last executing test programs: 6.050873775s ago: executing program 1 (id=4674): socket$nl_sock_diag(0x10, 0x3, 0x4) (async) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) r1 = socket(0xa, 0x1, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) (async) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010026bd7000fbdbdf2503000000100007800c00018008000100", @ANYRES32=r1, @ANYBLOB="080001"], 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x20000844) sendmsg$RDMA_NLDEV_CMD_DELLINK(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="1800000002140400"/24], 0x18}, 0x1, 0x0, 0x0, 0x40}, 0x4048001) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xf0b, 0x70bd2b, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0xfff4}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x7fff, 0x7f, 0x192, 0xf, 0x7fff, 0x205}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x5, 0x400000000000001, 0x80, 0x0, 0x1bb, 0x400}}]}}}]}, 0x78}}, 0x0) getsockopt$sock_buf(r0, 0x1, 0x5, &(0x7f0000000000)=""/51, &(0x7f0000000040)=0x33) 5.670199982s ago: executing program 1 (id=4679): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x20, 0x10, 0x401}, 0x20}}, 0x0) recvmmsg(r0, &(0x7f0000000dc0)=[{{0x0, 0x0, 0x0}, 0x9}], 0x1, 0x0, &(0x7f00000015c0)) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x10, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000040000000000000000000000b7080000000000007b8af8ff00000000b7080000000001007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500060800000085000000a50000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r4, 0x84, 0x6d, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'bridge_slave_1\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071123e000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNSETQUEUE(r8, 0x400454d9, &(0x7f00000012c0)={'macsec0\x00', 0x400}) ioctl$TUNSETQUEUE(r8, 0x400454d9, &(0x7f00000006c0)={'bridge_slave_0\x00', 0x600}) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000007000010010ab4be68e8da23507000000", @ANYRES32=r6, @ANYBLOB="1000018004000480080001"], 0x28}}, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000380), r2) ioctl$OCFS2_IOC_GROUP_ADD64(r5, 0x40186f03, &(0x7f0000000140)={0x5, 0x4, 0x0, 0x8}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x16, 0xe, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r9, 0x89b0, &(0x7f0000000080)={'vlan0\x00', 0x2000}) openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x88842, 0x0) writev(r3, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x1}], 0x1) r10 = socket$netlink(0x10, 0x3, 0x4) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_LINK_TOL(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="01002bbd700000000000010000000000000007410000001400180000000069623a6e6963766630def4fd"], 0x30}}, 0x0) sendmsg$TIPC_CMD_GET_NODES(r10, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r12, 0x200, 0x70bd2b, 0x25dfdbfd, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000080) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=@newsa={0x16c, 0x10, 0x713, 0x0, 0x25dfdbfe, {{@in=@rand_addr=0x64010101, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x2, 0x4e23, 0x2, 0x2, 0x0, 0x0, 0x1d}, {@in=@dev={0xac, 0x14, 0x14, 0x27}, 0xfe, 0x32}, @in6=@empty, {0x0, 0x0, 0x2, 0x8, 0x1, 0x9, 0x7fffffff, 0x8000000000000543}, {0x5, 0x8000000000000001}, {0x3}, 0x70bd2c, 0x3504, 0xa, 0x4, 0x0, 0x2d4363205ffec2a2}, [@replay_esn_val={0x1c, 0x17, {0x0, 0x70bd28, 0x70bd27, 0x1, 0x70bd2d, 0x7}}, @algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x16c}}, 0x48080) 4.313574495s ago: executing program 3 (id=4686): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000100), r0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket(0x1, 0x80802, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000440bcd8698dfc8f157ff7d50bccdf1c48418046cb72e678430aa58b33e5941179cb09b1eed58bb80460cf9383f33ded94433144080b887f55f3b80e35bfbf7c68b41937a017941d09f6d25342f0ec44e8ac08fcbafe76208c75f71b4de1a26c89ccc8ae815addcf6910441b105f749ba89d4ac06ea8c9e97cea3", @ANYRES32, @ANYBLOB="ffff00"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r3, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r5 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000092870000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b70200001400a400b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000084000000b70000000000000095"], &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x3a, r3, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r4, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r6, &(0x7f00000002c0)={0x1f, 0x0, @any, 0xfff8}, 0xe) connect$bt_l2cap(r6, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmsg$nl_route(r1, &(0x7f00000004c0)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)=@ipv6_getanyicast={0x14, 0x3e, 0x400, 0x70bd2c, 0x25dfdbff, {}, ["", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40005}, 0x24000000) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000700)={0x0}, &(0x7f0000000740)=0xc) sendmsg$AUDIT_SET(r0, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x3c, 0x3e9, 0x200, 0x70bd2a, 0x25dfdbfc, {0x1, 0x0, 0x2, r7, 0x5, 0x800, 0x5, 0x4, 0x0, 0x6, 0x100}, ["", "", "", ""]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048}, 0x4040004) setsockopt$bt_l2cap_L2CAP_OPTIONS(r6, 0x6, 0x1, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000340)={r5, 0xffffffffffffffff, 0x18, 0x0, @void}, 0x10) r8 = epoll_create1(0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'veth0_to_bond\x00', &(0x7f0000000080)=@ethtool_sset_info={0x37, 0x4, 0x10}}) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r10, 0x0) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_mreq(r11, 0x29, 0x8, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r9, 0x8946, &(0x7f0000000040)={'wlan0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1a, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="180000000300000000000000fe02001085000000b700000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x37, '\x00', 0x0, @tracing=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r1, &(0x7f00000000c0)={0x10000001}) epoll_pwait(r10, &(0x7f0000000080)=[{}], 0x1, 0x80000000, 0x0, 0x0) connect$unix(r1, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e24}, 0x6e) 4.297769975s ago: executing program 1 (id=4687): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x311) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x8041, 0x0) close(r1) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000300)={0x1, &(0x7f00000002c0)=[{0x6, 0xc8, 0x6, 0x7}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="18080000cbb60000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0920000000000035090100000000009500000000000000b7080000000000007b8af8ff00000000b7080000020000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000001"], 0x0, 0x25, 0x0, 0x0, 0x40f00, 0x8, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000}, 0x94) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'netdevsim0\x00', 0x0}) sendmsg$ETHTOOL_MSG_PAUSE_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000600)=ANY=[@ANYRESHEX, @ANYRES16=r5], 0x28}, 0x1, 0x0, 0x0, 0x841}, 0x0) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r6) r7 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r8 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="4c00000014006b03000000d86e6c1d00104c250002000f00000017d34460bc24feb556a705251e6182949a369f3d3b48dfd8cdbf9367b4fa51f60a64c9f4d4938037e786a6d0bdd700000000", 0x4c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x3, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x2}, [@snprintf={{0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x8, 0xfe00}, {0x7, 0x0, 0x8, 0x8, 0x0, 0x0, 0xfffffffe}, {}, {0x5}, {0x7, 0x0, 0x0, 0x0}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r10}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x19}}]}, &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4c, '\x00', 0x0, @sched_cls, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r9) ioctl$IOCTL_GET_NCIDEV_IDX(r7, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r11, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r12], 0x1c}}, 0x840) write$nci(r6, &(0x7f0000000300)=ANY=[@ANYBLOB="7105020903"], 0x1b) connect$can_j1939(r2, &(0x7f00000001c0)={0x1d, r5, 0x1, {0x0, 0x81}}, 0x18) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) 4.172467232s ago: executing program 4 (id=4688): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0xb8825000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r3) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)={0x3c, r4, 0x1, 0x70bd27, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_PHYADDR={0x5, 0x3, 0x9}, @ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKINFO_PORT={0x5, 0x2, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20009815}, 0x4000080) recvmsg(r1, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x3f01) sendmsg$tipc(r2, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) (async) sendmmsg$sock(r2, &(0x7f0000002c80)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000008c0)="9a1646e333841dd817f884072bcfc4e86d09eae42c771150d2a0f7409c1370d3638a8b435039d8f5f5a58fd9696b618dee51e4869aced576ce4348d9b259fb3273c6a36fc309164021180c785a3c299cbf15a38790db0474eb0b41d11d4893959adec407e9ba742652a28fc5165a05b7593682298736a7ccd86db5f3758d2939e9992035d6de58a4b803a94a72a31139fd6e1f77b7e96492191da02c8bfd789de8bc6acd5484430d64a233fd9512f3d646d33db37e305f92dc1db89bd85b2689c942b596c0a45c4efff576", 0xcb}, {&(0x7f00000009c0)="efaf7a93d21cbcbd56d058e53b498eb5aec446ded5a0a15afc4a85e66ba967dd32bdaa041334d821c83f07626dff625725d9d7f2454a3c0354409cd461092701a394007cca7bf7ed39cb6d0860fc9fffc3867688808a8a9fa32d9c9f797ac6d2f35665413642d174ba233adaa36bf0d40144a05abc9458f98e5738d6952053397589681183bf74246782eaa788d1afbf227f54319c505f1678a3165181261067da7d2cc5ce2f9a8ca0b99fa09f8e95675cd7666c5e2edb4b8029c371ccfe0497285e0e223106e4b43dbbdae8faa67a625fff23346e701f1c8cf9b6cd0d485c422d1c07b63988d3377dfe6634b1e184", 0xef}, {&(0x7f0000000ac0)="8f30e4f3a357d24b35a884da0ffdc5c42f7ce57129b691f99daded3f1e2aa5f6738c747cd9fa7b3e59a5a24970b0a2a5bcc8cd72fc0a6e472442b441e273146cb840d20afb23fa12cfaaf4d54ffea9bdaf5d445e4773e815b6462cdc4b449d55a1d007a07e49cef17635abf4c4986abcc36fc5529e63aa97265af26fd3286548b2a7932c81883c382b1598d0761891370633573d40cd4b425576ff4998bf040fa0aef4b64392fc7f7b6fafb4a073a88f883f16c9c771664b430d91", 0xbb}, {&(0x7f0000000b80)="3b3d07b7091f697381965e2e7909f9f6f54a284af3f8fdb1c24e6d0c4a7f58ffca9b24b191f510fbf55fd3e76154e2a4fe1e14c7bbff4c24907805f79e2a90f0d8c8faccbd2243475ecfa1f5fac83b8910baf212596b2a4a23aab8eb9cfa683836af5e50b1bc4f815b49fc47f85fe32f63a26492042b663d8c955bfad12d47e8", 0x80}], 0x4}}, {{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000d80)="d51927d7b27f39aa725cb19a990f66ac9aae2f7d92045a4c05e60f4dc5dc6c4e4ac8449b9915fb289bf1692a4c7d9440950ee716b680274b3c53048b6a2aeca47c5e6987db6b4fb364fa1e1709caa0696b9e02eabc8757ef2dd6a17f3efa", 0x5e}, {&(0x7f0000000e00)="96bc7002996addfa3b96a5e4de4cf18b08fa24022c9eb8cd8932ada8710619787de006", 0x23}, {&(0x7f0000000e40)="1304235350b0171b15c5c7a6c9861daf", 0x10}, {&(0x7f0000000e80)="048dc9fb57afe301fd6f418490309860762750", 0x13}], 0x4}}], 0x3, 0x0) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a80200003e000701feffffff00000000017c0000040042808802018006000600800a00007b02018020ef82972c4a888fa13836e811c4cd03b722b4ceca8be06b765000fcffffffffffff7eb6b5009a881fd61885956a03d9a9dc8452516454a3d167abf84c778c4df8237c0c0860693c5060dfea16df72653289de5ae7f1f3a2746c7e0900000011b9b91ed5687f850c00c8007d25212b2b4a2d000800a500", @ANYRES32=r5, @ANYBLOB="590123809542d4912acea6c2a67d2baa4aa8043fe21dae7c2c095655b2fa25cc65a17fc77fa653210b7c0fce9c96f3e60f82eaa7bd8dbb3fff64c0f3b6029345ad92ce2bc4f40a4ef463dfa58d4b002f2f9ba78811a69294da38c9d1f56bf4a8c60e8a8f852036a60aba986804009f8008001e000600000067ca43cec3ad3fffcb4f4ead06be3ff342037b3565bb4e6a7408e629e42e4e80cccad28015d25cbe59315c3bbb49e2bc2d5f3d36708a8023c3401d3dd8a348b591d9654f94e8965119f7355ec5b058b1599b9daffeee0056088600be00708f351745d53e502e56356916b733c51db948d6769ce7f52e7c5cd4a32d898f5cbb7776d60a9d41972931ddaf957cef1388b3775364d48e2bc64798a17a43ff3ec4adfba0f2dac85fa0675767d5489fcd66f581ae0492db512a2ec19a723432a391ffd1bb26c4fb339892b4860b67245d3590579f1f68b83097f53ccf94e0e2dfa00000000000f7c275d0093816ad1560f29cf45c1faa05436f722dd3ec0259c8e387658641be12dc21d2815f0441efc9d61d7a07369532c79023ed006fbe5d1e1ece72fd969d956f704e62fecb9e61fef78f1a6dff894d9adee12d08c151f5f67302be6f021d84a5c60f8f1b502e70b527327ccac8c989018eddedee145291d2bdb4e7c4cbd32fd49e7d7a8bd0f87167a5b529660dc89b9c9f968ead0facea4be31a8eaa491900080002"], 0x2a8}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000580)=@bpf_lsm={0xc, 0x3, &(0x7f00000000c0)=@framed={{0x6e, 0xa, 0xa, 0x0, 0x0, 0x79, 0x10, 0x82}}, &(0x7f0000000000)='GPL\x00'}, 0x90) 4.118290684s ago: executing program 2 (id=4689): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000180)={0x1f, 0x1}, 0x6) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x1, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000080000000000000006da435cbad0000000000000095000000000000002cd0531828a4893346ec9842eed05f2edc5a29c0cec701edee9a69f157737fef3ff6d4c6d813079114a952d6889c9a56e64017ac0c4d5be323ce63ac87a782d443e985156e18b261c9a14cdfad9afd14a8aab53900ee04068bccd9e6121bf4306b284d5cdaf014fd6f2015e240c092d286d2bc5a140962336ff4d7108a801e6596ced780c4b32702e5506a8754978b35364dd7051b7710739d72fec1151790fe110e0f5e91a9fdb9e752474bdc6a7857e31f625b6e9c356865f27c4b0adcb1013b283b0433455b03a380e709885090e0fe2db54de2bdd1e7da7fb64f6f3f7a3689dac7e1241e20efb0d35c4122"], &(0x7f0000000000)='syzkaller\x00'}, 0x94) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="440000001000090600000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="a7ffa888000000001c00128009000100766c616e000000000c000280060001000100000008000500", @ANYRES32=r6], 0x44}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="e41e0699", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00?\x00\x00\b\x00\n\x00', @ANYRES32=r9, @ANYBLOB="240012800b00010062726964676500001400028005000700060000000600270000000000"], 0x4c}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) 4.06665692s ago: executing program 0 (id=4690): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x12, 0x7, 0x8, 0x22}, 0x48) r2 = socket(0x1, 0x3, 0x0) getsockopt$sock_buf(r0, 0x1, 0x37, &(0x7f00000006c0)=""/238, &(0x7f00000007c0)=0xee) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r1, &(0x7f0000000380), &(0x7f00000003c0)=@tcp=r2, 0x3}, 0x20) setsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000540)={0x0, 0xe, 0x7, 0x862}, 0x8) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x4c0, 0x98, 0x138, 0x428, 0x0, 0x0, 0x428, 0x428, 0x428, 0x428, 0x428, 0x6, 0x0, {[{{@ip={@remote, @multicast1=0xe0007600, 0x11000000, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x9}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@private=0xa010100, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00', {}, {0xff}}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {}, 0x32}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x9, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00', {}, {}, 0x0, 0x3, 0x8}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x520) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xb, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="620ac4ff000000007110bd000000000095"], &(0x7f0000000480)='GPL\x00'}, 0x90) 3.836116192s ago: executing program 0 (id=4691): syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), 0xffffffffffffffff) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000580)) r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=r1, @ANYBLOB="000000000000000024001280110001006272696467655f736c617665000000000c000580050027"], 0x44}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket(0x10, 0x3, 0x0) write(r4, &(0x7f0000000100)="140000001a004f7fb3e45f2024d2f1c9fb470000", 0x14) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001040)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x404c8f0}, 0x4890) r9 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r9, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d86dd", 0x5ea, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r8, 0x1, 0xd8, 0x6, @multicast}, 0x14) sendmsg$NFNL_MSG_CTHELPER_DEL(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)={0x14, 0x2, 0x9, 0x5, 0x0, 0x0, {0x7}}, 0x14}}, 0x0) 3.808832478s ago: executing program 3 (id=4692): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="3800000041000701fefffffffeffffff017c0000040042800c00018006000600800a00001400028010000b800c0009"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f00000011c0)={0x0, 0x0, 0x0}, 0x20000004) close(0x3) connect$unix(r3, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ff03e1ffffff00000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000004000008500000083000000bf09000000000000550901000000000095000000000000001844000003000000000000000000000085000000c0ffffff9500000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x7, 0x1001, &(0x7f0000001cc0)=""/4097, 0x41100}, 0x94) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x30, &(0x7f00000001c0)="520222171935f335f1e859e48843f49ecfabe6b7aa722b66173da5cfcfd393c7d2070bbb91ab1ffa5da786cc4db054006fd676484e513462d69932ded722da3375df83a1748971fa20cecfc3ab09095aad8df77320aa60a2395a9b1c2ef04ac3a39350293363d331ab4061e904586bc47e737a30bc4eb214f6d15c3ebdf02fe04e78c21c2c3a0352e3c22402e8ecce7ff6", 0x91) r5 = socket$netlink(0x10, 0x3, 0x7) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_procs(r6, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r8) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c0000000c0a0101f4ffffffffffffff0a0000060900020073797a31000000000900010073797a31000000002000038004b106000c00018006000100000000000c0004400000000000000007140000001100010000000000000000000100000a"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r10, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r10, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0xefff, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x20000880) close(0x3) poll(&(0x7f0000000140)=[{r7, 0x200}], 0x1, 0x30) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f02feff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008004f0fffeffe809005300fff5dd000000100001000a0c10000000000000000000", 0x58}], 0x1) 3.796746627s ago: executing program 4 (id=4693): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7be", 0x10) close(0xffffffffffffffff) 3.532239519s ago: executing program 4 (id=4694): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETVNETHDRSZ(r0, 0x400454d8, &(0x7f0000000100)=0x9b72) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000000000006b113e00000000008510000002000000850000000500000095003300000000009500250500000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8000000}, 0x70) 3.531966063s ago: executing program 3 (id=4695): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x38, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty=0xfffffffe}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@deltaction={0xac, 0x31, 0x1, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x64, 0x1, [{0xc, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'nat\x00'}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_INDEX}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xc, 0x1, 'skbedit\x00'}}, {0x10, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @TCA_ACT_TAB={0x34, 0x1, [{0xc, 0x0, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}, {0x56, 0x0, 0x0, 0x0, @TCA_ACT_INDEX={0x8}}, {0xc, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ipt\x00'}}]}]}, 0xac}}, 0x0) 3.498566939s ago: executing program 2 (id=4696): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=ANY=[@ANYBLOB="4c0000001000010027bd700402d4df2500000000", @ANYRES32=r3, @ANYBLOB="984e0600c16a01002c001280110001006272696467655f736c617665000000001400058006000200060000000500010010"], 0x4c}, 0x1, 0x0, 0x0, 0x400c080}, 0x200088c2) r4 = socket(0x2, 0x80805, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000000000)={0x2, 0x24e23, @loopback}, 0x10) getsockopt$bt_hci(r4, 0x84, 0x75, &(0x7f0000000000)=""/4102, &(0x7f00000010c0)=0x1006) recvmsg(r4, &(0x7f0000002240)={&(0x7f0000001040)=@nfc_llcp, 0x80, &(0x7f0000002200)=[{&(0x7f0000001100)=""/59, 0x3b}, {&(0x7f0000001140)=""/117, 0x75}, {&(0x7f0000002080)=""/111, 0x6f}, {&(0x7f0000002100)=""/211, 0xd3}], 0x4}, 0x40000000) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000011c0)=@newtaction={0xe98, 0x30, 0x25, 0x0, 0x0, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x30, 0x5, 0x0, 0x1, [{0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}]}, {0xffffffffffffff40, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0x4}]}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x718}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x7f}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x800}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0xfffffffc}], [{}, {}, {}, {}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x5}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) 3.275209324s ago: executing program 3 (id=4697): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0}, 0x1, 0x0, 0x0, 0x41800}, 0x0) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$gtp(&(0x7f0000000300), 0xffffffffffffffff) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="c4000000190001002dbd700000000000fe880000000000000000000000000001fe8000000000000000000000000000aa00000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff00000b000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008000000000000000001000000000000000a00100001"], 0xc4}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff0000000000000000000000000000000000000000000000000700000000000000feffffffff7f400002000000000000080180000001000000010006010000000044000500fc000000000000000000000000000001000000003c00000002000000ff0700000000000000000000000000000600000004"], 0xfc}}, 0x0) r5 = socket$inet6(0xa, 0x800000000000002, 0x0) sendmmsg$inet6(r5, &(0x7f0000000440)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) sendmsg$GTP_CMD_GETPDP(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)={0x1c, r2, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@GTPA_VERSION={0x8, 0x2, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4080}, 0x0) r6 = socket$packet(0x11, 0x2, 0x300) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$packet_int(r6, 0x107, 0xe, &(0x7f0000000280)=0x5, 0x4) bind$inet6(r8, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0x3}, 0x1c) socket$netlink(0x10, 0x3, 0x10) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_udp_encap(r8, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) write$tun(r7, &(0x7f0000000240)={@val={0x8, 0x800}, @val={0x0, 0x3, 0x6, 0xfdcd, 0x2f, 