last executing test programs: 2.78902792s ago: executing program 4 (id=8437): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000680)=ANY=[@ANYBLOB="440000001000090600000000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="a7ffa888000000001c00128009000100766c616e000000000c000280060001000100000008000500", @ANYRES32=r5], 0x44}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r7, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=@newlink={0x4c, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_MASTER={0x8, 0xa, r8}, @IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x6}, @IFLA_BR_VLAN_DEFAULT_PVID={0x6}]}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) 2.737432064s ago: executing program 3 (id=8438): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x121800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x200005, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0x8}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x1, 0x10, 0x6, 0x8, 0x4fbee}, 0x13, 0x1, 0x3, 0x0, 0x10, 0x4, 0x1b, 0x18, 0x5, 0x402, {0x6, 0x8001, 0xfffffffc, 0x0, 0xffffffff, 0x40005}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000004c0)=':d', 0x2, 0x4000845, &(0x7f0000000140)={0x11, 0x88a8, r5, 0x1, 0x3, 0x6, @local}, 0x14) 2.721997379s ago: executing program 0 (id=8439): sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x36, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) 2.418524518s ago: executing program 0 (id=8440): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x2, 0xfff3}, {}, {0x8, 0x10}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_connmark={0x50, 0x1, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x2, 0x3, 0x4, 0x32, 0xfffffbff}, 0x80}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) r8 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000140)=@xdp={0x2c, 0x8, r2, 0x3c}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000540)='\'', 0x59}], 0x1}, 0x4011) 1.814169017s ago: executing program 4 (id=8444): writev(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000140)="1a36c585040053c08764d056a86d003cbaf5cde47e5f51052d82c19aa673d66141642953", 0x24}], 0x1) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0xa2d40, 0x0) close(r0) close(0xffffffffffffffff) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r2) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000000)={0x500, 0x0, 0x0}, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2000001, 0x12, 0xffffffffffffffff, 0x34de2000) ioctl$TUNSETFILTEREBPF(0xffffffffffffffff, 0x800454e1, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="810902000000000000000300000008000100000000001c0007800c00"], 0x38}, 0x1, 0x0, 0x0, 0x2008810}, 0x48080) 1.813832322s ago: executing program 1 (id=8445): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001a00)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) 1.769439029s ago: executing program 3 (id=8446): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$kcm(r0, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x20040000) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @loopback}, 0x10, 0x0}, 0x30004001) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000c40)=ANY=[@ANYBLOB="140000002400010026bd700055dbdf25040000"], 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c0000000200"/31], 0x0, 0x26}, 0x28) syz_genetlink_get_family_id$nl80211(0x0, r1) sendmsg$NL80211_CMD_TESTMODE(r1, 0x0, 0x81) sendmsg$NL80211_CMD_GET_STATION(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000c80)={0x20, 0x0, 0x201, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xcea, 0x7e}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x40014}, 0x4000005) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, 0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r2, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x0) 1.660964279s ago: executing program 1 (id=8447): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000140)={'erspan0\x00', 0x0}) sendmsg$GTP_CMD_GETPDP(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000300}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x24, 0x0, 0x2, 0x70bd2b, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @multicast2}, @GTPA_LINK={0x8, 0x1, r1}]}, 0x24}, 0x1, 0x0, 0x0, 0x40040a5}, 0x8800) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r2, 0x0, 0x80c0) r3 = socket(0x1a, 0x2, 0x1) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, 0x0) sendmsg$nl_route_sched(r2, 0x0, 0x8) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r0, 0x8983, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000009c0), r0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000a00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_BSS(r0, &(0x7f0000000b00)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x2c, r4, 0x1, 0x70bd25, 0x25dfdbff, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_BSS_HT_OPMODE={0x6, 0x6d, 0x200}, @NL80211_ATTR_P2P_OPPPS={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x8000) 1.545698769s ago: executing program 0 (id=8448): socket$inet6_sctp(0xa, 0x1, 0x84) socket(0x2, 0x80805, 0x0) socket$inet(0x2, 0x80001, 0x84) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket(0xa, 0x3, 0x3a) socket$inet6(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x10, 0x2, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)={0x1c, 0x15, 0x301, 0x0, 0x0, {0xa}, [@typed={0x8, 0x2, 0x0, 0x0, @fd=r2}]}, 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) 1.488823248s ago: executing program 4 (id=8449): r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r0, 0x7) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r1, 0x100) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0x1) r3 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r3, 0x7) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r4, 0x100) r5 = socket$inet(0xa, 0x801, 0x84) listen(r5, 0x8) r6 = socket$netlink(0x10, 0x3, 0x4) writev(r6, &(0x7f0000000200)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x48}], 0x1) 1.488094347s ago: executing program 1 (id=8450): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x42901, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x24040084) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newqdisc={0x50, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x8, '\x00', 0x7, 0x7f, 0x1, 0x7}}}}, @TCA_RATE={0x6, 0x5, {0x7}}]}, 0x50}, 0x1, 0x0, 0x0, 0x14028010}, 0x20004000) 1.312233772s ago: executing program 0 (id=8452): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb305e06daab01a77}, 0x40) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r3) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000100)={@ipv4={'\x00', '\xff\xff', @multicast2}, 0x56, r2}) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCSIFADDR(r6, 0x8916, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2d, r4}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 1.311920945s ago: executing program 4 (id=8453): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r2, 0x200) r3 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r3, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) sendto(0xffffffffffffffff, &(0x7f0000000000), 0xfeb5, 0x0, 0x0, 0x0) recvmmsg(r3, &(0x7f0000006000)=[{{0x0, 0x0, &(0x7f0000000040)}, 0x4}], 0x1, 0x0, 0x0) recvfrom(r3, &(0x7f0000000380)=""/49, 0xfec6, 0x10022, 0x0, 0x0) sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000ec0)={0x14, r1, 0xe701ac47a3d23ecd}, 0x14}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@newlink={0x6c, 0x10, 0x401, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, 0x585d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @private2}]}]}, @IFLA_IFNAME={0x14, 0x3, 'ipvlan0\x00'}, @IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPVLAN_MODE={0x6}]}}}]}, 0x6c}}, 0x0) 1.21948221s ago: executing program 2 (id=8454): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000005580)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822a0269a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7ae22e16c6c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546bba3d005585bf07d70e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225c380fac12f8205d182f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05fea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d96ee1b84bb64b14aebc6b5194c55dd6890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56bd86acb7654a195bc3e98df3a5dffd5b07838a3ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828bf209d0ed9829dec16ab67a4f59a504e09f55ab82bbd405087a17a229a149c53ee9145500db213cb36489a10957739e481a756e65bde579bbbfb404213f661eeaaffacbcfbfd6"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000019800)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)={@cgroup=r0, r0, 0x2f, 0x558}, 0x20) 1.10223254s ago: executing program 1 (id=8455): socket$kcm(0x10, 0x400000002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f0000000080)=0x10) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) r2 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) listen(r2, 0x9) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) sendto$inet(r4, &(0x7f00000000c0)="ab", 0xfffd, 0xc1, &(0x7f0000000280)={0x2, 0x4e22, @loopback}, 0x10) readv(r1, &(0x7f0000000b40)=[{&(0x7f0000000cc0)=""/154, 0x9a}], 0x1) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c000000140011f225bd7000fddbcf250284", @ANYRES32], 0x4c}, 0x1, 0x0, 0x0, 0x48000}, 0x40) 955.80848ms ago: executing program 2 (id=8456): socket$packet(0x11, 0x2, 0x300) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=@newtaction={0x4d0, 0x30, 0x100, 0x70bd29, 0x25dfdbfe, {}, [{0x4bc, 0x1, [@m_skbedit={0x84, 0x1b, 0x0, 0x0, {{0xc}, {0x3c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x7}, @TCA_SKBEDIT_PRIORITY={0x8, 0x3, {0x6, 0xd}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x3}, @TCA_SKBEDIT_PARMS={0x18, 0x2, {0x9, 0x3, 0x8, 0x3, 0xfff}}, @TCA_SKBEDIT_QUEUE_MAPPING={0x6, 0x4, 0x6}]}, {0x1d, 0x6, "6cbc0be399313f4862f2515a09a917bc7d87e474f1fa546fba"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x6b31a6586b121e0b, 0x2}}}}, @m_police={0x434, 0x19, 0x0, 0x0, {{0xb}, {0x408, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9880, 0xfffffc00, 0xfffffff8, 0x6, 0x800, 0x80000000, 0x7d, 0xfffffffd, 0x3ff, 0xfffffe01, 0x7, 0x7, 0x0, 0x5, 0x3, 0x3, 0x4, 0x8, 0x200, 0x0, 0xfffffffe, 0x8000, 0x2, 0x92, 0x4, 0x3, 0x6, 0x2, 0xe, 0x2b8, 0x50, 0x5, 0x9, 0x3, 0x6, 0x10000, 0x7fff, 0x0, 0xb, 0x8, 0x5, 0xf, 0xfffffffd, 0x9, 0x99b, 0x4, 0x6, 0x0, 0x3, 0x6, 0x4, 0x5, 0x2, 0x7, 0x7, 0x5, 0x3, 0x5, 0x29, 0x0, 0x8, 0x2, 0x80000000, 0xaf9d, 0x6, 0x9, 0x80000001, 0x7, 0x5, 0xfffffffb, 0xd00000, 0x9e, 0x8, 0x401, 0x3, 0x6, 0x8, 0x3, 0x3, 0x2, 0x100, 0xfffffc01, 0x6, 0x545, 0x0, 0x9, 0x200, 0xd3, 0x401, 0x5, 0x7, 0x2, 0x5, 0x5a3, 0x451f, 0x1, 0xaffc, 0xfffffffd, 0x9294, 0xa, 0x1, 0x71b, 0x2, 0x9, 0x80, 0x6, 0x401, 0x9, 0x8001, 0x4, 0x10, 0x200, 0x91e, 0x80000001, 0x793bd975, 0x71f, 0x9, 0x8, 0x6, 0x5, 0x9f6, 0xf, 0x4, 0x8, 0x7f, 0x2, 0xb, 0x2eb, 0x4, 0x0, 0xdd65, 0x80000000, 0x6, 0x8, 0x0, 0xff800000, 0xfffffff2, 0x4, 0x1000, 0x0, 0x7, 0xa882, 0x7, 0x9, 0x881, 0x4, 0x8, 0x2, 0x80, 0xffffff6a, 0x8000, 0xfffffffb, 0x10001, 0x4, 0x5, 0x8, 0x0, 0x0, 0x7ff, 0xfff, 0x40, 0x9, 0x8, 0xe, 0xc, 0x1, 0x5, 0x81, 0x6, 0x7ff, 0x86, 0x2, 0xcd, 0x2, 0x8, 0x8, 0xd9bd, 0xcc3c, 0x92, 0xa, 0x9, 0x2, 0x26, 0x4, 0x80000000, 0xb, 0x4, 0x80, 0xe5, 0x1026, 0x3, 0xffffffe1, 0xfffffff3, 0x4, 0x7fff, 0x1, 0x1, 0x0, 0xd7ec, 0xd, 0xfffffffb, 0x0, 0x915, 0x3, 0x5, 0x6, 0x7, 0x10, 0x3, 0x6, 0x0, 0xb017, 0x8, 0x1, 0x8, 0x3, 0x3fc, 0xd37, 0x3ff, 0xe54, 0x9191, 0xff, 0x3, 0xff, 0xc0000000, 0x0, 0x5, 0x87, 0x5, 0x0, 0xef0, 0x8, 0xd, 0x6, 0x3, 0x4, 0xfffffff0, 0x200, 0x0, 0x4, 0x7, 0x25ff, 0x1, 0xffffff6f, 0x40, 0x9, 0x5, 0x7, 0x8000, 0x6, 0x774, 0x10001, 0x5af, 0xc, 0x7, 0x80000000]}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x6fe4b901c62758b}}}}]}]}, 0x4d0}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x6}, @empty, @private=0xa010101, 0xff000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) write$tun(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="000008004500001c000100004001"], 0xfdef) 829.378456ms ago: executing program 1 (id=8457): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x4, 0x35dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x0, 0xb}, {0xffff, 0x6}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x1c, 0x2, [@TCA_CODEL_TARGET={0x8, 0x1, 0x40}, @TCA_CODEL_INTERVAL={0x8, 0x3, 0x9}, @TCA_CODEL_ECN={0x8, 0x4, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240048e4}, 0x20004810) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200820814120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 829.108097ms ago: executing program 3 (id=8458): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=@newtfilter={0x50, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x4}, {}, {0x1, 0xa}}, [@TCA_CHAIN={0x8, 0xb, 0x3ff}, @filter_kind_options=@f_matchall={{0xd}, {0x4}}, @filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000010}, 0x80) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40088a01, 0x0) r7 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r3, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x0, 0x1, 0x9, 0x8000, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x40007, 0x8, 0xf, 0x2, 0x80000001, 0x400, 0x1007fc, 0xffff8000, 0x6, 0x403, 0x9, 0x8, 0xffffe4f5, 0xd6, 0x4, 0xfffb, 0x7, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0x2, 0xb, 0x4, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x6a, 0x2, 0x4, 0xd05, 0x1000044, 0x8, 0x8, 0x1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x4, 0x68, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0x7, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x8, 0xa, 0x7, 0x1, 0x1, 0x1, 0x7, 0x40, 0x7, 0x12, 0x87d0, 0x1, 0x4dc, 0x80, 0x3, 0x7fffffff, 0xff, 0x5, 0xa7, 0xf, 0x1, 0xffffffff, 0x3, 0x1001, 0x4, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0xfffd, 0x2, 0x6, 0x3ff, 0xf04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x6, 0x1, 0x3, 0xfffffffb, 0x1, 0x0, 0x3, 0x2, 0x5, 0x8, 0x3, 0x0, 0x800, 0xf06, 0x8, 0x7ff, 0x0, 0x1, 0x6, 0x5, 0x400001, 0x4d15, 0x1ff, 0x7, 0x3, 0x8001, 0x3, 0x0, 0x200, 0xf, 0x7, 0x9, 0x8, 0x42ba, 0x4, 0x9, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x200, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x1, 0x1ff, 0x5, 0x5, 0x1, 0x8, 0x2, 0x8, 0x0, 0xd, 0x0, 0x4, 0x10, 0x901, 0x5, 0x2, 0x7b, 0xfffffeff, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x10000068, 0x80000001, 0x6, 0x9fd, 0x10000006, 0x200, 0x2]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0x40098}, 0x20000010) 744.063709ms ago: executing program 0 (id=8459): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000019800)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) socket$inet6(0xa, 0x1, 0x100) 648.075882ms ago: executing program 0 (id=8460): syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) write$cgroup_type(r1, &(0x7f0000000280), 0x9) r2 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r4, 0x1, 0x2e, &(0x7f0000000100)=0x6, 0x4) recvfrom(r4, 0x0, 0x0, 0x32, 0x0, 0x0) r5 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r5, &(0x7f0000000200)=0x1, 