [ 792.350802][T20163] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3100'. [ 792.470288][T20168] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3101'. [ 792.471553][T20168] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3101'. [ 792.510994][T20168] macsec1: entered promiscuous mode [ 792.511204][T20168] macsec1: entered allmulticast mode [ 792.511221][T20168] gretap0: entered allmulticast mode [ 792.542369][T20168] gretap0: left allmulticast mode [ 792.652348][T20170] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3102'. [ 792.793039][T20163] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3100'. [ 792.793115][T20163] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3100'. [ 792.890254][ T134] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 792.890279][ T134] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 792.891992][T20174] tipc: Enabling of bearer rejected, already enabled [ 793.041610][ T1160] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 793.041634][ T1160] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 793.317321][T20195] netlink: 'syz.0.3105': attribute type 5 has an invalid length. [ 793.560844][T20187] xt_TPROXY: Can be used only with -p tcp or -p udp [ 793.774857][T20207] FAULT_INJECTION: forcing a failure. [ 793.774857][T20207] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 793.774897][T20207] CPU: 0 UID: 0 PID: 20207 Comm: syz.2.2986 Not tainted syzkaller #0 PREEMPT(full) [ 793.774923][T20207] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 793.774938][T20207] Call Trace: [ 793.774947][T20207] [ 793.774957][T20207] dump_stack_lvl+0xe8/0x150 [ 793.774999][T20207] should_fail_ex+0x410/0x560 [ 793.775034][T20207] _copy_from_user+0x2d/0xb0 [ 793.775067][T20207] do_sock_getsockopt+0x1fa/0x640 [ 793.775108][T20207] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 793.775141][T20207] ? do_sys_openat2+0x14e/0x200 [ 793.775169][T20207] ? kmem_cache_free+0x182/0x650 [ 793.775213][T20207] ? ksys_write+0x1fc/0x270 [ 793.775254][T20207] __x64_sys_getsockopt+0x1a4/0x240 [ 793.775296][T20207] do_syscall_64+0x166/0x520 [ 793.775327][T20207] ? trace_irq_disable+0x3b/0x140 [ 793.775352][T20207] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.775376][T20207] ? clear_bhb_loop+0x70/0xc0 [ 793.775405][T20207] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 793.775428][T20207] RIP: 0033:0x7f40ca19e159 [ 793.775450][T20207] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 793.775470][T20207] RSP: 002b:00007f40cb047028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 793.775495][T20207] RAX: ffffffffffffffda RBX: 00007f40ca425fa0 RCX: 00007f40ca19e159 [ 793.775513][T20207] RDX: 0000000000000023 RSI: 0000000000000006 RDI: 0000000000000003 [ 793.775527][T20207] RBP: 00007f40cb047090 R08: 0000200000002100 R09: 0000000000000000 [ 793.775543][T20207] R10: 00002000000020c0 R11: 0000000000000246 R12: 0000000000000001 [ 793.775565][T20207] R13: 00007f40ca426038 R14: 00007f40ca425fa0 R15: 00007ffd03acb908 [ 793.775601][T20207] [ 794.154843][ T5619] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 794.160355][ T5619] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 794.161200][ T5619] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 794.192229][ T5619] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 794.200882][ T5619] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 794.748493][T20223] Bluetooth: ISO socket layer initialized [ 795.587755][T20232] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 795.641684][T20247] bridge_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 795.906629][ T5619] block nbd2: Receive control failed (result -32) [ 796.016615][T20253] bridge0: port 1(bridge_slave_0) entered disabled state [ 796.021251][T20253] bridge0: port 2(bridge_slave_1) entered disabled state [ 796.090031][T20256] netlink: 'syz.2.3115': attribute type 16 has an invalid length. [ 796.090057][T20256] netlink: 'syz.2.3115': attribute type 17 has an invalid length. [ 796.225864][T20256] bridge0: port 1(bridge_slave_0) entered blocking state [ 796.226006][T20256] bridge0: port 1(bridge_slave_0) entered forwarding state [ 796.229255][T20256] bridge0: port 2(bridge_slave_1) entered blocking state [ 796.229384][T20256] bridge0: port 2(bridge_slave_1) entered forwarding state [ 796.285556][ T5619] Bluetooth: hci1: command tx timeout [ 796.523426][T20255] netlink: 'syz.1.3114': attribute type 5 has an invalid length. [ 796.836520][T20213] netdevsim0 speed is unknown, defaulting to 1000 [ 796.871428][T20213] wlan0 speed is unknown, defaulting to 1000 [ 797.241789][T20277] batman_adv: batadv0: Adding interface: macvtap1 [ 797.241811][T20277] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 797.241842][T20277] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 797.365156][T20282] netlink: 'syz.1.3119': attribute type 1 has an invalid length. [ 797.521034][T20282] bond8: entered promiscuous mode [ 797.546810][T20282] 8021q: adding VLAN 0 to HW filter on device bond8 [ 798.334170][ T5619] Bluetooth: hci1: command tx timeout [ 798.476516][T20312] xt_addrtype: ipv6 BLACKHOLE matching not supported [ 798.517682][T20278] 8021q: adding VLAN 0 to HW filter on device bond8 [ 798.518168][T20278] bond8: (slave gre1): The slave device specified does not support setting the MAC address [ 798.518190][T20278] bond8: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 798.597695][T20278] bond8: (slave gre1): making interface the new active one [ 798.597724][T20278] gre1: entered promiscuous mode [ 798.662362][T20278] bond8: (slave gre1): Enslaving as an active interface with an up link [ 799.191687][T20213] bridge0: port 1(bridge_slave_0) entered blocking state [ 799.194202][T20213] bridge0: port 1(bridge_slave_0) entered disabled state [ 799.194902][T20213] bridge_slave_0: entered allmulticast mode [ 799.199755][T20213] bridge_slave_0: entered promiscuous mode [ 799.218508][T20213] bridge0: port 2(bridge_slave_1) entered blocking state [ 799.260975][T20213] bridge0: port 2(bridge_slave_1) entered disabled state [ 799.261184][T20213] bridge_slave_1: entered allmulticast mode [ 799.287480][T20213] bridge_slave_1: entered promiscuous mode [ 799.352407][T20213] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 799.371564][T20213] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 799.421310][T20213] team0: Port device team_slave_0 added [ 799.430588][T20213] team0: Port device team_slave_1 added [ 799.479644][T20213] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 799.479665][T20213] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 799.479694][T20213] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 799.481968][T20213] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 799.481985][T20213] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 799.482022][T20213] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 799.639357][T20334] ip_tables: iptables: counters copy to user failed while replacing table [ 799.661047][T20334] IPVS: set_ctl: invalid protocol: 58 172.30.254.3:20002 [ 799.884753][T20213] hsr_slave_0: entered promiscuous mode [ 799.885910][T20213] hsr_slave_1: entered promiscuous mode [ 799.886694][T20213] debugfs: 'hsr0' already exists in 'hsr' [ 799.886714][T20213] Cannot create hsr debugfs directory [ 799.985056][T20335] syz_tun: left promiscuous mode [ 800.299423][T20335] veth3: left promiscuous mode [ 800.312052][T20335] dvmrp0: left promiscuous mode [ 800.321506][T20335] vlan3: left promiscuous mode [ 800.321569][T20335] macvlan0: left promiscuous mode [ 800.414362][ T5619] Bluetooth: hci1: command tx timeout [ 800.449514][T20335] geneve3: left promiscuous mode [ 800.514302][T20335] ip6gre1: left promiscuous mode [ 800.516057][T20335] geneve4: left promiscuous mode [ 800.516077][T20335] A link change request failed with some changes committed already. Interface geneve4 may have been left with an inconsistent configuration, please check. [ 800.562053][T20026] wlan0 speed is unknown, defaulting to 1000 [ 800.710998][T20362] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3133'. [ 800.968900][T20370] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3134'. [ 801.212533][T20380] IPVS: Unknown mcast interface: pim6reg0 [ 801.277394][T20373] netlink: 220 bytes leftover after parsing attributes in process `syz.0.3136'. [ 801.352742][T20370] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3134'. [ 801.717495][T20402] ip_tables: iptables: counters copy to user failed while replacing table [ 801.789197][T20213] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 801.851294][T20403] netlink: 'syz.0.3139': attribute type 16 has an invalid length. [ 801.851322][T20403] netlink: 'syz.0.3139': attribute type 17 has an invalid length. [ 802.167791][T20403] gtp0: left allmulticast mode [ 802.268346][T20403] veth1: left allmulticast mode [ 802.408622][T20403] ip6gre1: left allmulticast mode [ 802.432268][T20403] geneve4: left allmulticast mode [ 802.432296][T20403] A link change request failed with some changes committed already. Interface geneve4 may have been left with an inconsistent configuration, please check. [ 802.458009][T13834] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 802.477913][ T134] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 802.480145][ T134] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 802.500280][ T5619] Bluetooth: hci1: command tx timeout [ 802.514741][T20026] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 802.588948][T20213] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 802.635720][T20026] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 802.639829][ T134] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 802.644938][ T134] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 802.680558][T20025] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 802.713975][T20025] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 802.744463][ T134] ip6_tunnel: ip6tnl5 xmit: Local address not yet configured! [ 802.971193][T20213] bond0: (slave netdevsim1): Releasing backup interface [ 803.039544][T20213] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 803.309353][T20213] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 803.336337][T20426] netlink: 'syz.0.3142': attribute type 1 has an invalid length. [ 803.336493][T20428] netlink: 'syz.0.3142': attribute type 1 has an invalid length. [ 803.339694][T19396] smbdirect: ib_dev[syz2] removed [ 803.396998][T20430] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3142'. [ 804.589211][T20388] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 804.618023][T20213] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 804.658583][T20213] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 804.659658][T20213] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 804.720184][T20213] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 804.721783][T20213] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 804.771076][T20213] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 804.833135][T20213] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 805.262263][T20463] nft_compat: unsupported protocol 1 [ 805.439428][T20213] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 805.854343][T19439] Bluetooth: hci1: command 0x0405 tx timeout [ 806.085932][T20485] sock: sock_timestamping_bind_phc: sock not bind to device [ 806.149544][T20484] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3149'. [ 807.086008][T20213] 8021q: adding VLAN 0 to HW filter on device bond0 [ 807.225958][T20501] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3153'. [ 807.231555][T20213] 8021q: adding VLAN 0 to HW filter on device team0 [ 807.281579][ T1160] bridge0: port 1(bridge_slave_0) entered blocking state [ 807.281688][ T1160] bridge0: port 1(bridge_slave_0) entered forwarding state [ 807.378749][ T1160] bridge0: port 2(bridge_slave_1) entered blocking state [ 807.378826][ T1160] bridge0: port 2(bridge_slave_1) entered forwarding state [ 807.528164][T20513] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3156'. [ 807.939784][T20520] bond0: (slave ip6tnl0): refused to change device type [ 807.959051][T20520] netlink: NAT attribute has 5 unknown bytes [ 807.959093][T20520] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 809.258203][T20213] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 809.622343][T20213] veth0_vlan: entered promiscuous mode [ 809.671903][T20213] veth1_vlan: entered promiscuous mode [ 809.732625][T20558] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3168'. [ 810.127360][T20213] veth0_macvtap: entered promiscuous mode [ 810.174654][T20213] veth1_macvtap: entered promiscuous mode [ 810.258728][T20567] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 810.332423][T20568] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3170'. [ 810.366086][T20571] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3169'. [ 810.502141][T20213] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 810.640853][T20554] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3163'. [ 810.796387][T20213] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 810.835866][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.836151][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.837149][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.839294][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 811.196471][T19396] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 811.196495][T19396] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 811.324297][ T3322] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 811.324323][ T3322] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 811.552233][T20592] netlink: 'syz.4.3178': attribute type 1 has an invalid length. [ 811.640922][T20597] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3177'. [ 811.641024][T20597] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3177'. [ 