0x40}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x28, 0x2c, 0x65, 0x0, 0x3f, 0x11, 0x0, @private=0xa010104, @broadcast}, {0x4e26, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0x7ff, 0x7f}}}}, 0x3a) getsockopt$inet_int(r0, 0x0, 0x2, &(0x7f0000000140), &(0x7f00000001c0)=0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000)=@req3={0x3, 0x4, 0x6, 0x9, 0x8, 0x8, 0x3}, 0x1c) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)=@newlink={0x40, 0x10, 0xc3b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x88a8}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_TYPE={0x6}]}}}]}, 0x40}}, 0x0) getsockopt$WPAN_SECURITY_LEVEL(r0, 0x0, 0x2, &(0x7f00000002c0), &(0x7f0000000380)=0x4) 3.205191127s ago: executing program 4 (id=4698): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x300, &(0x7f0000000200)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2c, 0x25dfdbfc, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'vxcan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x810) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x35, 0x0, 0x0) close(0xffffffffffffffff) socket$netlink(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) syz_emit_ethernet(0x63, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) (async) r3 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r3, &(0x7f0000000040), 0x10) (async) listen(r3, 0x0) (async) r4 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r4, &(0x7f0000000080), 0x10) (async) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004ec0)=[{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000500)='\b', 0x1}], 0x1, 0x0, 0x0, 0x4000004}], 0x1, 0x20) (async) setsockopt$sock_linger(r4, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) (async) sendmmsg(r4, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x1, 0x24008094) (async) r5 = accept4$unix(r3, 0x0, 0x0, 0x0) recvfrom$unix(r5, &(0x7f0000000140)=""/263, 0x107, 0x0, 0x0, 0x0) (async) recvmsg(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/58, 0x3a}], 0x1}, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000018c0), r6) sendmsg$IEEE802154_SET_MACPARAMS(r6, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000001a00)={&(0x7f0000001980)={0x14, r7, 0xc0f, 0x70bd29, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x4040}, 0x0) (async) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4c0000000206010800000000000000000000003f0500010006000000050005000200000005000400000000000900020073797a310020000013000300686173683a6e65742c6966616365"], 0x4c}}, 0x0) (async) r8 = socket$inet(0x2, 0xa, 0x8) ioctl$sock_inet_SIOCDARP(r8, 0x8953, &(0x7f0000000000)={{0x2, 0x4e22, @multicast1}, {0x306, @multicast}, 0x2, {0x2, 0x4e21, @local}, 'syzkaller1\x00'}) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000005700)=ANY=[@ANYBLOB="580000000906010200000000000000000200fe01300007800c0001800800014003b70f82140017006261746164765f736c6176655f3000000c00028008000140ac1414bb0900020073797a31000000000500010007"], 0x58}, 0x1, 0x0, 0x0, 0x80}, 0x40c0080) (async) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x6, @empty}, 0x1c) (async) recvmmsg(r1, &(0x7f0000008cc0)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x2, 0x0) 1.216985905s ago: executing program 2 (id=4699): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x5, 0x1cf1cd988231dbb, 0x1, 0x2, 0xc, 0xffff}, 0x20) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) ioctl(r0, 0x8b32, &(0x7f0000000040)) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000001a40)=[{&(0x7f0000000000)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, 0x0}], 0x1, 0x0) r2 = socket(0x2, 0x80805, 0x0) r3 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) bind$bt_l2cap(r5, &(0x7f0000000980)={0x1f, 0x0, @any, 0x0, 0x2}, 0xe) bind$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x2, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x0, 0x1}, 0xe) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f0000000780)=ANY=[@ANYRES32=r4], 0x12) ioctl$FS_IOC_GETFSLABEL(r1, 0x400452c9, &(0x7f0000000100)) 1.12716213s ago: executing program 1 (id=4700): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x5, 0x2, 0x1000, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000002c0)={r1, &(0x7f00000001c0)="7e9c41dd3d", &(0x7f0000000240)}, 0x20) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x7, 0x10012, r0, 0x0) write$cgroup_subtree(r0, 0x0, 0x4d) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)=0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000740)=@bpf_lsm={0xc, 0x3, &(0x7f0000000080)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x59}}, &(0x7f0000000000)='GPL\x00'}, 0x94) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x0, 0x1, @rand_addr=' \x01\x00'}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}, 0x0, 0x0, 0x0, 0x0, 0x4}, &(0x7f00000001c0)=0x9c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0xffffffc0}, @NFTA_NG_TYPE={0x8}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_NG_OFFSET={0x8, 0x4, 0x1, 0x0, 0x2798}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) ioctl$FS_IOC_RESVSP(r4, 0x40305828, &(0x7f00000001c0)={0x0, 0x1, 0x9, 0x3}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r6) sendmsg$NLBL_UNLABEL_C_STATICADD(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="98000000", @ANYRES16=r7, @ANYBLOB="010025bd7000fbdbdf25030000002b00070073797374656d5f753a6f626a6563745f723a63726f6e645f756e69745f66696c655f743a7330000014000600626f6e645f736c6176655f310000000014000200fe8000000000000000000000000000bb0500010001000000140003"], 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000010) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r9 = openat$cgroup_ro(r8, &(0x7f0000000140)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) write$cgroup_subtree(r9, &(0x7f00000012c0)={[{0x2b, 'hugetlb'}]}, 0x9) syz_open_procfs$namespace(r2, &(0x7f00000000c0)='ns/ipc\x00') r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r12 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffffd, {0x0, 0x0, 0x0, r11, {0x7, 0xd}, {}, {0x8, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x24048840}, 0x40004) ioctl$BTRFS_IOC_SUBVOL_SYNC_WAIT(r10, 0x40109441, &(0x7f0000000340)={0x156, 0x2, 0x3e4}) sendmsg$nl_route(r0, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@bridge_getlink={0x2c, 0x12, 0x4, 0x70bd2a, 0x25dfdbfe, {0x7, 0x0, 0x0, r11, 0x28100, 0x20}, [@IFLA_ADDRESS={0xa, 0x1, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40801}, 0x40080) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) 1.060708833s ago: executing program 4 (id=4701): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) r2 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x4e20, 0x2ffffd, @local, 0xcb1}, 0x1c) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000100)=ANY=[@ANYRES16=r0, @ANYRESHEX=r1, @ANYBLOB="0100000000003fc14d7a0100000004000480080002000100000008000100000000000420088008010c8054000b800800090000000000080009000000000008000a0000000000080009000000000008000a00000000000800090000000009"], 0x134}}, 0x800) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000000)={0xffffffff}, 0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="2000ee001600010026bd7400009eed0001000000", @ANYRES32=0x0, @ANYBLOB='\b\x00\n\x00\x00\x00\x00\x00'], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x54004) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x200400a0}, 0x2000c8c0) 943.130685ms ago: executing program 4 (id=4702): socket$netlink(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = socket(0x8, 0x4, 0x3) setsockopt$inet_sctp_SCTP_DELAYED_SACK(r0, 0x84, 0x10, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x4, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x43}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195}, 0x70) 920.164333ms ago: executing program 0 (id=4703): r0 = socket$netlink(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x803, 0x0) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, 0x0, &(0x7f0000000040)) (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000dc0)={&(0x7f0000001000)=@newtaction={0xbc, 0x30, 0x1, 0x70bd2b, 0x25dfdbde, {}, [{0xa8, 0x1, [@m_bpf={0x60, 0x1, 0x0, 0x0, {{0x8}, {0x38, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x0, 0x3, 0x1}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0xef, 0x1, 0x8000, 0x2}}, @TCA_ACT_BPF_OPS={0x14, 0x4, [{0x12, 0xf2, 0x3, 0x7}, {0x1, 0x9, 0x4, 0x2}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}, @m_bpf={0x44, 0x2, 0x0, 0x0, {{0x8}, {0x1c, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_PARMS={0x18, 0x2, {0x3, 0x2, 0x0, 0x6, 0x80}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0xc044}, 0x4000814) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.events\x00', 0x7a05, 0x1700) pwritev(r4, &(0x7f00000004c0)=[{&(0x7f0000000200)="db", 0x1}], 0x1, 0x8040000, 0x0) (async) getpeername$packet(r1, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000400)=0x14) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0x3, 0xe, &(0x7f00000022c0)=ANY=[@ANYRESDEC=r1], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', r5, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040), 0x10}, 0x94) (async) r7 = socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000001f40)={0xffffffffffffffff}) ppoll(&(0x7f0000002000)=[{r8, 0x400}], 0x1, 0x0, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000d00)={0x13, 0x1a, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000900000000000000e705000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000900000000550901000000000095000000000000001801000020646c2500000000002020207b1af8ff00000000bc59c3160000000007010000f8ffffffb702000008000000b70300000200000085000000060000005688f8ff0000000018480000060000000000000000000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000b80)='syzkaller\x00', 0x0, 0x1f, &(0x7f0000000bc0)=""/31, 0x41000, 0x28, '\x00', r5, @fallback=0x15, r8, 0x8, &(0x7f0000000c00)={0x4, 0x5}, 0x8, 0x10, &(0x7f0000000c40)={0x1, 0x2, 0x1, 0x7}, 0x10, 0x0, r6, 0x7, 0x0, &(0x7f0000000c80)=[{0x4, 0x5, 0x9}, {0x0, 0x1, 0x8, 0x3}, {0x4, 0x1, 0x3, 0x3}, {0x0, 0x1, 0x1, 0xa}, {0x1, 0x1, 0x2, 0xb}, {0x5, 0x1, 0x3, 0x1}, {0x3, 0x4, 0x0, 0x7}], 0x10, 0x5}, 0x94) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f3, &(0x7f0000000180)={'sit0\x00', &(0x7f0000000300)={'ip_vti0\x00', 0x0, 0x0, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x11, 0x0, 0x89, 0x0, @remote, @private}}}}) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r6, 0x0, 0x62, 0xfe, &(0x7f0000000140)="cb74445b7d4c0b24676c6c71ae37efcedaf40242309766deb4e793f90000000000000000dbc856cbc664650634231454ca2d8034c4ca29e0d99c3b6615e91835a600c08f989af45438a54981be310aad92ae545b1c961e5f3762a51fe4c736edec6f", &(0x7f0000000440)=""/254, 0x2f00, 0x0, 0xff, 0x194, &(0x7f0000000980)="ffc4438e5c3081d0e133e812196ec0ed923733aa8b5aba32c8650e7a66d6136853773dfbc6226be13039e230d511f1ac50cc7811aac0400e4c833fedf842ae2918e6fddb550729246fcf4c0a01bc64989ea3985fb362751a83991bd56e761379caa64f6148893ff25f38d5cd6dd695bbf9ca709a9960e0e6b054d5e2239bcb7c0fb2ac66dc4c8f534e439ff20ccaf0d48a98c19c92a3b437a699350f49606d21a403f8c112c46fea5486bf367a854b0f6c1e563b656e4794f6793a08bb3656c391643f6df71d0255054368a938d38503d064da82d5dbf395ad47ed3932669168d324ed0f6de8360d499042ddc7d02b6c0772128257702bfe6d0971f00fea85da062cdc", &(0x7f00000007c0)="4c87fe555ceb79157b1e507ff4d3cc053321e42ae89f596427188b4877ab8f1776c0685784f1174c6401ecc1dd6e2a77bc79238f87ad9215a92ff203a30099e77c543e702b4a4438d358616381745f24f74e585498af129c4b173b242f445b08135f7fa40eb7ba78160ff4f0c80e1b324d0c234cb7f43a3ff9e9535dc16000c797113a039f4508a09144090000009f38a90a24f173b3e68377e4272950a80cfcd3aa6850e917bc7e57370060f5e6db941d67fc98a1e98103830b821657438325578d2af822dd4fc13ea7a7eef8d9be4e715aec8fd6cadc41c8da5ce9da2b9e1559d92a1936fc2b3a00000000000000000072200e10ba6269b634f10f7098c65ba67ba65c0e2687637e131fb8d5ba6c12c09c8356853c434a44ff0878e496dcf9a4f5ca02c293279948f37ebb28843f92c87c057a3b410e04418557d5deda7ddd3bd1d384d64ec980187e8b64a0696571a49e847db79349c9b3c3fab5f1f977bde4d802d9026ae0c11744eb1525c5195fd215d7a432497f35c2f2cfcd2b6336b26dfef0cb968c910ea2af5cdd4d58cc08535d5514", 0x2, 0x0, 0x10000}, 0x24) (async) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000e80)=ANY=[@ANYRESHEX=r9, @ANYRES32=r9, @ANYBLOB="5787785334082b490107d20af318959c7dc42b4f64568ab3b41691d29afa02682c9e8e3602c0a8236bee2b89be56032c2ed913910ef7c212d96f1935dd", @ANYRES16=r0, @ANYBLOB="b9eee81d92016759ada10fd1e811f4b3a09a732f0d96acd6ef90da60859154a15700fa4fecb159ca2903cdb83f779b1612dff209e5efa0d791a243f5ddd4cf4747f3c4e8e9357a487f0ec365fc80861baaca498a4a8dfa401c494ab64f135b4dbbfd3842cdcf98b6f3ee158135ba2782381dded93d48919b177abdabf56c1f0968bb3c9b55d31e3742d7e0406c7ca65ce24fd2bf6b57a9f310bd98313225c1193db0d096524c4c05cbbcef4822ab08369d963149dc264ec36de7775628efceb4e3b03cf2127e9ebc136764dc3ce9b2723bb41c7e08cbe0009ba8bd5fdccbb927a88b26ae964627d4c8beff1e4b538c9f8622c1fbdb09e002", @ANYRES16=r0, @ANYRES32=r4], 0x3c}, 0x1, 0x0, 0x0, 0x84}, 0x20000084) (async) ioctl$BTRFS_IOC_INO_PATHS(r1, 0xc0389423, &(0x7f0000000200)={0x8001, 0x18, [0x2, 0x1, 0x0, 0x9], &(0x7f00000001c0)=[0x0, 0x0, 0x0]}) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) mkdirat$cgroup(0xffffffffffffffff, &(0x7f0000000140)='syz1\x00', 0x1ff) (async) sendmsg$nl_route(r10, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=ANY=[@ANYRES16=r0, @ANYRESOCT=r0, @ANYBLOB="00000000000000005000128009000100766c616e000000004000028006000100fe0f000004000480280003800c00010040000000060000000c000100ff04000000000000d8fd010006000000090000000600050088a800000800feff", @ANYRES32, @ANYBLOB="08000500", @ANYRES16=r9], 0x8c}, 0x1, 0xba01, 0x0, 0x4004001}, 0x0) (async) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="6400000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000016000300686173683a6e65742c706f72742c6e657400000014000780080006402000000008001340"], 0x64}}, 0x0) (async) syz_emit_ethernet(0x6f, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa01000000000000006000000200393a00fe8000000000000000000000000000bbfe8000000000000000000000000000aa08029078000000006000081000002f0000000000000000000000ffff00000000fc020000000000000000000000000024e15735d6e7b1000000"], 0x0) (async) r12 = socket$nl_generic(0x10, 0x3, 0x10) (async) r13 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r12, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00L\v', @ANYRES16=r13, @ANYBLOB="010000000000fcdbdf252400000018000180140002006c6f00"/38], 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r9], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 860.993848ms ago: executing program 2 (id=4704): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x2, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="180000000000000000000000000000006301edff0000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x38, 0x40, 0x107, 0x70ad2b, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x2fc}, @nested={0xc, 0x3, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @pid}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x5, 0x27, 0x0, 0x0, @str='\x00'}]}, @typed={0x8, 0x5, 0x0, 0x0, @fd=r0}]}, 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) 856.941106ms ago: executing program 3 (id=4705): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x4, &(0x7f0000000100)=0x1000, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0xc0a41, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller0\x00', @broadcast}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x11}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x0) write$tun(r1, &(0x7f0000000240)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x300, 0x14}, @ipv4=@tcp={{0x5, 0x4, 0x0, 0x3c, 0x8016, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @broadcast}, {{0xa200, 0x22eb, 0x41424344, 0x41424344, 0x0, 0x0, 0x1}}}}, 0xfdef) 735.387504ms ago: executing program 1 (id=4706): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x70bd2b, 0x25dfdbfd, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e21}]}}}]}, 0x38}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x68, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x24, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0xc, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @void}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xb0}}, 0x20050800) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r0, 0x942e, 0x0) 713.446594ms ago: executing program 0 (id=4707): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="900000001000030406000000dfff000000000000", @ANYBLOB, @ANYRES8=0x0], 0x90}}, 0x40448c4) (async) r1 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r1, 0x891d, &(0x7f00000001c0)={'gre0\x00', 0x0}) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000300)={'ip6gre0\x00', &(0x7f0000000200)=@ethtool_dump={0x3f, 0x4, 0x5, 0x9c, "ed3bd79ebbf744a5badc036b6ea2402599657f7164e10de88c5e447efda78331ba65c38ee985acfac46829b25d1029790f9bc1e329bb88f35c1e15487af42af5c6d45dee7c9e957466bd673a4f77ea7646edf7660617098c776fe72a3a6d83f6894114ea68dad5e627a0183f778ac9a3ac859033498ae1913901ca7761bb761f6a136dae977634047d6f085b0826a4f665b50d583f3033a84d498fb5"}}) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100), 0xffffffffffffffff) (async, rerun: 32) r4 = socket$packet(0x11, 0x2, 0x300) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) (async, rerun: 32) r6 = socket(0x1d, 0x2, 0x6) (rerun: 32) bind$can_j1939(r6, &(0x7f00000014c0)={0x1d, r5, 0x0, {0x0, 0xf0}, 0x1}, 0x18) (async) sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x40, r3, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@FOU_ATTR_PEER_V4={0x8, 0x8, @dev={0xac, 0x14, 0x14, 0x41}}, @FOU_ATTR_PEER_V6={0x14, 0x9, @rand_addr=' \x01\x00'}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e21}, @FOU_ATTR_TYPE={0x5, 0x4, 0x3}]}, 0x40}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r7, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x200000, 0x1000}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000440)={'sit0\x00', 0x0}) r10 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r10, 0x84, 0x82, 0x0, 0x0) (async, rerun: 64) setsockopt$XDP_RX_RING(r7, 0x11b, 0x2, &(0x7f0000000340)=0x800, 0x4) (rerun: 64) setsockopt$XDP_UMEM_COMPLETION_RING(r7, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) (async) bind$xdp(r7, &(0x7f00000003c0)={0x2c, 0x0, r9}, 0x10) sendmsg$FOU_CMD_DEL(r1, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0xa00, 0x70bd27, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8040}, 0x4051) 648.594062ms ago: executing program 2 (id=4708): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x34, 0x10, 0x0, 0x1000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x60b3}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vcan={{0x9}, {0x4}}}]}, 0x34}}, 0x4000800) r1 = socket$kcm(0x2, 0x1000000000000005, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x8, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000002c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5}, [@printk={@p, {}, {}, {}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x5}, {}, {0x85, 0x0, 0x0, 0x72}}, @call={0x85, 0x0, 0x0, 0x23}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b70300000000ff808500000004"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r6}, 0xc) sendfile(r4, r5, 0x0, 0x8) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000000100)={0xe, {{0xa, 0x4e24, 0x73, @mcast2, 0x2}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000000040)={0xa, {{0xa, 0x4e21, 0x7, @mcast1, 0x9}}}, 0x88) bind$inet6(0xffffffffffffffff, &(0x7f0000000340)={0xa, 0x4e23, 0x0, @empty}, 0x1c) syz_emit_ethernet(0xd2, &(0x7f00000001c0)=ANY=[@ANYBLOB="0180c2000000ffffffffffff86dd60010700009c110000000000000000000000000000000000ff02000000000000000000000000000100000e22"], 0x0) shutdown(r2, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000240)={0x9, 0x4, 0x6, 0x5, 0x5, 0x3, 0x8, 0xee, 0x7, 0xf4, 0x64, 0x8, 0xfb, 0x10}, 0xe) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x1c, &(0x7f0000000280)=[@in6={0xa, 0x4e20, 0xae, @loopback, 0x400}]}, &(0x7f0000000180)=0x10) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r9 = accept4(r8, 0x0, 0x0, 0x800) sendmmsg$alg(r9, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f", 0xb4}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000001440)=""/67, 0x43}, {&(0x7f0000001280)=""/204, 0xcc}], 0x2}, 0x40000000) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f00000006c0)={'ip_vti0\x00', 0x0}) setsockopt$packet_add_memb(r11, 0x107, 0x1, &(0x7f0000000100)={r12, 0x2, 0x6, @local}, 0x10) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r9, 0x84, 0x6c, &(0x7f00000000c0)={r7, 0x1, "c5"}, &(0x7f0000000200)=0x9) sendmsg$inet(r1, &(0x7f0000007940)={&(0x7f0000000100)={0x2, 0x0, @rand_addr=0xa9fe0000}, 0x10, &(0x7f0000000140)=[{&(0x7f0000000080)='r', 0x1}], 0x1}, 0xe0) 310.901366ms ago: executing program 2 (id=4709): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'\x00', 0x5}) ioctl$TUNSETPERSIST(r0, 0x400454c9, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x1) 310.312831ms ago: executing program 3 (id=4710): bpf$TOKEN_CREATE(0x24, &(0x7f0000000180), 0x8) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000380)={'sit0\x00', &(0x7f0000000280)={'gretap0\x00', 0x0, 0x8000, 0x7, 0xd, 0x100, {{0x2c, 0x4, 0x0, 0x0, 0xb0, 0x65, 0x0, 0x5, 0x4, 0x0, @multicast2, @remote, {[@noop, @ra={0x94, 0x4, 0x1}, @end, @ra={0x94, 0x4, 0x1}, @cipso={0x86, 0x37, 0x1, [{0x6, 0x4, 'me'}, {0x2, 0x5, "801f7e"}, {0x5, 0x10, "062d1d608503852589b655fb15e8"}, {0x2, 0xc, "c27e541f073b248c1146"}, {0x6, 0x3, 'L'}, {0x5, 0x9, "a466749bd73f75"}]}, @lsrr={0x83, 0x17, 0x8e, [@remote, @broadcast, @local, @multicast1, @local]}, @cipso={0x86, 0x31, 0xfd66da18f7ce9689, [{0x7, 0xd, "9a890dd69d566b9936dba1"}, {0x5, 0x2}, {0x5, 0xb, "5fdae972ed05b532c1"}, {0x2, 0x7, "b516812c1b"}, {0x6, 0xa, "a9911954121aeb34"}]}, @ra={0x94, 0x4, 0x1}, @ra={0x94, 0x4}, @lsrr={0x83, 0xb, 0x8e, [@local, @dev={0xac, 0x14, 0x14, 0x19}]}]}}}}}) r1 = socket$nl_rdma(0x10, 0x3, 0x14) r2 = socket(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000440), r2) sendmsg$ETHTOOL_MSG_PAUSE_GET(r2, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x3c, r4, 0x100, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) r5 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r8 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r7, &(0x7f00000006c0)=ANY=[@ANYBLOB="0a00001bbbbbbbbbbbbbaaaaaaaaaa2986dd6d002008001884ff20"], 0x52) sendmsg$nl_route_sched(r2, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x5820a61ca228651, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000006c0)=@newtfilter={0x34, 0x28, 0x575ac7824d421509, 0x70bd2d, 0x4, {0x0, 0x0, 0x0, r6, {0x10}, {0x1}, {0xfff1, 0x3d}}, [@filter_kind_options=@f_bpf={{0x8}, {0x8, 0x2, [@TCA_BPF_ACT={0x4}]}}]}, 0x34}}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000030085000000a8000000850000007e00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x28, 