0x12) 588.990229ms ago: executing program 2 (id=8461): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) recvfrom(r0, &(0x7f0000001380)=""/179, 0xb3, 0x1, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d382e23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) writev(r0, &(0x7f0000001540)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c80", 0x87}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dd", 0x2c}], 0x2) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 508.880665ms ago: executing program 3 (id=8462): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3, 0x6, 0x7, 0x200, 0x4, 0x8, 0x8ed, 0x10, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8810) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000500)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x7fffe, {0x0, 0x0, 0x0, r5, {0x0, 0x7}, {0x1, 0xb}, {0x4, 0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4048800}, 0x20000000) sendto$packet(r4, &(0x7f00000002c0)="05031c00d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 488.43817ms ago: executing program 2 (id=8463): socket$nl_xfrm(0x10, 0x3, 0x6) socket(0x10, 0x80002, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) bind$packet(r0, &(0x7f0000000000)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @link_local}, 0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x5, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$kcm(0x11, 0x200000000000003, 0x300) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f00000003c0), 0x4) recvmsg$kcm(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000006c0), 0x60}, 0x0) sendto$inet6(r0, &(0x7f0000000280)="02043c00ec074802010e0200c52cf7c20675e005b02f0800eb2b2ff0dac8897c6b112002faffffff3066090cb600c5471d130a66321a54e7df305f80a88161b6fd8f24286a57c3feffff", 0xfc13, 0x800, 0x0, 0x2f) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, 0x0) 395.038176ms ago: executing program 4 (id=8464): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x1d, 0x4, &(0x7f0000000600)=@raw=[@call={0x85, 0x0, 0x0, 0x7b}, @call={0x85, 0x0, 0x0, 0xaf}, @map_fd={0x18, 0x7}], 0x0, 0x4, 0x0, 0x0, 0x0, 0x4a}, 0x94) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f00000004c0)=ANY=[@ANYBLOB="7103b3"], 0xb6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r6, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) 296.46348ms ago: executing program 2 (id=8465): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, 0x0, 0x8) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='io.stat\x00', 0x26e1, 0x0) close(r2) ioctl$TUNSETOFFLOAD(0xffffffffffffffff, 0xc004743e, 0x110c23003f) write$cgroup_devices(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="80fd"], 0xa) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="600000001800010400000000000000000a400000fe0300010000000014000500fe8000000000000000000000000000bb08000400", @ANYRES32=0x2], 0x60}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv6_newroute={0x60, 0x18, 0x401, 0x0, 0x0, {0xa, 0x40, 0x0, 0x0, 0xfe, 0x3, 0x0, 0x1}, [@RTA_GATEWAY={0x14, 0x5, @remote}, @RTA_OIF={0x8, 0x4, 0x2}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x8}, @RTA_ENCAP={0x20, 0x16, 0x0, 0x1, @RPL_IPTUNNEL_SRH={0x1c, 0x1, {0x0, 0x2, 0x1, 0x1, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}}}]}, 0x60}}, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) 295.686543ms ago: executing program 3 (id=8466): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=@newqdisc={0x74, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x0, 0xb}, {0xffff, 0x6}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x48, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0x2}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0x8, 0xfff7, 0x1, 0x3}, {0xa5, 0x0, 0xfff8, 0x7, 0x8001, 0x4}, 0xd860, 0x7c, 0x1c75}}, @TCA_TBF_PRATE64={0xc, 0x5, 0x50c2c3d35d16a8e7}, @TCA_TBF_BURST={0x8, 0x6, 0x194b}]}}]}, 0x74}, 0x1, 0x0, 0x0, 0x240048e4}, 0x8000) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 225.331363ms ago: executing program 1 (id=8467): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'veth1_to_bridge\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r4, 0x29, 0x33, &(0x7f0000000000)=0x5, 0x4) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r4, &(0x7f0000000240)="1c", 0xffffffffffffff1f, 0x200080c0, &(0x7f00000001c0)={0xa, 0x2, 0x3ff, @loopback, 0xffffff1e}, 0x1c) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r5, 0x0, 0x2f, &(0x7f0000000240)={0x2, {{0x2, 0x3, @multicast1}}, {{0x2, 0x0, @rand_addr=0x64010101}}}, 0x108) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x170bd26, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x3972d, 0x4b7bc}, [@IFLA_MASTER={0x8, 0xa, r1}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r3}]}, 0x44}, 0x1, 0x0, 0x0, 0x24004844}, 0x8000002) 37.677603ms ago: executing program 2 (id=8468): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(0xffffffffffffffff, 0x0, 0x4894) r1 = socket(0x2b, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r2, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x48) accept$packet(r1, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r3, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) 34.272421ms ago: executing program 3 (id=8469): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xa}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x2}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0xfff7, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x14, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x6}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x2}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 0s ago: executing program 4 (id=8470): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x4) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x101) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005500e502000000000000000007000000", @ANYRES32=r2, @ANYBLOB="20000100", @ANYRES16=r0], 0x38}}, 0x0) kernel console output (not intermixed with test programs): cess `syz.3.3233'. [ 273.312071][T12754] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3235'. [ 273.334147][T12754] tipc: Invalid UDP bearer configuration [ 273.334201][T12754] tipc: Enabling of bearer rejected, failed to enable media [ 273.387070][T12756] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.3236'. [ 273.411196][T12756] netlink: 4595 bytes leftover after parsing attributes in process `syz.4.3236'. [ 273.817911][T12768] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 273.817911][T12768] Please contact the netfilter-devel mailing list or update your nftables rules. [ 274.505918][T12790] netlink: 'syz.0.3253': attribute type 1 has an invalid length. [ 274.540441][T12790] netlink: 5120 bytes leftover after parsing attributes in process `syz.0.3253'. [ 275.397358][T12815] netlink: 'syz.2.3265': attribute type 1 has an invalid length. [ 276.677945][T12851] netlink: 'syz.1.3281': attribute type 2 has an invalid length. [ 277.198011][T12871] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3292'. [ 277.707218][T12893] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3303'. [ 277.759238][T12893] netlink: 60 bytes leftover after parsing attributes in process `syz.3.3303'. [ 278.322749][T12917] netlink: 'syz.2.3315': attribute type 1 has an invalid length. [ 279.289227][T12950] netlink: 'syz.4.3330': attribute type 2 has an invalid length. [ 279.400717][T12950] : entered promiscuous mode [ 279.850296][T12975] netlink: 'syz.2.3342': attribute type 23 has an invalid length. [ 280.230507][T12990] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 280.684447][T13001] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3354'. [ 281.986499][T13038] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3372'. [ 282.036938][T13038] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3372'. [ 282.039682][T13042] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3373'. [ 282.672733][T13069] openvswitch: netlink: Missing key (keys=40, expected=100) [ 282.870057][T13078] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3391'. [ 283.480735][T13100] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3403'. [ 283.516414][T13102] netlink: 'syz.4.3404': attribute type 3 has an invalid length. [ 283.526113][T13100] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3403'. [ 284.004718][T13127] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3416'. [ 284.640967][T13143] netlink: 'syz.4.3423': attribute type 4 has an invalid length. [ 284.677986][T13143] netlink: 240 bytes leftover after parsing attributes in process `syz.4.3423'. [ 284.907358][T13157] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3429'. [ 284.936480][T13157] netlink: 120 bytes leftover after parsing attributes in process `syz.3.3429'. [ 284.969776][T13157] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3429'. [ 286.000823][T13202] netlink: 'syz.1.3451': attribute type 1 has an invalid length. [ 286.027401][T13202] netlink: 232 bytes leftover after parsing attributes in process `syz.1.3451'. [ 286.071646][T13202] netlink: 'syz.1.3451': attribute type 1 has an invalid length. [ 286.162245][T13210] netlink: 'syz.4.3455': attribute type 58 has an invalid length. [ 286.165460][T13206] nftables ruleset with unbound set [ 286.198666][T13210] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3455'. [ 287.964066][T13279] netlink: 'syz.2.3487': attribute type 29 has an invalid length. [ 288.015292][T13282] __nla_validate_parse: 1 callbacks suppressed [ 288.015309][T13282] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3488'. [ 288.322312][T13296] netlink: 348 bytes leftover after parsing attributes in process `syz.3.3494'. [ 288.470717][T13300] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3498'. [ 288.489753][T13302] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3497'. [ 289.270233][T13334] atomic_op ffff88801c2b0198 conn xmit_atomic 0000000000000000 [ 290.471349][T13370] tipc: Enabling of bearer rejected, failed to enable media [ 290.799604][T13383] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3536'. [ 290.883606][T13383] vlan2: entered promiscuous mode [ 290.916988][T13383] gretap0: entered promiscuous mode [ 292.062501][T13429] vlan2: entered allmulticast mode [ 292.092268][T13429] bond0: entered allmulticast mode [ 292.117963][T13429] bond_slave_0: entered allmulticast mode [ 292.142319][T13429] bond_slave_1: entered allmulticast mode [ 292.682278][T13447] xt_socket: unknown flags 0xe4 [ 292.781685][T13449] netlink: 'syz.0.3570': attribute type 2 has an invalid length. [ 292.906395][T13453] nbd: must specify a size in bytes for the device [ 293.557416][T13473] sit1: entered promiscuous mode [ 293.580461][T13473] sit1: entered allmulticast mode [ 295.674911][T13556] openvswitch: netlink: IP tunnel attribute has 5385 unknown bytes. [ 296.117131][T13573] netlink: 'syz.1.3628': attribute type 3 has an invalid length. [ 296.161190][T13573] netlink: 666 bytes leftover after parsing attributes in process `syz.1.3628'. [ 296.412320][T13585] netlink: 'syz.1.3636': attribute type 1 has an invalid length. [ 296.644265][T13592] veth3: entered allmulticast mode [ 297.213396][T13617] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3650'. [ 298.702955][T13659] lo: entered allmulticast mode [ 298.734416][T13659] lo: left allmulticast mode [ 298.878395][T13667] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3676'. [ 299.025528][T13672] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3679'. [ 299.301242][T13677] nbd: socks must be embedded in a SOCK_ITEM attr [ 299.803493][T13698] veth0_to_bond: entered allmulticast mode [ 300.349221][T13716] openvswitch: netlink: Tunnel attr 9 has unexpected len 4 expected 2 [ 300.730034][T13729] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 302.354534][T13797] vlan3: entered promiscuous mode [ 302.391477][T13797] bridge0: entered promiscuous mode [ 302.425683][T13797] vlan3: entered allmulticast mode [ 302.449976][T13797] bridge0: entered allmulticast mode [ 303.189439][T13825] netlink: 2 bytes leftover after parsing attributes in process `syz.0.3752'. [ 303.274522][T13829] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3754'. [ 304.489112][T13870] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3775'. [ 304.581925][T13873] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3776'. [ 305.058087][T13888] netlink: 'syz.2.3782': attribute type 11 has an invalid length. [ 305.072396][T13891] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 305.779196][T13920] team0: Device ipvlan0 failed to register rx_handler [ 306.514196][T13951] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3812'. [ 306.845787][T13964] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3818'. [ 306.895530][T13966] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3819'. [ 307.091084][T13975] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3823'. [ 307.165810][T13975] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3823'. [ 307.199212][T13975] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3823'. [ 308.131665][T14006] mac80211_hwsim hwsim3 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 308.312154][T14010] ip_tables: iptables: counters copy to user failed while replacing table [ 308.386965][T14012] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 309.468177][T14050] openvswitch: netlink: Missing key (keys=40, expected=100) [ 310.031608][T14070] __nla_validate_parse: 38 callbacks suppressed [ 310.031625][T14070] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3870'. [ 310.097814][T14072] netlink: 332 bytes leftover after parsing attributes in process `syz.1.3869'. [ 310.390807][T14078] vlan3: entered allmulticast mode [ 310.413005][T14078] bond0: entered allmulticast mode [ 310.439685][T14078] bond_slave_0: entered allmulticast mode [ 310.471358][T14078] bond_slave_1: entered allmulticast mode [ 310.759875][ T81] wlan1: Trigger new scan to find an IBSS to join [ 310.995367][T14105] openvswitch: netlink: Missing valid actions attribute. [ 311.039442][T14105] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 311.934593][T14136] sctp: [Deprecated]: syz.1.3901 (pid 14136) Use of int in maxseg socket option. [ 311.934593][T14136] Use struct sctp_assoc_value instead [ 312.629429][T14160] netlink: 'syz.1.3913': attribute type 2 has an invalid length. [ 312.647555][T14160] netlink: 156 bytes leftover after parsing attributes in process `syz.1.3913'. [ 313.191283][T14172] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 313.230570][T14172] team0: Device ipvlan2 is already an upper device of the team interface [ 313.516367][T14187] netlink: 240 bytes leftover after parsing attributes in process `syz.2.3925'. [ 313.716916][ T57] wlan1: Trigger new scan to find an IBSS to join [ 313.732600][T14195] tunl0: entered promiscuous mode [ 313.753174][T14195] netlink: 'syz.1.3928': attribute type 4 has an invalid length. [ 313.776954][T14195] netlink: 9 bytes leftover after parsing attributes in process `syz.1.3928'. [ 314.064235][T14210] netlink: 'syz.0.3937': attribute type 1 has an invalid length. [ 314.279261][T14218] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3941'. [ 