811.662446][T20592] bond11: entered promiscuous mode [ 811.669798][T20592] 8021q: adding VLAN 0 to HW filter on device bond11 [ 811.877133][T20599] bond11: (slave bridge0): making interface the new active one [ 811.877163][T20599] bridge0: entered promiscuous mode [ 811.898348][T20599] bond11: (slave bridge0): Enslaving as an active interface with an up link [ 812.259620][T19439] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 812.266079][T19439] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 812.272156][T19439] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 812.310534][T19439] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 812.315421][T19439] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 812.404668][T20604] syzkaller1: entered promiscuous mode [ 812.404880][T20604] syzkaller1: entered allmulticast mode [ 812.442683][T20615] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3183'. [ 812.501349][T20615] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3183'. [ 812.519370][T20615] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 812.566279][T20619] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3184'. [ 812.665388][T20621] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3183'. [ 812.733699][T20621] netlink: 'syz.4.3183': attribute type 2 has an invalid length. [ 813.348984][T20641] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3188'. [ 813.637315][T20649] tipc: Started in network mode [ 813.637354][T20649] tipc: Node identity 96ec9b925fcd, cluster identity 4711 [ 813.637538][T20649] tipc: Enabled bearer , priority 0 [ 813.863050][ C0] ip6_tnl_xmit_ctl: 26 callbacks suppressed [ 813.863077][ C0] ip6_tunnel: ip6tnl5 xmit: Local address not yet configured! [ 813.898094][T20652] syzkaller0: entered promiscuous mode [ 813.898125][T20652] syzkaller0: entered allmulticast mode [ 813.902127][T20652] tipc: Resetting bearer [ 814.062649][T20671] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3191'. [ 814.084327][T20640] tipc: Resetting bearer [ 814.431476][ T5619] Bluetooth: hci4: command tx timeout [ 814.493063][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 815.133080][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 815.140029][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 815.781292][ C0] ip6_tunnel: ip6tnl6 xmit: Local address not yet configured! [ 816.418836][ C0] ip6_tunnel: ip6tnl7 xmit: Local address not yet configured! [ 816.495370][ T5619] Bluetooth: hci4: command tx timeout [ 818.161785][T20640] tipc: Disabling bearer [ 818.295799][T20646] bridge0: port 2(bridge_slave_1) entered disabled state [ 818.296486][T20646] bridge0: port 1(bridge_slave_0) entered disabled state [ 818.396681][T20677] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3192'. [ 818.396710][T20677] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3192'. [ 818.396727][T20677] netlink: 'syz.3.3192': attribute type 6 has an invalid length. [ 818.396741][T20677] netlink: 'syz.3.3192': attribute type 5 has an invalid length. [ 818.396755][T20677] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3192'. [ 818.530772][T20646] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 818.559470][T20646] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 818.576331][ T5619] Bluetooth: hci4: command tx timeout [ 818.826166][T20683] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3194'. [ 819.078021][T13834] tipc: Node number set to 3374422930 [ 819.085092][ T1160] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 819.085429][ T1160] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 819.085474][ T1160] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 819.085514][ T1160] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 819.141033][T20686] lo: entered allmulticast mode [ 819.302706][T20684] lo: left allmulticast mode [ 819.346186][T20694] Bluetooth: MGMT ver 1.23 [ 819.510701][T20706] netlink: 'syz.2.3196': attribute type 2 has an invalid length. [ 819.510728][T20706] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3196'. [ 819.564354][T20608] wlan0 speed is unknown, defaulting to 1000 [ 819.630168][T20713] netlink: 'syz.3.3199': attribute type 21 has an invalid length. [ 819.630195][T20713] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3199'. [ 819.670910][T20714] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3196'. [ 819.670936][T20714] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3196'. [ 819.794282][T20706] : entered promiscuous mode [ 820.129277][T20708] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 820.182526][T20708] bond1 (unregistering): Released all slaves [ 820.442697][T20713] netlink: 'syz.3.3199': attribute type 4 has an invalid length. [ 820.442723][T20713] netlink: 'syz.3.3199': attribute type 3 has an invalid length. [ 820.442738][T20713] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3199'. [ 820.664205][ T5619] Bluetooth: hci4: command tx timeout [ 820.871321][T20736] netlink: 144 bytes leftover after parsing attributes in process `syz.2.3201'. [ 821.597772][T20757] netlink: 'syz.3.3204': attribute type 39 has an invalid length. [ 822.031225][T20770] netlink: Unknown nat attribute (0) [ 822.031260][T20770] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 822.585668][T20774] ip_tables: iptables: counters copy to user failed while replacing table [ 822.924725][T20608] bridge0: port 1(bridge_slave_0) entered blocking state [ 822.925394][T20608] bridge0: port 1(bridge_slave_0) entered disabled state [ 822.926236][T20608] bridge_slave_0: entered allmulticast mode [ 822.961261][T20608] bridge_slave_0: entered promiscuous mode [ 822.971748][T20608] bridge0: port 2(bridge_slave_1) entered blocking state [ 822.971940][T20608] bridge0: port 2(bridge_slave_1) entered disabled state [ 822.972091][T20608] bridge_slave_1: entered allmulticast mode [ 823.004178][T20608] bridge_slave_1: entered promiscuous mode [ 823.051690][T20608] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 823.066089][T20608] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 823.129896][T20608] team0: Port device team_slave_0 added [ 823.140506][T20608] team0: Port device team_slave_1 added [ 823.182061][T20608] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 823.182080][T20608] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 823.182107][T20608] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 823.248013][T20608] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 823.248032][T20608] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 823.248061][T20608] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 823.472855][T20608] hsr_slave_0: entered promiscuous mode [ 823.474750][T20608] hsr_slave_1: entered promiscuous mode [ 823.475633][T20608] debugfs: 'hsr0' already exists in 'hsr' [ 823.475654][T20608] Cannot create hsr debugfs directory [ 824.075181][T20814] set match dimension is over the limit! [ 824.155574][T20817] __nla_validate_parse: 1 callbacks suppressed [ 824.155597][T20817] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3214'. [ 825.163854][T20834] netlink: 'syz.4.3219': attribute type 1 has an invalid length. [ 825.163879][T20834] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3219'. [ 825.163896][T20834] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3219'. [ 825.290834][T20836] netlink: 35 bytes leftover after parsing attributes in process `syz.0.3218'. [ 825.290871][T20836] netlink: 35 bytes leftover after parsing attributes in process `syz.0.3218'. [ 825.345703][T20831] bond5: Removing last arp target with arp_interval on [ 825.584445][T20843] netlink: 2 bytes leftover after parsing attributes in process `syz.3.3217'. [ 825.631421][T20608] bond0: (slave netdevsim1): Releasing backup interface [ 825.735651][T20608] netdevsim netdevsim1 netdevsim1 (unregistering): left promiscuous mode [ 825.916012][T20850] ip_tables: iptables: counters copy to user failed while replacing table [ 826.035635][T20846] team0: left allmulticast mode [ 826.041650][T20846] bridge0: port 1(team0) entered disabled state [ 826.360802][T20846] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 826.361041][T20851] tipc: Enabled bearer , priority 0 [ 827.363995][T20877] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3228'. [ 827.525587][T20862] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3225'. [ 827.525613][T20862] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3225'. [ 827.526510][T20862] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3225'. [ 827.933063][ C0] ip6_tunnel: ip6tnl5 xmit: Local address not yet configured! [ 828.009174][T20608] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 828.046928][T20608] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 828.071609][T20608] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 828.166455][T20608] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 828.170644][T20608] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 828.221400][T20608] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 828.232294][T20608] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 828.314595][T20608] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 828.560605][T20916] netlink: 'syz.4.3231': attribute type 1 has an invalid length. [ 828.609244][T20894] syzkaller0: entered promiscuous mode [ 828.609273][T20894] syzkaller0: entered allmulticast mode [ 828.903398][T20912] 8021q: adding VLAN 0 to HW filter on device bond12 [ 828.954832][T20913] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 828.961328][T20913] bond12: (slave batadv1): Enslaving as an active interface with an up link [ 829.012291][T20916] bond12 (unregistering): (slave batadv1): Releasing backup interface [ 829.048386][T20916] bond12 (unregistering): Released all slaves [ 829.431423][T20935] ip_tables: iptables: counters copy to user failed while replacing table [ 830.492993][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 830.800802][T20956] __nla_validate_parse: 65 callbacks suppressed [ 830.800826][T20956] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3236'. [ 831.133204][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 831.787096][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 833.064961][ C0] ip6_tunnel: ip6tnl6 xmit: Local address not yet configured! [ 834.477578][T20941] tipc: Resetting bearer [ 834.481255][T20941] tipc: Resetting bearer [ 834.761915][T20961] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3237'. [ 834.974269][ C0] ip6_tunnel: ip6tnl7 xmit: Local address not yet configured! [ 835.164651][T20608] 8021q: adding VLAN 0 to HW filter on device bond0 [ 835.277514][T20608] 8021q: adding VLAN 0 to HW filter on device team0 [ 835.311922][ T9632] bridge0: port 1(bridge_slave_0) entered blocking state [ 835.312057][ T9632] bridge0: port 1(bridge_slave_0) entered forwarding state [ 835.365400][ T134] bridge0: port 2(bridge_slave_1) entered blocking state [ 835.365518][ T134] bridge0: port 2(bridge_slave_1) entered forwarding state [ 837.215713][T21024] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3248'. [ 837.931450][T20608] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 837.957303][T21045] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3252'. [ 838.001474][T21046] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3252'. [ 838.480245][T20608] veth0_vlan: entered promiscuous mode [ 838.541350][T20608] veth1_vlan: entered promiscuous mode [ 838.798289][T20608] veth0_macvtap: entered promiscuous mode [ 838.871107][T20608] veth1_macvtap: entered promiscuous mode [ 839.050271][T20608] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 839.105636][T20608] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 839.178548][ T9632] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 839.179061][ T9632] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 839.179105][ T9632] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 839.187167][ T1160] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 839.196269][ T5619] block nbd3: Receive control failed (result -32) [ 839.646454][T21086] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3257'. [ 839.736283][T21091] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3259'. [ 839.842404][T19398] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 839.842427][T19398] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 839.870000][T21095] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3261'. [ 840.161804][ T9632] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 840.161833][ T9632] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 840.295816][T21089] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3258'. [ 840.534369][T21109] netlink: 'syz.1.3180': attribute type 61 has an invalid length. [ 840.708001][T21112] syzkaller0: entered promiscuous mode [ 840.708028][T21112] syzkaller0: entered allmulticast mode [ 840.969767][T21120] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3268'. [ 841.246723][T21125] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3267'. [ 841.270917][T21125] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3267'. [ 841.382560][T19439] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 841.391311][T19439] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 841.401171][T19439] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 841.416173][T19439] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 841.420783][T19439] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 842.635923][T21155] __nla_validate_parse: 1 callbacks suppressed [ 842.635950][T21155] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3274'. [ 843.616333][ T5619] Bluetooth: hci0: command tx timeout [ 844.566379][T21185] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3278'. [ 844.890511][T21197] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3281'. [ 844.988208][T21201] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3283'. [ 