0x140c, 0x1, 0x70bd29, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_RES_CQN={0x8, 0x3d, 0x4}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x5c}, [@ldst={0x6}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc9, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', r0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000003c0)={0x7}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 183.30546ms ago: executing program 0 (id=4711): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000001100)=ANY=[@ANYBLOB="b7020000b96871dfbfa30000000000000703000000feffff7a0af0fff8ffff1971a4f0ff00000000b7060000080000001e6400000000000045040400010000001704000001000a00b7040000000100006a0af2fe0000004f850000001a000000b7000000000000009500000000000000455781a5feee5e1ce784909b849d5550adf200000000000000b61d69f2ffdaa10350e11cb97c8ad51bcda0c4ee6d9674c77404ceb9971e43405d62de53a9a53608c10556e5734eb84049761451ce2e2d9f8004e26f7fcc059c06220002595f6dba87b81d1106fb026cce67a66afd9ac3d09e29a9d542ca9d85a5c9c88474895c679838def0a83a733dc6a39b63a5ed69d32394c53361d7480884bd6fee53f5b2e7b91c61ced1ebad000000000000e8122a793c080a882add4e1179bd4a44f2fcb6d753a78845d8363e0401861abebe428ba953df4aece69311687f4122073a236c3ad198e3f3a532efa04137d452ff47d2638da3261c8362bb7c7824be6195a66d2e17e122040e11e3bd4a69fc6e8d9f7043e09b9e10dc7777bfae5884e4ba1e9cc4a2bbe99e30810400000000000000d63d716c0975e1ce4a655362e7062ff6ab3934555c01840219829472adefa06d3482c7b2711b98eabdca89b77efd13e6dba4a431ce47911834118093b6cabaa17a57727474e1785ee234835088445aa4a9b677d3d342640e328504aea02a2d727e62b7f097a02dbf8fe1d704765de7482040b2fc3000000000000000008947baeaaf954aff687deaa2f804924600273ee26d8115cbca081a14cba24788779291745083fccdddc90d7af35c048d46362ea0d8d79c79ddca066da478c197d4a550470557bc99cca336bd88cd28a5ee651627e3a6fbf6ea53b95ddb64c69c7d8d2f4baddc239828760459564124bad68209d2a1d16ad085886c017679cfcda8b10700ac1e2bcc5ede5b5687aa418abfa29acd7339e73b2cd185c9eb5fb34fccd20ffa155b16c0c309ed6f6663677df37de0ec0d0f548b273940be5d1fe0bae14d1a76bf741330dacd9cc19c0163bcc93059e8d2d120ea257bba458ecd989cb3581a3f270ad48255ac0dad4923e3e357e4e90583ce8d43ec65ed491d87a51d7c13f665dcf772e3ead71112008b16b0ea821f70aee1ccbd71c5a1c21e87d5b7b73d356337dbcf3456ff6cd0d6b98a258e3509a7d15b9dcae4d0d750ffa07909c955e718585b2456308beda2fa03bb9bcf03cdff31ee4b1665b987829c0f0872c006c6e4ed666fe23b343aae943923eedbdb0e7abee90e3da7b98b7d07d2d4816201ad1737798635b0a3ebd3aed120e4500c16e6c9dc729f009db49c6b8b19613e4d792cb4ff5106419291d4222980b49ddb9527ce785822d8f4e2bc30a96767f500b9e26e3b12854da63083320d8bfe49d85e0842803dc59d6375bce2b8a93caf39c0ba767880bbb9bf9407e6a6c0f9a43d1ab51dabf9423b482e848fbe1653ff0c6161fa43543546ce17a42e6cddadaf0767d84407478ffe2d0b567d81201efc81e800d4c0874235ff5cd7f5f0ee71cc2b0193bfc9290627ceaeb0b02931a817688f3a51fa2861e70cbab50a5d434ed8d8841694dba46f3d5a95ae86e4d471684ccf427b2ba53a157b2a7cf7a4c10051bb77822190a14c2ab1f271a7cf9c240b99"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x3}, 0x10}, 0x94) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000340)={{0x1, 0xffffffffffffffff}, &(0x7f0000000200), 0x0}, 0x20) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'aead\x00', 0x11, 0x0, 'aegis256-generic\x00'}, 0x58) bind$inet6(0xffffffffffffffff, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @loopback, 0x3}, 0x7e) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x48000, &(0x7f0000000200)={0xa, 0x4e23, 0x3ff, @loopback, 0x10001}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffffff, 0x84, 0x6d, &(0x7f0000000240)={0x0, 0x81, "7bf8ec152fa16d39e4553d9607191c01003f4f261459314625abafbae09b2f3f5bd1d92f8a3b28f86ac6911e26622113c1d519b46c2b1bb9b76cf8008d37a06e88b31100ae16fcb20ca3c5e2bc78d0014278c1e4c7fb4ab35e2c3ae32abc7bf205fd325765be5684ece2933f3325ec9cb8b4725605bf2722d1ded87089430c8a35"}, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c}}, 0x40040) bind$alg(0xffffffffffffffff, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3", 0x5) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f0000000280)={r1, 0x985, 0x7, 0x70, 0x1, 0x7fd, 0xc, 0x9, {0x0, @in={{0x2, 0x4e24, @multicast1}}, 0x81, 0x3, 0x3, 0x8, 0x9}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="6400000010000305160000001dc76dcd00000000", @ANYRES32=0x0, @ANYBLOB="00000000000000004400128009000100626f6e64000000003400028005000100"], 0xc3}, 0x1, 0x100000000000000}, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000480), r3) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f0000000780)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r3, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000680)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010027bd7000fbdbdf25150000000c002b80080001000200000008000300", @ANYRES32=r5, @ANYBLOB="c7c562028329dd214c88518b116f0753d5f9a862bdcae22fad1cf9ff08ba92143b3952c12f3eb1ac3c3f05f3b6e39cd30f0023e4373b1afd878a6a"], 0x28}, 0x1, 0x0, 0x0, 0x4044804}, 0x20000080) r6 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000002000000000000000000000e00000039ac222744516d83b102027221bedf0281bbedefd1b20549df2d49a07af3b47a845544cf7b00caf5abd46fb44f0acbd2cb1bceff566c1f478e83977feb5e31d2f1000000"], &(0x7f0000001f80)=""/237, 0x26, 0xed, 0x2}, 0x1a) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) ioctl$NILFS_IOCTL_GET_VINFO(r0, 0xc0186e86, &(0x7f0000000880)={&(0x7f0000000740)=[{0x6, 0x2, 0x9, 0xe6d}, {0x3, 0x100000000, 0x0, 0xfff}, {0x5, 0x100000000, 0xc92, 0x10001}, {0xfffffffffffffff7, 0x4, 0x8, 0x1}, {0x1000, 0x200, 0x200, 0x2}, {0x5, 0xe, 0x7}, {0x7ff, 0x203, 0x5, 0xfffffffffffffff8}, {0x0, 0x8, 0xb}, {0x2, 0x7fffffffffffffff, 0x7, 0x10}], 0x9, 0x20, 0xc, 0x1}) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYRES8, @ANYBLOB="010026bd7000fddbdf2506000000140002002001000000000000000000000000000114000300fe88000000000000000000000000010108000400ac1414bb2b00070073797374656d5f753a6f626a6563745f723a7373685f"], 0x70}, 0x1, 0x0, 0x0, 0x4}, 0xc8a0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x16, &(0x7f0000000280)=ANY=[@ANYBLOB="7912b8000000000061138c0000000000bf2000000000000015000000080063033d030100000000009500003a000000006916000000000000bf6700000000000066060500fcff03006706000002000000760300000ee60060bf050000000000003c6500bf000000006507f9ff01000000070700004cdfffff1e75040000000000bf54000000000000070400000400f9ffad43010000000000d5000000000000000500000000000000950000000000000032410000000000000054bb12dc8c27df8ecfc7bdd2d17f2f1754558f22dd399703d6c4f6f3be0b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bdb94a05000000c6c60bf7a13ba1fcf1111ce4fc0d742a81762bab8395fa64810b5b40d893ea8fe0ffffff7f1b546cad3f1d5af65706fd4f68795cce6cf16ab689b555202da2e0ec2871a51445dc8da39e5b0ab71ca9b901627b562ed84b026002d4519af619e3cca4d69e0dee080006774a8f3e691700ec88158f02001b0000c81c8b297dff0445a13d0045fb3cda32a673a6bb55d8c80800dce431e56723888fb126a1403d2b63f16fb2ad9bc117aba7cbebe174aba210d739a018f9bbec63222d20cedbc4d03723f1c932b3a6aa57f1ad2e99e0e67a993716d20000009f0f53acbb40b401e3738270b3156268784f2af9e4bcf8b07a10d6735154be1602f9dd1d7d4301e00000000000460bcc5989ec85e3cbcb6bcfaf0000000000000000bc00f674629709e7e78f4ddc211bc3ebf0bd9d42ca019dd5d0861cd64722cf74686ebfbe2562671cd47840f81d2a8f8f9be3bcd19dc6840aa7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7eab049b1bd47287cd31cc43ea0ffb567b40407d000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x15, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="b40500000000000071101300000000007a050000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x366, 0x10, &(0x7f0000000000), 0x2b2}, 0x48) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_PAUSE_SET(r8, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000b40)=ANY=[@ANYRES16=r7, @ANYBLOB="42231da2bd27072169cfa8716561bedbeaf15a3e2bc594634f3569bef84f985820585e86a0e36955275e815f99b09c49311e3a57a3", @ANYBLOB="da9a2a1498738e5dc0822ed53a8955331ffcc88f68094d0023c5e939ec4d8e99efb32240cf90791ede6e7f682b34120b5449e3b333628ae78cf99a3d03a23b359fd3c426e8a28473ecb85fb071966c4c8f5794e2d5cc46db18c0702392a85926eb2a27f63abc7896c21a5a9e2c8f034b0a8cebd9701dc9a5a83f1f3292e0843dd779914c5dae52575312476289fdceef7779b0d6d59867afa3ef8e030e0bc12ca6068bd640b871c192d2192d1eb8199703d929b66b105b6770f02a7c839f3cfd760001521d42bd3a9898ea66e64c4491427d1ea42ddacffb0f968c154f939c810d00a02d475ffd4fbeda96c0d62eee00"/255, @ANYRESDEC, @ANYRES32], 0x20}, 0x1, 0x0, 0x0, 0x4054}, 0x404d8c0) 125.18791ms ago: executing program 1 (id=4712): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, &(0x7f0000000040), r3, 0x0, 0x800000000ff, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000640)=@newtfilter={0xdc, 0x2c, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r1, {0x5, 0x9}, {}, {0x1c, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0xb0, 0x2, [@TCA_U32_SEL={0xa4, 0x5, {0x7, 0x82, 0x9, 0x0, 0x8, 0x200, 0x9, 0x2, [{0xffff0001, 0xffff, 0x9, 0x7}, {0xe, 0x2c3, 0xb526, 0x110}, {0xc, 0x6, 0xfffff65d, 0x5}, {0x3, 0x9, 0x3ff, 0x6}, {0x7, 0x5b, 0x8, 0x6}, {0x4, 0x7, 0x0, 0x5}, {0x6, 0x4, 0x7, 0x4}, {0x4, 0x2, 0xffff6d1b, 0x3}, {0x3, 0x1, 0xaf, 0x401}]}}, @TCA_U32_LINK={0x8, 0x3, 0x1}]}}]}, 0xdc}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x38, 0x38, 0x4, [@var={0x2, 0x0, 0x0, 0x11, 0x4}, @const={0x0, 0x0, 0x0, 0x2, 0x3}, @func_proto={0x2, 0x0, 0x0, 0x12, 0x2}, @var={0x2, 0x0, 0x0, 0xe, 0x3}]}, {0x0, [0x0, 0x61]}}, 0x0, 0x54}, 0x20) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x27, 0x301, 0x270bda5, 0x25dfdbfa, {0x1}}, 0x14}}, 0x80) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) 0s ago: executing program 0 (id=4713): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(r1, 0x84, 0x73, &(0x7f00000000c0)=""/47, &(0x7f0000000040)=0x2f) (async) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, 0x0, &(0x7f0000000100)) (async) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000080)={@broadcast, @empty, @remote}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x4, &(0x7f0000000000)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x88}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="bc010000190001000000000000000000000000000000ac06bf0750d3ae41d9d64cb35584b2698b0a73bf1877f818940064b62a1af8adbc2b53531af8e948e18e1414bb000000000000000000000000000012f0bb93ceeffe0e92cdcdf5f10e135db3646dee2dc3b4724d3688332454194e544696c0f89be224816701c626cd48aecbb5526569bcf5375288e4f109099acbf5f3b1eb5121046ad6e76152597a457add8000822017f5974b5526", @ANYRES32=0x0, @ANYRES32], 0x1bc}}, 0x0) syz_emit_ethernet(0x70, &(0x7f0000000000)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xd}, @void, {@mpls_uc={0x8847, {[{0x1}, {0x7}, {0x8, 0x0, 0x1}, {0x8001, 0x0, 0x1}, {0x689a}, {0xe40f}, {0x1, 0x0, 0x1}, {0x80, 0x0, 0x1}, {0xc6}], @generic="83da143f535baa2627077a1861d3d6d3a2bb289a4dcc000c181c68577688f1ae4caa6d445df38f77e39bedd238e1aa0c0c5a50ad9bf03b5dde47e6cf2365"}}}}, 0x0) kernel console output (not intermixed with test programs): 0 to HW filter on device netdevsim0 [ 420.974725][T17094] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3050'. [ 420.988538][T16788] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 421.009395][T16788] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 421.032727][T16788] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 421.071405][T16788] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 421.095846][T16788] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 421.118308][T16788] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 421.294748][T17108] netlink: 'syz.1.3053': attribute type 6 has an invalid length. [ 421.315806][T17108] netlink: 'syz.1.3053': attribute type 5 has an invalid length. [ 421.357627][T17113] netlink: 'syz.0.3055': attribute type 9 has an invalid length. [ 421.499779][T16788] 8021q: adding VLAN 0 to HW filter on device bond0 [ 421.584759][T16788] 8021q: adding VLAN 0 to HW filter on device team0 [ 421.617711][T12718] bridge0: port 1(bridge_slave_0) entered blocking state [ 421.625015][T12718] bridge0: port 1(bridge_slave_0) entered forwarding state [ 421.636308][T17122] netlink: 'syz.4.3059': attribute type 1 has an invalid length. [ 421.658623][T17123] netlink: 'syz.4.3059': attribute type 1 has an invalid length. [ 421.696308][T12718] bridge0: port 2(bridge_slave_1) entered blocking state [ 421.703584][T12718] bridge0: port 2(bridge_slave_1) entered forwarding state [ 421.821879][T17126] IPv6: Can't replace route, no match found [ 421.831170][T17126] IPv6: Can't replace route, no match found [ 421.859589][T17128] xt_socket: unknown flags 0x8 [ 422.303429][T17147] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 422.552790][T17167] netlink: 'syz.0.3072': attribute type 2 has an invalid length. [ 422.568233][T17167] : entered promiscuous mode [ 422.714606][T17171] geneve3: entered promiscuous mode [ 422.725461][T17171] geneve3: entered allmulticast mode [ 422.747220][ T6522] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 422.771617][ T6522] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 422.799591][ T6522] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 422.819691][ T6522] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 423.058971][T17187] netlink: 'syz.0.3076': attribute type 2 has an invalid length. [ 423.108527][T16788] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 423.276129][T16788] veth0_vlan: entered promiscuous mode [ 423.293449][T17198] __nla_validate_parse: 13 callbacks suppressed [ 423.293471][T17198] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3080'. [ 423.316643][T17197] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3079'. [ 423.316815][T17200] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3079'. [ 423.345130][T17197] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3079'. [ 423.359143][T16788] veth1_vlan: entered promiscuous mode [ 423.375954][T17200] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3079'. [ 423.496645][T16788] veth0_macvtap: entered promiscuous mode [ 423.522121][T16788] veth1_macvtap: entered promiscuous mode [ 423.580610][T16788] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 423.643525][T16788] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 423.694705][T12711] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.754515][T12711] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.783307][T12711] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.818512][T12711] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.886432][T17225] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3089'. [ 423.895836][T17225] netlink: 'syz.4.3089': attribute type 10 has an invalid length. [ 423.903951][T17225] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3089'. [ 423.951202][T17225] geneve4: entered promiscuous mode [ 423.956600][T17225] geneve4: entered allmulticast mode [ 424.446923][T17248] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3093'. [ 424.457150][T17248] netlink: 'syz.3.3093': attribute type 30 has an invalid length. [ 426.270677][T12711] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.301315][T12711] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.334285][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 426.338067][T12711] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.365462][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 426.420683][T12711] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.508511][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 426.530458][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 426.560673][T17262] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3094'. [ 426.602538][T17259] bond1: option lp_interval: invalid value (0) [ 426.613523][T17262] netlink: 'syz.1.3094': attribute type 10 has an invalid length. [ 426.629780][T17259] bond1: option lp_interval: allowed values 1 - 2147483647 [ 426.643614][T17262] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3094'. [ 426.662484][T17259] bond1 (unregistering): Released all slaves [ 426.735680][T17262] geneve3: entered promiscuous mode [ 426.785304][T17262] geneve3: entered allmulticast mode [ 426.871666][T17272] netlink: 'syz.2.2960': attribute type 1 has an invalid length. [ 426.933465][T17272] netlink: 'syz.2.2960': attribute type 1 has an invalid length. [ 426.969470][T17272] netlink: 'syz.2.2960': attribute type 1 has an invalid length. [ 427.003174][T17272] netlink: 'syz.2.2960': attribute type 1 has an invalid length. [ 427.037760][T17272] netlink: 'syz.2.2960': attribute type 1 has an invalid length. [ 427.074745][T17272] netlink: 'syz.2.2960': attribute type 1 has an invalid length. [ 427.330816][ T50] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 427.344239][ T50] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 427.355559][ T50] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 427.369891][ T50] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 427.387855][ T50] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 427.980364][ T6532] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 427.992853][ T6532] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.005659][ T6532] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 428.035980][T17305] IPVS: lc: FWM 3 0x00000003 - no destination available [ 428.424397][T17320] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 428.457055][T17326] validate_nla: 63 callbacks suppressed [ 428.457074][T17326] netlink: 'syz.1.3107': attribute type 2 has an invalid length. [ 428.478466][ T6532] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.495330][T17326] __nla_validate_parse: 6 callbacks suppressed [ 428.495349][T17326] netlink: 188 bytes leftover after parsing attributes in process `syz.1.3107'. [ 428.528514][ T6532] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.538226][T17320] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 428.562644][ T6532] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 428.718328][T17331] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3111'. [ 428.751819][T17331] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3111'. [ 428.856306][ T6532] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.880845][ T6532] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.917714][ T6532] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 429.076257][T17340] geneve3: entered promiscuous mode [ 429.398349][ T6532] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 429.427380][ T6532] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 429.443478][ T6532] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 429.477898][T17283] lo speed is unknown, defaulting to 1000 [ 429.484678][ T5640] Bluetooth: hci1: command tx timeout [ 429.496871][T17351] Cannot find set identified by id 65534 to match [ 429.728272][T17359] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3119'. [ 429.773833][T17359] netlink: 35 bytes leftover after parsing attributes in process `syz.2.3119'. [ 429.827642][T17359] netlink: 'syz.2.3119': attribute type 5 has an invalid length. [ 429.881385][T17359] netlink: 'syz.2.3119': attribute type 6 has an invalid length. [ 429.909391][T17359] netlink: 35 bytes leftover after parsing attributes in process `syz.2.3119'. [ 430.036301][T17366] bond1: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 430.061084][T17366] bond1 (unregistering): Released all slaves [ 430.188885][ T6532] batadv1: left allmulticast mode [ 430.206911][ T6532] batadv1: left promiscuous mode [ 430.222663][ T6532] bridge0: port 3(batadv1) entered disabled state [ 430.254934][ T6532] bridge_slave_1: left allmulticast mode [ 430.272309][ T6532] bridge_slave_1: left promiscuous mode [ 430.285451][ T6532] bridge0: port 2(bridge_slave_1) entered disabled state [ 430.344305][ T6532] bridge_slave_0: left allmulticast mode [ 430.358203][ T6532] bridge_slave_0: left promiscuous mode [ 430.376602][ T6532] bridge0: port 1(bridge_slave_0) entered disabled state [ 430.581285][ T6532] pim6reg527: left allmulticast mode [ 430.606007][ T6532] pimreg3: left allmulticast mode [ 431.264737][ T6532] bond4 (unregistering): (slave gretap1): Releasing active interface [ 431.527200][ T6532] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 431.539324][ T6532] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 431.553531][ T6532] bond0 (unregistering): Released all slaves [ 431.561402][ T5640] Bluetooth: hci1: command tx timeout [ 431.575625][ T6532] bond1 (unregistering): Released all slaves [ 431.605150][ T6532] bond2 (unregistering): Released all slaves [ 431.632674][ T6532] bond3 (unregistering): Released all slaves [ 431.655847][ T6532] bond4 (unregistering): Released all slaves [ 431.684242][ T6532] bond5 (unregistering): Released all slaves [ 431.706553][ T6532] bond6 (unregistering): Released all slaves [ 431.734778][ T6532] bond7 (unregistering): Released all slaves [ 432.071478][ T6532] tipc: Left network mode [ 432.196892][T17412] tipc: New replicast peer: 255.255.255.255 [ 432.233661][T17412] tipc: Enabled bearer , priority 10 [ 432.852818][T17448] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3134'. [ 433.146574][T17448] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 433.155234][T17448] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 433.181184][T17448] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3134'. [ 433.228753][T17455] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3134'. [ 433.338252][T17448] hsr_slave_0: left promiscuous mode [ 433.383884][T17448] hsr_slave_1: left promiscuous mode [ 433.493096][T17464] dvmrp0: left allmulticast mode [ 433.505012][T17464] dvmrp8: left allmulticast mode [ 433.638213][T17490] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3138'. [ 433.647565][ T5640] Bluetooth: hci1: command tx timeout [ 433.653759][T17490] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3138'. [ 433.669689][T17471] pimreg: entered allmulticast mode [ 433.675959][T17490] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3138'. [ 433.687015][T17490] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3138'. [ 433.710045][T17491] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3139'. [ 434.150714][T17283] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.187655][T17283] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.213669][T17283] bridge_slave_0: entered allmulticast mode [ 434.222140][T17283] bridge_slave_0: entered promiscuous mode [ 434.251654][T17283] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.269358][T17283] bridge0: port 2(bridge_slave_1) entered disabled state [ 434.294032][T17283] bridge_slave_1: entered allmulticast mode [ 434.339551][T17283] bridge_slave_1: entered promiscuous mode [ 434.512173][T17517] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3145'. [ 434.584750][T17522] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3146'. [ 434.830991][T17517] veth0_macvtap: left allmulticast mode [ 434.843081][T17517] veth0_macvtap: left promiscuous mode [ 434.958088][T17283] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 434.981555][T17535] netlink: 768 bytes leftover after parsing attributes in process `syz.3.3149'. [ 434.996618][T17283] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 435.062408][ T6532] hsr_slave_0: left promiscuous mode [ 435.095602][ T6532] hsr_slave_1: left promiscuous mode [ 435.128841][ T6532] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 435.145536][ T6532] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 435.205277][ T6532] veth1_macvtap: left promiscuous mode [ 435.225327][ T6532] veth0_macvtap: left promiscuous mode [ 435.240938][ T6532] veth1_vlan: left promiscuous mode [ 435.266673][ T6532] veth0_vlan: left promiscuous mode [ 435.299886][T17555] netlink: 'syz.1.3153': attribute type 10 has an invalid length. [ 435.386381][T17547] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3151'. [ 435.727042][ T5640] Bluetooth: hci1: command tx timeout [ 436.052050][T17555] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 436.062155][T17555] .