314.841989][T14240] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3951'. [ 315.199206][T14254] vlan4: entered allmulticast mode [ 316.687948][ T550] wlan1: Trigger new scan to find an IBSS to join [ 316.999933][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.390475][T14338] IPv6: NLM_F_CREATE should be specified when creating new route [ 317.452325][T14338] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3999'. [ 317.808035][ T550] wlan1: Creating new IBSS network, BSSID a6:d5:06:90:ae:f4 [ 318.290912][T14369] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4015'. [ 319.173039][T14400] Dead loop on virtual device ip6_vti0 (net 39), fix it urgently! [ 320.495417][T14432] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4045'. [ 321.190417][T14453] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 323.193582][T14524] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4090'. [ 323.352332][T14534] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 323.436581][T14524] bond3: option lacp_strict: mode dependency failed, not supported in mode balance-rr(0) [ 323.552254][T14524] bond3 (unregistering): Released all slaves [ 325.250075][T14609] netlink: 76 bytes leftover after parsing attributes in process `syz.1.4132'. [ 325.294161][T14609] nbd: illegal input index 65508 [ 325.496096][T14622] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4134'. [ 325.533648][T14622] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4134'. [ 325.724852][T14630] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4141'. [ 325.794461][T14628] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4140'. [ 325.915762][T14636] RDS: rds_bind could not find a transport for 400:0:1200:0:1030:0:ffff:ffff, load rds_tcp or rds_rdma? [ 327.260052][T14681] smc: smcd device lo applied user defined pnetid SYZ0 [ 327.801340][T14702] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4174'. [ 328.117349][ T5631] Bluetooth: hci4: command 0x0406 tx timeout [ 328.455829][T14725] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 330.058168][T14783] tipc: Enabling of bearer rejected, failed to enable media [ 331.033491][T14819] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4230'. [ 331.063175][T14819] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4230'. [ 332.292059][T14868] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 332.356291][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 333.230395][T14904] netlink: 100 bytes leftover after parsing attributes in process `syz.4.4271'. [ 333.643011][T14920] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 333.931501][T14931] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4281'. [ 334.981427][T14962] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4297'. [ 335.005699][T14963] netlink: 277 bytes leftover after parsing attributes in process `syz.4.4298'. [ 335.882717][T14996] vcan0: entered allmulticast mode [ 336.430291][T15020] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4325'. [ 337.202973][T15036] netlink: 'syz.3.4333': attribute type 1 has an invalid length. [ 338.993459][T15094] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4362'. [ 339.061018][T15096] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4363'. [ 339.119424][T15096] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4363'. [ 339.663458][T15116] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4373'. [ 340.436994][T15152] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4391'. [ 340.763666][T15164] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 342.760132][T15219] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 342.976356][T15227] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 343.106905][T15232] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4430'. [ 344.266469][T15280] netlink: 'syz.3.4454': attribute type 4 has an invalid length. [ 344.611721][T15291] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4459'. [ 345.682773][T15333] ip6gre0: Master is either lo or non-ether device [ 345.949456][T15344] netlink: 104 bytes leftover after parsing attributes in process `syz.4.4484'. [ 346.326309][T15359] netlink: 27 bytes leftover after parsing attributes in process `syz.0.4490'. [ 346.745164][T15373] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4498'. [ 347.402075][T15398] netlink: 'syz.1.4511': attribute type 2 has an invalid length. [ 348.170850][T15419] bridge0: port 2(bridge_slave_1) entered disabled state [ 348.190154][T15429] netlink: 'syz.2.4525': attribute type 12 has an invalid length. [ 348.228059][T15429] netlink: 'syz.2.4525': attribute type 29 has an invalid length. [ 348.255861][T15429] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4525'. [ 348.293418][T15429] netlink: 'syz.2.4525': attribute type 1 has an invalid length. [ 348.340616][T15429] netlink: 'syz.2.4525': attribute type 2 has an invalid length. [ 349.008224][T15458] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4539'. [ 349.280022][T15461] 8021q: adding VLAN 0 to HW filter on device bond1 [ 349.297500][T15461] bond0: (slave bond1): Enslaving as an active interface with an up link [ 349.840406][T15488] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4553'. [ 350.059131][T15496] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4556'. [ 350.277036][ T81] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 350.794693][T15517] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 350.834612][T15517] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 350.975027][T15522] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4568'. [ 350.994596][T15522] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4568'. [ 351.334697][T15534] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 351.932080][T15558] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4584'. [ 352.291753][T15571] netlink: 'syz.4.4592': attribute type 8 has an invalid length. [ 352.337053][T15571] sch_fq: defrate 0 ignored. [ 352.720516][T15590] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4602'. [ 353.154266][T15612] sctp: [Deprecated]: syz.2.4610 (pid 15612) Use of struct sctp_assoc_value in delayed_ack socket option. [ 353.154266][T15612] Use struct sctp_sack_info instead [ 353.776775][T15632] netlink: 10 bytes leftover after parsing attributes in process `syz.0.4622'. [ 353.923694][T15637] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4624'. [ 354.480347][T15655] netlink: 16215 bytes leftover after parsing attributes in process `syz.2.4632'. [ 354.785523][T15666] blkio.reset_stats is deprecated [ 355.228634][T15686] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4645'. [ 355.324219][T15688] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4648'. [ 355.621033][T15695] netlink: 'syz.1.4651': attribute type 1 has an invalid length. [ 355.672657][T15695] netlink: 193500 bytes leftover after parsing attributes in process `syz.1.4651'. [ 355.703041][T15695] netlink: 'syz.1.4651': attribute type 1 has an invalid length. [ 355.720732][T15695] netlink: 2016 bytes leftover after parsing attributes in process `syz.1.4651'. [ 355.980364][T15709] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4657'. [ 357.035318][T15747] ip_tables: iptables: counters copy to user failed while replacing table [ 357.210143][T15756] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4679'. [ 357.537810][T15767] netlink: 'syz.1.4684': attribute type 16 has an invalid length. [ 357.582549][T15767] netlink: 'syz.1.4684': attribute type 2 has an invalid length. [ 357.632387][T15767] netlink: 64110 bytes leftover after parsing attributes in process `syz.1.4684'. [ 357.706767][T15766] lo speed is unknown, defaulting to 1000 [ 358.527361][T15798] bridge0: port 2(bridge_slave_1) entered disabled state [ 359.853571][T15851] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4725'. [ 360.144414][T15865] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4732'. [ 360.994719][T15895] netlink: 232 bytes leftover after parsing attributes in process `syz.0.4747'. [ 362.388960][T15941] netlink: Unknown nat attribute (0) [ 362.413326][T15943] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 362.420615][T15943] IPv6: NLM_F_CREATE should be set when creating new route [ 362.427884][T15943] IPv6: NLM_F_CREATE should be set when creating new route [ 362.432689][T15941] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 362.461964][T15943] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 362.893534][T15961] netlink: 'syz.2.4779': attribute type 83 has an invalid length. [ 362.939722][T15965] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 362.960085][T15967] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4782'. [ 363.127636][T15973] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4785'. [ 365.298849][T16052] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4822'. [ 366.180284][T16091] openvswitch: netlink: IP tunnel dst address not specified [ 366.237392][T16091] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 366.405312][T16097] ip_tables: iptables: counters copy to user failed while replacing table [ 366.902250][T16120] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4856'. [ 366.975401][T16120] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4856'. [ 367.354797][T16133] tap0: tun_chr_ioctl cmd 2148553947 [ 367.600404][T16143] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4866'. [ 368.425023][T16177] openvswitch: netlink: Missing key (keys=c0, expected=480) [ 368.894381][T16194] macvlan0: left promiscuous mode [ 368.906722][T16194] netlink: 'syz.3.4890': attribute type 2 has an invalid length. [ 369.285106][T16203] ip_tables: iptables: counters copy to user failed while replacing table [ 369.544912][T16215] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4900'. [ 369.596786][T16218] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4900'. [ 369.636490][T16215] xfrm1: entered promiscuous mode [ 369.662111][T16215] xfrm1: entered allmulticast mode [ 371.463671][T16297] netlink: 'syz.1.4934': attribute type 14 has an invalid length. [ 371.709416][T16311] bridge0: port 3(dummy0) entered blocking state [ 371.733020][T16311] bridge0: port 3(dummy0) entered disabled state [ 371.771768][T16311] dummy0: entered allmulticast mode [ 371.834512][T16311] dummy0: entered promiscuous mode [ 372.445131][T16335] xt_hashlimit: size too large, truncated to 1048576 [ 373.634992][T16378] ip_tables: iptables: counters copy to user failed while replacing table [ 373.673280][T16380] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4973'. [ 374.895205][T16429] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4997'. [ 375.263045][T16443] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.5003'. [ 375.291596][T16443] netlink: 4768 bytes leftover after parsing attributes in process `syz.3.5003'. [ 376.408379][T16488] ip_tables: iptables: counters copy to user failed while replacing table [ 376.724015][T16499] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5030'. [ 377.035209][T16511] netlink: 'syz.0.5035': attribute type 21 has an invalid length. [ 377.083418][T16516] netlink: 'syz.0.5035': attribute type 21 has an invalid length. [ 377.134141][T16516] netlink: 128 bytes leftover after parsing attributes in process `syz.0.5035'. [ 377.135063][T16511] netlink: 128 bytes leftover after parsing attributes in process `syz.0.5035'. [ 377.213762][T16516] netlink: 'syz.0.5035': attribute type 4 has an invalid length. [ 377.274070][T16516] netlink: 'syz.0.5035': attribute type 5 has an invalid length. [ 377.333378][T16516] netlink: 3 bytes leftover after parsing attributes in process `syz.0.5035'. [ 377.376437][T16511] netlink: 'syz.0.5035': attribute type 4 has an invalid length. [ 377.405288][T16511] netlink: 'syz.0.5035': attribute type 5 has an invalid length. [ 377.436552][T16511] netlink: 3 bytes leftover after parsing attributes in process `syz.0.5035'. [ 378.295532][T16553] netlink: 1044 bytes leftover after parsing attributes in process `syz.0.5053'. [ 378.442963][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 379.391533][T16596] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 381.269763][T16667] netlink: 196 bytes leftover after parsing attributes in process `syz.2.5106'. [ 382.279003][ T1105] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 382.423895][T16711] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5128'. [ 383.190006][T16738] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5141'. [ 383.389809][T16746] netlink: 'syz.2.5145': attribute type 10 has an invalid length. [ 384.584721][T16793] netlink: 'syz.1.5167': attribute type 4 has an invalid length. [ 384.611726][T16794] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5166'. [ 387.843500][ T30] audit: type=1804 audit(1785959555.597:3): pid=16910 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.5219" name="/newroot/1033/cgroup.controllers" dev="tmpfs" ino=5200 res=1 errno=0 [ 387.972989][ T30] audit: type=1800 audit(1785959555.637:4): pid=16910 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.5219" name="cgroup.controllers" dev="tmpfs" ino=5200 res=0 errno=0 [ 388.397089][T16937] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5231'. [ 388.504881][T16942] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 388.527083][T16940] tun0: tun_chr_ioctl cmd 1074025675 [ 388.546380][T16940] tun0: persist disabled [ 388.848754][T16956] netlink: 'syz.4.5240': attribute type 83 has an invalid length. [ 389.198990][T16969] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 389.508016][T16981] netlink: 'syz.1.5251': attribute type 83 has an invalid length. [ 389.834629][T17000] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5260'. [ 389.891461][T17002] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5261'. [ 392.157300][T17079] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5298'. [ 392.380815][T17086] netlink: 81 bytes leftover after parsing attributes in process `syz.1.5301'. [ 393.744984][T17145] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5330'. [ 394.220600][T17163] TCP: TCP_TX_DELAY enabled [ 394.289726][ T5639] Bluetooth: hci4: link tx timeout [ 394.295132][ T5639] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 394.303269][ T5631] Bluetooth: hci4: link tx timeout [ 394.308921][ T5631] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 394.323778][ T5631] Bluetooth: hci4: link tx timeout [ 394.329394][ T5631] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 394.339733][ T5631] Bluetooth: hci4: link tx timeout [ 394.345371][ T5631] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 394.353142][ T5631] Bluetooth: hci4: link tx timeout [ 394.359256][ T5631] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 394.380438][ T5631] Bluetooth: hci4: link tx timeout [ 394.385589][ T5631] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 394.394288][ T5631] Bluetooth: hci4: link tx timeout [ 394.399836][ T5631] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 394.448149][T17170] syzkaller1: tun_chr_ioctl cmd 1074025678 [ 394.454042][T17170] syzkaller1: group set