845.348415][T21212] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3284'. [ 845.348456][T21212] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3284'. [ 845.551199][T21204] 8021q: adding VLAN 0 to HW filter on device bond2 [ 845.586629][T21204] bond1: (slave bond2): Enslaving as an active interface with an up link [ 845.693803][ T5619] Bluetooth: hci0: command tx timeout [ 845.713994][T21222] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3286'. [ 845.714033][T21222] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3286'. [ 845.722503][T21208] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 845.831528][T21228] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3286'. [ 845.831561][T21228] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3286'. [ 845.901583][ T1160] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 845.901690][ T1160] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 845.901752][ T1160] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 845.913704][T19398] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 845.996563][T21127] wlan0 speed is unknown, defaulting to 1000 [ 847.432316][T21269] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 847.529370][T21275] netlink: 'syz.4.3292': attribute type 30 has an invalid length. [ 847.600505][T21270] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 847.687195][T21282] __nla_validate_parse: 4 callbacks suppressed [ 847.687219][T21282] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3294'. [ 847.775020][ T5619] Bluetooth: hci0: command tx timeout [ 847.854524][T21286] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3293'. [ 847.986550][T21290] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3295'. [ 848.049050][T21290] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3295'. [ 848.193647][T21127] bridge0: port 1(bridge_slave_0) entered blocking state [ 848.194120][T21127] bridge0: port 1(bridge_slave_0) entered disabled state [ 848.194475][T21127] bridge_slave_0: entered allmulticast mode [ 848.202079][T21127] bridge_slave_0: entered promiscuous mode [ 848.246982][T21127] bridge0: port 2(bridge_slave_1) entered blocking state [ 848.247463][T21127] bridge0: port 2(bridge_slave_1) entered disabled state [ 848.247904][T21127] bridge_slave_1: entered allmulticast mode [ 848.276849][T21127] bridge_slave_1: entered promiscuous mode [ 848.459099][T21127] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 848.491235][T21127] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 848.678138][T21127] team0: Port device team_slave_0 added [ 848.702698][T21127] team0: Port device team_slave_1 added [ 848.825977][T21309] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3299'. [ 848.959273][T21309] 8021q: adding VLAN 0 to HW filter on device bond0 [ 848.998212][T21127] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 848.998232][T21127] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 848.998260][T21127] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 848.999506][T21309] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 848.999530][T21309] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 849.033953][T21127] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 849.034009][T21127] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 849.034092][T21127] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 849.236902][T21314] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3300'. [ 849.479606][T21127] hsr_slave_0: entered promiscuous mode [ 849.489040][T21127] hsr_slave_1: entered promiscuous mode [ 849.496724][T21127] debugfs: 'hsr0' already exists in 'hsr' [ 849.496751][T21127] Cannot create hsr debugfs directory [ 849.501493][T21322] syzkaller0: left promiscuous mode [ 849.501693][T21322] syzkaller0: left allmulticast mode [ 849.853663][ T5619] Bluetooth: hci0: command tx timeout [ 849.911089][T21334] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3305'. [ 849.971581][T21334] ovs-system: entered promiscuous mode [ 850.978465][T21342] bond8: (slave veth0_to_bond): Releasing active interface [ 851.010013][T21342] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 851.767296][T21374] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3315'. [ 851.905985][T21369] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3313'. [ 852.218081][T21374] team0: Port device team_slave_0 removed [ 852.441687][T21367] ip6gretap0: left promiscuous mode [ 853.108249][T21402] bridge0: port 3(syz_tun) entered blocking state [ 853.108434][T21402] bridge0: port 3(syz_tun) entered disabled state [ 853.108699][T21402] syz_tun: entered allmulticast mode [ 853.249064][T21402] syz_tun: entered promiscuous mode [ 853.472454][T21405] bridge0: port 4(ip6gretap0) entered blocking state [ 853.472563][T21405] bridge0: port 4(ip6gretap0) entered disabled state [ 853.472735][T21405] ip6gretap0: entered allmulticast mode [ 853.526981][T21405] ip6gretap0: entered promiscuous mode [ 854.435287][T21432] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3324'. [ 855.480574][T21127] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 855.543515][T21127] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 855.549413][T21127] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 855.633051][T21127] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 855.645103][T21127] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 855.728380][T21127] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 855.856337][T21127] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 855.894319][T21127] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 856.057869][T21455] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3328'. [ 856.733026][ C0] ip6_tunnel: ip6tnl5 xmit: Local address not yet configured! [ 856.792398][T21487] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3332'. [ 856.818819][ T9632] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x30 [ 856.921376][T21127] 8021q: adding VLAN 0 to HW filter on device bond0 [ 857.076782][T21127] 8021q: adding VLAN 0 to HW filter on device team0 [ 857.147328][ T134] bridge0: port 1(bridge_slave_0) entered blocking state [ 857.147450][ T134] bridge0: port 1(bridge_slave_0) entered forwarding state [ 857.262340][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 857.262450][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 857.908127][T21502] netpci0: tun_chr_ioctl cmd 1074025678 [ 857.908154][T21502] netpci0: group set to 0 [ 857.949964][T21502] SET target dimension over the limit! [ 858.109074][T21512] syzkaller0: entered promiscuous mode [ 858.109100][T21512] syzkaller0: entered allmulticast mode [ 859.984307][T21569] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3346'. [ 860.225723][T21579] xt_hashlimit: size too large, truncated to 1048576 [ 860.272717][T21127] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 860.762168][T21127] veth0_vlan: entered promiscuous mode [ 860.849311][T21127] veth1_vlan: entered promiscuous mode [ 860.947793][T21592] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3350'. [ 861.181702][T21127] veth0_macvtap: entered promiscuous mode [ 861.241672][T21127] veth1_macvtap: entered promiscuous mode [ 861.391641][T21127] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 861.468826][T21127] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 861.565827][T19398] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.565880][T19398] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.565934][T19398] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.565973][T19398] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.124744][T21611] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3352'. [ 862.165574][T21536] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 862.166130][T21547] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 862.293821][ T1160] IPVS: starting estimator thread 0... [ 862.384147][T21626] IPVS: using max 24 ests per chain, 57600 per kthread [ 862.788034][T21636] IPVS: sync thread started: state = MASTER, mcast_ifn = lo, syncid = 0, id = 0 [ 862.886718][ T134] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 862.886740][ T134] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 863.126451][ T134] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 863.126476][ T134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 863.133427][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 863.134164][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 863.136319][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 863.921307][T21664] Bluetooth: MGMT ver 1.23 [ 864.391065][T21664] mac80211_hwsim hwsim48 ..ãc¤±: renamed from wlan1 (while UP) [ 864.630562][T21683] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3358'. [ 864.630842][T21683] vlan1: entered promiscuous mode [ 864.631563][T21683] vlan1: entered allmulticast mode [ 864.631581][T21683] veth0_vlan: entered allmulticast mode [ 865.713568][T21705] netlink: 148 bytes leftover after parsing attributes in process `syz.3.3362'. [ 865.713751][T21705] netlink: 1 bytes leftover after parsing attributes in process `syz.3.3362'. [ 865.713796][T21705] netlink: 'syz.3.3362': attribute type 1 has an invalid length. [ 865.962423][T19439] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 865.980524][T19439] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 865.990665][T19439] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 866.008830][T19439] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 866.012051][T19439] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 866.707389][T21723] netlink: 'syz.2.3368': attribute type 1 has an invalid length. [ 866.785871][T21723] 8021q: adding VLAN 0 to HW filter on device bond3 [ 866.802218][T21719] netlink: 'syz.0.3366': attribute type 16 has an invalid length. [ 866.802245][T21719] netlink: 64138 bytes leftover after parsing attributes in process `syz.0.3366'. [ 867.043915][T21735] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3365'. [ 867.229113][T21728] bond3: (slave geneve2): making interface the new active one [ 867.251676][T21728] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 867.493849][ T159] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 867.495438][T21735] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 867.604939][T21735] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 867.615393][ C0] ip6_tunnel: ip6tnl6 xmit: Local address not yet configured! [ 867.784673][T21747] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3370'. [ 867.855697][T19883] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 867.855758][T19883] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 867.855795][T19883] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 868.136616][ T5619] Bluetooth: hci2: command tx timeout [ 869.080740][T21710] wlan0 speed is unknown, defaulting to 1000 [ 869.220273][T21782] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3376'. [ 869.546667][T21790] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 0, id = 0 [ 869.871999][T21794] ip_tables: iptables: counters copy to user failed while replacing table [ 870.180835][ C0] ip6_tunnel: ip6tnl7 xmit: Local address not yet configured! [ 870.877560][T21815] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3381'. [ 870.949011][T21801] netlink: 68 bytes leftover after parsing attributes in process `syz.3.3381'. [ 871.316806][T21823] openvswitch: netlink: Multiple metadata blocks provided [ 871.345631][T21823] netlink: 256 bytes leftover after parsing attributes in process `syz.0.3383'. [ 871.417594][T21821] netlink: 'syz.0.3383': attribute type 3 has an invalid length. [ 871.417935][T21821] netlink: 'syz.0.3383': attribute type 3 has an invalid length. [ 872.028894][T21830] block nbd4: server does not support multiple connections per device. [ 872.029319][T21830] block nbd4: shutting down sockets [ 872.788197][T21836] bridge0: port 1(bridge_slave_0) entered forwarding state [ 872.810845][T21710] bridge0: port 1(bridge_slave_0) entered blocking state [ 872.814572][T21710] bridge0: port 1(bridge_slave_0) entered disabled state [ 872.814786][T21710] bridge_slave_0: entered allmulticast mode [ 872.821348][T21710] bridge_slave_0: entered promiscuous mode [ 872.864655][T21710] bridge0: port 2(bridge_slave_1) entered blocking state [ 872.869818][T21710] bridge0: port 2(bridge_slave_1) entered disabled state [ 872.872490][T21710] bridge_slave_1: entered allmulticast mode [ 872.900782][T21710] bridge_slave_1: entered promiscuous mode [ 873.266101][T21710] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 873.284943][T21853] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3389'. [ 873.406993][T21861] ip_tables: iptables: counters copy to user failed while replacing table [ 873.474035][T21710] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 873.505334][T21859] ip_tables: iptables: counters copy to user failed while replacing table [ 873.957547][T21710] team0: Port device team_slave_0 added [ 873.971248][T21837] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 873.971275][T21837] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 874.008833][T21710] team0: Port device team_slave_1 added [ 874.456066][T21710] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 874.456087][T21710] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 874.456117][T21710] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 874.457569][T21837] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 874.457590][T21837] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 874.543694][T21710] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 874.543713][T21710] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 874.543743][T21710] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 874.667239][T21710] hsr_slave_0: entered promiscuous mode [ 874.668350][T21710] hsr_slave_1: entered promiscuous mode [ 874.669129][T21710] debugfs: 