`: (slave batadv0): Enslaving as an active interface with an up link [ 436.071387][T12718] smbdirect: ib_dev[syú2] removed [ 436.128606][T17556] bond0 (unregistering): Released all slaves [ 436.186987][T17547] team0: Port device syz_tun removed [ 436.204354][ T5287] 8021q: adding VLAN 0 to HW filter on device eth1 [ 436.266444][T17283] team0: Port device team_slave_0 added [ 436.303381][T17283] team0: Port device team_slave_1 added [ 436.428170][T17579] netlink: 'syz.2.3158': attribute type 3 has an invalid length. [ 436.462403][T17283] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 436.490358][T17283] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 436.529377][T17583] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3158'. [ 436.552599][T17283] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 436.578231][T17283] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 436.599327][T17283] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 436.698993][T17283] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 436.746456][T17594] netlink: 'syz.0.3160': attribute type 13 has an invalid length. [ 436.970447][ T11] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 437.066752][T17283] hsr_slave_0: entered promiscuous mode [ 437.078471][T17283] hsr_slave_1: entered promiscuous mode [ 437.313448][T17614] veth0: entered promiscuous mode [ 437.322289][T17615] batadv_slave_1: entered promiscuous mode [ 437.346744][T17613] batadv_slave_1: left promiscuous mode [ 437.369654][T17613] veth0: left promiscuous mode [ 437.402988][T16625] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 437.462571][T17622] netlink: 'syz.1.3168': attribute type 2 has an invalid length. [ 437.484547][T17622] netlink: 'syz.1.3168': attribute type 11 has an invalid length. [ 438.955902][T17698] syzkaller0: entered promiscuous mode [ 438.975332][T17698] syzkaller0: entered allmulticast mode [ 439.046473][T17283] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 439.076545][T17283] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 439.091988][T17708] __nla_validate_parse: 6 callbacks suppressed [ 439.092006][T17708] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3192'. [ 439.167249][T17283] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 439.192350][T17283] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 439.208815][T17283] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 439.267031][T17283] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 439.288551][T17283] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 439.309638][T17283] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 439.786005][T17283] 8021q: adding VLAN 0 to HW filter on device bond0 [ 439.870252][T17283] 8021q: adding VLAN 0 to HW filter on device team0 [ 439.890977][T17754] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 439.917302][T12718] bridge0: port 1(bridge_slave_0) entered blocking state [ 439.924560][T12718] bridge0: port 1(bridge_slave_0) entered forwarding state [ 439.984800][ T6522] bridge0: port 2(bridge_slave_1) entered blocking state [ 439.992080][ T6522] bridge0: port 2(bridge_slave_1) entered forwarding state [ 440.123895][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.555054][T17775] netlink: 'syz.1.3204': attribute type 1 has an invalid length. [ 440.739328][T17775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 441.244798][T17810] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3210'. [ 441.277672][T17811] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 441.416665][T17811] A link change request failed with some changes committed already. Interface vxlan1 may have been left with an inconsistent configuration, please check. [ 441.475557][T17819] erspan0: entered promiscuous mode [ 441.903616][T17840] sctp: [Deprecated]: syz.0.3216 (pid 17840) Use of int in max_burst socket option deprecated. [ 441.903616][T17840] Use struct sctp_assoc_value instead [ 441.985104][T17283] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 442.259886][T17864] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3222'. [ 442.499922][T17868] bond10: Unable to set peer notification delay as MII monitoring is disabled [ 442.536639][T17868] bond10 (unregistering): Released all slaves [ 442.587456][T17870] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3224'. [ 442.607253][T17881] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3226'. [ 442.665173][T17283] veth0_vlan: entered promiscuous mode [ 442.686512][T17283] veth1_vlan: entered promiscuous mode [ 442.777647][T17283] veth0_macvtap: entered promiscuous mode [ 442.789815][T17283] veth1_macvtap: entered promiscuous mode [ 442.827442][T17283] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 442.850227][T17888] block nbd0: Unsupported socket: should be TCP or UNIX. [ 442.874027][T17283] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 442.917093][ T12] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.948794][ T12] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.992751][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.017968][ T12] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.244382][T12711] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 443.255629][T12711] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 443.386633][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 443.411409][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 443.893784][T17935] syzkaller0: entered promiscuous mode [ 443.914409][T17935] syzkaller0: entered allmulticast mode [ 444.212145][T17947] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3244'. [ 444.245365][ T50] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 444.264863][ T50] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 444.279057][ T50] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 444.292641][ T50] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 444.308567][ T50] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 445.445939][T18010] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3258'. [ 445.471032][T18010] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3258'. [ 445.617766][T18012] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3259'. [ 445.635486][T18012] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3259'. [ 446.361636][ T5640] Bluetooth: hci2: command tx timeout [ 446.435165][T18036] netlink: 'syz.2.3269': attribute type 2 has an invalid length. [ 446.448209][T18036] ieee802154 phy0 wpan0: encryption failed: -22 [ 446.583091][T18043] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3270'. [ 446.746943][T18046] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3271'. [ 447.067106][T17952] bridge0: port 1(bridge_slave_0) entered blocking state [ 447.090799][T17952] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.108114][T17952] bridge_slave_0: entered allmulticast mode [ 447.121592][T17952] bridge_slave_0: entered promiscuous mode [ 447.135465][T18057] netlink: 'syz.2.3272': attribute type 11 has an invalid length. [ 447.152145][T17952] bridge0: port 2(bridge_slave_1) entered blocking state [ 447.185958][T17952] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.200801][T17952] bridge_slave_1: entered allmulticast mode [ 447.208857][T17952] bridge_slave_1: entered promiscuous mode [ 447.259129][T18060] netlink: 'syz.3.3275': attribute type 12 has an invalid length. [ 447.267252][T18060] netlink: 'syz.3.3275': attribute type 29 has an invalid length. [ 447.275638][T18060] netlink: 148 bytes leftover after parsing attributes in process `syz.3.3275'. [ 447.285248][T18060] netlink: 'syz.3.3275': attribute type 1 has an invalid length. [ 447.293425][T18060] netlink: 'syz.3.3275': attribute type 2 has an invalid length. [ 447.301569][T18060] netlink: 11 bytes leftover after parsing attributes in process `syz.3.3275'. [ 447.362322][T18060] batman_adv: batadv0: adding TT local entry aa:aa:aa:aa:aa:17 to non-existent VLAN 1303 [ 447.426051][T18062] tipc: Enabling of bearer rejected, failed to enable media [ 447.448499][T17952] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 447.487784][T17952] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 447.642882][T17952] team0: Port device team_slave_0 added [ 447.670929][T17952] team0: Port device team_slave_1 added [ 447.697851][T18070] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3276'. [ 447.784821][T17952] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 447.792675][T17952] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 447.822312][T17952] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 447.869022][T17952] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 447.879484][T17952] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 447.994114][T17952] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 448.067251][T18078] hsr0: entered promiscuous mode [ 448.139033][T17952] hsr_slave_0: entered promiscuous mode [ 448.147120][T17952] hsr_slave_1: entered promiscuous mode [ 448.157240][T17952] debugfs: 'hsr0' already exists in 'hsr' [ 448.164266][T17952] Cannot create hsr debugfs directory [ 448.453265][T18080] syzkaller0: entered promiscuous mode [ 448.459000][T18080] syzkaller0: entered allmulticast mode [ 448.470155][ T5640] Bluetooth: hci2: command tx timeout [ 448.883873][T17952] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 448.900489][T17952] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 448.937675][T18104] vcan0: tx drop: invalid sa for name 0x0000000000000002 [ 449.157976][T17952] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 449.216112][T17952] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.399728][T18109] bridge0: port 2(bridge_slave_1) entered disabled state [ 449.407511][T18109] bridge0: port 1(bridge_slave_0) entered disabled state [ 449.609633][T18109] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 449.670058][T18119] __nla_validate_parse: 2 callbacks suppressed [ 449.670080][T18119] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3292'. [ 449.688095][T18109] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 450.375985][ T6518] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 450.472204][T17952] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 450.518267][T17952] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 450.531515][ T5640] Bluetooth: hci2: command tx timeout [ 450.549814][ T6518] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 450.559858][ T6518] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 450.597840][ T6518] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 450.699798][T18135] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3295'. [ 450.738077][T18128] bridge0: port 2(bridge_slave_1) entered disabled state [ 450.745941][T18128] bridge0: port 1(bridge_slave_0) entered disabled state [ 450.938457][T18128] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 450.975941][T18128] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 451.167299][T18019] Set syz1 is full, maxelem 65536 reached [ 451.259872][T18143] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 451.473041][T17952] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 451.494937][T17952] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.554399][T18138] IPVS: Unknown mcast interface: nr0 [ 451.571450][ T36] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 451.598539][ T36] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.709620][ T36] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 451.737360][ T36] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.769912][ T36] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 451.789652][ T36] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 451.803976][T18162] veth1_macvtap: left promiscuous mode [ 451.907566][ T6548] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 451.930684][ T6548] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.600576][ T5640] Bluetooth: hci2: command tx timeout [ 452.932936][ T5287] veth1_macvtap: entered promiscuous mode [ 453.113415][T17952] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 453.147848][T17952] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 453.167150][T17952] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 453.233267][T17952] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 453.261415][T17952] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 453.278636][T17952] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 453.288568][T17952] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 453.317166][T17952] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 453.405370][T18215] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 453.599409][T18226] tipc: Started in network mode [ 453.605412][T18226] tipc: Node identity 0aa23b3c7605, cluster identity 4711 [ 453.613323][T18226] tipc: Enabled bearer , priority 0 [ 453.684227][T18226] syzkaller0: entered promiscuous mode [ 453.703513][T18226] syzkaller0: entered allmulticast mode [ 453.721773][T18226] tipc: Resetting bearer [ 453.735775][T18233] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3314'. [ 453.766241][T18225] tipc: Resetting bearer [ 453.835435][T18230] netlink: 'syz.4.3314': attribute type 1 has an invalid length. [ 455.220807][T18256] netlink: 'syz.2.3318': attribute type 25 has an invalid length. [ 456.382292][T18225] tipc: Disabling bearer [ 456.396978][T18230] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 456.405231][T18246] IPVS: Unknown mcast interface: vcan0 [ 456.422445][ T5738] tipc: Node number set to 2091334460 [ 456.435322][T18259] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3319'. [ 456.596601][T17952] 8021q: adding VLAN 0 to HW filter on device bond0 [ 456.683913][T17952] 8021q: adding VLAN 0 to HW filter on device team0 [ 456.706650][T12711] bridge0: port 1(bridge_slave_0) entered blocking state [ 456.713886][T12711] bridge0: port 1(bridge_slave_0) entered forwarding state [ 456.809642][ T6522] bridge0: port 2(bridge_slave_1) entered blocking state [ 456.816913][ T6522] bridge0: port 2(bridge_slave_1) entered forwarding state [ 456.915531][T18278] sctp: [Deprecated]: syz.2.3324 (pid 18278) Use of int in maxseg socket option. [ 456.915531][T18278] Use struct sctp_assoc_value instead [ 457.463899][T18304] xt_hashlimit: size too large, truncated to 1048576 [ 457.545200][T18311] : renamed from ip6_vti0 (while UP) [ 457.714867][T18320] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3333'. [ 457.976792][T18333] netlink: 100 bytes leftover after parsing attributes in process `syz.2.3336'. [ 458.315222][T17952] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 458.335792][T18340] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3337'. [ 458.419855][T18347] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3338'. [ 458.486265][T17952] veth0_vlan: entered promiscuous mode [ 458.596310][T18347] 8021q: adding VLAN 0 to HW filter on device .` [ 458.721741][T18359] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3339'. [ 458.736722][T18359] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3339'. [ 458.828442][T18347] 8021q: adding VLAN 0 to HW filter on device bond2 [ 458.857843][T18347] bridge0: port 3(batadv1) entered blocking state [ 458.864500][T18347] bridge0: port 3(batadv1) entered forwarding state [ 458.877011][T18347] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 458.911047][T18347] 8021q: adding VLAN 0 to HW filter on device bond9 [ 458.919081][T18347] veth0_macvtap: entered promiscuous mode [ 458.953067][T17952] veth1_vlan: entered promiscuous mode [ 459.110779][T18367] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3341'. [ 459.123061][T18367] netlink: 'syz.2.3341': attribute type 7 has an invalid length. [ 459.131960][T18367] netlink: 'syz.2.3341': attribute type 8 has an invalid length. [ 459.140164][T18367] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3341'. [ 459.166457][T12711] bond8: (slave veth0_to_bond): link status definitely up, 10000 Mbps full duplex [ 459.178035][T18367] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3341'. [ 459.189851][T12711] bond8: (slave veth0_to_bond): making interface the new active one [ 459.205213][T12711] bond8: active interface up! [ 459.214831][T18367] netlink: 'syz.2.3341': attribute type 32 has an invalid length. [ 459.324531][T18367] bond1: Setting coupled_control to off (0) [ 459.394952][T17952] veth0_macvtap: entered promiscuous mode [ 459.413821][T17952] veth1_macvtap: entered promiscuous mode [ 459.454660][T17952] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 459.492109][T17952] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 459.513476][ T6532] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.524008][ T6532] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.535641][ T6532] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.551112][ T6532] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 459.805473][ T6532] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 459.814900][ T6532] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 459.816841][T12718] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 459.838741][T12718] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 459.850268][ T11] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 459.861671][T18381] netlink: 'syz.2.3343': attribute type 12 has an invalid length. [ 459.869668][T18381] netlink: 'syz.2.3343': attribute type 29 has an invalid length. [ 459.879464][T18381] netlink: 'syz.2.3343': attribute type 3 has an invalid length. [ 459.888753][T18381] netlink: 'syz.2.3343': attribute type 2 has an invalid length. [ 460.163974][T18391] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 460.171278][T18391] syzkaller1: Linktype set failed because interface is up [ 460.190338][ T5790] syzkaller1: tun_net_xmit 90 [ 460.242544][T18396] syzkaller0: entered promiscuous mode [ 460.248055][T18396] syzkaller0: entered allmulticast mode [ 460.270394][ T5790] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 460.310201][ T5790] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 460.481941][T18402] bond10: entered promiscuous mode [ 460.487537][T18402] 8021q: adding VLAN 0 to HW filter on device bond10 [ 460.518887][T18401] 8021q: adding VLAN 0 to HW filter on device bond10 [ 460.527166][T18401] bond10: (slave sit1): The slave device specified does not support setting the MAC address [ 460.541139][T18401] bond10: (slave sit1): Error -95 calling set_mac_address [ 460.571419][T18402] bond10: (slave sit1): The slave device specified does not support setting the MAC address [ 460.582397][T18402] bond10: (slave sit1): Error -95 calling set_mac_address [ 460.870519][T18409] netlink: 'syz.1.3351': attribute type 1 has an invalid length. [ 460.879779][T18409] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 462.692781][T18376] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 462.816803][T12718] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 462.839546][T12718] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 464.120182][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 465.927502][T18424] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 466.229840][T18457] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 466.292019][T18454] ip6_vti0: entered promiscuous mode [ 466.309264][T18454] __nla_validate_parse: 6 callbacks suppressed [ 466.309282][T18454] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3362'. [ 466.427146][ T50] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 466.445542][ T50] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 466.456145][ T50] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 466.464826][ T50] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 466.474728][ T50] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 466.658515][T18466] syzkaller0: entered promiscuous mode [ 466.671670][T18466] syzkaller0: entered allmulticast mode [ 467.057777][T18492] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 467.182734][T18498] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3371'. [ 468.524476][ T5640] Bluetooth: hci3: command tx timeout [ 469.108756][T18491] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3369'. [ 469.620465][T18537] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3377'. [ 469.700808][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 469.735824][ T12] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.114537][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.128697][ T12] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.298348][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.338096][ T12] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.604513][ T5640] Bluetooth: hci3: command tx timeout [ 470.618696][ T12] netdevsim netdevsim1  (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 470.647873][ T12] netdevsim netdevsim1  (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 470.763968][T18585] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3389'. [ 470.789674][T18590] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3391'. [ 470.840203][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 471.084914][T18592] syzkaller1: entered promiscuous mode [ 471.100142][T18592] syzkaller1: entered allmulticast mode [ 471.216973][T18597] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3393'. [ 471.364039][T18600] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3395'. [ 471.384016][ T12] batadv1: left allmulticast mode [ 471.401964][ T12] batadv1: left promiscuous mode [ 471.414653][ T12] bridge0: port 3(batadv1) entered disabled state [ 471.422291][T18606] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3395'. [ 471.513599][ T12] pimreg: left allmulticast mode [ 471.647209][T18621] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3401'. [ 471.928103][ T12] bond6 (unregistering): (slave vti0): Releasing backup interface [ 471.936375][ T12] vti0 (unregistering): left promiscuous mode [ 472.197139][ T12] .