to 0 [ 395.172346][T17198] skbuff: bad partial csum: csum=65535/0 headroom=64 headlen=65537 [ 395.571098][T17217] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5361'. [ 395.644869][T17219] netlink: 'syz.1.5362': attribute type 11 has an invalid length. [ 396.146184][T17233] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5369'. [ 396.328859][T17242] netlink: 'syz.2.5373': attribute type 83 has an invalid length. [ 396.358279][ T5631] Bluetooth: hci4: command 0x0406 tx timeout [ 397.062296][T17266] bond2: entered promiscuous mode [ 398.133100][ T5631] block nbd0: Receive control failed (result -32) [ 398.437120][ T5631] Bluetooth: hci4: command 0x0406 tx timeout [ 398.514274][T17332] netlink: 'syz.3.5413': attribute type 1 has an invalid length. [ 398.537465][T17332] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5413'. [ 399.323962][T17361] ip6gre1: entered allmulticast mode [ 399.348883][ T1113] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 399.654986][T17378] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5437'. [ 400.299869][T17402] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5443'. [ 400.569794][ T5631] block nbd1: Receive control failed (result -32) [ 401.204539][T17443] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5463'. [ 401.566627][T17458] netlink: 'syz.1.5470': attribute type 11 has an invalid length. [ 401.630369][T17462] sctp: [Deprecated]: syz.4.5473 (pid 17462) Use of struct sctp_assoc_value in delayed_ack socket option. [ 401.630369][T17462] Use struct sctp_sack_info instead [ 401.878019][T17470] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5476'. [ 401.935223][T17470] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5476'. [ 401.961004][T17473] erspan0: entered promiscuous mode [ 402.086805][T17478] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5479'. [ 403.044213][T17515] netlink: 'syz.2.5497': attribute type 83 has an invalid length. [ 403.236499][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 403.388895][T17531] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5506'. [ 403.729155][T17546] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.5513'. [ 404.100645][T17562] ip_tables: iptables: counters copy to user failed while replacing table [ 404.275648][T17565] netlink: 'syz.1.5523': attribute type 2 has an invalid length. [ 404.574501][T17575] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5527'. [ 404.911683][T17596] sctp: [Deprecated]: syz.0.5537 (pid 17596) Use of struct sctp_assoc_value in delayed_ack socket option. [ 404.911683][T17596] Use struct sctp_sack_info instead [ 405.405918][T17607] bond0: entered promiscuous mode [ 405.435736][T17607] bond_slave_0: entered promiscuous mode [ 405.454719][T17607] bond_slave_1: entered promiscuous mode [ 405.476394][T17607] batadv0: entered promiscuous mode [ 405.498805][T17607] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 405.522014][T17607] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 405.549692][T17607] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 405.582747][T17607] bond0: left promiscuous mode [ 405.603066][T17607] bond_slave_0: left promiscuous mode [ 405.626411][T17607] bond_slave_1: left promiscuous mode [ 405.648897][T17607] batadv0: left promiscuous mode [ 405.921454][T17617] netlink: 56 bytes leftover after parsing attributes in process `syz.2.5546'. [ 406.423103][T17644] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.5557'. [ 406.446476][T17637] netlink: 16402 bytes leftover after parsing attributes in process `syz.2.5557'. [ 406.578523][T17648] team0: Cannot enslave team device to itself [ 406.754581][T17655] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5565'. [ 407.001542][T17670] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5572'. [ 407.032805][T17670] netlink: 60 bytes leftover after parsing attributes in process `syz.3.5572'. [ 407.195227][T17678] xt_hashlimit: size too large, truncated to 1048576 [ 407.377401][T17682] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 407.413507][T17682] bond_slave_0: left allmulticast mode [ 407.444311][T17682] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 407.478914][T17682] bond_slave_1: left allmulticast mode [ 407.505918][T17682] bond0 (unregistering): Released all slaves [ 408.522212][T17726] netlink: 68 bytes leftover after parsing attributes in process `syz.0.5597'. [ 408.598002][T17731] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5598'. [ 408.828781][T17737] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5601'. [ 408.864957][T17739] netlink: 'syz.2.5602': attribute type 1 has an invalid length. [ 408.884811][T17737] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5601'. [ 408.901178][T17739] netlink: 'syz.2.5602': attribute type 2 has an invalid length. [ 409.237962][T17744] tipc: Enabling of bearer rejected, failed to enable media [ 409.715347][T17764] pim6reg: entered allmulticast mode [ 410.269718][T17789] erspan0: entered promiscuous mode [ 410.952548][T17822] __nla_validate_parse: 4 callbacks suppressed [ 410.952565][T17822] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5638'. [ 411.076213][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 411.251408][T17826] sctp: [Deprecated]: syz.0.5641 (pid 17826) Use of int in max_burst socket option deprecated. [ 411.251408][T17826] Use struct sctp_assoc_value instead [ 411.428851][T17841] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5648'. [ 412.012360][T17868] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 412.036839][T17868] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 412.060157][T17868] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 412.075520][T17868] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 412.579090][T17894] netlink: 104 bytes leftover after parsing attributes in process `syz.3.5674'. [ 412.831593][T17903] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5678'. [ 412.982253][T17907] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5680'. [ 413.101958][T17907] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5680'. [ 413.132937][T17912] netlink: 108 bytes leftover after parsing attributes in process `syz.0.5682'. [ 413.503984][T17929] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5690'. [ 413.554231][T17934] netlink: 'syz.1.5694': attribute type 2 has an invalid length. [ 413.772041][T17945] netlink: 'syz.1.5698': attribute type 83 has an invalid length. [ 413.944098][T17949] netlink: 284 bytes leftover after parsing attributes in process `syz.4.5699'. [ 414.170304][T17958] tap0: tun_chr_ioctl cmd 1074025676 [ 414.194699][T17958] tap0: owner set to 0 [ 414.224507][T17962] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5705'. [ 414.277050][ T1113] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 415.693802][T18029] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 415.725930][ T29] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 416.799941][T18074] xt_hashlimit: size too large, truncated to 1048576 [ 417.132435][T18092] __nla_validate_parse: 5 callbacks suppressed [ 417.132453][T18092] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5767'. [ 417.735079][T18113] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5777'. [ 418.956953][T18161] ip_tables: iptables: counters copy to user failed while replacing table [ 419.243740][T18171] sctp: [Deprecated]: syz.1.5798 (pid 18171) Use of int in maxseg socket option. [ 419.243740][T18171] Use struct sctp_assoc_value instead [ 420.712824][T18235] nbd2: detected capacity change from 0 to 63 [ 420.738493][ T5631] block nbd2: Receive control failed (result -32) [ 420.754767][ T1681] block nbd2: Dead connection, failed to find a fallback [ 420.762252][ T1681] block nbd2: shutting down sockets [ 420.768131][ T1681] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.778982][ T1681] Buffer I/O error on dev nbd2, logical block 0, async page read [ 420.787644][ T1681] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.797434][ T1681] Buffer I/O error on dev nbd2, logical block 1, async page read [ 420.806656][ T1681] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.816523][ T1681] Buffer I/O error on dev nbd2, logical block 2, async page read [ 420.825444][ T1681] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.835484][ T1681] Buffer I/O error on dev nbd2, logical block 3, async page read [ 420.844434][ T1681] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 420.854493][ T1681] Buffer I/O error on dev nbd2, logical block 0, async page read [ 420.862927][ T1681] Buffer I/O error on dev nbd2, logical block 1, async page read [ 420.870987][ T1681] Buffer I/O error on dev nbd2, logical block 2, async page read [ 420.878952][ T1681] Buffer I/O error on dev nbd2, logical block 3, async page read [ 420.887358][ T1681] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 420.897108][ T1681] Buffer I/O error on dev nbd2, logical block 0, async page read [ 420.904878][ T1681] Buffer I/O error on dev nbd2, logical block 1, async page read [ 420.913056][ T1681] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.924580][ T1681] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 420.934701][ T1681] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 420.944657][ T1681] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 420.955908][ T5638] ldm_validate_partition_table(): Disk read failed. [ 420.964825][ T5638] Dev nbd2: unable to read RDB block 0 [ 420.972068][ T5638] nbd2: unable to read partition table [ 420.994663][ T5638] ldm_validate_partition_table(): Disk read failed. [ 421.003461][ T5638] Dev nbd2: unable to read RDB block 0 [ 421.011008][ T5638] nbd2: unable to read partition table [ 421.937496][T18274] team0: No ports can be present during mode change [ 422.580356][T18301] erspan0: entered promiscuous mode [ 423.377793][T18331] netlink: 576 bytes leftover after parsing attributes in process `syz.4.5856'. [ 423.641243][T18341] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5861'. [ 423.666235][T18341] block nbd3: Unsupported socket: should be TCP or UNIX. [ 423.955920][T18357] netlink: 88 bytes leftover after parsing attributes in process `syz.0.5869'. [ 424.215549][T18367] netlink: 104 bytes leftover after parsing attributes in process `syz.0.5874'. [ 424.520918][T18376] bridge0: port 2(bridge_slave_1) entered listening state [ 424.809982][T18364] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 424.851397][T18393] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5884'. [ 425.232225][T18364] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.601363][T18364] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 425.795822][T18428] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5896'. [ 425.796232][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 425.933359][ T57] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 425.960866][ T57] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.096584][ T550] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.124237][ T550] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 426.287287][ T550] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.348967][ T550] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.383867][ T550] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.424571][ T550] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 426.861200][T18457] 8021q: adding VLAN 0 to HW filter on device macsec3 [ 427.227958][T18473] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5918'. [ 427.793053][T18494] netlink: 'syz.0.5928': attribute type 1 has an invalid length. [ 427.875121][T18494] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5928'. [ 428.633478][T18520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5941'. [ 428.659739][T18520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5941'. [ 428.687770][T18520] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5941'. [ 428.771101][T18529] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 428.859255][T18533] netlink: 'syz.4.5947': attribute type 2 has an invalid length. [ 428.887226][T18533] netlink: 100 bytes leftover after parsing attributes in process `syz.4.5947'. [ 429.514847][T18562] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5961'. [ 429.728760][T18572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5966'. [ 429.771425][T18572] netlink: 'syz.2.5966': attribute type 1 has an invalid length. [ 429.820180][T18572] netlink: 'syz.2.5966': attribute type 2 has an invalid length. [ 430.255326][T18600] block nbd3: Unsupported socket: should be TCP or UNIX. [ 430.524043][T18608] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5983'. [ 431.123264][T18636] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5996'. [ 431.383538][T18643] tap0: tun_chr_ioctl cmd 1074025672 [ 431.400350][T18643] tap0: ignored: set checksum disabled [ 431.988491][T18666] netlink: 'syz.2.6011': attribute type 10 has an invalid length. [ 432.060635][T18666] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 432.105124][T18666] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 432.162557][T18673] 8021q: adding VLAN 0 to HW filter on device bond2 [ 432.175511][T18673] bond0: (slave bond2): Enslaving as an active interface with an up link [ 432.649540][T18696] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6024'. [ 432.694690][T18696] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6024'. [ 432.865169][T18703] openvswitch: netlink: IPv4 tunnel dst address is zero [ 432.903317][T18703] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 433.090483][T18715] netlink: 'syz.0.6033': attribute type 9 has an invalid length. [ 434.493650][T18761] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6054'. [ 435.564447][T18806] IPVS: persistence engine module ip_vs_pe_À not found [ 435.603573][T18814] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6079'. [ 435.686985][T18819] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6082'. [ 435.745358][T18819] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6082'. [ 436.110621][T18834] IPv6: NLM_F_CREATE should be specified when creating new route [ 436.214638][T18838] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6091'. [ 436.528105][T18848] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6097'. [ 436.974374][T18871] veth1_macvtap: left promiscuous mode [ 437.388168][T18889] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6115'. [ 437.503365][T18896] veth0: entered promiscuous mode [ 437.528399][T18895] veth0: left promiscuous mode [ 437.601286][T18901] tun0: tun_chr_ioctl cmd 1074025675 [ 437.622099][T18901] tun0: persist enabled [ 438.314524][ T5631] block nbd3: Receive control failed (result -32) [ 438.316183][ T5639] block nbd3: Receive control failed (result -32) [ 438.720108][T18955] netlink: 'syz.0.6144': attribute type 5 has an invalid length. [ 438.943508][T18965] openvswitch: netlink: IP tunnel TTL not specified. [ 438.972662][T18965] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 439.633135][T18999] netlink: 'syz.3.6167': attribute type 5 has an invalid length. [ 439.654311][T19002] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6168'. [ 