'hsr0' already exists in 'hsr' [ 874.669150][T21710] Cannot create hsr debugfs directory [ 874.944448][T21882] netlink: 'syz.0.3393': attribute type 1 has an invalid length. [ 875.048499][T21837] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 875.048527][T21837] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 875.620095][T21837] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 875.620124][T21837] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 875.791736][T21890] Bluetooth: hci0: invalid length 0, exp 2 for type 9 [ 876.357273][T21837] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 876.357302][T21837] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 877.066522][T21913] ip_tables: iptables: counters copy to user failed while replacing table [ 877.307855][T21710] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 877.392663][T21916] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 877.717224][T21710] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 877.761134][T21935] openvswitch: netlink: Unknown key attributes 1 [ 877.906927][T21710] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 878.251361][T21710] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 878.427453][T21957] ip_tables: iptables: counters copy to user failed while replacing table [ 878.688047][T21959] pim6reg: entered allmulticast mode [ 878.861695][T21967] xt_hashlimit: size too large, truncated to 1048576 [ 878.861720][T21967] xt_hashlimit: max too large, truncated to 1048576 [ 880.025622][T21987] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 880.116696][T21710] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 880.145382][T21997] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3420'. [ 880.145986][T21710] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 880.174592][T21710] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 880.192491][T21710] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 880.202272][T21710] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 880.207979][T21997] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3420'. [ 880.208045][T21997] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3420'. [ 880.258384][T21710] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 880.261016][T21710] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 880.300543][T21710] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 880.647003][T22012] ip_tables: iptables: counters copy to user failed while replacing table [ 880.811000][T22017] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3424'. [ 880.811057][T22017] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3424'. [ 880.811070][T22017] tipc: Invalid UDP bearer configuration [ 880.811104][T22017] tipc: Enabling of bearer rejected, failed to enable media [ 880.960676][T22016] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3425'. [ 885.256248][T22020] batman_adv: batadv0: Adding interface: dummy0 [ 885.256268][T22020] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 885.256304][T22020] batman_adv: batadv0: Interface activated: dummy0 [ 885.339432][T22024] batadv0: mtu less than device minimum [ 885.342105][T22024] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 885.344535][T22024] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 885.346118][T22024] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 885.347690][T22024] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 885.349229][T22024] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 885.350776][T22024] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 885.352401][T22024] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 885.353975][T22024] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 885.355548][T22024] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 885.940293][T21710] 8021q: adding VLAN 0 to HW filter on device bond0 [ 886.030688][T21710] 8021q: adding VLAN 0 to HW filter on device team0 [ 886.082842][ T9632] bridge0: port 1(bridge_slave_0) entered blocking state [ 886.082960][ T9632] bridge0: port 1(bridge_slave_0) entered forwarding state [ 886.302327][T22040] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 886.660329][T22040] bond1 (unregistering): Released all slaves [ 886.909739][T22047] syz_tun: entered allmulticast mode [ 886.920438][ T9632] bridge0: port 2(bridge_slave_1) entered blocking state [ 886.920564][ T9632] bridge0: port 2(bridge_slave_1) entered forwarding state [ 887.106872][T22043] syz_tun: left allmulticast mode [ 887.771444][T22080] syzkaller1: entered promiscuous mode [ 887.771472][T22080] syzkaller1: entered allmulticast mode [ 888.582747][T22118] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3441'. [ 888.768709][T22128] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3441'. [ 889.127337][T22125] syzkaller0: entered promiscuous mode [ 889.127550][T22125] syzkaller0: entered allmulticast mode [ 889.272433][T22125] tipc: Enabled bearer , priority 0 [ 889.456405][T22141] 8021q: adding VLAN 0 to HW filter on device bond1 [ 889.525692][T22124] tipc: Resetting bearer [ 889.558147][T22141] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3445'. [ 889.558176][T22141] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3445'. [ 889.735241][T22156] netlink: 'syz.1.3445': attribute type 2 has an invalid length. [ 889.735267][T22156] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3445'. [ 889.737603][T22124] tipc: Disabling bearer [ 889.849148][T22141] 8021q: adding VLAN 0 to HW filter on device bond0 [ 889.877541][T22141] bond1: (slave bond0): making interface the new active one [ 889.952569][T22161] netlink: 'syz.0.3446': attribute type 39 has an invalid length. [ 890.031266][T22141] bond1: (slave bond0): Enslaving as an active interface with an up link [ 890.227795][T22146] bond1 (unregistering): (slave bond0): Releasing active interface [ 890.244734][T22146] bond1 (unregistering): Released all slaves [ 890.356827][T22155] batadv_slave_0: entered promiscuous mode [ 890.379154][T22158] batadv_slave_0: left promiscuous mode [ 890.749699][T22180] bridge0: entered promiscuous mode [ 891.445636][T21710] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 891.551821][T22177] bridge0: left promiscuous mode [ 891.639594][T22214] net_ratelimit: 12 callbacks suppressed [ 891.639617][T22214] ip_tables: iptables: counters copy to user failed while replacing table [ 891.715504][T22213] syzkaller1: entered promiscuous mode [ 891.715528][T22213] syzkaller1: entered allmulticast mode [ 891.718502][T22218] raw_sendmsg: syz.0.3455 forgot to set AF_INET. Fix it! [ 892.337354][T22226] batman_adv: batadv0: Adding interface: gretap1 [ 892.337375][T22226] batman_adv: batadv0: The MTU of interface gretap1 is too small (1410) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 892.337412][T22226] batman_adv: batadv0: Interface activated: gretap1 [ 892.630676][T22249] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3461'. [ 892.647537][T22250] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3462'. [ 892.878177][T22257] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3463'. [ 893.119534][T21710] veth0_vlan: entered promiscuous mode [ 893.172353][T21710] veth1_vlan: entered promiscuous mode [ 893.379034][T21710] veth0_macvtap: entered promiscuous mode [ 893.421977][T21710] veth1_macvtap: entered promiscuous mode [ 893.620064][T21710] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 893.688019][T21710] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 893.794472][ T3322] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 893.794542][ T3322] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 893.794581][ T3322] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 893.794618][ T3322] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.190713][T22276] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3467'. [ 894.367553][T22284] ip_tables: iptables: counters copy to user failed while replacing table [ 894.658070][ T3356] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 894.658097][ T3356] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 895.315446][T22310] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 895.539696][ T3356] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 895.539723][ T3356] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 895.827337][T22317] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3474'. [ 895.902069][T22317] syzkaller1: entered promiscuous mode [ 895.902095][T22317] syzkaller1: entered allmulticast mode [ 896.107262][T22321] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3473'. [ 896.161274][T22324] bond0: option min_links: invalid value (18446744073709551615) [ 896.161305][T22324] bond0: option min_links: allowed values 0 - 2147483647 [ 896.161792][T22324] bond0: option min_links: invalid value (18446744073709551615) [ 896.161814][T22324] bond0: option min_links: allowed values 0 - 2147483647 [ 896.904052][T22338] ip_tables: iptables: counters copy to user failed while replacing table [ 897.501355][T22350] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3483'. [ 897.797949][T22315] bridge0: port 2(bridge_slave_1) entered disabled state [ 897.798646][T22315] bridge0: port 1(bridge_slave_0) entered disabled state [ 899.056922][T22374] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 899.201501][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201543][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201572][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201600][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201626][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201654][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201681][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201708][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201735][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201763][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201790][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201817][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201844][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201872][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201899][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201927][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201954][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.201981][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202009][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202036][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202063][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202090][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202117][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202145][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202172][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202208][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202235][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202262][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202288][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202315][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202342][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202369][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202397][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202424][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202452][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.202479][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361103][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361146][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361183][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361211][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361240][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361266][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361295][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361321][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361349][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361376][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361404][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.361432][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.487373][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.488431][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.489389][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.490362][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.491173][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.492099][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.492948][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.493916][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.494793][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.495771][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.496701][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.497699][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.508137][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.710771][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.710827][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.710855][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 899.710883][T22378] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 900.258895][T22315] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 900.367910][T22388] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3487'. [ 900.411024][T22388] netlink: 'syz.0.3487': attribute type 16 has an invalid length. [ 900.411049][T22388] netlink: 'syz.0.3487': attribute type 17 has an invalid length. [ 900.713651][T22392] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3487'. [ 901.493053][T19396] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 901.493109][T19396] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 901.493149][T19396] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 