` (unregistering): (slave batadv0): Releasing backup interface [ 472.212687][ T12] .` (unregistering): Released all slaves [ 472.230514][ T12] bond1 (unregistering): Released all slaves [ 472.247903][ T12] bond2 (unregistering): Released all slaves [ 472.265118][ T12] bond3 (unregistering): Released all slaves [ 472.282662][ T12] bond4 (unregistering): Released all slaves [ 472.305258][ T12] bond5 (unregistering): Released all slaves [ 472.335713][ T12] bond6 (unregistering): Released all slaves [ 472.354025][ T12] bond7 (unregistering): Released all slaves [ 472.380175][ T12] bond8 (unregistering): (slave veth0_to_bond): Releasing active interface [ 472.391331][ T12] bond8 (unregistering): Released all slaves [ 472.411347][ T12] bond9 (unregistering): Released all slaves [ 472.430552][ T12] bond0 (unregistering): Released all slaves [ 472.451332][ T12] bond10 (unregistering): Released all slaves [ 472.680645][ T5640] Bluetooth: hci3: command tx timeout [ 472.767926][ T12] : left promiscuous mode [ 472.789667][T18635] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3406'. [ 472.798920][T18635] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3406'. [ 472.939190][T18637] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 472.982388][T18637] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 473.316913][T18654] x_tables: duplicate underflow at hook 2 [ 473.344236][T18661] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3411'. [ 473.357852][ T12] tipc: Disabling bearer [ 473.373432][ T12] tipc: Left network mode [ 473.687881][T18673] netlink: 'syz.2.3413': attribute type 3 has an invalid length. [ 473.827345][T18681] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3416'. [ 473.976560][T18684] xt_policy: output policy not valid in PREROUTING and INPUT [ 474.101600][ T5287] 8021q: adding VLAN 0 to HW filter on device eth1 [ 474.265764][T18672] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3414'. [ 474.284180][T18468] bridge0: port 1(bridge_slave_0) entered blocking state [ 474.291624][T18468] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.299026][T18468] bridge_slave_0: entered allmulticast mode [ 474.313776][T18468] bridge_slave_0: entered promiscuous mode [ 474.463108][T18709] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3422'. [ 474.533103][T18468] bridge0: port 2(bridge_slave_1) entered blocking state [ 474.554115][T18468] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.569310][T18468] bridge_slave_1: entered allmulticast mode [ 474.588803][T18468] bridge_slave_1: entered promiscuous mode [ 474.617748][T18716] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3423'. [ 474.760824][ T5640] Bluetooth: hci3: command tx timeout [ 474.823564][T18468] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 474.848198][T18724] netlink: 'syz.4.3427': attribute type 2 has an invalid length. [ 474.862085][T18468] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 474.892255][T18724] netlink: 'syz.4.3427': attribute type 2 has an invalid length. [ 475.129157][T18468] team0: Port device team_slave_0 added [ 475.293166][T18468] team0: Port device team_slave_1 added [ 475.774677][T18759] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 475.803509][T18468] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 475.811169][T18468] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 475.844770][T18468] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 475.896752][T18762] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 475.948762][T18768] erspan0: entered promiscuous mode [ 476.093408][ T12] veth0_macvtap: left promiscuous mode [ 476.106492][ T12] veth1_vlan: left allmulticast mode [ 476.115603][ T12] veth1_vlan: left promiscuous mode [ 476.127325][ T12] veth0_vlan: left promiscuous mode [ 476.698874][T18468] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 476.706163][T18468] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 476.732284][T18468] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 476.778982][ T5287] 8021q: adding VLAN 0 to HW filter on device eth2 [ 476.967011][T18793] __nla_validate_parse: 3 callbacks suppressed [ 476.967033][T18793] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3440'. [ 476.989133][T18468] hsr_slave_0: entered promiscuous mode [ 477.030974][T18468] hsr_slave_1: entered promiscuous mode [ 477.043076][T18468] debugfs: 'hsr0' already exists in 'hsr' [ 477.056858][T18468] Cannot create hsr debugfs directory [ 477.067850][T18799] xt_l2tp: v2 doesn't support IP mode [ 477.097918][T18793] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3440'. [ 477.301901][T18809] netlink: 'syz.4.3445': attribute type 2 has an invalid length. [ 477.756896][T18836] xt_hashlimit: size too large, truncated to 1048576 [ 477.783882][T18822] bond2: option miimon: invalid value (18446744073709551614) [ 477.821382][T18822] bond2: option miimon: allowed values 0 - 2147483647 [ 477.856501][T18822] bond2 (unregistering): Released all slaves [ 477.998583][ T12] IPVS: stop unused estimator thread 0... [ 478.277149][T18861] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3458'. [ 478.315788][T18862] netlink: 'syz.4.3455': attribute type 4 has an invalid length. [ 478.450982][T18867] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3460'. [ 478.497416][T18867] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3460'. [ 478.737429][T18876] netlink: 'syz.2.3462': attribute type 10 has an invalid length. [ 478.759187][T18876] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3462'. [ 478.892127][T18876] team0: entered allmulticast mode [ 478.912093][T18876] team_slave_0: entered allmulticast mode [ 478.933601][T18876] team_slave_1: entered allmulticast mode [ 478.947428][T18876] bridge0: port 3(team0) entered blocking state [ 478.961045][T18876] bridge0: port 3(team0) entered disabled state [ 478.981019][T18876] team0: entered promiscuous mode [ 478.987739][T18876] team_slave_0: entered promiscuous mode [ 479.005859][T18876] team_slave_1: entered promiscuous mode [ 479.024227][T18876] bridge0: port 3(team0) entered blocking state [ 479.030720][T18876] bridge0: port 3(team0) entered forwarding state [ 479.065593][T18881] bridge0: port 3(veth1_to_bridge) entered blocking state [ 479.091132][T18881] bridge0: port 3(veth1_to_bridge) entered disabled state [ 479.123154][T18881] veth1_to_bridge: entered allmulticast mode [ 479.154183][T18881] veth1_to_bridge: entered promiscuous mode [ 479.813265][T18911] syzkaller0: entered promiscuous mode [ 479.831172][T18911] syzkaller0: entered allmulticast mode [ 479.885334][T18908] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3474'. [ 479.922794][T18908] openvswitch: netlink: Flow key attr not present in new flow. [ 480.039143][T18468] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 480.067890][T18468] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 480.089091][T18468] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 480.112139][T18468] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 480.172277][T18468] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 480.209631][T18468] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 480.255378][T18468] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 480.280222][T18468] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 480.528691][T18953] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3483'. [ 480.657242][T18468] 8021q: adding VLAN 0 to HW filter on device bond0 [ 480.745286][T18468] 8021q: adding VLAN 0 to HW filter on device team0 [ 480.764445][T18965] netlink: 'syz.3.3486': attribute type 10 has an invalid length. [ 480.779768][ T6548] bridge0: port 1(bridge_slave_0) entered blocking state [ 480.787004][ T6548] bridge0: port 1(bridge_slave_0) entered forwarding state [ 480.814722][T18965] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 480.868811][T18965] bond0: (slave batadv0): Releasing backup interface [ 480.937848][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 480.945212][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 481.345600][T18997] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci3/hci3:200/input5 [ 481.793658][T19023] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3500'. [ 481.916224][T19032] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 481.942907][T19024] bond4: invalid ARP target 0.0.0.0 specified for addition [ 481.978324][T19024] bond4: option arp_ip_target: invalid value (0) [ 482.009530][T19024] bond4 (unregistering): Released all slaves [ 482.174095][T19023] bond4: invalid ARP target 0.0.0.0 specified for addition [ 482.192659][T19023] bond4: option arp_ip_target: invalid value (0) [ 482.210972][T19023] bond4 (unregistering): Released all slaves [ 482.581242][T19067] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3508'. [ 482.653911][T19071] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3510'. [ 483.027687][T19086] tc action pedit offset 132 out of bounds [ 483.108480][T19086] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3514'. [ 483.200892][T19094] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3516'. [ 483.237980][T18468] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 483.388089][T19110] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3518'. [ 483.481743][T18468] veth0_vlan: entered promiscuous mode [ 483.530227][T18468] veth1_vlan: entered promiscuous mode [ 483.540907][T19110] netlink: 'syz.0.3518': attribute type 8 has an invalid length. [ 483.717937][T18468] veth0_macvtap: entered promiscuous mode [ 483.763091][T18468] veth1_macvtap: entered promiscuous mode [ 483.846522][T18468] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 483.870755][T19124] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3522'. [ 483.927105][T18468] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 483.939774][T19126] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3523'. [ 483.964706][T19126] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3523'. [ 483.975544][T19128] x_tables: duplicate entry at hook 3 [ 484.084389][ T6532] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.130928][ T6532] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.165688][ T6532] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.192816][ T6532] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.364237][T19148] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3527'. [ 484.386247][T19148] openvswitch: netlink: Message has 4 unknown bytes. [ 484.444127][T19147] bridge_slave_0: invalid flags given to default FDB implementation [ 484.483770][T19147] netlink: 'syz.0.3526': attribute type 9 has an invalid length. [ 484.630055][ T6552] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 484.686558][ T6552] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 484.781063][ T6532] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 484.799413][ T6532] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 485.077054][T19178] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3533'. [ 485.120096][T19178] netlink: 'syz.4.3533': attribute type 20 has an invalid length. [ 485.163301][ T12] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 485.172363][T19178] netlink: 'syz.4.3533': attribute type 20 has an invalid length. [ 485.190121][ T12] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 485.217016][ T12] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 485.254088][ T6539] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 485.354170][T19189] tipc: Started in network mode [ 485.378568][T19189] tipc: Node identity a276d43517b8, cluster identity 4711 [ 485.406821][T19189] tipc: Enabled bearer , priority 0 [ 485.548582][T19189] syzkaller0: entered promiscuous mode [ 485.555338][T19189] syzkaller0: entered allmulticast mode [ 485.580764][T19189] tipc: Resetting bearer [ 485.787841][T19203] netlink: 'syz.2.3536': attribute type 1 has an invalid length. [ 485.865576][T19205] nbd: must specify a size in bytes for the device [ 485.978633][ T6560] tipc: Resetting bearer [ 486.175129][T19228] nbd: must specify a device to reconfigure [ 486.223976][T19203] 8021q: adding VLAN 0 to HW filter on device bond2 [ 486.263642][T19207] bond2: (slave geneve2): making interface the new active one [ 486.277708][T19207] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 486.332316][T19175] tipc: Resetting bearer [ 488.297050][T19175] tipc: Disabling bearer [ 488.346395][T19232] vlan2: entered promiscuous mode [ 488.352471][T19232] hsr0: entered promiscuous mode [ 488.357901][T19232] vlan2: entered allmulticast mode [ 488.364253][T19232] hsr0: entered allmulticast mode [ 488.369457][T19232] hsr_slave_0: entered allmulticast mode [ 488.375854][T19232] hsr_slave_1: entered allmulticast mode [ 488.385602][ T5790] tipc: Node number set to 3050230837 [ 488.529209][T19239] xt_l2tp: v2 doesn't support IP mode [ 488.588894][T19244] __nla_validate_parse: 8 callbacks suppressed [ 488.588984][T19244] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3545'. [ 488.605785][T19244] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3545'. [ 491.009872][T19265] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 491.055275][T19272] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.3551'. [ 491.778511][T19318] bridge0: port 3(syz_tun) entered blocking state [ 491.807052][T19318] bridge0: port 3(syz_tun) entered disabled state [ 491.842919][T19318] syz_tun: entered allmulticast mode [ 491.895530][T19324] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3564'. [ 491.915685][T19318] syz_tun: entered promiscuous mode [ 491.948313][T19318] bridge0: adding interface syz_tun with same address as a received packet (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 491.983713][T19318] bridge0: adding interface syz_tun with same address as a received packet (addr:aa:aa:aa:aa:aa:aa, vlan:1) [ 491.997714][T19318] bridge0: port 3(syz_tun) entered blocking state [ 492.006486][T19318] bridge0: port 3(syz_tun) entered forwarding state [ 492.026003][ T5287] veth1_vlan: left promiscuous mode [ 492.049358][T19330] IPv6: sit1: Disabled Multicast RS [ 492.098696][T19320] netlink: 'syz.2.3563': attribute type 19 has an invalid length. [ 492.162224][T19322] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3563'. [ 492.234149][T19337] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3567'. [ 492.313665][T19345] netlink: 'syz.4.3569': attribute type 39 has an invalid length. [ 492.337168][T19343] x_tables: ip6_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 492.476365][T19322] 8021q: adding VLAN 0 to HW filter on device bond3 [ 492.487630][T19354] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3570'. [ 492.493216][ T36] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 492.530145][ T36] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 492.563871][ T36] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 492.689348][ T36] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 492.931671][T19375] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3574'. [ 493.330608][T19392] vlan2: entered promiscuous mode [ 493.364071][T19392] bridge0: entered promiscuous mode [ 493.479757][T19403] netlink: 'syz.2.3582': attribute type 9 has an invalid length. [ 493.934353][T19432] bridge2: entered promiscuous mode [ 493.943698][T19432] bridge2: entered allmulticast mode [ 493.970519][T19432] team0: Port device bridge2 added [ 493.986336][T19437] bridge0: port 3(team0) entered blocking state [ 494.011472][T19437] bridge0: port 3(team0) entered disabled state [ 494.034412][T19437] team0: entered allmulticast mode [ 494.054571][T19437] team_slave_0: entered allmulticast mode [ 494.068822][T19437] team_slave_1: entered allmulticast mode [ 494.104056][T19437] team0: entered promiscuous mode [ 494.127652][T19443] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3588'. [ 494.140531][T19437] team_slave_0: entered promiscuous mode [ 494.158169][T19437] team_slave_1: entered promiscuous mode [ 494.362678][T19455] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3590'. [ 494.384676][T19456] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3591'. [ 494.394390][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.420252][T19456] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3591'. [ 494.430614][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.439369][T19456] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3591'. [ 494.447507][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.463457][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.474779][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.486344][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.488915][T19456] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3591'. [ 494.502103][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.527462][T19456] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3591'. [ 494.536890][T19456] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3591'. [ 494.546416][T19456] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3591'. [ 494.546417][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.546785][T19456] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3591'. [ 494.578227][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.591080][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.604570][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.615833][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.633298][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.644419][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.658099][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.671077][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.684221][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.695680][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.708681][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.720792][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.731923][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.745558][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.756617][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.769753][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.781091][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.792199][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.803375][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.814752][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.825873][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.838433][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.849663][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.861014][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 494.872494][T19457] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 496.449005][T19401] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 496.772339][T19537] macvtap1: entered promiscuous mode [ 496.789879][T19537] macvtap1: entered allmulticast mode [ 496.819692][T19537] veth1_vlan: entered allmulticast mode [ 496.928169][T19542] macvtap2: entered promiscuous mode [ 496.949371][T19542] macvtap2: entered allmulticast mode [ 497.020556][T19547] 8021q: VLANs not supported on ip_vti0 [ 497.215618][T19560] netlink: 'syz.2.3602': attribute type 9 has an invalid length. [ 497.243492][T19558] netlink: 'syz.2.3602': attribute type 9 has an invalid length. [ 497.277983][T19563] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 497.311845][T19563] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 498.061844][T19617] vlan3: entered allmulticast mode [ 498.565974][T19650] openvswitch: netlink: Key 6 has unexpected len 0 expected 2 [ 498.575829][ T6544] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 498.618436][ T6544] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.688713][T19660] Cannot find add_set index 4 as target [ 499.137007][T19683] __nla_validate_parse: 30 callbacks suppressed [ 499.137028][T19683] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3634'. [ 499.196442][T19683] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3634'. [ 499.221297][T19687] xt_hashlimit: size too large, truncated to 1048576 [ 499.579894][T19692] bridge_slave_0 (unregistering): left allmulticast mode [ 499.588827][T19692] bridge_slave_0 (unregistering): left promiscuous mode [ 499.599090][T19692] bridge0: port 1(bridge_slave_0) entered disabled state [ 499.909533][T19712] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3644'. [ 499.930987][T19712] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3644'. [ 499.983946][T19716] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3643'. [ 500.037789][T19722] netlink: 256 bytes leftover after parsing attributes in process `syz.0.3645'. [ 500.053108][T19716] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3643'. [ 500.170854][T19726] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3645'. [ 500.228346][T19729] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3647'. [ 500.321125][T19739] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3650'. [ 501.480457][ T50] Bluetooth: hci3: command 0x0405 tx timeout [ 501.493008][T19800] Cannot find set identified by id 0 to match [ 501.511721][T19801] Cannot find set identified by id 0 to match [ 501.545463][T19800] openvswitch: netlink: Message has 12 unknown bytes. [ 501.563970][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.599536][T19800] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 502.045686][T19829] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 502.609652][T19866] dvmrp0: entered allmulticast mode [ 503.418791][T19919] xt_policy: output policy not valid in PREROUTING and INPUT [ 503.632864][T19926] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 503.639528][T19924] netlink: 'syz.0.3694': attribute type 4 has an invalid length. [ 504.176478][T19945] team0 (unregistering): Port device team_slave_0 removed [ 504.197085][T19948] __nla_validate_parse: 14 callbacks suppressed [ 504.197105][T19948] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3699'. [ 504.284007][T19945] team0 (unregistering): Port device team_slave_1 removed [ 504.456153][T19953] IPv6: sit2: Disabled Multicast RS [ 505.063826][T19983] netlink: 'syz.3.3708': attribute type 1 has an invalid length. [ 505.208878][T19993] netlink: 'syz.0.3710': attribute type 21 has an invalid length. [ 505.265736][T19983] bond4: entered promiscuous mode [ 505.274324][T19983] 8021q: adding VLAN 0 to HW filter on device bond4 [ 505.304122][T20000] netlink: 'syz.2.3711': attribute type 11 has an invalid length. [ 505.367758][T20000] netlink: 4312 bytes leftover after parsing attributes in process `syz.2.3711'. [ 