439.879705][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.942409][T19016] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6172'. [ 440.624975][T19047] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6186'. [ 440.758213][T19053] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6189'. [ 440.780070][T19053] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6189'. [ 441.581840][T19081] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6203'. [ 441.617564][T19086] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6204'. [ 441.653496][T19086] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6204'. [ 441.781012][T19091] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6207'. [ 442.039143][T19103] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6213'. [ 442.073563][T19101] netlink: 'syz.0.6212': attribute type 83 has an invalid length. [ 444.170179][T19188] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 444.177531][T19188] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 444.911954][T19223] sch_tbf: burst 0 is lower than device lo mtu (81) ! [ 445.179528][T19233] veth0: entered promiscuous mode [ 445.221470][T19233] veth0: left promiscuous mode [ 445.458417][T19242] netlink: 'syz.0.6277': attribute type 33 has an invalid length. [ 445.645559][T19242] bond3: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 445.682202][T19242] bond3 (unregistering): Released all slaves [ 446.413731][T19280] netlink: 'syz.4.6296': attribute type 12 has an invalid length. [ 446.455839][T19280] netlink: 'syz.4.6296': attribute type 29 has an invalid length. [ 446.495748][T19280] __nla_validate_parse: 6 callbacks suppressed [ 446.495763][T19280] netlink: 148 bytes leftover after parsing attributes in process `syz.4.6296'. [ 446.593788][T19280] netlink: 'syz.4.6296': attribute type 2 has an invalid length. [ 446.981144][T19305] openvswitch: netlink: IP tunnel dst address not specified [ 446.986626][T19304] team0: Device gtp0 is of different type [ 447.011066][T19305] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 447.181762][T19309] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6309'. [ 448.564613][T19361] vxcan0: tx address claim with different name [ 448.706604][T19372] netlink: 'syz.4.6340': attribute type 8 has an invalid length. [ 448.727998][T19374] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6341'. [ 448.942010][T19383] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6344'. [ 449.443574][T19397] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6352'. [ 449.480125][T19397] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6352'. [ 450.482393][T19451] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6374'. [ 450.901474][T19464] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6385'. [ 450.948194][T19464] netlink: 'syz.2.6385': attribute type 7 has an invalid length. [ 451.003701][T19468] sctp: [Deprecated]: syz.3.6384 (pid 19468) Use of struct sctp_assoc_value in delayed_ack socket option. [ 451.003701][T19468] Use struct sctp_sack_info instead [ 451.028008][T19464] netlink: 'syz.2.6385': attribute type 8 has an invalid length. [ 451.071581][T19467] bond3: option mode: invalid value (10) [ 451.095161][T19464] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6385'. [ 451.112349][T19467] bond3 (unregistering): Released all slaves [ 451.913576][T19490] netlink: 27 bytes leftover after parsing attributes in process `syz.4.6394'. [ 451.972611][T19492] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6395'. [ 452.034062][T19492] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 452.067815][T19495] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6397'. [ 452.119273][T19492] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 452.737401][T19518] netlink: 'syz.2.6406': attribute type 1 has an invalid length. [ 452.757600][T19518] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6406'. [ 453.234197][T19545] netlink: 'syz.0.6419': attribute type 17 has an invalid length. [ 453.266996][T19545] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6419'. [ 453.332920][T19545] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6419'. [ 453.407411][T19545] gretap0: entered promiscuous mode [ 453.434270][T19545] gretap0: left promiscuous mode [ 453.908507][T19576] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6431'. [ 453.948696][T19578] syzkaller1: entered promiscuous mode [ 453.973093][T19578] syzkaller1: entered allmulticast mode [ 455.000152][T19624] netlink: 64 bytes leftover after parsing attributes in process `syz.0.6453'. [ 455.237063][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 455.387232][T19637] lo speed is unknown, defaulting to 1000 [ 456.239946][T19672] netlink: NAT attribute type 0 has unexpected length (1 != 0) [ 456.280267][T19672] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 456.856580][T19692] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6481'. [ 458.885185][T19766] netlink: 84 bytes leftover after parsing attributes in process `syz.3.6510'. [ 459.385893][T19794] PF_CAN: dropped non conform CAN skbuff: dev type 65534, len 64 [ 460.263427][T19809] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6532'. [ 460.300753][T19809] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6532'. [ 460.346452][T19809] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6532'. [ 460.386832][T19809] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6532'. [ 460.729829][T19832] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6542'. [ 461.953975][T19878] xt_hashlimit: size too large, truncated to 1048576 [ 462.010007][T19880] bridge_slave_0: left allmulticast mode [ 462.024273][T19880] bridge_slave_0: left promiscuous mode [ 462.046578][T19880] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.056605][T19881] netlink: 45349 bytes leftover after parsing attributes in process `syz.2.6561'. [ 462.103993][T19880] bridge_slave_1: left promiscuous mode [ 462.125077][T19880] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.163256][T19880] bond0: (slave bond_slave_0): Releasing backup interface [ 462.192483][T19880] bond0: (slave bond_slave_1): Releasing backup interface [ 462.244693][T19880] team0: Port device team_slave_0 removed [ 462.331255][T19880] team0: Port device team_slave_1 removed [ 462.349454][T19880] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 462.369013][T19880] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 462.384065][T19880] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 462.402020][T19880] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 462.417593][T19880] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 462.453823][T19881] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 462.482232][T19881] 0ªX¹¦Dö»: entered allmulticast mode [ 463.032421][T19910] netlink: 40 bytes leftover after parsing attributes in process `syz.1.6575'. [ 463.254334][T19919] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6579'. [ 463.284375][T19919] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6579'. [ 464.314639][ T29] hsr0: entered promiscuous mode [ 464.322438][T19964] __nla_validate_parse: 1 callbacks suppressed [ 464.322456][T19964] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6598'. [ 464.822593][T19983] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6609'. [ 464.840344][T19980] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 465.512976][T20014] netlink: 'syz.3.6624': attribute type 1 has an invalid length. [ 465.529818][T20014] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.6624'. [ 465.549659][T20014] netlink: 'syz.3.6624': attribute type 1 has an invalid length. [ 465.560226][T20014] netlink: 2016 bytes leftover after parsing attributes in process `syz.3.6624'. [ 466.531847][T20067] netlink: 156 bytes leftover after parsing attributes in process `syz.1.6643'. [ 466.692799][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.726183][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 466.778606][T20072] sctp: [Deprecated]: syz.0.6647 (pid 20072) Use of int in max_burst socket option. [ 466.778606][T20072] Use struct sctp_assoc_value instead [ 466.886286][T20074] netlink: 120 bytes leftover after parsing attributes in process `syz.2.6648'. [ 466.944313][T20076] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6649'. [ 466.991848][T20076] veth0_macvtap: left promiscuous mode [ 467.165263][T20085] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6652'. [ 467.206033][T20085] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6652'. [ 468.177485][T20129] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.6672'. [ 468.229600][T20131] xt_hashlimit: size too large, truncated to 1048576 [ 468.383404][T20133] bridge_slave_0 (unregistering): left allmulticast mode [ 468.406515][T20133] bridge_slave_0 (unregistering): left promiscuous mode [ 468.421520][T20133] bridge0: port 1(bridge_slave_0) entered disabled state [ 469.137592][T20163] block nbd4: Unsupported socket: should be TCP or UNIX. [ 470.596447][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 470.612016][T20229] __nla_validate_parse: 3 callbacks suppressed [ 470.612031][T20229] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6715'. [ 470.787865][T20233] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6715'. [ 470.814750][T20233] nbd: device at index 64 is going down [ 471.143397][T20251] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6722'. [ 471.205699][T20251] netlink: 'syz.4.6722': attribute type 10 has an invalid length. [ 471.235688][ T5638] udevd[5638]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 471.237876][T20251] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6722'. [ 471.533117][T20260] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6728'. [ 471.570304][T20266] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6730'. [ 471.653555][T20272] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6729'. [ 471.876811][T20281] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6736'. [ 473.641261][T20350] netlink: 'syz.3.6769': attribute type 39 has an invalid length. [ 473.829478][T20359] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6773'. [ 473.894212][ T5639] block nbd4: Receive control failed (result -107) [ 475.105604][T20411] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6795'. [ 476.447161][T20466] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6818'. [ 476.565764][T20470] syzkaller1: entered promiscuous mode [ 476.592147][T20470] syzkaller1: entered allmulticast mode [ 476.598966][T20473] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6822'. [ 476.825489][T20477] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6824'. [ 476.858295][T20477] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6824'. [ 477.433826][T20504] bridge_slave_1: left promiscuous mode [ 477.481562][T20504] bridge0: port 2(bridge_slave_1) entered disabled state [ 477.551669][T20504] bridge_slave_0: left allmulticast mode [ 477.563271][T20512] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6840'. [ 477.573791][T20504] bridge_slave_0: left promiscuous mode [ 477.592831][T20504] bridge0: port 1(bridge_slave_0) entered disabled state [ 477.603742][T20512] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6840'. [ 478.315293][T20532] syzkaller1: entered allmulticast mode [ 478.345131][T20539] : renamed from bond0 [ 478.767257][T20559] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6861'. [ 478.811759][T20559] netlink: 'syz.1.6861': attribute type 10 has an invalid length. [ 478.849721][T20559] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6861'. [ 478.957498][T20565] netlink: 'syz.2.6864': attribute type 4 has an invalid length. [ 479.181188][T20575] tipc: Started in network mode [ 479.195437][T20575] tipc: Node identity ac14142f, cluster identity 4711 [ 479.213358][T20575] tipc: New replicast peer: 172.20.20.170 [ 479.238973][T20575] tipc: Enabled bearer , priority 10 [ 479.280537][T20580] tipc: New replicast peer: 0.0.0.0 [ 480.188088][T20608] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6883'. [ 480.255291][T20610] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6885'. [ 480.288167][T20610] netlink: 'syz.1.6885': attribute type 7 has an invalid length. [ 480.356375][ T5750] tipc: Node number set to 2886997039 [ 480.971084][T20631] veth0_macvtap: left promiscuous mode [ 482.289299][T20684] __nla_validate_parse: 2 callbacks suppressed [ 482.289317][T20684] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6918'. [ 482.355920][T20684] netlink: 60 bytes leftover after parsing attributes in process `syz.2.6918'. [ 482.397713][T20684] netlink: 500 bytes leftover after parsing attributes in process `syz.2.6918'. [ 482.810177][T20705] netlink: 'syz.1.6930': attribute type 5 has an invalid length. [ 482.871234][T20705] netlink: 'syz.1.6930': attribute type 9 has an invalid length. [ 482.917345][T20705] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6930'. [ 483.345161][T20723] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6938'. [ 483.370450][T20723] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6938'. [ 483.813508][T20736] syzkaller1: entered promiscuous mode [ 483.838891][T20736] syzkaller1: entered allmulticast mode [ 484.483475][T20772] netlink: 'syz.3.6962': attribute type 4 has an invalid length. [ 484.843273][T20785] geneve2: entered promiscuous mode [ 484.937437][ T36] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 58741 - 0 [ 484.968669][ T36] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 58741 - 0 [ 485.001106][ T36] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 58741 - 0 [ 485.040727][ T36] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 58741 - 0 [ 485.379261][T20800] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6973'. [ 485.489682][T20806] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6976'. [ 485.521810][T20806] netlink: 'syz.3.6976': attribute type 7 has an invalid length. [ 485.554448][T20806] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6976'. [ 485.809886][T20821] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6983'. [ 485.944435][T20829] tls_set_device_offload: netdev not found [ 486.178523][T20838] veth1_to_bond: entered allmulticast mode [ 486.191849][T20838] veth1_to_bond: entered promiscuous mode [ 486.304744][T20838] veth1_to_bond (unregistering): left allmulticast mode [ 486.327151][T20838] veth1_to_bond (unregistering): left promiscuous mode [ 486.401683][T20838] bond0: (slave bond_slave_1): Releasing backup interface [ 486.446189][T20838] bond_slave_1 (unregistering): left allmulticast mode [ 486.696851][T20855] netlink: 'syz.3.6998': attribute type 1 has an invalid length. [ 486.875281][T20855] 8021q: adding VLAN 0 to HW filter on device bond2 [ 486.927930][T20862] bond2: (slave geneve4): making interface the new active one [ 486.942767][T20862] bond2: (slave geneve4): Enslaving as an active interface with an up link [ 487.520617][T20897] netlink: 'syz.0.7016': attribute type 4 has an invalid length. [ 488.034057][T20910] ip6gre1: entered allmulticast mode [ 488.046826][ T1113] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 488.084350][T20914] netlink: 'syz.1.7024': attribute type 7 has an invalid length. [ 488.192119][T20918] xt_hashlimit: size too large, truncated to 1048576 [ 488.228565][T20914] netlink: 'syz.1.7024': attribute type 7 has an invalid length. [ 488.494299][T20929] __nla_validate_parse: 7 callbacks suppressed [ 488.494318][T20929] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7030'. [ 488.544296][T20931] netlink: 'syz.4.7031': attribute type 5 has an invalid length. [ 488.565584][T20929] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7030'. [ 488.637688][T20933] ipip0: entered promiscuous mode [ 488.642922][T20933] ipip0: entered allmulticast mode [ 488.679488][T20935] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7033'. [ 488.940669][T20946] netlink: 'syz.4.7038': attribute type 11 has an invalid length. [ 488.966880][T20946] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7038'. [ 488.999046][T20946] netlink: 'syz.4.7038': attribute type 11 has an invalid length. [ 489.038301][T20946] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7038'. [ 489.405260][T20966] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7046'. [ 489.457276][T20966] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7046'. [ 489.479521][T20966] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7046'. [ 489.512477][T20966] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7046'. [ 489.545123][T20966] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7046'. [ 489.609257][T20974] trusted_key: syz.0.7050 sent an empty control message without MSG_MORE. [ 489.720027][T20977] syz_tun: entered allmulticast mode [ 489.759667][T20977] dvmrp8: entered allmulticast mode [ 489.781776][T20975] syz_tun: left allmulticast mode [ 489.914257][T20982] netlink: 'syz.3.7054': attribute type 7 has an invalid length. [ 489.925173][T20982] netlink: 'syz.3.7054': attribute type 7 has an invalid length. [ 490.115775][ C1] vcan0: j1939_tp_rxtimer: 0xffff88801fad5000: rx timeout, send abort [ 490.243793][T20990] netlink: 'syz.1.7058': attribute type 4 has an invalid length. [ 490.290662][T20994] netlink: 'syz.4.7059': attribute type 1 has an invalid length. [ 490.409354][T20994] bond0: entered promiscuous mode [ 490.447620][T20994] 8021q: adding VLAN 0 to HW filter on device bond0 [ 490.571210][T20996] bond0: (slave bridge1): making interface the new active one [ 490.586778][T20996] bridge1: entered promiscuous mode [ 490.601344][T20996] bond0: (slave bridge1): Enslaving as an active interface with an up link [ 490.617712][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b14f400: rx timeout, send abort [ 490.626450][ C1] vcan0: j1939_tp_rxtimer: 0xffff88801fad5000: abort rx timeout. Force session deactivation [ 490.747965][T20999] hsr_slave_1 (unregistering): left promiscuous mode [ 490.847544][T21009] netlink: 'syz.3.7060': attribute type 2 has an invalid length. [ 490.924293][T20992] netlink: 'syz.3.7060': attribute type 2 has an invalid length. [ 491.125943][ C1] vcan0: j1939_tp_rxtimer: 0xffff88807b14f400: abort rx timeout. Force session deactivation [ 491.750123][T21042] netlink: 'syz.0.7077': attribute type 2 has an invalid length. [ 491.802643][T21042] netlink: 'syz.0.7077': attribute type 2 has an invalid length. [ 491.877432][ T30] audit: type=1800 audit(1785959659.627:5): pid=21046 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.7079" name=4996AE17DFFC2E43C8174B54B620636894AAACF28FF62616363C70A440AEC4014CAF28C0ADC04308 dev="tmpfs" ino=7126 res=0 errno=0 [ 492.036401][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 492.114275][T21058] bridge1: entered promiscuous mode [ 492.127117][T21058] bridge1: entered allmulticast mode [ 492.403084][T21070] netlink: 'syz.1.7089': attribute type 1 has an invalid length. [ 493.130519][T21104] netlink: 'syz.0.7102': attribute type 9 has an invalid length. [ 495.528988][T21154] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 495.535129][T21154] syzkaller1: Refused to change device type [ 495.650857][T21088] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 495.698510][T21136] validate_nla: 1 callbacks suppressed [ 495.698527][T21136] netlink: 'syz.3.7117': attribute type 1 has an invalid length. [ 495.768545][T21136] __nla_validate_parse: 6 callbacks suppressed [ 495.768565][T21136] netlink: 224 bytes leftover after parsing attributes in process `syz.3.7117'. [ 495.849489][T21136] workqueue: Failed to create a rescuer kthread for wq "phy2-mac-cmds": -EINTR [ 496.293918][T21175] netlink: 27 bytes leftover after parsing attributes in process `syz.3.7132'. [ 496.673582][T21185] pim6reg1: entered promiscuous mode [ 496.687045][T21185] pim6reg1: entered allmulticast mode [ 497.963222][T21244] netlink: 'syz.2.7167': attribute type 2 has an invalid length. [ 498.093434][T21251] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7168'. [ 498.257102][T21254] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7170'. [ 498.336498][T21257] netlink: 144 bytes leftover after parsing attributes in process `syz.4.7170'. [ 498.587623][T21267] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7175'. [ 498.627327][T21267] netlink: 'syz.1.7175': attribute type 7 has an invalid length. [ 498.656141][T21267] netlink: 'syz.1.7175': attribute type 8 has an invalid length. [ 498.689547][T21267] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7175'. [ 500.037418][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 500.070442][T21328] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 500.157017][T21328] bond0: (slave lo): Enslaving as an active interface with an up link [ 500.182777][T21328] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 500.297147][T21328] syz.0.7192 (21328) used greatest stack depth: 19488 bytes left [ 500.532067][T21345] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7197'. [ 501.006596][T21358] syzkaller1: entered promiscuous mode [ 501.020180][T21358] syzkaller1: entered allmulticast mode [ 501.319197][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 502.245880][T21415] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7229'. [ 503.468147][T21453] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 503.782216][T21467] bridge0: port 2(bridge_slave_1) entered blocking state [ 503.789471][T21467] bridge0: port 2(bridge_slave_1) entered forwarding state [ 503.797039][T21467] bridge0: port 1(bridge_slave_0) entered blocking state [ 503.804194][T21467] bridge0: port 1(bridge_slave_0) entered forwarding state [ 503.851352][T21467] bridge0: entered promiscuous mode [ 503.877944][T21467] bridge0: entered allmulticast mode [ 503.920863][T21466] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7250'. [ 503.967177][T21468] netlink: 144 bytes leftover after parsing attributes in process `syz.1.7250'. [ 503.978145][T21470] netlink: 'syz.3.7252': attribute type 1 has an invalid length. [ 503.994960][T21470] netlink: 'syz.3.7252': attribute type 2 has an invalid length. [ 504.404614][T21484] netlink: 1355 bytes leftover after parsing attributes in process `syz.4.7258'. [ 505.482386][T21524] netlink: 'syz.1.7275': attribute type 11 has an invalid length. [ 505.514487][T21526] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7273'. [ 505.710791][T21531] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7279'. [ 505.775870][T21536] bridge_slave_0: invalid flags given to default FDB implementation [ 505.808184][T21537] bridge0: port 3(syz_tun) entered blocking state [ 505.834234][T21537] bridge0: port 3(syz_tun) entered disabled state [ 505.865349][T21537] syz_tun: entered allmulticast mode [ 505.957741][T21542] xt_hashlimit: size too large, truncated to 1048576 [ 505.967496][T21537] syz_tun: entered promiscuous mode [ 505.974660][T21544] netlink: 'syz.2.7283': attribute type 21 has an invalid length. [ 505.997232][T21537] bridge0: port 3(syz_tun) entered blocking state [ 506.003783][T21537] bridge0: port 3(syz_tun) entered forwarding state [ 506.016236][T21544] netlink: 128 bytes leftover after parsing attributes in process `syz.2.7283'. [ 506.053235][T21544] netlink: 'syz.2.7283': attribute type 5 has an invalid length. [ 506.070237][T21544] netlink: 'syz.2.7283': attribute type 6 has an invalid length. [ 506.100118][T21544] netlink: 3 bytes leftover after parsing attributes in process `syz.2.7283'. [ 506.155402][ T30] audit: type=1800 audit(1785959673.907:6): pid=21551 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.7286" name=0A dev="tmpfs" ino=7577 res=0 errno=0 [ 506.707737][T21569] PF_CAN: dropped non conform CAN XL skbuff: dev type 280, len 40 [ 507.612564][T21578] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 507.631387][T21578] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 508.151425][T21612] netlink: 'syz.4.7310': attribute type 10 has an invalid length. [ 508.783007][T21645] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7323'. [ 508.818486][T21645] netlink: 'syz.3.7323': attribute type 2 has an invalid length. [ 508.842645][T21645] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7323'. [ 508.917737][T21651] netlink: 'syz.2.7326': attribute type 15 has an invalid length. [ 509.452425][T21672] netlink: 'syz.4.7335': attribute type 2 has an invalid length. [ 509.476131][T21672] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7335'. [ 509.819723][T21689] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7342'. [ 509.833002][T21689] vcan0 (unregistering): left allmulticast mode [ 510.123632][T21701] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7346'. [ 510.171672][T21704] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7348'. [ 510.475686][T21717] netlink: 'syz.3.7354': attribute type 4 has an invalid length. [ 510.535468][T21717] netlink: 'syz.3.7354': attribute type 4 has an invalid length. [ 510.611440][ T29] lo speed is unknown, defaulting to 1000 [ 510.625583][ T29] syz2: Port: 1 Link ACTIVE [ 510.860879][T21724] netlink: 6 bytes leftover after parsing attributes in process `syz.4.7355'. [ 510.939835][T21728] netlink: 'syz.0.7358': attribute type 21 has an invalid length. [ 510.985161][T21728] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7358'. [ 511.062784][T21728] netlink: 'syz.0.7358': attribute type 21 has an invalid length. [ 511.104651][T21728] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7358'. [ 511.560503][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 511.904085][T21760] syzkaller1: entered promiscuous mode [ 511.917010][T21760] syzkaller1: entered allmulticast mode [ 512.074189][T21771] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7372'. [ 512.419726][T21781] bridge_slave_1 (unregistering): left promiscuous mode [ 512.448544][T21781] bridge0: port 2(bridge_slave_1) entered disabled state [ 512.643012][T21795] netlink: 'syz.1.7381': attribute type 22 has an invalid length. [ 512.727554][ T1113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 512.777511][T21795] netlink: 'syz.1.7381': attribute type 22 has an invalid length. [ 513.403710][T21825] netlink: 'syz.0.7396': attribute type 1 has an invalid length. [ 513.479713][T21825] 8021q: adding VLAN 0 to HW filter on device bond3 [ 513.497752][T21831] veth0: entered promiscuous mode [ 513.517400][T21828] veth0: left promiscuous mode [ 513.716414][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.726505][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.734895][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.743340][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.751755][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.760174][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.768594][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.777024][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 513.838722][T21846] __nla_validate_parse: 8 callbacks suppressed [ 513.838736][T21846] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7405'. [ 513.886292][T21846] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7405'. [ 513.934419][T21846] netlink: 'syz.2.7405': attribute type 15 has an invalid length. [ 514.015309][T21846] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7405'. [ 514.024487][ T13] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 256 - 0 [ 514.050433][ T13] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 256 - 0 [ 514.063424][T21846] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7405'. [ 514.083518][ T13] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 256 - 0 [ 514.108346][T21846] netlink: 'syz.2.7405': attribute type 15 has an invalid length. [ 514.136554][ T13] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 256 - 0 [ 514.931398][T21888] af_packet: tpacket_rcv: packet too big, clamped from 4080 to 3952. macoff=96 [ 515.310514][T21906] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7431'. [ 515.431127][T21913] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7434'. [ 515.491641][T21917] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7435'. [ 515.502229][T21917] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7435'. [ 515.531624][T21906] 8021q: adding VLAN 0 to HW filter on device bond2 [ 515.568397][T21918] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7434'. [ 515.666968][T21911] bond2: (slave batadv1): Opening slave failed [ 516.676272][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 516.676663][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 516.801244][T21953] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7452'. [ 516.996297][ C1] net_ratelimit: 14 callbacks suppressed [ 516.996314][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.010317][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.018574][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.026833][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.035065][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.043313][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.051572][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.059810][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.296884][ T1113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.359275][T21973] syzkaller1: entered promiscuous mode [ 517.379239][T21973] syzkaller1: entered allmulticast mode [ 517.412880][T21973] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 4116 [ 518.457408][ T1113] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.320300][T22034] block nbd0: Unsupported socket: should be TCP or UNIX. [ 520.291181][T22064] syzkaller1: entered promiscuous mode [ 520.298768][T22064] syzkaller1: entered allmulticast mode [ 520.691233][T22080] geneve2: entered promiscuous mode [ 522.951998][ T57] net_ratelimit: 11 callbacks suppressed [ 522.952017][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 523.033634][T22159] netlink: 'syz.3.7526': attribute type 1 has an invalid length. [ 523.150228][T22159] bond3: entered promiscuous mode [ 523.208817][T22159] 8021q: adding VLAN 0 to HW filter on device bond3 [ 523.424373][T22166] 8021q: adding VLAN 0 to HW filter on device bond3 [ 523.443387][T22166] bond3: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 