901.493189][T19396] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 901.996077][T22389] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3487'. [ 902.280501][T22409] netlink: 'syz.3.3491': attribute type 2 has an invalid length. [ 902.380197][T22409] : entered promiscuous mode [ 902.478918][T22412] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3492'. [ 902.507042][T22409] syzkaller1: entered promiscuous mode [ 902.507069][T22409] syzkaller1: entered allmulticast mode [ 902.581688][T22414] netlink: 47 bytes leftover after parsing attributes in process `syz.0.3492'. [ 902.581745][T22414] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3492'. [ 903.435312][T22432] pim6reg99999999: entered allmulticast mode [ 903.794750][T22442] lo: entered promiscuous mode [ 903.795760][T22442] tunl0: entered promiscuous mode [ 903.796789][T22442] gre0: entered promiscuous mode [ 903.797933][T22442] gretap0: entered promiscuous mode [ 903.799003][T22442] erspan0: entered promiscuous mode [ 903.800062][T22442] ip_vti0: entered promiscuous mode [ 903.801154][T22442] ip6_vti0: entered promiscuous mode [ 903.802200][T22442] sit0: entered promiscuous mode [ 903.813938][T22442] ip6tnl0: entered promiscuous mode [ 903.815038][T22442] ip6gre0: entered promiscuous mode [ 903.816623][T22442] syz_tun: entered promiscuous mode [ 903.819101][T22442] ip6gretap0: entered promiscuous mode [ 903.821198][T22442] bridge0: entered promiscuous mode [ 903.841437][T22442] vcan0: entered promiscuous mode [ 903.844142][T22442] bond0: entered promiscuous mode [ 903.844195][T22442] bond_slave_0: entered promiscuous mode [ 903.897840][T22442] bond_slave_1: entered promiscuous mode [ 903.901363][T22442] team0: entered promiscuous mode [ 903.901413][T22442] team_slave_0: entered promiscuous mode [ 903.916713][T22442] team_slave_1: entered promiscuous mode [ 903.926067][T22442] dummy0: entered promiscuous mode [ 903.929645][T22442] nlmon0: entered promiscuous mode [ 903.930959][T22442] batadv0: entered promiscuous mode [ 903.932061][T22442] vxcan0: entered promiscuous mode [ 903.958453][T22442] vxcan1: entered promiscuous mode [ 903.958618][T22442] veth0: entered promiscuous mode [ 903.958793][T22442] veth1: entered promiscuous mode [ 903.958960][T22442] wg0: entered promiscuous mode [ 903.959121][T22442] wg2: entered promiscuous mode [ 903.959307][T22442] veth0_to_bridge: entered promiscuous mode [ 903.959595][T22442] veth1_to_bridge: entered promiscuous mode [ 903.959887][T22442] veth0_to_bond: entered promiscuous mode [ 903.960191][T22442] veth1_to_bond: entered promiscuous mode [ 903.960525][T22442] veth0_to_team: entered promiscuous mode [ 903.960850][T22442] veth1_to_team: entered promiscuous mode [ 903.961244][T22442] veth0_to_batadv: entered promiscuous mode [ 903.961406][T22442] batadv_slave_0: entered promiscuous mode [ 903.961562][T22442] xfrm0: entered promiscuous mode [ 903.961735][T22442] veth0_to_hsr: entered promiscuous mode [ 903.962067][T22442] veth1_to_hsr: entered promiscuous mode [ 903.962366][T22442] hsr0: entered promiscuous mode [ 903.962526][T22442] veth1_virt_wifi: entered promiscuous mode [ 903.962729][T22442] veth0_virt_wifi: entered promiscuous mode [ 904.081131][T22442] virt_wifi0: entered promiscuous mode [ 904.081657][T22442] vlan0: entered promiscuous mode [ 904.082004][T22442] vlan1: entered promiscuous mode [ 904.082376][T22442] macvlan1: entered promiscuous mode [ 904.082545][T22442] ipvlan0: entered promiscuous mode [ 904.082711][T22442] ipvlan1: entered promiscuous mode [ 904.119687][T22442] macvtap0: entered promiscuous mode [ 904.119863][T22442] macsec0: entered promiscuous mode [ 904.120072][T22442] geneve0: entered promiscuous mode [ 904.120236][T22442] geneve1: entered promiscuous mode [ 904.120439][T22442] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 904.120587][T22442] netdevsim netdevsim3 netdevsim1: entered promiscuous mode [ 904.120726][T22442] netdevsim netdevsim3 netdevsim2: entered promiscuous mode [ 904.120861][T22442] netdevsim netdevsim3 netdevsim3: entered promiscuous mode [ 904.121006][T22442] mac80211_hwsim hwsim43 wlan0: entered promiscuous mode [ 904.121174][T22442] macvlan2: entered promiscuous mode [ 904.121345][T22442] gtp0: entered promiscuous mode [ 904.199278][T22442] syzkaller1: entered promiscuous mode [ 904.281747][ T3356] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 904.281771][ T3356] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 904.347656][ T3356] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 904.347682][ T3356] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 904.495225][T22447] openvswitch: netlink: Flow actions attr not present in new flow. [ 905.290668][T22471] netlink: 'syz.1.3506': attribute type 1 has an invalid length. [ 905.290694][T22471] netlink: 756 bytes leftover after parsing attributes in process `syz.1.3506'. [ 905.455152][T22474] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3507'. [ 905.580927][T22474] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3507'. [ 905.610378][T22474] ip6tnl1: entered allmulticast mode [ 905.764585][T22481] syzkaller0: entered promiscuous mode [ 905.764619][T22481] syzkaller0: entered allmulticast mode [ 905.771237][T22481] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3508'. [ 905.793463][ T1160] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 905.803508][ T1160] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 905.803639][ T1160] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 905.803737][ T1160] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 905.846284][T22481] unsupported nlmsg_type 40 [ 905.927343][ T31] audit: type=1800 audit(1790748819.286:3): pid=22485 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3512" name="memory.events" dev="tmpfs" ino=358 res=0 errno=0 [ 905.930133][ T31] audit: type=1804 audit(1790748819.286:4): pid=22485 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.3512" name="/newroot/67/memory.events" dev="tmpfs" ino=358 res=1 errno=0 [ 906.537693][T22504] ip_tables: iptables: counters copy to user failed while replacing table [ 906.682549][T22509] nbd4: detected capacity change from 0 to 63 [ 906.701409][T22501] syzkaller1: entered promiscuous mode [ 906.701654][T22501] syzkaller1: entered allmulticast mode [ 906.934339][ T5619] block nbd4: Receive control failed (result -104) [ 907.051043][T22523] netlink: 'syz.3.3520': attribute type 1 has an invalid length. [ 907.920594][T22532] syz.3.3520 (22532) used obsolete PPPIOCDETACH ioctl [ 908.027896][T22527] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3519'. [ 908.374658][T22552] netlink: 'syz.1.3522': attribute type 12 has an invalid length. [ 908.374687][T22552] netlink: 'syz.1.3522': attribute type 29 has an invalid length. [ 908.374703][T22552] netlink: 148 bytes leftover after parsing attributes in process `syz.1.3522'. [ 908.847378][T22560] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3524'. [ 911.349329][T22570] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3527'. [ 911.441547][T22576] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3526'. [ 911.484692][T22572] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3527'. [ 912.197632][T22598] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3532'. [ 912.746324][T22613] netlink: 7 bytes leftover after parsing attributes in process `syz.3.3535'. [ 913.018126][T22619] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3536'. [ 913.018151][T22619] netlink: 356 bytes leftover after parsing attributes in process `syz.2.3536'. [ 913.018167][T22619] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3536'. [ 913.018188][T22619] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3536'. [ 913.437035][T22623] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 913.888894][T22633] netlink: 'syz.0.3539': attribute type 1 has an invalid length. [ 913.921840][T22633] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3539'. [ 913.969661][T22636] nbd: socks must be embedded in a SOCK_ITEM attr [ 913.981454][T22634] nbd: socks must be embedded in a SOCK_ITEM attr [ 914.626928][T22588] udevd[22588]: inotify_add_watch(7, /dev/nbd6, 10) failed: No such file or directory [ 914.671526][T22586] udevd[22586]: inotify_add_watch(7, /dev/nbd5, 10) failed: No such file or directory [ 914.706324][T22650] netlink: 'syz.2.3543': attribute type 12 has an invalid length. [ 915.634152][T22682] bridge0: port 2(bridge_slave_1) entered disabled state [ 915.635519][T22682] bridge0: port 1(bridge_slave_0) entered disabled state [ 916.897006][T22716] __nla_validate_parse: 3 callbacks suppressed [ 916.897031][T22716] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3556'. [ 916.902011][T22716] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 916.902553][T22716] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 917.496087][T22727] netlink: 'syz.2.3558': attribute type 4 has an invalid length. [ 917.721588][T22726] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3557'. [ 919.539261][T22771] netlink: 'syz.3.3568': attribute type 1 has an invalid length. [ 920.609561][T22796] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3575'. [ 920.641061][T22796] bond0: (slave bond_slave_0): Releasing backup interface [ 920.727787][T22796] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 920.790267][T22801] syzkaller0: entered promiscuous mode [ 920.790308][T22801] syzkaller0: entered allmulticast mode [ 921.008589][T22801] tipc: Started in network mode [ 921.008627][T22801] tipc: Node identity 025e6fc3c36d, cluster identity 4711 [ 921.008972][T22801] tipc: Enabled bearer , priority 0 [ 921.011854][T22801] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3577'. [ 921.089006][T22798] tipc: Resetting bearer [ 921.145566][T22798] tipc: Disabling bearer [ 921.373655][ C0] ip6_tunnel: ip6tnl5 xmit: Local address not yet configured! [ 921.560765][T22823] netlink: 'syz.1.3583': attribute type 2 has an invalid length. [ 921.694424][T22824] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3581'. [ 921.826821][T22836] netlink: 'syz.1.3585': attribute type 1 has an invalid length. [ 921.826846][T22836] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3585'. [ 921.826863][T22836] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3585'. [ 922.568433][T22853] xt_TCPMSS: Only works on TCP SYN packets [ 922.625673][T22857] ip6gretap1: entered allmulticast mode [ 922.695666][T22857] batman_adv: batadv0: Adding interface: ip6gretap1 [ 922.695686][T22857] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 922.695718][T22857] batman_adv: batadv0: Interface activated: ip6gretap1 [ 923.178620][T22873] –: renamed from virt_wifi0 (while UP) [ 923.536810][T22861] wlan0 speed is unknown, defaulting to 1000 [ 924.635464][T22906] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3594'. [ 925.290648][T22917] netlink: 'syz.3.3596': attribute type 20 has an invalid length. [ 925.290672][T22917] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3596'. [ 925.480681][T22917] netlink: 'syz.3.3596': attribute type 20 has an invalid length. [ 925.480704][T22917] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3596'. [ 925.513416][ T159] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 925.513464][ T159] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 925.513502][ T159] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 925.524002][ T1160] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 925.649924][T19439] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 925.667655][T19439] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 925.704458][T19439] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 925.708902][T19439] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 925.714535][T19439] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 925.828205][T22924] tap0: tun_chr_ioctl cmd 35108 [ 925.910310][T22924] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 925.910340][T22924] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 925.970630][T22924] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 925.970656][T22924] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 926.503078][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 926.906742][T22944] netlink: 'syz.3.3601': attribute type 1 has an invalid length. [ 927.310285][ T9632] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 927.741797][T22978] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3605'. [ 927.774681][ T5619] Bluetooth: hci3: command tx timeout [ 929.854249][T19439] Bluetooth: hci3: command tx timeout [ 931.613774][ C1] ip6_tunnel: ip6tnl3 xmit: Local address not yet configured! [ 931.614066][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 931.740438][T22999] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 931.756238][T22999] Bluetooth: MGMT ver 1.23 [ 931.871535][ T9632] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 931.935669][T19439] Bluetooth: hci3: command tx timeout [ 932.054454][T22922] wlan0 speed is unknown, defaulting to 1000 [ 932.256498][T23024] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3615'. [ 932.300525][ T9632] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 932.412221][T23010] netlink: 'syz.0.3616': attribute type 2 has an invalid length. [ 932.768258][T23028] bond1 (unregistering): Released all slaves [ 933.039735][ T9632] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 933.130186][T23034] pim6reg: entered allmulticast mode [ 933.430947][T23031] pim6reg: left allmulticast mode [ 933.898500][T23048] IPVS: set_ctl: invalid protocol: 59 172.20.20.187:20003 [ 933.932177][T23048] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3621'. [ 934.024561][T19439] Bluetooth: hci3: command tx timeout [ 934.058757][T23056] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3618'. [ 934.136702][T23060] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3618'. [ 935.348668][ T9632] bridge_slave_1: left allmulticast mode [ 935.348699][ T9632] bridge_slave_1: left promiscuous mode [ 935.351170][ T9632] bridge0: port 2(bridge_slave_1) entered disabled state [ 935.391927][ T9632] bridge_slave_0: left allmulticast mode [ 935.391956][ T9632] bridge_slave_0: left promiscuous mode [ 935.395106][ T9632] bridge0: port 1(bridge_slave_0) entered disabled state [ 935.604352][T23091] netlink: 100 bytes leftover after parsing attributes in process `syz.2.3627'. [ 936.049628][T23106] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3626'. [ 936.151433][T23113] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3626'. [ 936.220187][T23114] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 936.545817][ T9632] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 936.566111][ T9632] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 936.588981][ T9632] bond0 (unregistering): Released all slaves [ 936.685028][T23106] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3626'. [ 936.733190][ C0] ip6_tunnel: ip6tnl7 xmit: Local address not yet configured! [ 936.733884][ C0] ip6_tunnel: ip6tnl6 xmit: Local address not yet configured! [ 936.911433][T23101] syzkaller1: entered promiscuous mode [ 936.911466][T23101] syzkaller1: entered allmulticast mode [ 937.280047][T23135] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3635'. [ 937.382841][ T1706] block nbd4: Possible stuck request ffff888027005080: control (read@0,1024B). Runtime 30 seconds [ 937.385718][ T1706] block nbd4: Possible stuck request ffff888027005240: control (read@1024,1024B). Runtime 30 seconds [ 937.385757][ T1706] block nbd4: Possible stuck request ffff888027005400: control (read@2048,1024B). Runtime 30 seconds [ 937.385787][ T1706] block nbd4: Possible stuck request ffff8880270055c0: control (read@3072,1024B). Runtime 30 seconds [ 938.122484][T23159] Bluetooth: hci0: unsupported parameter 5135 [ 938.122531][T23159] Bluetooth: hci0: unsupported parameter 8192 [ 938.122547][T23159] Bluetooth: hci0: unsupported parameter 5135 [ 938.122561][T23159] Bluetooth: hci0: unsupported parameter 8192 [ 938.526288][T22922] bridge0: port 1(bridge_slave_0) entered blocking state [ 938.526871][T22922] bridge0: port 1(bridge_slave_0) entered disabled state [ 938.527231][T22922] bridge_slave_0: entered allmulticast mode [ 938.567021][T22922] bridge_slave_0: entered promiscuous mode [ 938.841514][ T9632] hsr_slave_0: left promiscuous mode [ 938.866022][ T9632] hsr_slave_1: left promiscuous mode [ 938.867096][ T9632] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 938.867178][ T9632] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 938.890566][ T9632] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 938.890591][ T9632] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 939.052126][ T9632] veth1_macvtap: left promiscuous mode [ 939.052202][ T9632] veth0_macvtap: left promiscuous mode [ 939.052316][ T9632] veth1_vlan: left promiscuous mode [ 939.052406][ T9632] veth0_vlan: left promiscuous mode [ 940.836462][ T9632] team0 (unregistering): Port device team_slave_1 removed [ 940.879976][ T9632] team0 (unregistering): Port device team_slave_0 removed [ 941.372103][T22922] bridge0: port 2(bridge_slave_1) entered blocking state [ 941.372599][T22922] bridge0: port 2(bridge_slave_1) entered disabled state [ 941.372947][T22922] bridge_slave_1: entered allmulticast mode [ 941.399682][T22922] bridge_slave_1: entered promiscuous mode [ 941.417635][ T5281] 8021q: adding VLAN 0 to HW filter on device eth1 [ 941.827192][T22922] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 942.150836][T22922] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 947.815288][T22922] team0: Port device team_slave_0 added [ 948.029955][T23270] netlink: 'syz.0.3655': attribute type 29 has an invalid length. [ 948.029982][T23270] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3655'. [ 948.035577][T22922] team0: Port device team_slave_1 added [ 948.330994][T22922] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 948.331014][T22922] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 948.331043][T22922] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 948.350495][T22922] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 948.350515][T22922] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 948.350546][T22922] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 948.674419][T23282] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3657'. [ 948.674447][T23282] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3657'. [ 948.674610][T23282] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3657'. [ 948.674627][T23282] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3657'. [ 948.748242][T22922] hsr_slave_0: entered promiscuous mode [ 948.761176][T22922] hsr_slave_1: entered promiscuous mode [ 948.762077][T22922] debugfs: 'hsr0' already exists in 'hsr' [ 948.762100][T22922] Cannot create hsr debugfs directory [ 949.511566][ T9632] IPVS: starting estimator thread 0... [ 949.599745][T23312] IPVS: using max 23 ests per chain, 55200 per kthread [ 950.612692][T23320] ref_ctr_offset mismatch. inode: 0x46 offset: 0x0 ref_ctr_offset(old): 0x300000006 ref_ctr_offset(new): 0x0 [ 951.119579][ T5281] 8021q: adding VLAN 0 to HW filter on device eth2 [ 951.167700][T23327] ip_tables: iptables: counters copy to user failed while replacing table [ 952.978269][T23362] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3672'. [ 953.007040][T23362] netlink: 1 bytes leftover after parsing attributes in process `syz.0.3672'. [ 953.007081][T23362] netlink: 'syz.0.3672': attribute type 1 has an invalid length. [ 953.101914][T23363] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3673'. [ 953.251987][T23369] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3676'. [ 953.914886][T23382] batman_adv: batadv0: Adding interface: macvlan2 [ 953.914907][T23382] batman_adv: batadv0: The MTU of interface macvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 953.914943][T23382] batman_adv: batadv0: Interface activated: macvlan2 [ 953.914961][T23382] batadv0: mtu less than device minimum [ 953.918617][T23382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 953.920066][T23382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 953.921427][T23382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 953.933281][T23382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 953.937226][T23382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 953.939478][T23382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 953.943317][T23382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 953.947229][T23382] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 954.192531][T22922] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 954.250624][T22922] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 954.271891][T22922] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 954.305565][T22922] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 954.327661][T22922] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 954.374520][T22922] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 954.427286][T22922] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 954.496115][T22922] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 954.946804][T23416] ip6gretap1: entered allmulticast mode [ 954.979448][T23416] batman_adv: batadv0: Adding interface: ip6gretap1 [ 954.979479][T23416] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 954.979514][T23416] batman_adv: batadv0: Interface activated: ip6gretap1 [ 955.225360][T22922] 8021q: adding VLAN 0 to HW filter on device bond0 [ 955.409246][T22922] 8021q: adding VLAN 0 to HW filter on device team0 [ 955.507633][T23436] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3684'. [ 955.521074][T19398] bridge0: port 1(bridge_slave_0) entered blocking state [ 955.521424][T19398] bridge0: port 1(bridge_slave_0) entered forwarding state [ 955.941856][ T9632] bridge0: port 2(bridge_slave_1) entered blocking state [ 955.941977][ T9632] bridge0: port 2(bridge_slave_1) entered forwarding state [ 956.694590][T23470] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3691'. [ 956.765769][T23474] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3692'. [ 956.789694][T23470] syz_tun (unregistering): left allmulticast mode [ 956.789728][T23470] syz_tun (unregistering): left promiscuous mode [ 956.789874][T23470] bridge0: port 3(syz_tun) entered disabled state [ 957.312116][T23479] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3693'. [ 957.312658][T23479] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3693'. [ 957.313390][T23479] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3693'. [ 957.313920][T23479] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3693'. [ 957.314381][T23479] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3693'. [ 958.572308][T23512] netlink: 'syz.2.3696': attribute type 21 has an invalid length. [ 958.572334][T23512] __nla_validate_parse: 20 callbacks suppressed [ 958.572347][T23512] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3696'. [ 958.572428][T23512] netlink: 'syz.2.3696': attribute type 4 has an invalid length. [ 958.572443][T23512] netlink: 'syz.2.3696': attribute type 3 has an invalid length. [ 958.572457][T23512] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3696'. [ 958.596861][T23512] netlink: 'syz.2.3696': attribute type 21 has an invalid length. [ 958.596941][T23512] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3696'. [ 958.597090][T23512] netlink: 'syz.2.3696': attribute type 4 has an invalid length. [ 958.597130][T23512] netlink: 'syz.2.3696': attribute type 3 has an invalid length. [ 958.597172][T23512] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3696'. [ 958.597943][T23512] netlink: 'syz.2.3696': attribute type 21 has an invalid length. [ 958.597984][T23512] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3696'. [ 958.598082][T23512] netlink: 'syz.2.3696': attribute type 4 has an invalid length. [ 958.598121][T23512] netlink: 'syz.2.3696': attribute type 3 has an invalid length. [ 958.598154][T23512] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3696'. [ 958.598909][T23512] netlink: 'syz.2.3696': attribute type 21 has an invalid length. [ 958.598923][T23512] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3696'. [ 958.598966][T23512] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3696'. [ 958.599289][T23512] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3696'. [ 958.599333][T23512] netlink: 3 bytes leftover after parsing attributes in process `syz.2.3696'. [ 959.544642][T23516] wlan0 speed is unknown, defaulting to 1000 [ 960.169801][T22922] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 960.754538][T23545] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 961.070071][T23560] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 962.778459][T23581] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 963.069822][T23581] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 963.218265][T23613] 8021q: adding VLAN 0 to HW filter on device bond2 [ 963.220636][T23613] bond1: (slave bond2): making interface the new active one [ 963.221280][T23613] bond1: (slave bond2): Enslaving as an active interface with an up link [ 963.289857][T23581] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 963.332171][T23610] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 963.352553][T23613] 8021q: adding VLAN 0 to HW filter on device bond1 [ 963.365044][T22922] veth0_vlan: entered promiscuous mode [ 963.437004][T23581] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 963.505018][T22922] veth1_vlan: entered promiscuous mode [ 963.641229][T22922] veth0_macvtap: entered promiscuous mode [ 963.658611][T22922] veth1_macvtap: entered promiscuous mode [ 963.688070][T22922] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 963.702549][T22922] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 963.733738][ T3322] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 963.733795][ T3322] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 963.733837][ T3322] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 963.733878][ T3322] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.188613][T23621] __nla_validate_parse: 85 callbacks suppressed [ 964.188647][T23621] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3714'. [ 964.404791][ T13] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.660546][ T9632] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 964.660572][ T9632] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 964.684364][ T9632] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.697388][T23633] validate_nla: 31 callbacks suppressed [ 964.697408][T23633] netlink: 'syz.3.3717': attribute type 1 has an invalid length. [ 964.752671][ T134] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 964.760745][T23641] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3717'. [ 964.875614][T23633] bond3: entered promiscuous mode [ 964.878604][T23633] 8021q: adding VLAN 0 to HW filter on device bond3 [ 964.935811][T23635] 8021q: adding VLAN 0 to HW filter on device bond3 [ 964.936235][T23635] bond3: (slave gre1): The slave device specified does not support setting the MAC address [ 964.936256][T23635] bond3: (slave gre1): Setting fail_over_mac to active for active-backup mode [ 964.979479][T23635] bond3: (slave gre1): making interface the new active one [ 964.979507][T23635] gre1: entered promiscuous mode [ 964.981149][T23635] bond3: (slave gre1): Enslaving as an active interface with an up link [ 964.985798][T23649] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3720'. [ 965.048801][T23641] bond3 (unregistering): (slave gre1): Releasing backup interface [ 965.048831][T23641] gre1: left promiscuous mode [ 965.068816][T23641] bond3 (unregistering): Released all slaves [ 965.219020][ T134] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 