506.034356][T20038] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 506.224970][T20046] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3723'. [ 506.266352][T20047] team0: Device gtp0 is up. Set it down before adding it as a team port [ 506.437072][T20047] netlink: 'syz.2.3722': attribute type 1 has an invalid length. [ 506.640763][T20046] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3723'. [ 506.673806][T20047] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3722'. [ 506.716341][T20069] bond5 (unregistering): Released all slaves [ 506.832857][T20081] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3727'. [ 506.964015][T20081] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 507.096008][T20090] tipc: Enabling of bearer rejected, failed to enable media [ 507.371931][T20102] netlink: 'syz.0.3733': attribute type 13 has an invalid length. [ 507.393822][T20106] netlink: 'syz.2.3736': attribute type 1 has an invalid length. [ 507.406695][T20102] netlink: 'syz.0.3733': attribute type 27 has an invalid length. [ 507.437092][T20102] netlink: 'syz.0.3733': attribute type 39 has an invalid length. [ 507.493106][T20102] bridge0: port 3(syz_tun) entered disabled state [ 507.613725][T20102] syz_tun (unregistering): left allmulticast mode [ 507.650037][T20102] syz_tun (unregistering): left promiscuous mode [ 507.669884][T20102] bridge0: port 3(syz_tun) entered disabled state [ 507.854402][T20122] syzkaller0: entered promiscuous mode [ 507.868210][T20122] syzkaller0: entered allmulticast mode [ 508.728020][T20158] tipc: Started in network mode [ 508.733157][T20158] tipc: Node identity 7e60bf8c1fc8, cluster identity 4711 [ 508.741241][T20158] tipc: Enabled bearer , priority 0 [ 508.775626][T20161] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3749'. [ 508.972324][T20139] tipc: Disabling bearer [ 508.988585][T20183] nft_compat: unsupported protocol 0 [ 509.157181][T20189] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3753'. [ 509.239300][T20184] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3752'. [ 509.262706][T20189] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 509.372628][T20189] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 509.507671][T20204] openvswitch: netlink: Flow key attr not present in new flow. [ 509.618193][T20209] netlink: 165 bytes leftover after parsing attributes in process `syz.4.3758'. [ 510.074775][T20225] Cannot find add_set index 0 as target [ 510.105319][T20225] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3763'. [ 510.184580][T20233] netlink: 144 bytes leftover after parsing attributes in process `syz.1.3767'. [ 510.404866][T20244] netlink: 16215 bytes leftover after parsing attributes in process `syz.0.3769'. [ 510.593747][T20245] tipc: Enabled bearer , priority 0 [ 510.913662][T20256] x_tables: duplicate underflow at hook 1 [ 510.921809][T20258] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3773'. [ 510.951634][T20228] tipc: Disabling bearer [ 511.097455][T20266] netlink: 'syz.0.3774': attribute type 11 has an invalid length. [ 511.370570][T20282] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3780'. [ 511.735830][T20312] xt_CT: You must specify a L4 protocol and not use inversions on it [ 511.956932][T20324] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3790'. [ 511.978228][T20328] tipc: Enabled bearer , priority 0 [ 511.987857][T20329] netlink: 288 bytes leftover after parsing attributes in process `syz.2.3792'. [ 512.014315][T20324] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3790'. [ 512.050376][T20324] netlink: 'syz.0.3790': attribute type 12 has an invalid length. [ 512.106337][ T36] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 512.130404][ T36] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 512.139502][ T36] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 512.148690][ T36] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 512.515763][T20304] tipc: Disabling bearer [ 512.960872][T20379] netlink: 'syz.1.3802': attribute type 1 has an invalid length. [ 513.159065][T20388] 8021q: adding VLAN 0 to HW filter on device bond2 [ 513.195924][T20388] bond1: (slave bond2): making interface the new active one [ 513.216075][T20388] bond1: (slave bond2): Enslaving as an active interface with an up link [ 513.243833][T20390] netlink: 'syz.2.3804': attribute type 32 has an invalid length. [ 513.268976][T20379] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 513.324996][T20390] bond5: option coupled_control: invalid value (110) [ 513.336064][T20390] bond5 (unregistering): Released all slaves [ 513.444399][T20407] x_tables: duplicate underflow at hook 2 [ 514.155447][T20435] syzkaller0: entered promiscuous mode [ 514.161431][T20435] syzkaller0: entered allmulticast mode [ 514.171384][T20439] syzkaller0: entered promiscuous mode [ 514.177379][T20439] syzkaller0: entered allmulticast mode [ 517.004999][T20490] __nla_validate_parse: 9 callbacks suppressed [ 517.005022][T20490] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3825'. [ 517.119179][T20489] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 517.146186][T20482] bond1: option resend_igmp: invalid value (32767) [ 517.174677][T20489] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 517.184887][T20482] bond1: option resend_igmp: allowed values 0 - 255 [ 517.223504][T20489] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 517.255742][T20482] bond1 (unregistering): Released all slaves [ 517.342409][T20487] bond1: option resend_igmp: invalid value (32767) [ 517.349401][T20487] bond1: option resend_igmp: allowed values 0 - 255 [ 517.378695][T20487] bond1 (unregistering): Released all slaves [ 517.416208][T20497] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3826'. [ 517.430271][T20497] netlink: 50 bytes leftover after parsing attributes in process `syz.2.3826'. [ 517.451194][T20497] netlink: 50 bytes leftover after parsing attributes in process `syz.2.3826'. [ 517.483372][T20497] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3826'. [ 517.504424][T20497] openvswitch: netlink: EtherType 0 is less than min 600 [ 518.215015][T20541] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3837'. [ 518.377027][T20541] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3837'. [ 544.600196][ T5640] Bluetooth: hci4: command 0x0406 tx timeout [ 549.720291][ T5640] Bluetooth: hci1: command 0x0406 tx timeout [ 563.001499][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 568.458837][T20603] IPVS: set_ctl: invalid protocol: 92 0.0.0.0:20004 [ 568.494112][T20610] netlink: 'syz.1.3840': attribute type 4 has an invalid length. [ 568.682221][T20622] syz_tun: entered allmulticast mode [ 568.714784][T20622] dvmrp8: entered allmulticast mode [ 568.732068][T20619] syz_tun: left allmulticast mode [ 568.928369][T20639] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3849'. [ 569.116740][T20648] bridge4: entered promiscuous mode [ 569.122609][T20648] bridge4: entered allmulticast mode [ 569.484408][T20668] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3856'. [ 569.516622][T20668] mac80211_hwsim hwsim32 syzkaller0: entered promiscuous mode [ 569.540100][T20668] mac80211_hwsim hwsim32 syzkaller0: entered allmulticast mode [ 569.584559][T20670] bridge_slave_0 (unregistering): left allmulticast mode [ 569.613014][T20670] bridge_slave_0 (unregistering): left promiscuous mode [ 569.620359][T20670] bridge0: port 1(bridge_slave_0) entered disabled state [ 569.673361][T20680] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.3859'. [ 569.723919][T20680] openvswitch: netlink: Message has 512 unknown bytes. [ 569.724340][T20675] syzkaller0: entered promiscuous mode [ 569.783997][T20675] syzkaller0: entered allmulticast mode [ 569.916511][T20688] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3861'. [ 570.054178][T20694] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3863'. [ 570.156718][T20694] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3863'. [ 570.184182][T20696] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3863'. [ 570.201733][ T5640] Bluetooth: hci5: command 0x0406 tx timeout [ 570.364978][T20713] sctp: [Deprecated]: syz.1.3868 (pid 20713) Use of int in max_burst socket option. [ 570.364978][T20713] Use struct sctp_assoc_value instead [ 570.515700][T20717] 8021q: adding VLAN 0 to HW filter on device bond2 [ 570.582350][T20725] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3870'. [ 570.591666][T20732] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3870'. [ 570.780744][T20738] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3874'. [ 571.164227][T20738] bridge0: port 3(batadv2) entered blocking state [ 571.180176][T20738] bridge0: port 3(batadv2) entered disabled state [ 571.208879][T20738] batadv2: entered allmulticast mode [ 571.233969][T20738] batadv2: entered promiscuous mode [ 571.651687][ T6539] batman_adv: batadv2: No IGMP Querier present - multicast optimizations disabled [ 571.661313][ T6539] batman_adv: batadv2: No MLD Querier present - multicast optimizations disabled [ 572.060545][T20785] netlink: 'syz.0.3890': attribute type 39 has an invalid length. [ 572.101116][T20786] lo: entered allmulticast mode [ 572.111007][T20786] lo: left allmulticast mode [ 572.150526][T20787] netlink: 'syz.0.3890': attribute type 1 has an invalid length. [ 572.779034][T20808] vlan2: entered allmulticast mode [ 572.786958][T20808] bond0: entered allmulticast mode [ 572.792418][T20808] bond_slave_0: entered allmulticast mode [ 572.800096][T20808] bond_slave_1: entered allmulticast mode [ 572.834185][T20810] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 573.006282][T20820] Bluetooth: MGMT ver 1.23 [ 573.132125][T20822] netlink: 'syz.3.3902': attribute type 1 has an invalid length. [ 573.618484][T20842] netlink: 'syz.3.3910': attribute type 1 has an invalid length. [ 573.688943][T20842] bond5: entered promiscuous mode [ 573.694944][T20842] 8021q: adding VLAN 0 to HW filter on device bond5 [ 573.967142][T20861] __nla_validate_parse: 7 callbacks suppressed [ 573.967165][T20861] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3914'. [ 573.995468][T20859] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3915'. [ 574.135853][T20868] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3918'. [ 574.153944][T20868] netlink: 6 bytes leftover after parsing attributes in process `syz.4.3918'. [ 574.166426][T20870] sctp: [Deprecated]: syz.1.3919 (pid 20870) Use of int in max_burst socket option deprecated. [ 574.166426][T20870] Use struct sctp_assoc_value instead [ 574.359854][T20887] sctp: [Deprecated]: syz.3.3924 (pid 20887) Use of int in max_burst socket option. [ 574.359854][T20887] Use struct sctp_assoc_value instead [ 574.568906][T20897] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3925'. [ 574.622946][T20892] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 574.888868][T20911] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3928'. [ 574.941496][T20915] netlink: 14 bytes leftover after parsing attributes in process `syz.4.3929'. [ 575.014408][T20920] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 575.183377][T20927] tipc: Enabling of bearer rejected, failed to enable media [ 575.228296][T20927] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 575.229832][ T50] block nbd2: Receive control failed (result -32) [ 575.309655][T20932] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3937'. [ 575.415169][T20937] xt_CT: You must specify a L4 protocol and not use inversions on it [ 575.445563][T20940] FAULT_INJECTION: forcing a failure. [ 575.445563][T20940] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 575.482105][T20940] CPU: 0 UID: 0 PID: 20940 Comm: syz.2.3939 Not tainted syzkaller #0 PREEMPT(full) [ 575.482149][T20940] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 575.482170][T20940] Call Trace: [ 575.482241][T20940] [ 575.482309][T20940] dump_stack_lvl+0xe8/0x150 [ 575.482451][T20940] should_fail_ex+0x40c/0x560 [ 575.482578][T20940] _copy_from_user+0x2d/0xb0 [ 575.482629][T20940] ___sys_sendmsg+0x1c6/0x360 [ 575.482731][T20940] ? __lock_acquire+0x683/0x2cf0 [ 575.482791][T20940] ? __pfx____sys_sendmsg+0x10/0x10 [ 575.482856][T20940] ? __fget_files+0x2a/0x420 [ 575.482909][T20940] ? __fget_files+0x3a2/0x420 [ 575.482949][T20940] __x64_sys_sendmsg+0x1b1/0x290 [ 575.482978][T20940] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 575.483025][T20940] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.483072][T20940] do_syscall_64+0x174/0x580 [ 575.483192][T20940] ? trace_irq_disable+0x3b/0x140 [ 575.483240][T20940] ? clear_bhb_loop+0x40/0x90 [ 575.483268][T20940] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 575.483289][T20940] RIP: 0033:0x7f6173f9de59 [ 575.483318][T20940] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 575.483337][T20940] RSP: 002b:00007f6174ed1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 575.483360][T20940] RAX: ffffffffffffffda RBX: 00007f6174225fa0 RCX: 00007f6173f9de59 [ 575.483376][T20940] RDX: 0000000000000040 RSI: 0000200000000740 RDI: 0000000000000004 [ 575.483389][T20940] RBP: 00007f6174ed1090 R08: 0000000000000000 R09: 0000000000000000 [ 575.483403][T20940] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 575.483415][T20940] R13: 00007f6174226038 R14: 00007f6174225fa0 R15: 00007ffe696e6618 [ 575.483449][T20940] [ 575.768126][T20951] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3943'. [ 575.777551][T20951] netlink: 19 bytes leftover after parsing attributes in process `syz.2.3943'. [ 575.846892][T20952] netlink: 'syz.2.3943': attribute type 1 has an invalid length. [ 576.226325][T20976] netlink: 'syz.1.3950': attribute type 7 has an invalid length. [ 576.253428][T20976] netlink: 'syz.1.3950': attribute type 8 has an invalid length. [ 576.566238][T20990] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 576.605705][T21000] openvswitch: netlink: ct_state flags ffffffff unsupported [ 576.614801][T21000] veth0: entered promiscuous mode [ 576.622040][T21000] veth0: left promiscuous mode [ 576.891483][T21007] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 576.918357][ T5737] IPVS: starting estimator thread 0... [ 577.021808][T21015] IPVS: using max 25 ests per chain, 60000 per kthread [ 577.124107][T21018] veth3: entered allmulticast mode [ 577.189571][T21021] syzkaller0: entered promiscuous mode [ 577.203845][T21021] syzkaller0: entered allmulticast mode [ 577.562990][T21039] syzkaller1: entered promiscuous mode [ 577.582957][T21039] syzkaller1: entered allmulticast mode [ 578.013506][T21060] syzkaller0: entered promiscuous mode [ 578.019193][T21060] syzkaller0: entered allmulticast mode [ 578.080264][T21062] netlink: 'syz.4.3980': attribute type 1 has an invalid length. [ 578.458636][T21082] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 578.891810][T21100] netlink: 'syz.2.3991': attribute type 4 has an invalid length. [ 578.921341][T21099] netlink: 'syz.4.3992': attribute type 1 has an invalid length. [ 578.987718][T21102] xt_hashlimit: size too large, truncated to 1048576 [ 579.075426][T21107] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 579.167072][ T30] audit: type=1804 audit(1783050072.228:9): pid=21107 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.3994" name="/newroot/93/cgroup.controllers" dev="tmpfs" ino=492 res=1 errno=0 [ 579.256515][ T30] audit: type=1800 audit(1783050072.258:10): pid=21107 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3994" name="cgroup.controllers" dev="tmpfs" ino=492 res=0 errno=0 [ 579.435280][T21117] __nla_validate_parse: 13 callbacks suppressed [ 579.435302][T21117] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3996'. [ 579.703375][T21130] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4002'. [ 580.025803][T21141] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4006'. [ 580.047317][T21141] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4006'. [ 580.067040][T21144] netlink: 'syz.3.4007': attribute type 4 has an invalid length. [ 580.214730][T21144] bond6: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 580.271653][T21144] bond6 (unregistering): Released all slaves [ 580.297657][T21151] netlink: 'syz.4.4008': attribute type 1 has an invalid length. [ 580.387662][T21156] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4008'. [ 580.474056][T21152] bond5: Unable to set up delay as MII monitoring is disabled [ 580.485217][T21152] bond5 (unregistering): Released all slaves [ 580.531272][T21151] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 580.754318][T21170] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 580.794098][T21173] netlink: 52 bytes leftover after parsing attributes in process `syz.2.4015'. [ 580.804547][T21168] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4012'. [ 580.986000][T21185] tipc: New replicast peer: 255.255.255.255 [ 581.008539][T21185] tipc: Enabled bearer , priority 10 [ 581.187210][T21198] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4025'. [ 581.229527][T21204] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4028'. [ 581.431329][T21218] netlink: 524 bytes leftover after parsing attributes in process `syz.3.4030'. [ 582.154176][T21262] netlink: 'syz.4.4044': attribute type 1 has an invalid length. [ 583.161544][T21322] netlink: 'syz.0.4066': attribute type 1 has an invalid length. [ 583.348325][T21335] netlink: 'syz.2.4069': attribute type 29 has an invalid length. [ 583.665541][T21345] sch_tbf: burst 7 is lower than device syzkaller0 mtu (1514) ! [ 583.964927][T21361] syzkaller0: entered promiscuous mode [ 583.986558][T21361] syzkaller0: entered allmulticast mode [ 584.100581][ T5790] IPVS: starting estimator thread 0... [ 584.200783][T21372] IPVS: using max 26 ests per chain, 62400 per kthread [ 584.239474][T21378] xt_hashlimit: size too large, truncated to 1048576 [ 584.395319][T21386] netlink: 'syz.1.4088': attribute type 1 has an invalid length. [ 584.403605][T21386] netlink: 'syz.1.4088': attribute type 3 has an invalid length. [ 584.416127][T21386] NCSI netlink: No device for ifindex 813332851 [ 584.952739][T21413] __nla_validate_parse: 15 callbacks suppressed [ 584.952761][T21413] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4094'. [ 584.972033][T21423] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4097'. [ 584.981347][T21423] netlink: 'syz.2.4097': attribute type 8 has an invalid length. [ 585.044984][T21413] netlink: 'syz.1.4094': attribute type 3 has an invalid length. [ 585.099870][T21429] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4100'. [ 585.246809][T21434] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4102'. [ 585.523502][T21452] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.4106'. [ 585.581975][ T5640] Bluetooth: hci2: command 0x0406 tx timeout [ 585.668524][T21456] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 585.734821][T21460] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4110'. [ 585.748188][T21461] netlink: 'syz.1.4110': attribute type 1 has an invalid length. [ 585.793157][T21460] ip6gretap1: entered promiscuous mode [ 585.811961][T21460] ip6gretap1: entered allmulticast mode [ 586.145428][T21492] SET target dimension over the limit! [ 586.196473][T21494] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 586.265817][T21500] xt_hashlimit: max too large, truncated to 1048576 [ 586.301492][T21500] No such timeout policy "syz1" [ 586.544919][T21516] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4126'. [ 586.566998][T21515] syzkaller0: entered promiscuous mode [ 586.574075][T21515] syzkaller0: entered allmulticast mode [ 586.603012][T21516] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4126'. [ 586.608033][T21519] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4129'. [ 586.624304][T21516] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4126'. [ 586.753817][T21522] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 586.764219][T21522] netlink: 'syz.4.4130': attribute type 1 has an invalid length. [ 587.498454][T16625] IPVS: starting estimator thread 0... [ 587.543191][T21542] bond5: Unable to set down delay as MII monitoring is disabled [ 587.554969][T21542] bond5 (unregistering): Released all slaves [ 587.590069][T21558] IPVS: using max 26 ests per chain, 62400 per kthread [ 587.639080][T21563] bridge6: entered allmulticast mode [ 587.842542][T21574] netlink: 'syz.3.4148': attribute type 23 has an invalid length. [ 588.026423][T21589] openvswitch: netlink: IP tunnel dst address not specified [ 588.173380][T21582] tipc: Started in network mode [ 588.178585][T21582] tipc: Node identity 02d1bbd16d53, cluster identity 4711 [ 588.186704][T21582] tipc: Enabled bearer , priority 0 [ 588.248056][T21587] syzkaller0: entered promiscuous mode [ 588.253825][T21587] syzkaller0: entered allmulticast mode [ 588.261257][T21587] tipc: Resetting bearer [ 588.339048][T21598] netlink: zone id is out of range [ 588.434342][ T6539] tipc: Resetting bearer [ 588.459673][T21569] tipc: Resetting bearer [ 590.350823][T21569] tipc: Disabling bearer [ 590.364012][T21602] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 590.405256][T21610] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 590.473703][T21610] batman_adv: batadv0: Adding interface: gretap1 [ 590.503937][T21610] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 590.555141][T21618] __nla_validate_parse: 8 callbacks suppressed [ 590.555164][T21618] netlink: 170676 bytes leftover after parsing attributes in process `syz.3.4157'. [ 590.590386][T21610] batman_adv: batadv0: Interface activated: gretap1 [ 590.601367][T21618] openvswitch: netlink: ufid size 41726 bytes exceeds the range (1, 16) [ 590.622108][T21618] openvswitch: netlink: Message has 512 unknown bytes. [ 590.633399][T21611] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 590.635407][ T5737] tipc: Node number set to 1870838737 [ 590.661009][T21623] netlink: 'syz.1.4159': attribute type 19 has an invalid length. [ 590.679648][T21626] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4160'. [ 590.857972][T21634] netlink: 'syz.2.4161': attribute type 1 has an invalid length. [ 590.876997][T21634] netlink: 240 bytes leftover after parsing attributes in process `syz.2.4161'. [ 590.887159][T21634] netlink: 'syz.2.4161': attribute type 1 has an invalid length. [ 590.905174][T21632] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4162'. [ 591.032066][T21642] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 591.231540][T21649] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 591.260447][T21655] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4169'. [ 591.490435][T21663] tipc: Started in network mode [ 591.509946][T21663] tipc: Node identity ac14140f, cluster identity 4711 [ 591.541063][T21663] tipc: New replicast peer: 255.255.255.255 [ 591.567445][T21663] tipc: Enabled bearer , priority 10 [ 591.592653][T21662] tipc: Enabled bearer , priority 