523.476681][T22166] bond3: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 523.564431][T22166] bond3: (slave ip6gre2): making interface the new active one [ 523.586993][T22166] ip6gre2: entered promiscuous mode [ 523.597497][T22166] bond3: (slave ip6gre2): Enslaving as an active interface with an up link [ 524.098785][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 525.328315][T22226] netlink: Invalid conntrack timeout [ 525.334181][T22226] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 525.525241][T22238] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 525.587984][T22240] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 525.918241][T22251] __nla_validate_parse: 1 callbacks suppressed [ 525.918259][T22251] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7559'. [ 526.523153][T22266] syzkaller1: entered promiscuous mode [ 526.540169][T22266] syzkaller1: entered allmulticast mode [ 526.555153][T22268] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7566'. [ 526.734811][T22276] GUP no longer grows the stack in syz.4.7568 (22276): 200000003000-20000000a000 (200000001000) [ 526.766711][T22276] CPU: 0 UID: 0 PID: 22276 Comm: syz.4.7568 Not tainted syzkaller #0 PREEMPT(full) [ 526.766745][T22276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 526.766768][T22276] Call Trace: [ 526.766776][T22276] [ 526.766784][T22276] dump_stack_lvl+0xe8/0x150 [ 526.766879][T22276] __get_user_pages+0x238c/0x2720 [ 526.766927][T22276] ? __gup_longterm_locked+0xc3b/0x15c0 [ 526.766979][T22276] __gup_longterm_locked+0xd52/0x15c0 [ 526.767005][T22276] ? lock_acquire+0x106/0x350 [ 526.767072][T22276] gup_fast_fallback+0x1d8c/0x20e0 [ 526.767130][T22276] ? __pfx_gup_fast_fallback+0x10/0x10 [ 526.767156][T22276] ? is_valid_gup_args+0x11f/0x200 [ 526.767179][T22276] ? get_user_pages_fast+0x4d/0xb0 [ 526.767203][T22276] __iov_iter_get_pages_alloc+0x378/0xa40 [ 526.767375][T22276] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 526.767412][T22276] iov_iter_get_pages2+0x5e/0xa0 [ 526.767445][T22276] __se_sys_vmsplice+0x7b5/0x1660 [ 526.767509][T22276] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 526.767539][T22276] ? __pfx_futex_wait+0x10/0x10 [ 526.767645][T22276] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.767682][T22276] do_syscall_64+0x174/0x580 [ 526.767808][T22276] ? trace_irq_disable+0x3b/0x140 [ 526.767844][T22276] ? clear_bhb_loop+0x40/0x90 [ 526.767868][T22276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 526.767887][T22276] RIP: 0033:0x7fb52299e0d9 [ 526.767905][T22276] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 526.767922][T22276] RSP: 002b:00007fb52387f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 526.767948][T22276] RAX: ffffffffffffffda RBX: 00007fb522c25fa0 RCX: 00007fb52299e0d9 [ 526.767962][T22276] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000005 [ 526.767974][T22276] RBP: 00007fb522a35024 R08: 0000000000000000 R09: 0000000000000000 [ 526.767986][T22276] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 526.767998][T22276] R13: 00007fb522c26038 R14: 00007fb522c25fa0 R15: 00007ffdf19f03f8 [ 526.768031][T22276] [ 528.388275][T22309] syzkaller0: entered promiscuous mode [ 528.405196][T22309] syzkaller0: entered allmulticast mode [ 528.496476][T22329] netlink: 'syz.0.7579': attribute type 1 has an invalid length. [ 530.796539][T22329] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 530.797306][T22333] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 530.818598][T22333] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 531.529167][T22369] syzkaller1: entered promiscuous mode [ 531.558773][T22369] syzkaller1: entered allmulticast mode [ 531.975275][T22382] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 533.481424][T22443] netlink: 'syz.0.7623': attribute type 1 has an invalid length. [ 533.670542][T22449] veth0: entered promiscuous mode [ 533.729999][T22446] bond4: (slave geneve3): making interface the new active one [ 533.754725][T22446] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.772430][T22446] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 533.784198][T22449] veth0: left promiscuous mode [ 533.846517][ T36] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 533.895918][ T36] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 533.925798][ T36] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 534.010153][ T36] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 534.839130][T22474] netlink: 'syz.4.7635': attribute type 15 has an invalid length. [ 534.851632][T22476] xt_hashlimit: size too large, truncated to 1048576 [ 535.449646][T22496] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 535.466642][T22496] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 535.870513][T22511] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7651'. [ 535.880364][T22498] 8021q: adding VLAN 0 to HW filter on device bond0 [ 535.911229][T22498] 8021q: adding VLAN 0 to HW filter on device team0 [ 535.978002][T22516] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7651'. [ 535.995329][T22498] tipc: Resetting bearer [ 536.063852][T22518] netlink: 'syz.2.7654': attribute type 21 has an invalid length. [ 536.096525][T22518] netlink: 'syz.2.7654': attribute type 22 has an invalid length. [ 536.104484][T22504] veth1_to_bond: entered allmulticast mode [ 536.133187][T22507] veth1_to_bond: left allmulticast mode [ 536.138888][T22518] netlink: 'syz.2.7654': attribute type 23 has an invalid length. [ 536.181438][T22518] netlink: 'syz.2.7654': attribute type 25 has an invalid length. [ 536.226741][T22518] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7654'. [ 536.932118][T22540] syzkaller1: entered promiscuous mode [ 536.946803][T22540] syzkaller1: entered allmulticast mode [ 538.612622][T22605] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7689'. [ 538.723977][T22605] team1: entered promiscuous mode [ 538.741205][T22605] team1: entered allmulticast mode [ 538.796706][T22577] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 540.087304][T22658] netlink: 'syz.3.7710': attribute type 1 has an invalid length. [ 540.161295][T22658] bond4: entered promiscuous mode [ 540.167968][T22658] 8021q: adding VLAN 0 to HW filter on device bond4 [ 540.308362][T22658] 8021q: adding VLAN 0 to HW filter on device bond4 [ 540.315898][T22658] bond4: (slave ip6gre3): The slave device specified does not support setting the MAC address [ 540.331548][T22658] bond4: (slave ip6gre3): Setting fail_over_mac to active for active-backup mode [ 540.340848][T22633] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 540.381702][T22658] bond4: (slave ip6gre3): making interface the new active one [ 540.423522][T22658] ip6gre3: entered promiscuous mode [ 540.461052][T22658] bond4: (slave ip6gre3): Enslaving as an active interface with an up link [ 540.830616][T22684] netlink: 'syz.1.7717': attribute type 1 has an invalid length. [ 540.850293][T22684] netlink: 224 bytes leftover after parsing attributes in process `syz.1.7717'. [ 540.940260][T22684] nbd1: detected capacity change from 0 to 127 [ 540.978617][ T1681] block nbd1: Dead connection, failed to find a fallback [ 540.990442][ T1681] block nbd1: shutting down sockets [ 540.997438][ T1681] blk_print_req_error: 107 callbacks suppressed [ 540.997454][ T1681] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 541.013391][ T1681] buffer_io_error: 138 callbacks suppressed [ 541.013406][ T1681] Buffer I/O error on dev nbd1, logical block 0, async page read [ 541.028391][ T1681] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 541.038062][ T1681] Buffer I/O error on dev nbd1, logical block 1, async page read [ 541.045967][ T1681] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 541.063736][ T1681] Buffer I/O error on dev nbd1, logical block 2, async page read [ 541.072021][ T1681] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 541.082253][ T1681] Buffer I/O error on dev nbd1, logical block 3, async page read [ 541.090280][ T1681] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 541.100686][ T1681] Buffer I/O error on dev nbd1, logical block 0, async page read [ 541.108695][ T1681] Buffer I/O error on dev nbd1, logical block 1, async page read [ 541.116570][ T1681] Buffer I/O error on dev nbd1, logical block 2, async page read [ 541.124446][ T1681] Buffer I/O error on dev nbd1, logical block 3, async page read [ 541.132976][ T1681] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 541.142597][ T1681] Buffer I/O error on dev nbd1, logical block 0, async page read [ 541.150389][ T1681] Buffer I/O error on dev nbd1, logical block 1, async page read [ 541.159872][ T1681] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 541.183286][ T1681] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 541.193748][ T1681] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 541.203509][ T1681] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 541.214390][ T5638] ldm_validate_partition_table(): Disk read failed. [ 541.224611][ T5638] Dev nbd1: unable to read RDB block 0 [ 541.231549][ T5638] nbd1: unable to read partition table [ 541.271033][ T5638] ldm_validate_partition_table(): Disk read failed. [ 541.279804][ T5638] Dev nbd1: unable to read RDB block 0 [ 541.287967][ T5638] nbd1: unable to read partition table [ 542.105915][T22722] Bluetooth: ISO socket layer initialized [ 542.338681][T22732] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7736'. [ 542.781664][T22749] netlink: 'syz.3.7742': attribute type 26 has an invalid length. [ 542.816854][T22749] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7742'. [ 542.841729][T22749] netlink: 'syz.3.7742': attribute type 26 has an invalid length. [ 542.853722][T22749] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7742'. [ 543.156564][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.432737][T22773] lo speed is unknown, defaulting to 1000 [ 543.758269][T22785] mac80211_hwsim hwsim2 wlan0: left promiscuous mode [ 545.213272][T22814] netlink: 104 bytes leftover after parsing attributes in process `syz.4.7768'. [ 545.578984][T22821] bridge0: port 3(syz_tun) entered disabled state [ 545.629159][T22821] syz_tun: left allmulticast mode [ 545.664465][T22821] syz_tun: left promiscuous mode [ 545.697263][T22821] bridge0: port 3(syz_tun) entered disabled state [ 545.700970][T22825] netlink: 'syz.1.7771': attribute type 39 has an invalid length. [ 545.762863][T22821] team0: Port device syz_tun added [ 545.789757][T22827] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7772'. [ 546.007033][T22831] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7772'. [ 546.182216][T22839] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7776'. [ 546.234242][T22843] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7776'. [ 546.462500][T22852] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7781'. [ 546.479295][T22855] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7783'. [ 546.565122][ T13] netdevsim netdevsim2 eth3: set [0, 1] type 1 family 0 port 8472 - 0 [ 546.602565][ T13] netdevsim netdevsim2 eth2: set [0, 1] type 1 family 0 port 8472 - 0 [ 546.729123][ T13] netdevsim netdevsim2 eth1: set [0, 1] type 1 family 0 port 8472 - 0 [ 546.782697][ T13] netdevsim netdevsim2 eth0: set [0, 1] type 1 family 0 port 8472 - 0 [ 547.244673][T22879] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 547.384733][T22887] netlink: 'syz.2.7797': attribute type 1 has an invalid length. [ 547.451177][T22887] 8021q: adding VLAN 0 to HW filter on device bond3 [ 547.483820][T22891] bond3: (slave veth0_to_bond): making interface the new active one [ 547.498009][T22891] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 547.571759][T22887] bond3: entered promiscuous mode [ 547.590551][T22887] veth0_to_bond: entered promiscuous mode [ 547.623946][T22887] bond3: entered allmulticast mode [ 547.657718][T22887] veth0_to_bond: entered allmulticast mode [ 548.019722][T22908] syz_tun: entered allmulticast mode [ 548.728227][T22901] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 549.021514][T22942] netlink: 'syz.2.7813': attribute type 1 has an invalid length. [ 549.052731][T22942] netlink: 'syz.2.7813': attribute type 2 has an invalid length. [ 549.379170][T22953] __nla_validate_parse: 2 callbacks suppressed [ 549.379188][T22953] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7818'. [ 549.721484][T22932] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 549.957495][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 550.557025][T22983] erspan0: entered promiscuous mode [ 550.585113][T22983] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7829'. [ 551.316918][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.326732][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.335155][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.443048][T23005] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7837'. [ 552.175811][T23026] netlink: 'syz.1.7845': attribute type 1 has an invalid length. [ 552.398416][T23031] netlink: 'syz.2.7847': attribute type 1 has an invalid length. [ 552.423244][T23031] netlink: 'syz.2.7847': attribute type 4 has an invalid length. [ 552.447614][T23033] syzkaller0: entered promiscuous mode [ 552.451988][T23034] netlink: 'syz.2.7847': attribute type 1 has an invalid length. [ 552.465702][T23033] syzkaller0: entered allmulticast mode [ 552.489209][T23031] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.7847'. [ 552.527537][T23034] netlink: 'syz.2.7847': attribute type 4 has an invalid length. [ 552.552984][T23034] netlink: 9462 bytes leftover after parsing attributes in process `syz.2.7847'. [ 552.805339][T23020] RDS: rds_bind could not find a transport for fe80::bb, load rds_tcp or rds_rdma? [ 552.827400][T23041] syzkaller1: entered promiscuous mode [ 552.843761][T23041] syzkaller1: entered allmulticast mode [ 553.351820][T23054] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7855'. [ 553.598567][T23040] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 553.895271][T23064] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7859'. [ 554.138314][T23068] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7860'. [ 554.858339][T23083] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7866'. [ 554.996345][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 555.873896][T23116] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 555.941285][T23117] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 556.099137][T23124] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7884'. [ 556.251199][T23124] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7884'. [ 556.928704][T23146] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 557.590755][T23157] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7897'. [ 558.421933][ T36] nci: nci_rsp_packet: unknown rsp opcode 0x303 [ 558.996368][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 559.005441][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 559.021736][T23197] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 559.149372][T23172] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 