965.219046][ T134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 965.245577][ T134] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 965.338728][T23654] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3721'. [ 965.619995][T23661] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3724'. [ 965.620024][T23661] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3724'. [ 965.620042][T23661] netlink: 'syz.3.3724': attribute type 5 has an invalid length. [ 965.620067][T23661] netlink: 43 bytes leftover after parsing attributes in process `syz.3.3724'. [ 965.786794][T23665] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3727'. [ 965.810982][T23665] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3727'. [ 965.837832][T23665] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 966.855448][T23696] netlink: 1004 bytes leftover after parsing attributes in process `syz.2.3736'. [ 967.465594][ T1706] block nbd4: Possible stuck request ffff888027005080: control (read@0,1024B). Runtime 60 seconds [ 967.465652][ T1706] block nbd4: Possible stuck request ffff888027005240: control (read@1024,1024B). Runtime 60 seconds [ 967.465686][ T1706] block nbd4: Possible stuck request ffff888027005400: control (read@2048,1024B). Runtime 60 seconds [ 967.465716][ T1706] block nbd4: Possible stuck request ffff8880270055c0: control (read@3072,1024B). Runtime 60 seconds [ 969.505230][ T4986] udevd[4986]: worker [22512] /devices/virtual/block/nbd4 is taking a long time [ 970.716349][T23731] netlink: 'syz.4.3744': attribute type 21 has an invalid length. [ 970.766080][T23733] net_ratelimit: 31 callbacks suppressed [ 970.766104][T23733] openvswitch: netlink: Mixed IPv4 and IPv6 tunnel attributes [ 970.815323][T23736] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3746'. [ 970.843229][T23736] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3746'. [ 971.068790][T23743] sctp: [Deprecated]: syz.3.3748 (pid 23743) Use of struct sctp_assoc_value in delayed_ack socket option. [ 971.068790][T23743] Use struct sctp_sack_info instead [ 971.130783][T23746] netlink: 'syz.4.3750': attribute type 1 has an invalid length. [ 971.279775][T23752] xt_CONNSECMARK: invalid mode: 254 [ 971.362096][T23756] netlink: 'syz.0.3755': attribute type 1 has an invalid length. [ 971.587618][T23756] 8021q: adding VLAN 0 to HW filter on device bond1 [ 971.712004][T23757] bond1: entered allmulticast mode [ 971.715952][T23768] FAULT_INJECTION: forcing a failure. [ 971.715952][T23768] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 971.715990][T23768] CPU: 0 UID: 0 PID: 23768 Comm: syz.4.3756 Not tainted syzkaller #0 PREEMPT(full) [ 971.716017][T23768] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 971.716031][T23768] Call Trace: [ 971.716041][T23768] [ 971.716051][T23768] dump_stack_lvl+0xe8/0x150 [ 971.716094][T23768] should_fail_ex+0x410/0x560 [ 971.716137][T23768] _copy_from_user+0x2d/0xb0 [ 971.716171][T23768] kstrtouint_from_user+0xd6/0x180 [ 971.716201][T23768] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 971.716241][T23768] ? lock_acquire+0x115/0x350 [ 971.716274][T23768] proc_fail_nth_write+0x8e/0x210 [ 971.716301][T23768] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 971.716336][T23768] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 971.716361][T23768] vfs_write+0x296/0xba0 [ 971.716410][T23768] ? __pfx_vfs_write+0x10/0x10 [ 971.716457][T23768] ? __fget_files+0x2a/0x420 [ 971.716495][T23768] ? __fget_files+0x3a2/0x420 [ 971.716527][T23768] ? __fget_files+0x2a/0x420 [ 971.716570][T23768] ksys_write+0x150/0x270 [ 971.716609][T23768] ? __pfx_ksys_write+0x10/0x10 [ 971.716658][T23768] do_syscall_64+0x166/0x520 [ 971.716692][T23768] ? trace_irq_disable+0x3b/0x140 [ 971.716715][T23768] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 971.716741][T23768] ? clear_bhb_loop+0x70/0xc0 [ 971.716769][T23768] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 971.716793][T23768] RIP: 0033:0x7fb53355e98e [ 971.716814][T23768] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 971.716833][T23768] RSP: 002b:00007fb534434fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 971.716859][T23768] RAX: ffffffffffffffda RBX: 00007fb5344356c0 RCX: 00007fb53355e98e [ 971.716877][T23768] RDX: 0000000000000001 RSI: 00007fb5344350a0 RDI: 0000000000000004 [ 971.716891][T23768] RBP: 00007fb534435090 R08: 0000000000000000 R09: 0000000000000000 [ 971.716906][T23768] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 971.716920][T23768] R13: 00007fb533826038 R14: 00007fb533825fa0 R15: 00007fff3a7041e8 [ 971.716959][T23768] [ 971.718227][T23757] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3755'. [ 972.036626][T23772] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3757'. [ 972.738373][T23784] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3760'. [ 972.760106][T23783] syzkaller0: entered promiscuous mode [ 972.760131][T23783] syzkaller0: entered allmulticast mode [ 972.916844][T23791] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3761'. [ 974.351140][T23834] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3773'. [ 974.351181][T23834] netlink: 'syz.3.3773': attribute type 30 has an invalid length. [ 974.351200][T23834] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3773'. [ 975.367329][T23857] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3780'. [ 975.370468][T23857] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3780'. [ 975.860578][T23871] __nla_validate_parse: 2 callbacks suppressed [ 975.860605][T23871] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3783'. [ 976.000048][T23878] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3785'. [ 976.000317][T23878] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 976.036720][T23878] netlink: 'syz.4.3785': attribute type 2 has an invalid length. [ 976.036747][T23878] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3785'. [ 976.090965][T23880] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3785'. [ 976.095363][T23880] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3785'. [ 976.095413][T23880] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3785'. [ 976.095431][T23880] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3785'. [ 977.036140][T23890] ip_tables: iptables: counters copy to user failed while replacing table [ 977.083423][T23878] : entered promiscuous mode [ 977.084901][T23885] FAULT_INJECTION: forcing a failure. [ 977.084901][T23885] name failslab, interval 1, probability 0, space 0, times 0 [ 977.084935][T23885] CPU: 0 UID: 0 PID: 23885 Comm: syz.3.3787 Not tainted syzkaller #0 PREEMPT(full) [ 977.084960][T23885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 977.084974][T23885] Call Trace: [ 977.084983][T23885] [ 977.084993][T23885] dump_stack_lvl+0xe8/0x150 [ 977.085034][T23885] should_fail_ex+0x410/0x560 [ 977.085066][T23885] ? __alloc_skb+0x1db/0x7a0 [ 977.085096][T23885] should_failslab+0xa8/0x100 [ 977.085128][T23885] ? __alloc_skb+0x1db/0x7a0 [ 977.085153][T23885] kmem_cache_alloc_node_noprof+0xa1/0x610 [ 977.085189][T23885] ? __alloc_skb+0x18d/0x7a0 [ 977.085218][T23885] ? __alloc_skb+0x1db/0x7a0 [ 977.085253][T23885] __alloc_skb+0x1db/0x7a0 [ 977.085285][T23885] netlink_dump+0x1e7/0xee0 [ 977.085441][T23885] ? __pfx_netlink_dump+0x10/0x10 [ 977.085498][T23885] ? netlink_recvmsg+0x5bf/0xa50 [ 977.085520][T23885] ? kmem_cache_free+0x182/0x650 [ 977.085553][T23885] netlink_recvmsg+0x683/0xa50 [ 977.085587][T23885] ? __pfx_netlink_recvmsg+0x10/0x10 [ 977.085608][T23885] ? lock_acquire+0x115/0x350 [ 977.085638][T23885] ? __lock_acquire+0x747/0x2de0 [ 977.085670][T23885] ? __pfx_netlink_recvmsg+0x10/0x10 [ 977.085695][T23885] sock_recvmsg_nosec+0x130/0x170 [ 977.085724][T23885] ____sys_recvmsg+0x3e3/0x4a0 [ 977.085772][T23885] ? __pfx_____sys_recvmsg+0x10/0x10 [ 977.085823][T23885] ? import_iovec+0x73/0xa0 [ 977.085859][T23885] ___sys_recvmsg+0x213/0x5a0 [ 977.085899][T23885] ? __pfx____sys_recvmsg+0x10/0x10 [ 977.085938][T23885] ? lock_acquire+0x115/0x350 [ 977.085998][T23885] do_recvmmsg+0x31a/0x7f0 [ 977.086041][T23885] ? __pfx_do_recvmmsg+0x10/0x10 [ 977.086089][T23885] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 977.086123][T23885] ? __fget_files+0x3a2/0x420 [ 977.086168][T23885] __x64_sys_recvmmsg+0x198/0x250 [ 977.086204][T23885] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 977.086252][T23885] do_syscall_64+0x166/0x520 [ 977.086280][T23885] ? trace_irq_disable+0x3b/0x140 [ 977.086303][T23885] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 977.086327][T23885] ? clear_bhb_loop+0x70/0xc0 [ 977.086357][T23885] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 977.086379][T23885] RIP: 0033:0x7ff1e5f9e159 [ 977.086399][T23885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 977.086418][T23885] RSP: 002b:00007ff1e6d82028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 977.086441][T23885] RAX: ffffffffffffffda RBX: 00007ff1e6225fa0 RCX: 00007ff1e5f9e159 [ 977.086465][T23885] RDX: 0000000000000300 RSI: 0000200000000e00 RDI: 0000000000000003 [ 977.086479][T23885] RBP: 00007ff1e6d82090 R08: 0000000000000000 R09: 0000000000000000 [ 977.086492][T23885] R10: 0000000000034000 R11: 0000000000000246 R12: 0000000000000002 [ 977.086505][T23885] R13: 00007ff1e6226038 R14: 00007ff1e6225fa0 R15: 00007ffe5eb0df48 [ 977.086543][T23885] [ 977.599124][T23899] block nbd0: reconnected socket [ 977.599776][T23899] block nbd0: reconnected socket [ 977.622275][T23899] netlink: 'syz.4.3792': attribute type 9 has an invalid length. [ 977.820886][T23904] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3791'. [ 978.419136][ T5619] block nbd0: Receive control failed (result -32) [ 978.421606][T19439] block nbd0: Receive control failed (result -32) [ 978.469491][T19396] bond5 (unregistering): (slave geneve4): Releasing backup interface [ 978.496516][T19396] bond4 (unregistering): (slave geneve3): Releasing active interface [ 978.566720][T19396] bond3 (unregistering): (slave bridge1): Releasing backup interface [ 978.650179][T19396] bond0 (unregistering): Released all slaves [ 978.677801][T19396] bond1 (unregistering): Released all slaves [ 978.711776][T19396] bond2 (unregistering): Released all slaves [ 978.737076][T19396] bond3 (unregistering): Released all slaves [ 978.768429][T19396] bond4 (unregistering): Released all slaves [ 978.790239][T19396] bond5 (unregistering): Released all slaves [ 978.832087][T19396] bond6 (unregistering): Released all slaves [ 978.858599][T19396] bond7 (unregistering): Released all slaves [ 978.892338][T19396] bond8 (unregistering): Released all slaves [ 979.229042][T23918] IPv6: Can't replace route, no match found [ 979.229303][T23918] IPv6: Can't replace route, no match found [ 979.370085][T19396] ovs-s!: left promiscuous mode [ 979.540032][T19396] ´: left promiscuous mode [ 979.632934][T23930] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3798'. [ 979.748413][T19396] tipc: Disabling bearer [ 979.804817][T19396] tipc: Left network mode [ 979.960003][T23938] bridge1: entered allmulticast mode [ 979.976088][T23929] FAULT_INJECTION: forcing a failure. [ 979.976088][T23929] name failslab, interval 1, probability 0, space 0, times 0 [ 979.976124][T23929] CPU: 0 UID: 0 PID: 23929 Comm: syz.0.3800 Not tainted syzkaller #0 PREEMPT(full) [ 979.976150][T23929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 979.976165][T23929] Call Trace: [ 979.976174][T23929] [ 979.976183][T23929] dump_stack_lvl+0xe8/0x150 [ 979.976222][T23929] should_fail_ex+0x410/0x560 [ 979.976255][T23929] should_failslab+0xa8/0x100 [ 979.976285][T23929] ? skb_clone+0x212/0x3a0 [ 979.976319][T23929] kmem_cache_alloc_noprof+0xa1/0x600 [ 979.976358][T23929] ? skb_clone+0x212/0x3a0 [ 979.976398][T23929] skb_clone+0x212/0x3a0 [ 979.976435][T23929] __netlink_deliver_tap+0x355/0x6e0 [ 979.976485][T23929] ? netlink_deliver_tap+0x2e/0x1b0 [ 979.976524][T23929] netlink_deliver_tap+0x19c/0x1b0 [ 979.976562][T23929] netlink_dump+0x95b/0xee0 [ 979.976610][T23929] ? __pfx_netlink_dump+0x10/0x10 [ 979.976659][T23929] ? netlink_recvmsg+0x5bf/0xa50 [ 979.976680][T23929] ? kmem_cache_free+0x182/0x650 [ 979.976713][T23929] netlink_recvmsg+0x683/0xa50 [ 979.976755][T23929] ? __pfx_netlink_recvmsg+0x10/0x10 [ 979.976777][T23929] ? lock_acquire+0x115/0x350 [ 979.976805][T23929] ? __lock_acquire+0x747/0x2de0 [ 979.976837][T23929] ? __pfx_netlink_recvmsg+0x10/0x10 [ 979.976862][T23929] sock_recvmsg_nosec+0x130/0x170 [ 979.976890][T23929] ____sys_recvmsg+0x3e3/0x4a0 [ 979.976934][T23929] ? __pfx_____sys_recvmsg+0x10/0x10 [ 979.976985][T23929] ? import_iovec+0x73/0xa0 [ 979.977020][T23929] ___sys_recvmsg+0x213/0x5a0 [ 979.977060][T23929] ? __pfx____sys_recvmsg+0x10/0x10 [ 979.977099][T23929] ? lock_acquire+0x115/0x350 [ 979.977159][T23929] do_recvmmsg+0x31a/0x7f0 [ 979.977202][T23929] ? __pfx_do_recvmmsg+0x10/0x10 [ 979.977254][T23929] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 979.977287][T23929] ? __fget_files+0x3a2/0x420 [ 979.977333][T23929] __x64_sys_recvmmsg+0x198/0x250 [ 979.977370][T23929] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 979.977418][T23929] do_syscall_64+0x166/0x520 [ 979.977447][T23929] ? trace_irq_disable+0x3b/0x140 [ 979.977470][T23929] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 979.977495][T23929] ? clear_bhb_loop+0x70/0xc0 [ 979.977523][T23929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 979.977547][T23929] RIP: 0033:0x7fdd05d9e159 [ 979.977567][T23929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 979.977587][T23929] RSP: 002b:00007fdd06c88028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 979.977611][T23929] RAX: ffffffffffffffda RBX: 00007fdd06025fa0 RCX: 00007fdd05d9e159 [ 979.977628][T23929] RDX: 0000000000000300 RSI: 0000200000000e00 RDI: 0000000000000003 [ 979.977644][T23929] RBP: 00007fdd06c88090 R08: 0000000000000000 R09: 0000000000000000 [ 979.977658][T23929] R10: 0000000000034000 R11: 0000000000000246 R12: 0000000000000002 [ 