0 [ 591.860485][T21676] syzkaller0: entered promiscuous mode [ 591.897461][T21676] syzkaller0: entered allmulticast mode [ 591.926124][T21676] tipc: Resetting bearer [ 592.054511][T21703] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4178'. [ 592.275493][T12717] tipc: Resetting bearer [ 592.287171][T21692] veth1_to_bridge: left allmulticast mode [ 592.300718][T21692] veth1_to_bridge: left promiscuous mode [ 592.313437][T21692] bridge0: port 3(veth1_to_bridge) entered disabled state [ 592.341666][T21692] bridge_slave_1: left promiscuous mode [ 592.362722][T21692] bridge0: port 2(bridge_slave_1) entered disabled state [ 592.391117][T21692] bond0: (slave bond_slave_0): Releasing backup interface [ 592.401622][T21692] bond0: (slave bond_slave_1): Releasing backup interface [ 592.414407][T21692] team0: Port device team_slave_0 removed [ 592.432771][T21692] team0: Port device team_slave_1 removed [ 592.454713][T21709] netlink: 'syz.2.4179': attribute type 23 has an invalid length. [ 592.485928][T21658] tipc: Resetting bearer [ 592.589560][T21714] netdevsim netdevsim2: Firmware load for './file0/file0/../file0' refused, path contains '..' component [ 592.720308][T21714] xt_l2tp: missing protocol rule (udp|l2tpip) [ 592.964942][T21723] netlink: 'syz.1.4181': attribute type 1 has an invalid length. [ 594.675507][T21658] tipc: Disabling bearer [ 594.685150][ T5287] veth1_macvtap: left promiscuous mode [ 594.697845][T16625] tipc: Node number set to 2886997007 [ 594.744778][T21717] lo speed is unknown, defaulting to 1000 [ 594.815109][T21717] lo speed is unknown, defaulting to 1000 [ 594.831961][T21717] lo speed is unknown, defaulting to 1000 [ 594.859866][T21717] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 594.926810][T21717] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 594.964389][T21732] netlink: 'syz.0.4182': attribute type 12 has an invalid length. [ 595.001252][T21717] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 595.076773][T21717] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 595.185402][T21717] lo speed is unknown, defaulting to 1000 [ 595.224315][T21751] sctp: [Deprecated]: syz.2.4184 (pid 21751) Use of struct sctp_assoc_value in delayed_ack socket option. [ 595.224315][T21751] Use struct sctp_sack_info instead [ 595.263020][T21717] lo speed is unknown, defaulting to 1000 [ 595.292091][T21717] lo speed is unknown, defaulting to 1000 [ 595.298265][T21757] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4187'. [ 595.322374][T21717] lo speed is unknown, defaulting to 1000 [ 595.354022][T21717] lo speed is unknown, defaulting to 1000 [ 595.376302][T21760] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4188'. [ 595.407523][T21717] lo speed is unknown, defaulting to 1000 [ 595.418596][T21760] netlink: 72 bytes leftover after parsing attributes in process `syz.1.4188'. [ 595.434980][T21717] lo speed is unknown, defaulting to 1000 [ 595.689138][T21774] netlink: 'syz.0.4191': attribute type 5 has an invalid length. [ 595.806640][T21781] tipc: Enabled bearer , priority 0 [ 595.877359][T21785] "syz.2.4194" (21785) uses obsolete ecb(arc4) skcipher [ 595.990457][T21794] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4197'. [ 596.012694][T21781] syzkaller0: entered promiscuous mode [ 596.031614][T21781] syzkaller0: entered allmulticast mode [ 596.041070][T21781] tipc: Resetting bearer [ 596.179479][T21794] team_slave_0: entered allmulticast mode [ 596.204438][T21773] tipc: Resetting bearer [ 596.331112][ T50] Bluetooth: hci3: link tx timeout [ 596.337440][ T50] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 596.349208][T21805] netlink: 164 bytes leftover after parsing attributes in process `syz.1.4199'. [ 596.394606][T21807] netlink: 'syz.2.4200': attribute type 1 has an invalid length. [ 597.114680][T21830] netlink: 'syz.0.4205': attribute type 1 has an invalid length. [ 598.363732][ T50] Bluetooth: hci3: command 0x0405 tx timeout [ 598.574989][T21773] tipc: Disabling bearer [ 598.586901][T21807] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 598.613710][T21814] netlink: 136 bytes leftover after parsing attributes in process `syz.2.4200'. [ 598.661458][T21816] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 598.662210][T16625] tipc: Node number set to 1638449036 [ 598.841160][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 599.153934][T21853] syzkaller0: entered promiscuous mode [ 599.173949][T21853] syzkaller0: entered allmulticast mode [ 599.184072][T21861] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4215'. [ 599.233873][T21862] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4216'. [ 599.262231][T21863] bond4 (unregistering): Released all slaves [ 599.346911][T21871] tipc: Enabled bearer , priority 0 [ 599.411753][T21874] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4219'. [ 599.548349][T21871] syzkaller0: entered promiscuous mode [ 599.564568][T21871] syzkaller0: entered allmulticast mode [ 599.572633][T21871] tipc: Resetting bearer [ 599.595666][T21880] tipc: New replicast peer: 255.255.255.255 [ 599.610759][T21880] tipc: Enabled bearer , priority 10 [ 599.627892][T21870] tipc: Resetting bearer [ 601.656302][T21870] tipc: Disabling bearer [ 601.678346][T21893] IPv6: sit2: Disabled Multicast RS [ 601.692139][T21893] sit2: entered allmulticast mode [ 601.875671][T21898] netlink: 'syz.0.4227': attribute type 1 has an invalid length. [ 601.901870][T21905] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4230'. [ 602.171859][T21921] netlink: 256 bytes leftover after parsing attributes in process `syz.0.4237'. [ 602.324784][T21924] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4238'. [ 602.408561][T21927] tipc: Enabled bearer , priority 0 [ 602.518607][T21927] syzkaller0: entered promiscuous mode [ 602.524455][T21927] syzkaller0: entered allmulticast mode [ 602.534021][T21927] tipc: Resetting bearer [ 602.555765][T21925] tipc: Resetting bearer [ 602.678846][T21949] netlink: 'syz.1.4244': attribute type 2 has an invalid length. [ 604.576151][T21925] tipc: Disabling bearer [ 604.706312][T21957] sctp: [Deprecated]: syz.1.4248 (pid 21957) Use of int in maxseg socket option. [ 604.706312][T21957] Use struct sctp_assoc_value instead [ 604.786715][T21963] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4246'. [ 604.805103][T21962] netlink: 248 bytes leftover after parsing attributes in process `syz.0.4249'. [ 604.848920][T21963] macvlan2: entered promiscuous mode [ 604.857350][T21968] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4250'. [ 604.874143][T21963] macvlan2: entered allmulticast mode [ 605.261198][T21988] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4257'. [ 605.295547][T21984] bond1: entered promiscuous mode [ 605.316870][T21984] bond1: entered allmulticast mode [ 605.350988][T21984] 8021q: adding VLAN 0 to HW filter on device bond1 [ 605.477501][T21998] tipc: Enabled bearer , priority 0 [ 605.520230][T22000] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4261'. [ 605.649444][T21998] syzkaller0: entered promiscuous mode [ 605.660061][T21998] syzkaller0: entered allmulticast mode [ 605.670702][T21998] tipc: Resetting bearer [ 605.868380][T12717] tipc: Resetting bearer [ 605.898676][T21995] tipc: Resetting bearer [ 606.001679][T22017] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4266'. [ 607.862679][T21995] tipc: Disabling bearer [ 608.000664][T22031] netlink: 284 bytes leftover after parsing attributes in process `syz.0.4268'. [ 608.059421][T22035] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4270'. [ 608.290646][T22045] xt_hashlimit: size too large, truncated to 1048576 [ 608.317425][T22049] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4273'. [ 608.486515][T22057] netlink: 'syz.3.4276': attribute type 2 has an invalid length. [ 608.746285][T22069] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4279'. [ 608.782136][T22071] tipc: Enabled bearer , priority 0 [ 608.985062][T22085] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4286'. [ 608.998863][T22077] netlink: 'syz.0.4283': attribute type 1 has an invalid length. [ 609.030684][T22078] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4283'. [ 609.071029][T22077] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4283'. [ 609.101204][T22078] openvswitch: netlink: EtherType 0 is less than min 600 [ 609.176501][T22091] netlink: 'syz.2.4287': attribute type 13 has an invalid length. [ 609.206871][T22091] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4287'. [ 609.272666][T22097] ieee802154 phy0 wpan0: encryption failed: -126 [ 609.287736][T22096] netlink: 9 bytes leftover after parsing attributes in process `syz.3.4289'. [ 609.628369][T22110] tipc: Enabled bearer , priority 0 [ 609.735715][T22121] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 609.762275][T22123] netlink: 'syz.2.4295': attribute type 1 has an invalid length. [ 609.764090][T22122] netlink: 'syz.2.4295': attribute type 1 has an invalid length. [ 609.797084][T22121] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 609.845975][T22110] syzkaller0: entered promiscuous mode [ 609.867259][T22121] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 609.870389][T22110] syzkaller0: entered allmulticast mode [ 609.915684][T22110] tipc: Resetting bearer [ 609.932274][T22123] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 609.933554][T22122] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 610.077024][T22108] tipc: Resetting bearer [ 610.344341][T22151] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4297'. [ 612.324461][T22108] tipc: Disabling bearer [ 612.509267][ T30] audit: type=1804 audit(1783050105.568:11): pid=22165 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.4301" name="/newroot/220/cgroup.controllers" dev="tmpfs" ino=1144 res=1 errno=0 [ 612.579185][ T30] audit: type=1800 audit(1783050105.608:12): pid=22165 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.4301" name="cgroup.controllers" dev="tmpfs" ino=1144 res=0 errno=0 [ 613.093049][T22208] __nla_validate_parse: 1 callbacks suppressed [ 613.093073][T22208] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4306'. [ 613.122646][T22209] tipc: Enabling of bearer rejected, already enabled [ 613.269078][T22213] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4315'. [ 613.514304][T22236] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4321'. [ 613.548289][T22237] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4321'. [ 613.655050][T22235] netlink: 'syz.0.4321': attribute type 3 has an invalid length. [ 613.781422][T22247] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4324'. [ 614.019602][T22261] netlink: 56 bytes leftover after parsing attributes in process `syz.4.4329'. [ 614.125984][T22261] syzkaller1: entered promiscuous mode [ 614.141648][T22261] syzkaller1: entered allmulticast mode [ 614.158117][T22263] tipc: Enabled bearer , priority 0 [ 614.341090][T22267] syzkaller0: entered promiscuous mode [ 614.365429][T22267] syzkaller0: entered allmulticast mode [ 614.377128][T22267] tipc: Resetting bearer [ 614.403406][T22266] syzkaller1: left promiscuous mode [ 614.418625][T22266] syzkaller1: left allmulticast mode [ 614.638782][T12717] tipc: Resetting bearer [ 614.648049][T22260] tipc: Resetting bearer [ 616.798346][T22260] tipc: Disabling bearer [ 616.843943][T22302] : renamed from bond0 [ 616.855454][T22305] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 617.097042][T22311] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4345'. [ 617.116053][T22315] vcan0: tx address claim with dest, not broadcast [ 617.126093][T22316] netlink: 'syz.1.4348': attribute type 1 has an invalid length. [ 617.135301][T22311] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4345'. [ 617.179071][T22316] 8021q: adding VLAN 0 to HW filter on device bond4 [ 617.230217][T22316] bond4: (slave dummy0): making interface the new active one [ 617.261575][T22316] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 617.280691][T22319] : renamed from dummy0 (while UP) [ 617.287016][T22323] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4346'. [ 617.445564][T22331] veth1_to_bond: entered allmulticast mode [ 617.498584][T22331] veth1_to_bond: left allmulticast mode [ 617.568113][T22339] FAULT_INJECTION: forcing a failure. [ 617.568113][T22339] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 617.582512][T22338] netlink: 632 bytes leftover after parsing attributes in process `syz.2.4352'. [ 617.593766][T22339] CPU: 1 UID: 0 PID: 22339 Comm: syz.4.4353 Not tainted syzkaller #0 PREEMPT(full) [ 617.593795][T22339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 617.593808][T22339] Call Trace: [ 617.593817][T22339] [ 617.593826][T22339] dump_stack_lvl+0xe8/0x150 [ 617.593868][T22339] should_fail_ex+0x40c/0x560 [ 617.593908][T22339] _copy_from_iter+0x1d3/0x1660 [ 617.594001][T22339] ? kmem_cache_alloc_node_noprof+0x1b1/0x610 [ 617.594053][T22339] ? rcu_is_watching+0x15/0xb0 [ 617.594095][T22339] ? trace_kmem_cache_alloc+0x29/0xe0 [ 617.594129][T22339] ? kmem_cache_alloc_node_noprof+0x3b8/0x610 [ 617.594155][T22339] ? __pfx__copy_from_iter+0x10/0x10 [ 617.594176][T22339] ? __alloc_skb+0x276/0x7a0 [ 617.594261][T22339] ? __alloc_skb+0x276/0x7a0 [ 617.594291][T22339] ? netlink_sendmsg+0x650/0xb40 [ 617.594400][T22339] ? skb_put+0x112/0x210 [ 617.594428][T22339] netlink_sendmsg+0x6c0/0xb40 [ 617.594467][T22339] ? __pfx_netlink_sendmsg+0x10/0x10 [ 617.594500][T22339] ? aa_sock_msg_perm+0xf1/0x1b0 [ 617.594611][T22339] ? __pfx_netlink_sendmsg+0x10/0x10 [ 617.594640][T22339] sock_sendmsg_nosec+0x13a/0x180 [ 617.594676][T22339] ____sys_sendmsg+0x54e/0x850 [ 617.594709][T22339] ? __pfx_____sys_sendmsg+0x10/0x10 [ 617.594746][T22339] ? import_iovec+0x73/0xa0 [ 617.594775][T22339] ___sys_sendmsg+0x2a5/0x360 [ 617.594801][T22339] ? __lock_acquire+0x683/0x2cf0 [ 617.594838][T22339] ? __pfx____sys_sendmsg+0x10/0x10 [ 617.594903][T22339] ? __fget_files+0x2a/0x420 [ 617.594931][T22339] ? __fget_files+0x3a2/0x420 [ 617.594971][T22339] __x64_sys_sendmsg+0x1b1/0x290 [ 617.595001][T22339] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 617.595048][T22339] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.595074][T22339] do_syscall_64+0x174/0x580 [ 617.595098][T22339] ? trace_irq_disable+0x3b/0x140 [ 617.595135][T22339] ? clear_bhb_loop+0x40/0x90 [ 617.595166][T22339] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.595188][T22339] RIP: 0033:0x7ff1e2b9de59 [ 617.595209][T22339] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 617.595228][T22339] RSP: 002b:00007ff1e3a0e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 617.595251][T22339] RAX: ffffffffffffffda RBX: 00007ff1e2e25fa0 RCX: 00007ff1e2b9de59 [ 617.595267][T22339] RDX: 0000000000000040 RSI: 0000200000000740 RDI: 0000000000000004 [ 617.595280][T22339] RBP: 00007ff1e3a0e090 R08: 0000000000000000 R09: 0000000000000000 [ 617.595294][T22339] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 617.595307][T22339] R13: 00007ff1e2e26038 R14: 00007ff1e2e25fa0 R15: 00007fff0b8c3a88 [ 617.595341][T22339] [ 618.073517][T22341] tipc: Enabled bearer , priority 0 [ 618.157808][T22341] syzkaller0: entered promiscuous mode [ 618.162270][T22353] sctp: [Deprecated]: syz.3.4358 (pid 22353) Use of int in max_burst socket option. [ 618.162270][T22353] Use struct sctp_assoc_value instead [ 618.164448][T22341] syzkaller0: entered allmulticast mode [ 618.200536][T22341] tipc: Resetting bearer [ 618.246647][T22340] tipc: Resetting bearer [ 618.401821][T22366] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4361'. [ 620.495496][T22340] tipc: Disabling bearer [ 620.679621][T22394] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4372'. [ 621.192717][T22430] tipc: Enabled bearer , priority 10 [ 621.303411][T22432] tipc: Enabled bearer , priority 0 [ 621.365760][T22432] syzkaller0: entered promiscuous mode [ 621.372058][T22432] syzkaller0: entered allmulticast mode [ 621.379276][T22432] tipc: Resetting bearer [ 621.424888][T22431] tipc: Resetting bearer [ 621.555737][T22404] netlink: 'syz.4.4374': attribute type 4 has an invalid length. [ 621.581384][T22404] netlink: 17 bytes leftover after parsing attributes in process `syz.4.4374'. [ 621.596981][T22437] netlink: 'syz.2.4385': attribute type 1 has an invalid length. [ 622.645517][T22472] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4390'. [ 624.035680][T22431] tipc: Disabling bearer [ 624.254584][T22480] tipc: Enabled bearer , priority 10 [ 624.443502][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.483705][T22487] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4398'. [ 624.785097][T22507] netlink: 256 bytes leftover after parsing attributes in process `syz.1.4402'. [ 624.838256][T22515] tipc: Enabled bearer , priority 0 [ 624.940255][T22518] netlink: 'syz.2.4405': attribute type 9 has an invalid length. [ 624.963752][T22515] syzkaller0: entered promiscuous mode [ 624.969369][T22515] syzkaller0: entered allmulticast mode [ 624.982456][T22515] tipc: Resetting bearer [ 624.998614][T22521] bridge: RTM_NEWNEIGH with invalid state 0x20 [ 625.039692][T22523] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4407'. [ 625.140714][T22512] tipc: Resetting bearer [ 625.165280][T22527] netlink: 'syz.0.4407': attribute type 39 has an invalid length. [ 625.475801][T22531] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4408'. [ 627.344658][T22512] tipc: Disabling bearer [ 627.355809][T22526] syzkaller1: entered promiscuous mode [ 627.361592][T22526] syzkaller1: entered allmulticast mode [ 627.712002][T22558] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4415'. [ 627.754330][T22561] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4415'. [ 627.797995][T22567] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4414'. [ 628.153937][T22587] syzkaller0: entered promiscuous mode [ 628.179775][T22587] syzkaller0: entered allmulticast mode [ 628.240829][T22594] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4424'. [ 628.257103][T22596] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4423'. [ 628.297585][T22584] syzkaller0: entered promiscuous mode [ 628.303552][T22584] syzkaller0: entered allmulticast mode [ 628.311209][T22587] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4422'. [ 631.045507][T22643] syzkaller0: entered promiscuous mode [ 631.061611][T22643] syzkaller0: entered allmulticast mode [ 631.112811][T22650] netlink: 'syz.2.4438': attribute type 1 has an invalid length. [ 631.125251][T22650] netlink: 'syz.2.4438': attribute type 1 has an invalid length. [ 631.424108][T22665] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4442'. [ 631.442575][T22665] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4442'. [ 633.816347][T22665] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4442'. [ 633.963863][T22692] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4450'. [ 634.548067][T22738] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4463'. [ 634.737816][T22735] syzkaller0: entered promiscuous mode [ 634.765632][T22735] syzkaller0: entered allmulticast mode [ 634.933315][T22759] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4468'. [ 634.943873][T22759] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4468'. [ 637.179040][T22782] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4469'. [ 637.292972][T22787] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4470'. [ 637.363556][T22790] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4472'. [ 637.398601][T22790] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4472'. [ 637.421405][T22790] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4472'. [ 637.453497][T22794] netlink: 'syz.1.4472': attribute type 5 has an invalid length. [ 637.483127][T22799] mac80211_hwsim hwsim37 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 637.776221][T22811] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4477'. [ 637.836240][T22811] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4477'. [ 637.864571][T22811] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4477'. [ 637.917366][T22824] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4480'. [ 638.548588][T22856] policy can only be matched on NF_INET_PRE_ROUTING [ 638.548611][T22856] unable to load match [ 638.559283][T22857] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4489'. [ 638.573263][T22859] netlink: 'syz.3.4491': attribute type 21 has an invalid length. [ 638.597928][T22859] netlink: 'syz.3.4491': attribute type 4 has an invalid length. [ 638.607014][T22859] netlink: 'syz.3.4491': attribute type 5 has an invalid length. [ 638.621405][T22859] netlink: 'syz.3.4491': attribute type 21 has an invalid length. [ 638.633138][T22859] netlink: 'syz.3.4491': attribute type 4 has an invalid length. [ 638.641743][T22866] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 638.661732][T22859] netlink: 'syz.3.4491': attribute type 5 has an invalid length. [ 638.727923][T22871] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 639.234405][T22895] openvswitch: netlink: Missing key (keys=40, expected=100) [ 639.366448][T22899] macsec2: entered promiscuous mode [ 639.384260][T22899] bridge0: entered promiscuous mode [ 639.404177][T22899] macsec2: entered allmulticast mode [ 639.415204][T22899] bridge0: entered allmulticast mode [ 639.424614][T22899] bridge0: port 1(macsec2) entered blocking state [ 639.436087][T22899] bridge0: port 1(macsec2) entered disabled state [ 640.198257][T22899] bridge0: left allmulticast mode [ 640.218481][T22899] bridge0: left promiscuous mode [ 640.288833][T22882] lo speed is unknown, defaulting to 1000 [ 640.696514][T22921] syzkaller0: entered promiscuous mode [ 640.702525][T22921] syzkaller0: entered allmulticast mode [ 640.885378][T22931] team0: left promiscuous mode [ 640.895674][T22931] team_slave_0: left promiscuous mode [ 640.905184][T22931] team_slave_1: left promiscuous mode [ 640.911916][T22931] bridge0: port 3(team0) entered disabled state [ 640.954921][T22931] bridge_slave_1: left allmulticast mode [ 640.963880][T22931] bridge_slave_1: left promiscuous mode [ 640.969809][T22931] bridge0: port 2(bridge_slave_1) entered disabled state [ 641.011272][T22931] bridge_slave_0: left allmulticast mode [ 641.033854][T22931] bridge_slave_0: left promiscuous mode [ 641.057020][T22931] bridge0: port 1(bridge_slave_0) entered disabled state [ 643.263395][T22941] __nla_validate_parse: 10 callbacks suppressed [ 643.263417][T22941] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4511'. [ 643.299351][T22941] tipc: Invalid UDP bearer configuration [ 643.299414][T22941] tipc: Enabling of bearer rejected, failed to enable media [ 643.328390][T22943] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4511'. [ 643.355435][T22943] tipc: Invalid UDP bearer configuration [ 643.355494][T22943] tipc: Enabling of bearer rejected, failed to enable media [ 643.609389][T22966] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4515'. [ 643.663172][T22968] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4515'. [ 643.923808][T22980] IPVS: set_ctl: invalid protocol: 135 224.0.0.1:20004 [ 644.117881][T22990] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4525'. [ 644.414326][T23009] netlink: 'syz.4.4531': attribute type 1 has an invalid length. [ 644.501850][T23009] bond5: entered promiscuous mode [ 644.507151][T23009] bond5: entered allmulticast mode [ 644.514267][T23009] 8021q: adding VLAN 0 to HW filter on device bond5 [ 644.545929][T23015] erspan1: entered allmulticast mode [ 644.558213][T23015] bond5: (slave erspan1): making interface the new active one [ 644.566049][T23015] erspan1: entered promiscuous mode [ 644.574996][T23015] bond5: (slave erspan1): Enslaving as an active interface with an up link [ 644.589029][T12705] tipc: Subscription rejected, illegal request [ 644.611338][T23022] veth0: entered promiscuous mode [ 644.776306][T23033] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4537'. [ 644.785756][T23021] veth0: left promiscuous mode [ 644.787160][T23030] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4536'. [ 644.818816][T23033] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 644.827314][ T5737] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 644.907733][T23038] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4539'. [ 644.924758][T23034] syzkaller0: entered promiscuous mode [ 644.936731][T23034] syzkaller0: entered allmulticast mode [ 644.972933][T23043] netlink: 164 bytes leftover after parsing attributes in process `syz.3.4541'. [ 645.041227][T23046] netlink: 'syz.2.4542': attribute type 21 has an invalid length. [ 645.053488][T23046] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4542'. [ 645.064544][T23046] netlink: 'syz.2.4542': attribute type 5 has an invalid length. [ 645.072732][T23046] netlink: 'syz.2.4542': attribute type 6 has an invalid length. [ 646.273695][T23094] netlink: 'syz.3.4558': attribute type 1 has an invalid length. [ 646.312726][T23094] netlink: 'syz.3.4558': attribute type 2 has an invalid length. [ 646.335769][T23095] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 646.911932][T23132] bond0: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 647.053410][T23137] netlink: 'syz.1.4573': attribute type 1 has an invalid length. [ 647.236223][T23150] netlink: 'syz.3.4578': attribute type 4 has an invalid length. [ 647.280857][T23154] netlink: 'syz.4.4580': attribute type 11 has an invalid length. [ 647.998056][T23192] syzkaller0: entered promiscuous mode [ 648.009685][T23192] syzkaller0: entered allmulticast mode [ 648.195810][T23197] netlink: 'syz.3.4591': attribute type 1 has an invalid length. [ 648.257797][T23200] syzkaller0: entered promiscuous mode [ 648.281452][T23200] syzkaller0: entered allmulticast mode [ 648.422806][T23200] tipc: Enabled bearer , priority 0 [ 648.447444][T23208] tipc: Enabling of bearer rejected, already enabled [ 648.509812][T23199] tipc: Resetting bearer [ 648.568036][T23199] tipc: Disabling bearer [ 648.686186][T23216] syzkaller0: entered promiscuous mode [ 648.714573][T23216] syzkaller0: entered allmulticast mode [ 648.803372][T23227] __nla_validate_parse: 8 callbacks suppressed [ 648.803392][T23227] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4599'. [ 648.826823][T23228] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4598'. [ 648.974943][T23232] openvswitch: netlink: Missing key (keys=40, expected=100) [ 648.993952][T23232] netlink: 27 bytes leftover after parsing attributes in process `syz.3.4600'. [ 649.032489][T23235] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 649.167558][T23243] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4602'. [ 649.237229][T23246] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4604'. [ 649.285245][T23251] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4605'. [ 649.341507][T23251] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4605'. [ 649.352805][T23251] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4605'. [ 649.364493][T23251] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4605'. [ 649.404020][T23251] netlink: 92 bytes leftover after parsing attributes in process `syz.1.4605'. [ 649.725602][T23269] lo: entered allmulticast mode [ 649.741263][T23269] tunl0: entered allmulticast mode [ 649.764611][T23269] gre0: entered allmulticast mode [ 649.845190][T23269] gretap0: entered allmulticast mode [ 649.935505][T23279] sctp: [Deprecated]: syz.3.4613 (pid 23279) Use of int in max_burst socket option deprecated. [ 649.935505][T23279] Use struct sctp_assoc_value instead [ 650.083334][T23269] erspan0: entered allmulticast mode [ 650.157381][T23285] openvswitch: netlink: Key 0 has unexpected len 4 expected 0 [ 650.170348][T23269] ip_vti0: entered allmulticast mode [ 650.235538][T23269] : entered allmulticast mode [ 650.271604][T23269] sit0: entered allmulticast mode [ 650.337580][T23269] ip6tnl0: entered allmulticast mode [ 650.405431][T23291] IPv6: NLM_F_CREATE should be specified when creating new route [ 650.422619][T23269] ip6gre0: entered allmulticast mode [ 650.783198][T23298] netlink: 'syz.3.4618': attribute type 13 has an invalid length. [ 651.073539][T23309] netlink: 'syz.1.4623': attribute type 25 has an invalid length. [ 651.160496][T23308] pimreg: entered allmulticast mode [ 651.716236][T23347] ieee802154 phy0 wpan0: encryption failed: -126 [ 652.046259][T23365] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 652.098930][T23368] xt_hashlimit: size too large, truncated to 1048576 [ 652.770266][T23406] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 652.956585][T23414] bond5: option arp_all_targets: invalid value (18446744073709551613) [ 653.012473][T23414] bond5 (unregistering): Released all slaves [ 653.023519][T23428] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 653.030104][T23428] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 653.076709][T23418] veth7: entered allmulticast mode [ 653.091848][T23429] netlink: 'syz.0.4661': attribute type 11 has an invalid length. [ 653.107874][T23429] netlink: 'syz.0.4661': attribute type 1 has an invalid length. [ 653.129736][T23424] veth9: entered allmulticast mode [ 653.155511][T23428] hsr_slave_0: left promiscuous mode [ 653.164368][T23428] hsr_slave_1: left promiscuous mode [ 653.276818][T23432] netlink: 'syz.1.4662': attribute type 1 has an invalid length. [ 653.549252][T23446] ipt_REJECT: ECHOREPLY no longer supported. [ 653.622300][T23455] netlink: 'syz.3.4670': attribute type 1 has an invalid length. [ 653.818848][T23464] block nbd0: reconnected socket [ 653.826384][ T5640] block nbd0: Receive control failed (result -107) [ 654.096638][T23482] __nla_validate_parse: 74 callbacks suppressed [ 654.096657][T23482] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4678'. [ 654.156469][T12715] bond_slave_0: left promiscuous mode [ 654.171144][T12715] bond_slave_1: left promiscuous mode [ 654.533511][T12715] bond8 (unregistering): (slave geneve2): Releasing active interface [ 654.611046][T12715] bond9 (unregistering): (slave bridge0): Releasing backup interface [ 654.651605][T12715]  (unregistering): (slave bond_slave_0): Releasing backup interface [ 654.662847][T12715]  (unregistering): (slave bond_slave_1): Releasing backup interface [ 654.685611][T12715]  (unregistering): Released all slaves [ 654.708055][T12715] bond0 (unregistering): Released all slaves [ 654.724054][T12715] bond1 (unregistering): Released all slaves [ 654.748503][T12715] bond2 (unregistering): Released all slaves [ 654.765551][T12715] bond3 (unregistering): Released all slaves [ 654.782377][T12715] bond4 (unregistering): Released all slaves [ 654.799832][T12715] bond5 (unregistering): Released all slaves [ 654.823321][T12715] bond6 (unregistering): Released all slaves [ 654.839693][T12715] bond7 (unregistering): Released all slaves [ 654.857976][T12715] bond8 (unregistering): Released all slaves [ 654.884689][T12715] bond9 (unregistering): Released all slaves [ 655.194098][T12715] : left promiscuous mode [ 655.373520][T23512] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4684'. [ 655.726345][T23533] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 9 [ 655.735462][T23527] netlink: 'syz.2.4689': attribute type 1 has an invalid length. [ 655.923317][T23527] 8021q: adding VLAN 0 to HW filter on device bond5 [ 656.018170][T23545] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 656.063248][T23536] vlan2: entered promiscuous mode [ 656.082342][T23536] bond5: entered promiscuous mode [ 656.097357][T23536] vlan2: entered allmulticast mode [ 656.116232][T23536] bond5: entered allmulticast mode [ 656.323763][T23560] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4695'. [ 656.336015][T23560] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4695'. [ 656.346268][T23560] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4695'. [ 656.546131][T23567] rdma_rxe: rxe_newlink: failed to add vxcan1 [ 658.478458][T23541] syzkaller0: entered promiscuous mode [ 658.484409][T23541] syzkaller0: entered allmulticast mode [ 658.506068][T23522] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 658.911297][T23587] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4703'. [ 658.936780][T23590] netlink: 'syz.2.4704': attribute type 2 has an invalid length. [ 659.150712][T23602] netlink: 112 bytes leftover after parsing attributes in process `syz.0.4707'. [ 659.502779][T23613] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4710'. [ 659.772072][T23629] netlink: 260 bytes leftover after parsing attributes in process `syz.0.4713'. [ 659.793739][T12715] [ 659.796130][T12715] ====================================================== [ 659.803237][T12715] WARNING: possible circular locking dependency detected [ 659.810277][T12715] syzkaller #0 Not tainted [ 659.814800][T12715] ------------------------------------------------------ [ 659.821886][T12715] kworker/u8:46/12715 is trying to acquire lock: [ 659.828243][T12715] ffff88801c28d210 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_unlink_sibling+0x6d/0x170 [ 659.838971][T12715] [ 659.838971][T12715] but task is already holding lock: [ 659.846348][T12715] ffff88801c28d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0x76/0x800 [ 659.855968][T12715] [ 659.855968][T12715] which lock already depends on the new lock. [ 659.855968][T12715] [ 659.866386][T12715] [ 659.866386][T12715] the existing dependency chain (in reverse order) is: [ 659.875421][T12715] [ 659.875421][T12715] -> #9 (&root->kernfs_rwsem){++++}-{4:4}: [ 659.883502][T12715] down_write+0x96/0x200 [ 659.888336][T12715] kernfs_add_one+0x41/0x5e0 [ 659.893496][T12715] kernfs_create_dir_ns+0x1a1/0x230 [ 659.899245][T12715] internal_create_group+0x440/0x1180 [ 659.905171][T12715] cpuhp_invoke_callback+0x434/0x810 [ 659.911026][T12715] cpuhp_issue_call+0x3f0/0x750 [ 659.916427][T12715] __cpuhp_setup_state_cpuslocked+0x3f4/0x6f0 [ 659.923044][T12715] __cpuhp_setup_state+0x3f/0x60 [ 659.928532][T12715] do_one_initcall+0x250/0x870 [ 659.933847][T12715] do_initcall_level+0x10a/0x1a0 [ 659.939578][T12715] do_initcalls+0x59/0xa0 [ 659.944456][T12715] kernel_init_freeable+0x29d/0x3e0 [ 659.950203][T12715] kernel_init+0x1d/0x1d0 [ 659.955089][T12715] ret_from_fork+0x514/0xb70 [ 659.960260][T12715] ret_from_fork_asm+0x1a/0x30 [ 659.965568][T12715] [ 659.965568][T12715] -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: [ 659.973412][T12715] [ 659.973412][T12715] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 659.981174][T12715] cpus_read_lock+0x42/0x160 [ 659.986307][T12715] static_key_slow_inc+0x12/0x30 [ 659.991819][T12715] nbd_genl_reconfigure+0x1301/0x1e80 [ 659.997814][T12715] genl_family_rcv_msg_doit+0x233/0x340 [ 660.003914][T12715] genl_rcv_msg+0x614/0x7a0 [ 660.008975][T12715] netlink_rcv_skb+0x226/0x4a0 [ 660.014297][T12715] genl_rcv+0x28/0x40 [ 660.018829][T12715] netlink_unicast+0x7bb/0x940 [ 660.024143][T12715] netlink_sendmsg+0x813/0xb40 [ 660.029455][T12715] sock_sendmsg_nosec+0x13a/0x180 [ 660.035034][T12715] ____sys_sendmsg+0x54e/0x850 [ 660.040341][T12715] ___sys_sendmsg+0x2a5/0x360 [ 660.045567][T12715] __x64_sys_sendmsg+0x1b1/0x290 [ 660.051051][T12715] do_syscall_64+0x174/0x580 [ 660.056193][T12715] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.062629][T12715] [ 660.062629][T12715] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 660.070298][T12715] __mutex_lock+0x19d/0x1550 [ 660.075527][T12715] nbd_queue_rq+0x373/0x1150 [ 660.080670][T12715] blk_mq_dispatch_rq_list+0x499/0x1990 [ 660.086845][T12715] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 660.093863][T12715] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 660.100394][T12715] blk_mq_run_work_fn+0x16c/0x300 [ 660.105969][T12715] process_scheduled_works+0xa8e/0x14e0 [ 660.112085][T12715] worker_thread+0xa47/0xfb0 [ 660.117220][T12715] kthread+0x388/0x470 [ 660.121836][T12715] ret_from_fork+0x514/0xb70 [ 660.126984][T12715] ret_from_fork_asm+0x1a/0x30 [ 660.132284][T12715] [ 660.132284][T12715] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 660.139518][T12715] __mutex_lock+0x19d/0x1550 [ 660.144658][T12715] nbd_queue_rq+0xc1/0x1150 [ 660.149711][T12715] blk_mq_dispatch_rq_list+0x499/0x1990 [ 660.155804][T12715] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 660.162718][T12715] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 660.169242][T12715] blk_mq_run_work_fn+0x16c/0x300 [ 660.174813][T12715] process_scheduled_works+0xa8e/0x14e0 [ 660.180917][T12715] worker_thread+0xa47/0xfb0 [ 660.186056][T12715] kthread+0x388/0x470 [ 660.190675][T12715] ret_from_fork+0x514/0xb70 [ 660.195813][T12715] ret_from_fork_asm+0x1a/0x30 [ 660.201145][T12715] [ 660.201145][T12715] -> #4 (set->srcu){.+.+}-{0:0}: [ 660.208297][T12715] __synchronize_srcu+0xc9/0x2f0 [ 660.213783][T12715] elevator_switch+0x1e8/0x7b0 [ 660.219259][T12715] elevator_change+0x2fa/0x480 [ 660.224566][T12715] elevator_set_default+0x375/0x440 [ 660.230392][T12715] blk_register_queue+0x3f3/0x4e0 [ 660.236024][T12715] __add_disk+0x6cb/0xe30 [ 660.240906][T12715] add_disk_fwnode+0xfb/0x4b0 [ 660.246229][T12715] nbd_dev_add+0x733/0xb60 [ 660.251192][T12715] nbd_init+0x15f/0x1e0 [ 660.255943][T12715] do_one_initcall+0x250/0x870 [ 660.261257][T12715] do_initcall_level+0x10a/0x1a0 [ 660.266742][T12715] do_initcalls+0x59/0xa0 [ 660.271612][T12715] kernel_init_freeable+0x29d/0x3e0 [ 660.277356][T12715] kernel_init+0x1d/0x1d0 [ 660.282264][T12715] ret_from_fork+0x514/0xb70 [ 660.287405][T12715] ret_from_fork_asm+0x1a/0x30 [ 660.292707][T12715] [ 660.292707][T12715] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 660.300554][T12715] __mutex_lock+0x19d/0x1550 [ 660.305696][T12715] elevator_change+0x1af/0x480 [ 660.311010][T12715] elevator_set_none+0xb5/0x140 [ 660.316416][T12715] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 660.322776][T12715] nbd_start_device+0x189/0xb30 [ 660.328174][T12715] nbd_genl_connect+0x1597/0x1c10 [ 660.333750][T12715] genl_family_rcv_msg_doit+0x233/0x340 [ 660.339852][T12715] genl_rcv_msg+0x614/0x7a0 [ 660.345095][T12715] netlink_rcv_skb+0x226/0x4a0 [ 660.350401][T12715] genl_rcv+0x28/0x40 [ 660.354930][T12715] netlink_unicast+0x7bb/0x940 [ 660.360238][T12715] netlink_sendmsg+0x813/0xb40 [ 660.365556][T12715] sock_sendmsg_nosec+0x13a/0x180 [ 660.371152][T12715] ____sys_sendmsg+0x54e/0x850 [ 660.376460][T12715] ___sys_sendmsg+0x2a5/0x360 [ 660.381693][T12715] __x64_sys_sendmsg+0x1b1/0x290 [ 660.387180][T12715] do_syscall_64+0x174/0x580 [ 660.392324][T12715] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.398767][T12715] [ 660.398767][T12715] -> #2 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 660.407403][T12715] blk_alloc_queue+0x544/0x690 [ 660.412716][T12715] __blk_mq_alloc_disk+0x194/0x390 [ 660.418382][T12715] nbd_dev_add+0x494/0xb60 [ 660.423359][T12715] nbd_init+0x15f/0x1e0 [ 660.428058][T12715] do_one_initcall+0x250/0x870 [ 660.433401][T12715] do_initcall_level+0x10a/0x1a0 [ 660.438880][T12715] do_initcalls+0x59/0xa0 [ 660.443842][T12715] kernel_init_freeable+0x29d/0x3e0 [ 660.449766][T12715] kernel_init+0x1d/0x1d0 [ 660.454644][T12715] ret_from_fork+0x514/0xb70 [ 660.459810][T12715] ret_from_fork_asm+0x1a/0x30 [ 660.465154][T12715] [ 660.465154][T12715] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 660.472387][T12715] fs_reclaim_acquire+0x71/0x100 [ 660.477904][T12715] kmem_cache_alloc_noprof+0x64/0x5f0 [ 660.483816][T12715] __kernfs_iattrs+0xdd/0x380 [ 660.489070][T12715] kernfs_iop_setattr+0xe6/0x3f0 [ 660.494549][T12715] notify_change+0xbba/0xea0 [ 660.499678][T12715] do_truncate+0x1c2/0x250 [ 660.504662][T12715] path_openat+0x2fed/0x3830 [ 660.509805][T12715] do_file_open+0x23e/0x4a0 [ 660.514875][T12715] do_sys_openat2+0x115/0x200 [ 660.520202][T12715] __x64_sys_openat+0x138/0x170 [ 660.525603][T12715] do_syscall_64+0x174/0x580 [ 660.530758][T12715] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 660.537196][T12715] [ 660.537196][T12715] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 660.545737][T12715] __lock_acquire+0x1520/0x2cf0 [ 660.551138][T12715] lock_acquire+0x106/0x350 [ 660.556186][T12715] down_write+0x96/0x200 [ 660.560969][T12715] kernfs_unlink_sibling+0x6d/0x170 [ 660.566712][T12715] kernfs_rename_ns+0x48e/0x800 [ 660.572111][T12715] sysfs_rename_link_ns+0x16e/0x1b0 [ 660.577856][T12715] device_rename+0x110/0x210 [ 660.583095][T12715] __dev_change_net_namespace+0x1519/0x1fb0 [ 660.589586][T12715] cfg802154_switch_netns+0xbd/0x410 [ 660.595523][T12715] cfg802154_pernet_exit+0x75/0xc0 [ 660.601198][T12715] ops_undo_list+0x43d/0x8d0 [ 660.606370][T12715] cleanup_net+0x572/0x810 [ 660.611327][T12715] process_scheduled_works+0xa8e/0x14e0 [ 660.617412][T12715] worker_thread+0xa47/0xfb0 [ 660.622546][T12715] kthread+0x388/0x470 [ 660.627160][T12715] ret_from_fork+0x514/0xb70 [ 660.632297][T12715] ret_from_fork_asm+0x1a/0x30 [ 660.637595][T12715] [ 660.637595][T12715] other info that might help us debug this: [ 660.637595][T12715] [ 660.647945][T12715] Chain exists of: [ 660.647945][T12715] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 660.647945][T12715] [ 660.662458][T12715] Possible unsafe locking scenario: [ 660.662458][T12715] [ 660.669940][T12715] CPU0 CPU1 [ 660.675376][T12715] ---- ---- [ 660.680753][T12715] lock(&root->kernfs_rwsem); [ 660.685552][T12715] lock(cpuhp_state_mutex); [ 660.692683][T12715] lock(&root->kernfs_rwsem); [ 660.699985][T12715] lock(&root->kernfs_iattr_rwsem); [ 660.705298][T12715] [ 660.705298][T12715] *** DEADLOCK *** [ 660.705298][T12715] [ 660.713478][T12715] 5 locks held by kworker/u8:46/12715: [ 660.718950][T12715] #0: ffff88801c28e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 660.729916][T12715] #1: ffffc9000d99fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 660.740580][T12715] #2: ffffffff9001ace8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 [ 660.749919][T12715] #3: ffffffff90029880 (rtnl_mutex){+.+.}-{4:4}, at: cfg802154_pernet_exit+0x18/0xc0 [ 660.759539][T12715] #4: ffff88801c28d180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_rename_ns+0x76/0x800 [ 660.769581][T12715] [ 660.769581][T12715] stack backtrace: [ 660.775485][T12715] CPU: 1 UID: 0 PID: 12715 Comm: kworker/u8:46 Not tainted syzkaller #0 PREEMPT(full) [ 660.775505][T12715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 660.775518][T12715] Workqueue: netns cleanup_net [ 660.775539][T12715] Call Trace: [ 660.775548][T12715] [ 660.775556][T12715] dump_stack_lvl+0xe8/0x150 [ 660.775583][T12715] print_circular_bug+0x2e1/0x300 [ 660.775602][T12715] check_noncircular+0x12e/0x150 [ 660.775632][T12715] __lock_acquire+0x1520/0x2cf0 [ 660.775658][T12715] ? __lock_acquire+0x683/0x2cf0 [ 660.775681][T12715] ? __lock_acquire+0x683/0x2cf0 [ 660.775708][T12715] ? kernfs_unlink_sibling+0x6d/0x170 [ 660.775734][T12715] lock_acquire+0x106/0x350 [ 660.775756][T12715] ? kernfs_unlink_sibling+0x6d/0x170 [ 660.775788][T12715] down_write+0x96/0x200 [ 660.775810][T12715] ? kernfs_unlink_sibling+0x6d/0x170 [ 660.775836][T12715] ? __pfx_down_write+0x10/0x10 [ 660.775861][T12715] ? kernfs_root+0x1c/0x230 [ 660.775881][T12715] ? kernfs_root+0x1c/0x230 [ 660.775902][T12715] ? kernfs_root+0x1c/0x230 [ 660.775924][T12715] ? kernfs_root+0x1ea/0x230 [ 660.775945][T12715] kernfs_unlink_sibling+0x6d/0x170 [ 660.775973][T12715] kernfs_rename_ns+0x48e/0x800 [ 660.776002][T12715] sysfs_rename_link_ns+0x16e/0x1b0 [ 660.776027][T12715] device_rename+0x110/0x210 [ 660.776053][T12715] __dev_change_net_namespace+0x1519/0x1fb0 [ 660.776086][T12715] ? __lock_acquire+0x683/0x2cf0 [ 660.776108][T12715] ? __pfx___dev_change_net_namespace+0x10/0x10 [ 660.776134][T12715] ? __lock_acquire+0x683/0x2cf0 [ 660.776160][T12715] ? __lock_acquire+0x683/0x2cf0 [ 660.776185][T12715] ? do_raw_spin_lock+0x12b/0x2f0 [ 660.776215][T12715] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 660.776296][T12715] ? lockdep_hardirqs_on+0x7a/0x110 [ 660.776315][T12715] ? __mutex_lock+0x1092/0x1550 [ 660.776334][T12715] ? __mutex_lock+0x5d4/0x1550 [ 660.776357][T12715] ? __pfx___mutex_lock+0x10/0x10 [ 660.776380][T12715] cfg802154_switch_netns+0xbd/0x410 [ 660.776407][T12715] cfg802154_pernet_exit+0x75/0xc0 [ 660.776432][T12715] ops_undo_list+0x43d/0x8d0 [ 660.776452][T12715] ? __pfx_ops_undo_list+0x10/0x10 [ 660.776471][T12715] ? idr_destroy+0x218/0x290 [ 660.776526][T12715] ? do_raw_spin_unlock+0xf5/0x210 [ 660.776547][T12715] cleanup_net+0x572/0x810 [ 660.776566][T12715] ? __pfx_cleanup_net+0x10/0x10 [ 660.776585][T12715] ? rcu_is_watching+0x15/0xb0 [ 660.776612][T12715] ? process_scheduled_works+0xa20/0x14e0 [ 660.776631][T12715] process_scheduled_works+0xa8e/0x14e0 [ 660.776661][T12715] ? __pfx_process_scheduled_works+0x10/0x10 [ 660.776682][T12715] ? assign_work+0x3cf/0x5d0 [ 660.776700][T12715] worker_thread+0xa47/0xfb0 [ 660.776730][T12715] kthread+0x388/0x470 [ 660.776753][T12715] ? __pfx_worker_thread+0x10/0x10 [ 660.776771][T12715] ? __pfx_kthread+0x10/0x10 [ 660.776795][T12715] ret_from_fork+0x514/0xb70 [ 660.776820][T12715] ? __pfx_ret_from_fork+0x10/0x10 [ 660.776850][T12715] ? __switch_to+0xc89/0x1420 [ 660.776871][T12715] ? __pfx_kthread+0x10/0x10 [ 660.776894][T12715] ret_from_fork_asm+0x1a/0x30 [ 660.776916][T12715] [ 661.105048][T12715] hsr_slave_0: left promiscuous mode [ 661.116654][T12715] hsr_slave_1: left promiscuous mode [ 661.151720][T12715] veth1_macvtap: left promiscuous mode [ 661.157478][T12715] veth0_macvtap: left promiscuous mode [ 661.283781][T12715] team0 (unregistering): Port device team_slave_1 removed [ 661.296103][T12715] team0 (unregistering): Port device team_slave_0 removed [ 661.377050][T23615] netlink: 'syz.3.4710': attribute type 1 has an invalid length. [ 661.537955][T12715] IPVS: stop unused estimator thread 0...