979.977672][T23929] R13: 00007fdd06026038 R14: 00007fdd06025fa0 R15: 00007ffcb022d5c8 [ 979.977711][T23929] [ 980.298844][T23935] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3801'. [ 980.502367][T23935] bond4: option lacp_active: invalid value (5) [ 980.559198][T23935] bond4 (unregistering): Released all slaves [ 981.064938][T23962] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3807'. [ 981.146189][T23961] ip_tables: iptables: counters copy to user failed while replacing table [ 981.395151][T23973] ip_tables: iptables: counters copy to user failed while replacing table [ 982.452120][T23983] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3811'. [ 982.546094][T23986] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3812'. [ 984.017994][T24003] 8021q: adding VLAN 0 to HW filter on device bond2 [ 984.045557][T24003] team0: Port device bond2 added [ 984.049284][T23982] mac80211_hwsim hwsim43 wlan0: left promiscuous mode [ 984.255283][T19396] [ 984.257673][T19396] ====================================================== [ 984.264713][T19396] WARNING: possible circular locking dependency detected [ 984.271774][T19396] syzkaller #0 Not tainted [ 984.276210][T19396] ------------------------------------------------------ [ 984.283267][T19396] kworker/u8:13/19396 is trying to acquire lock: [ 984.289619][T19396] ffff88801c2d4a10 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_unlink_sibling+0x6d/0x170 [ 984.300201][T19396] [ 984.300201][T19396] but task is already holding lock: [ 984.307590][T19396] ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0x77/0x930 [ 984.317211][T19396] [ 984.317211][T19396] which lock already depends on the new lock. [ 984.317211][T19396] [ 984.327643][T19396] [ 984.327643][T19396] the existing dependency chain (in reverse order) is: [ 984.336681][T19396] [ 984.336681][T19396] -> #9 (&root->kernfs_rwsem){++++}-{4:4}: [ 984.344711][T19396] down_write+0x96/0x200 [ 984.349546][T19396] kernfs_add_one+0x41/0x6f0 [ 984.354687][T19396] kernfs_create_dir_ns+0x1a1/0x230 [ 984.360437][T19396] internal_create_group+0x440/0x1180 [ 984.366361][T19396] cpuhp_invoke_callback+0x434/0x810 [ 984.372271][T19396] cpuhp_issue_call+0x3f0/0x750 [ 984.377686][T19396] __cpuhp_setup_state_cpuslocked+0x3f4/0x6f0 [ 984.384315][T19396] __cpuhp_setup_state+0x3f/0x60 [ 984.389822][T19396] do_one_initcall+0x250/0x870 [ 984.395146][T19396] do_initcall_level+0x10a/0x1a0 [ 984.400704][T19396] do_initcalls+0x59/0xa0 [ 984.405614][T19396] kernel_init_freeable+0x29d/0x3e0 [ 984.411389][T19396] kernel_init+0x22/0x1d0 [ 984.416282][T19396] ret_from_fork+0x514/0xb70 [ 984.421481][T19396] ret_from_fork_asm+0x1a/0x30 [ 984.426806][T19396] [ 984.426806][T19396] -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: [ 984.434689][T19396] [ 984.434689][T19396] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 984.442460][T19396] cpus_read_lock+0x42/0x160 [ 984.447633][T19396] static_key_slow_inc+0x12/0x30 [ 984.453164][T19396] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 984.459534][T19396] nbd_genl_foreach_sock+0x265/0x450 [ 984.465366][T19396] nbd_genl_reconfigure+0xbbb/0x1040 [ 984.471363][T19396] genl_family_rcv_msg_doit+0x233/0x340 [ 984.477481][T19396] genl_rcv_msg+0x614/0x7a0 [ 984.482548][T19396] netlink_rcv_skb+0x226/0x4a0 [ 984.487868][T19396] genl_rcv+0x28/0x40 [ 984.492399][T19396] netlink_unicast+0x7bd/0x940 [ 984.497739][T19396] netlink_sendmsg+0x813/0xb40 [ 984.503047][T19396] sock_sendmsg_nosec+0x14e/0x190 [ 984.508626][T19396] ____sys_sendmsg+0x54e/0x850 [ 984.513947][T19396] ___sys_sendmsg+0x2a5/0x360 [ 984.519176][T19396] __x64_sys_sendmsg+0x1b1/0x290 [ 984.524679][T19396] do_syscall_64+0x166/0x520 [ 984.529829][T19396] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 984.536287][T19396] [ 984.536287][T19396] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 984.543968][T19396] __mutex_lock+0x19d/0x1550 [ 984.549119][T19396] nbd_queue_rq+0x373/0xff0 [ 984.554170][T19396] blk_mq_dispatch_rq_list+0x499/0x1990 [ 984.560386][T19396] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 984.567316][T19396] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 984.573871][T19396] blk_mq_run_work_fn+0x16c/0x300 [ 984.579465][T19396] process_scheduled_works+0xc3d/0x1630 [ 984.585573][T19396] worker_thread+0xa47/0xfb0 [ 984.590724][T19396] kthread+0x38b/0x480 [ 984.595343][T19396] ret_from_fork+0x514/0xb70 [ 984.600488][T19396] ret_from_fork_asm+0x1a/0x30 [ 984.605817][T19396] [ 984.605817][T19396] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 984.613069][T19396] __mutex_lock+0x19d/0x1550 [ 984.618227][T19396] nbd_queue_rq+0xc1/0xff0 [ 984.623207][T19396] blk_mq_dispatch_rq_list+0x499/0x1990 [ 984.629326][T19396] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 984.636259][T19396] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 984.642843][T19396] blk_mq_run_work_fn+0x16c/0x300 [ 984.648473][T19396] process_scheduled_works+0xc3d/0x1630 [ 984.654600][T19396] worker_thread+0xa47/0xfb0 [ 984.659930][T19396] kthread+0x38b/0x480 [ 984.664553][T19396] ret_from_fork+0x514/0xb70 [ 984.669703][T19396] ret_from_fork_asm+0x1a/0x30 [ 984.675030][T19396] [ 984.675030][T19396] -> #4 (set->srcu){.+.+}-{0:0}: [ 984.682194][T19396] __synchronize_srcu+0xc9/0x2f0 [ 984.687694][T19396] elevator_switch+0x1e8/0x7b0 [ 984.693120][T19396] elevator_change+0x2fa/0x480 [ 984.698434][T19396] elevator_set_default+0x375/0x440 [ 984.704181][T19396] blk_register_queue+0x3f3/0x4e0 [ 984.709826][T19396] __add_disk+0x6b8/0xdb0 [ 984.714766][T19396] add_disk_fwnode+0x100/0x3a0 [ 984.720089][T19396] nbd_dev_add+0x733/0xb60 [ 984.725057][T19396] nbd_init+0x168/0x1f0 [ 984.729801][T19396] do_one_initcall+0x250/0x870 [ 984.735163][T19396] do_initcall_level+0x10a/0x1a0 [ 984.740661][T19396] do_initcalls+0x59/0xa0 [ 984.745544][T19396] kernel_init_freeable+0x29d/0x3e0 [ 984.751299][T19396] kernel_init+0x22/0x1d0 [ 984.756197][T19396] ret_from_fork+0x514/0xb70 [ 984.761390][T19396] ret_from_fork_asm+0x1a/0x30 [ 984.766724][T19396] [ 984.766724][T19396] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 984.774595][T19396] __mutex_lock+0x19d/0x1550 [ 984.779779][T19396] elevator_change+0x1af/0x480 [ 984.785103][T19396] elevator_set_none+0xb5/0x140 [ 984.790508][T19396] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 984.796878][T19396] nbd_start_device+0x189/0xb30 [ 984.802281][T19396] nbd_genl_connect+0x167d/0x1cd0 [ 984.808041][T19396] genl_family_rcv_msg_doit+0x233/0x340 [ 984.814172][T19396] genl_rcv_msg+0x614/0x7a0 [ 984.819411][T19396] netlink_rcv_skb+0x226/0x4a0 [ 984.824738][T19396] genl_rcv+0x28/0x40 [ 984.829359][T19396] netlink_unicast+0x7bd/0x940 [ 984.834683][T19396] netlink_sendmsg+0x813/0xb40 [ 984.839995][T19396] sock_sendmsg_nosec+0x14e/0x190 [ 984.845568][T19396] ____sys_sendmsg+0x54e/0x850 [ 984.850890][T19396] ___sys_sendmsg+0x2a5/0x360 [ 984.856122][T19396] __x64_sys_sendmsg+0x1b1/0x290 [ 984.861640][T19396] do_syscall_64+0x166/0x520 [ 984.866795][T19396] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 984.873244][T19396] [ 984.873244][T19396] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 984.881912][T19396] blk_alloc_queue+0x544/0x690 [ 984.887239][T19396] __blk_mq_alloc_disk+0x194/0x390 [ 984.892904][T19396] nbd_dev_add+0x494/0xb60 [ 984.897873][T19396] nbd_init+0x168/0x1f0 [ 984.902613][T19396] do_one_initcall+0x250/0x870 [ 984.907942][T19396] do_initcall_level+0x10a/0x1a0 [ 984.913455][T19396] do_initcalls+0x59/0xa0 [ 984.918374][T19396] kernel_init_freeable+0x29d/0x3e0 [ 984.924123][T19396] kernel_init+0x22/0x1d0 [ 984.929012][T19396] ret_from_fork+0x514/0xb70 [ 984.934150][T19396] ret_from_fork_asm+0x1a/0x30 [ 984.939499][T19396] [ 984.939499][T19396] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 984.946754][T19396] fs_reclaim_acquire+0x71/0x100 [ 984.952262][T19396] kmem_cache_alloc_noprof+0x5f/0x600 [ 984.958194][T19396] __kernfs_iattrs+0xdd/0x380 [ 984.963429][T19396] kernfs_iop_setattr+0xe6/0x3f0 [ 984.968929][T19396] notify_change+0xbba/0xea0 [ 984.974075][T19396] do_truncate+0x1c2/0x250 [ 984.979054][T19396] path_openat+0x15b5/0x1d60 [ 984.984192][T19396] do_file_open+0x23e/0x4a0 [ 984.989257][T19396] do_sys_openat2+0x115/0x200 [ 984.994518][T19396] __x64_sys_openat+0x138/0x170 [ 984.999947][T19396] do_syscall_64+0x166/0x520 [ 985.005093][T19396] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 985.011536][T19396] [ 985.011536][T19396] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 985.020082][T19396] __lock_acquire+0x164c/0x2de0 [ 985.025511][T19396] lock_acquire+0x115/0x350 [ 985.030589][T19396] down_write+0x96/0x200 [ 985.035386][T19396] kernfs_unlink_sibling+0x6d/0x170 [ 985.041140][T19396] kernfs_rename_ns+0x4a2/0x930 [ 985.046544][T19396] sysfs_rename_link_ns+0x16e/0x1b0 [ 985.052304][T19396] device_rename+0x110/0x210 [ 985.057533][T19396] __dev_change_net_namespace+0x1572/0x2060 [ 985.064162][T19396] cfg802154_switch_netns+0xbd/0x410 [ 985.070152][T19396] cfg802154_pernet_exit+0x75/0xc0 [ 985.075840][T19396] ops_undo_list+0x43d/0x8d0 [ 985.081092][T19396] cleanup_net+0x572/0x810 [ 985.086072][T19396] process_scheduled_works+0xc3d/0x1630 [ 985.092226][T19396] worker_thread+0xa47/0xfb0 [ 985.097421][T19396] kthread+0x38b/0x480 [ 985.102056][T19396] ret_from_fork+0x514/0xb70 [ 985.107209][T19396] ret_from_fork_asm+0x1a/0x30 [ 985.112542][T19396] [ 985.112542][T19396] other info that might help us debug this: [ 985.112542][T19396] [ 985.122800][T19396] Chain exists of: [ 985.122800][T19396] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 985.122800][T19396] [ 985.137367][T19396] Possible unsafe locking scenario: [ 985.137367][T19396] [ 985.144839][T19396] CPU0 CPU1 [ 985.150229][T19396] ---- ---- [ 985.155633][T19396] lock(&root->kernfs_rwsem); [ 985.160433][T19396] lock(cpuhp_state_mutex); [ 985.167579][T19396] lock(&root->kernfs_rwsem); [ 985.174889][T19396] lock(&root->kernfs_iattr_rwsem); [ 985.180201][T19396] [ 985.180201][T19396] *** DEADLOCK *** [ 985.180201][T19396] [ 985.188362][T19396] locks held by kworker/u8:13/19396: 5, last CPU#0: [ 985.194982][T19396] #0: ffff88801c2d6140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 985.205917][T19396] #1: ffffc90002eefc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 [ 985.216506][T19396] #2: ffffffff90246088 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 [ 985.225879][T19396] #3: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: cfg802154_pernet_exit+0x18/0xc0 [ 985.235513][T19396] #4: ffff88801c2d4980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0x77/0x930 [ 985.245577][T19396] [ 985.245577][T19396] stack backtrace: [ 985.251576][T19396] CPU: 0 UID: 0 PID: 19396 Comm: kworker/u8:13 Not tainted syzkaller #0 PREEMPT(full) [ 985.261234][T19396] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 [ 985.271316][T19396] Workqueue: netns cleanup_net [ 985.276128][T19396] Call Trace: [ 985.279441][T19396] [ 985.282396][T19396] dump_stack_lvl+0xe8/0x150 [ 985.287029][T19396] print_circular_bug+0x2e2/0x300 [ 985.292096][T19396] check_noncircular+0x12f/0x150 [ 985.297082][T19396] __lock_acquire+0x164c/0x2de0 [ 985.301973][T19396] ? __lock_acquire+0x747/0x2de0 [ 985.306959][T19396] ? __lock_acquire+0x747/0x2de0 [ 985.311926][T19396] ? trace_irq_disable+0x3b/0x140 [ 985.316996][T19396] lock_acquire+0x115/0x350 [ 985.321533][T19396] ? kernfs_unlink_sibling+0x6d/0x170 [ 985.326947][T19396] down_write+0x96/0x200 [ 985.331229][T19396] ? kernfs_unlink_sibling+0x6d/0x170 [ 985.336633][T19396] ? __pfx_down_write+0x10/0x10 [ 985.341526][T19396] ? kernfs_root+0x1c/0x230 [ 985.346054][T19396] ? kernfs_root+0x1c/0x230 [ 985.350586][T19396] ? kernfs_root+0x1ea/0x230 [ 985.355203][T19396] kernfs_unlink_sibling+0x6d/0x170 [ 985.360551][T19396] kernfs_rename_ns+0x4a2/0x930 [ 985.365443][T19396] sysfs_rename_link_ns+0x16e/0x1b0 [ 985.370686][T19396] device_rename+0x110/0x210 [ 985.375310][T19396] __dev_change_net_namespace+0x1572/0x2060 [ 985.381255][T19396] ? __pfx___dev_change_net_namespace+0x10/0x10 [ 985.387529][T19396] ? __lock_acquire+0x747/0x2de0 [ 985.392509][T19396] ? __mutex_trylock_common+0x15f/0x270 [ 985.398086][T19396] ? __pfx___mutex_trylock_common+0x10/0x10 [ 985.404035][T19396] ? rcu_is_watching+0x16/0xb0 [ 985.408855][T19396] ? trace_contention_end+0x3d/0x140 [ 985.414179][T19396] ? __mutex_lock+0x30b/0x1550 [ 985.418982][T19396] ? do_raw_spin_unlock+0xf5/0x200 [ 985.424145][T19396] ? _raw_spin_unlock+0x28/0x50 [ 985.429117][T19396] ? cfg802154_pernet_exit+0x18/0xc0 [ 985.434441][T19396] ? xa_erase+0xc6/0xf0 [ 985.438635][T19396] ? __pfx___mutex_lock+0x10/0x10 [ 985.443700][T19396] cfg802154_switch_netns+0xbd/0x410 [ 985.449048][T19396] cfg802154_pernet_exit+0x75/0xc0 [ 985.454208][T19396] ops_undo_list+0x43d/0x8d0 [ 985.458850][T19396] ? __pfx_ops_undo_list+0x10/0x10 [ 985.463991][T19396] ? idr_destroy+0x218/0x290 [ 985.468722][T19396] ? do_raw_spin_unlock+0xf5/0x200 [ 985.473884][T19396] cleanup_net+0x572/0x810 [ 985.478342][T19396] ? __pfx_cleanup_net+0x10/0x10 [ 985.483314][T19396] ? rcu_is_watching+0x16/0xb0 [ 985.488115][T19396] ? process_scheduled_works+0x97a/0x1630 [ 985.493869][T19396] process_scheduled_works+0xc3d/0x1630 [ 985.499469][T19396] ? __pfx_process_scheduled_works+0x10/0x10 [ 985.505488][T19396] ? assign_work+0x3cf/0x5d0 [ 985.510124][T19396] worker_thread+0xa47/0xfb0 [ 985.514766][T19396] kthread+0x38b/0x480 [ 985.518859][T19396] ? __pfx_worker_thread+0x10/0x10 [ 985.524008][T19396] ? __pfx_kthread+0x10/0x10 [ 985.528630][T19396] ret_from_fork+0x514/0xb70 [ 985.533251][T19396] ? __pfx_ret_from_fork+0x10/0x10 [ 985.538384][T19396] ? __switch_to+0xc89/0x1420 [ 985.543141][T19396] ? __pfx_kthread+0x10/0x10 [ 985.547762][T19396] ret_from_fork_asm+0x1a/0x30 [ 985.552573][T19396] [ 985.790301][T19396] hsr_slave_0: left promiscuous mode [ 985.791682][T19396] hsr_slave_1: left promiscuous mode [ 986.326038][T19396] IPVS: stop unused estimator thread 0...