559.435057][T23210] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 559.460045][T23210] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 559.697903][T23223] netlink: 'syz.0.7916': attribute type 4 has an invalid length. [ 559.770262][T23223] netlink: 'syz.0.7916': attribute type 4 has an invalid length. [ 560.058842][T23231] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7920'. [ 561.245913][T23252] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7926'. [ 562.065328][T23274] syzkaller1: entered promiscuous mode [ 562.084650][T23274] syzkaller1: entered allmulticast mode [ 562.335275][T23283] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 562.392051][T23286] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7940'. [ 562.401454][T23283] xt_hashlimit: size too large, truncated to 1048576 [ 562.759373][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 564.180182][T23335] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7956'. [ 564.282202][T23310] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 564.941381][T23358] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7965'. [ 565.412986][T23373] netlink: 9 bytes leftover after parsing attributes in process `syz.4.7969'. [ 565.449379][T23373] netlink: 9 bytes leftover after parsing attributes in process `syz.4.7969'. [ 565.486138][T23377] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7970'. [ 565.731530][T23386] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7972'. [ 566.182316][T23406] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 566.482630][T23421] netlink: 'syz.2.7981': attribute type 1 has an invalid length. [ 566.564238][T23421] 8021q: adding VLAN 0 to HW filter on device bond4 [ 566.585771][T23425] bond4: (slave gretap0): Enslaving as a backup interface with an up link [ 567.623704][T23455] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7992'. [ 567.786457][T23463] netlink: 'syz.1.7995': attribute type 1 has an invalid length. [ 567.819157][T23463] 8021q: adding VLAN 0 to HW filter on device bond4 [ 567.852370][T23463] bond4: (slave geneve3): making interface the new active one [ 567.864282][T23463] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 567.876738][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 570.155039][T23516] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8013'. [ 570.181723][T23516] netlink: 60 bytes leftover after parsing attributes in process `syz.1.8013'. [ 570.215222][T23516] netlink: 'syz.1.8013': attribute type 32 has an invalid length. [ 570.238322][T23516] netlink: 500 bytes leftover after parsing attributes in process `syz.1.8013'. [ 570.371766][T23523] syzkaller1: entered promiscuous mode [ 570.405631][T23523] syzkaller1: entered allmulticast mode [ 570.516664][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 570.525305][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 571.209460][T23556] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8028'. [ 571.813657][T23556] bond5: entered promiscuous mode [ 571.826743][T23556] 8021q: adding VLAN 0 to HW filter on device bond5 [ 571.908860][T23559] 8021q: adding VLAN 0 to HW filter on device bond5 [ 571.939956][T23559] bond5: (slave sit2): The slave device specified does not support setting the MAC address [ 571.976451][T23562] netlink: 'syz.4.8029': attribute type 1 has an invalid length. [ 572.009578][T23559] bond5: (slave sit2): Error -95 calling set_mac_address [ 572.027611][T23564] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8030'. [ 572.114309][T23568] netlink: 'syz.3.8031': attribute type 1 has an invalid length. [ 572.168596][T23562] 8021q: adding VLAN 0 to HW filter on device bond3 [ 572.249234][T23573] netlink: 'syz.4.8029': attribute type 10 has an invalid length. [ 572.259580][T23566] bond3: (slave veth5): Enslaving as a backup interface with a down link [ 572.284151][T23573] netlink: 40 bytes leftover after parsing attributes in process `syz.4.8029'. [ 572.322651][T23568] 8021q: adding VLAN 0 to HW filter on device bond5 [ 572.352827][T23569] bond3: (slave dummy0): Enslaving as a backup interface with an up link [ 572.377482][ T550] bond3: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 572.405759][T23573] dummy0: entered promiscuous mode [ 572.488745][ T13] bond3: (slave dummy0): link status up again after 0 ms [ 572.504012][T23573] bond3: (slave dummy0): Removing an active aggregator [ 572.531675][T23573] bond3: (slave dummy0): Releasing backup interface [ 572.630402][T23585] netlink: 28 bytes leftover after parsing attributes in process `syz.1.8035'. [ 572.678908][T23587] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8036'. [ 572.772439][T23590] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8037'. [ 572.813288][T23590] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8037'. [ 573.042256][T23602] netlink: 'syz.0.8042': attribute type 1 has an invalid length. [ 573.205423][T23611] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8046'. [ 573.223272][T23602] 8021q: adding VLAN 0 to HW filter on device bond5 [ 573.365567][T23607] bond5: (slave geneve4): making interface the new active one [ 573.389933][T23607] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.412349][T23607] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.448682][T23607] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.474939][T23607] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.504399][T23607] bond5: (slave geneve4): Enslaving as an active interface with an up link [ 573.588167][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.664911][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.675940][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.875583][T23627] veth1_to_bond: entered allmulticast mode [ 573.891962][ T9] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 573.897936][T23627] netlink: 8 bytes leftover after parsing attributes in process `syz.0.8052'. [ 574.006017][T23629] netlink: 'syz.3.8053': attribute type 1 has an invalid length. [ 574.098835][T23629] 8021q: adding VLAN 0 to HW filter on device bond6 [ 574.179868][T23634] bond6: (slave gretap4): making interface the new active one [ 574.213504][T23634] bond6: (slave gretap4): Enslaving as an active interface with an up link [ 574.242070][T23626] veth1_to_bond: left allmulticast mode [ 574.738257][T23648] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8058'. [ 574.892170][T23656] bond4: entered promiscuous mode [ 574.964078][T23661] macvlan3: entered promiscuous mode [ 575.000209][T23661] macvlan3: entered allmulticast mode [ 575.028287][T23661] bond4: (slave macvlan3): Opening slave failed [ 575.867377][T23692] tipc: Enabled bearer , priority 0 [ 576.033153][T23692] syzkaller0: entered promiscuous mode [ 576.054863][T23692] syzkaller0: entered allmulticast mode [ 576.065795][T23692] tipc: Resetting bearer [ 576.160757][T23691] tipc: Resetting bearer [ 577.833375][T12935] net_ratelimit: 9 callbacks suppressed [ 577.833392][T12935] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 577.866448][T12935] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.602292][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.989061][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.000981][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.633126][T23691] tipc: Disabling bearer [ 579.656989][T23702] ip6gre2: entered promiscuous mode [ 579.662475][T23702] ip6gre2: entered allmulticast mode [ 580.179414][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 580.225098][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 580.572662][T23755] __nla_validate_parse: 2 callbacks suppressed [ 580.572680][T23755] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8091'. [ 580.672685][T23755] 8021q: adding VLAN 0 to HW filter on device bond5 [ 580.784541][T23755] bond5: (slave vti0): refused to change device type [ 580.954582][T23764] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8094'. [ 581.358382][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.383573][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.589334][T23789] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8104'. [ 581.612239][T23789] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8104'. [ 581.679647][T23789] geneve5: entered promiscuous mode [ 581.857111][T23800] netlink: 'syz.3.8110': attribute type 2 has an invalid length. [ 582.316039][T23820] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 582.368801][T23823] netlink: 'syz.0.8118': attribute type 1 has an invalid length. [ 582.526624][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 582.541424][T23823] 8021q: adding VLAN 0 to HW filter on device bond6 [ 583.244526][T23849] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8127'. [ 583.597283][T23862] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8135'. [ 583.642104][T23862] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8135'. [ 583.668699][ T554] net_ratelimit: 1 callbacks suppressed [ 583.668716][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 583.710815][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 584.576511][T23894] syzkaller1: entered promiscuous mode [ 584.590898][T23894] syzkaller1: entered allmulticast mode [ 584.836436][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 584.846863][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 584.869195][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 585.442961][T23910] team0: Port device syz_tun removed [ 585.489803][T23910] bridge_slave_0: left promiscuous mode [ 585.531290][T23910] bridge0: port 1(bridge_slave_0) entered disabled state [ 585.600622][T23910] bridge_slave_1: left allmulticast mode [ 585.628341][T23910] bridge0: port 2(bridge_slave_1) entered disabled state [ 585.701794][T23910] team0: Port device team_slave_0 removed [ 585.731766][T23910] team0: Port device team_slave_1 removed [ 585.751659][T23910] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 585.780171][T23910] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 585.807923][T23910] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 585.824873][T23910] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 585.845414][T23910] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 585.880019][T23912] team0: Mode changed to "loadbalance" [ 586.010741][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.046200][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.436302][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.523892][T23933] tipc: Resetting bearer [ 586.799123][ T5809] lo speed is unknown, defaulting to 1000 [ 586.809723][ T5809] syz2: Port: 1 Link DOWN [ 587.047746][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 587.056287][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.090564][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 587.099592][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 1] type 2 family 0 port 19999 - 0 [ 587.113948][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.132370][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 1] type 2 family 0 port 19999 - 0 [ 587.172230][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 587.216951][ T1105] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.261938][ T1105] netdevsim netdevsim3 netdevsim0: unset [1, 1] type 2 family 0 port 19999 - 0 [ 587.294840][ T1105] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.326126][ T1105] netdevsim netdevsim3 netdevsim2: unset [1, 1] type 2 family 0 port 19999 - 0 [ 588.252783][T23993] tipc: Enabled bearer , priority 0 [ 588.274171][T23993] mac80211_hwsim hwsim5 syzkaller0: entered promiscuous mode [ 588.302155][T23993] mac80211_hwsim hwsim5 syzkaller0: entered allmulticast mode [ 588.397852][T24003] netlink: 12 bytes leftover after parsing attributes in process `syz.3.8182'. [ 588.541177][T24007] netlink: 4 bytes leftover after parsing attributes in process `syz.2.8183'. [ 588.611006][T24009] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8184'. [ 588.745405][T24012] netlink: 24 bytes leftover after parsing attributes in process `syz.3.8185'. [ 588.929595][T24022] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8185'. [ 589.479039][ T57] net_ratelimit: 3 callbacks suppressed [ 589.479056][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 589.519263][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 589.593948][ T5639] block nbd0: Receive control failed (result -107) [ 589.611154][T24039] block nbd0: reconnected socket [ 589.692941][T24041] netlink: 'syz.0.8194': attribute type 2 has an invalid length. [ 590.648103][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 590.681648][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 590.703176][T24045] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 590.916322][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.193832][T24065] bond_slave_0: mtu greater than device maximum [ 591.771987][T24093] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 591.779298][T24093] IPv6: NLM_F_CREATE should be set when creating new route [ 591.807537][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.828482][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.412381][T24117] tipc: Failed to remove unknown binding: 66,0,0/3758096385:1832959606/1832959607 [ 592.459080][T24117] tipc: Failed to remove unknown binding: 66,0,0/3758096385:1832959606/1832959607 [ 592.765468][T24131] netlink: 104 bytes leftover after parsing attributes in process `syz.0.8223'. [ 592.958584][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.974465][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 593.650614][T24156] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 593.666932][T24156] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 594.072051][T24164] netlink: 'syz.3.8235': attribute type 2 has an invalid length. [ 595.078255][T24198] netlink: 'syz.4.8242': attribute type 25 has an invalid length. [ 595.196614][ T57] net_ratelimit: 2 callbacks suppressed [ 595.196632][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.241639][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.428888][T24204] syzkaller0: entered promiscuous mode [ 595.450815][T24204] syzkaller0: entered allmulticast mode [ 595.623711][T24212] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8251'. [ 595.751736][T24215] mac80211_hwsim hwsim7 syzkaller0: left promiscuous mode [ 595.786353][T24215] mac80211_hwsim hwsim7 syzkaller0: left allmulticast mode [ 596.349696][T24242] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 596.366872][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.391142][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.429504][T24244] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.674924][T24256] syzkaller0: entered promiscuous mode [ 596.688177][T24256] syzkaller0: entered allmulticast mode [ 597.067660][T24266] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 597.570486][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 597.600541][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 597.969084][T24296] netlink: 16 bytes leftover after parsing attributes in process `syz.4.8283'. [ 598.568183][T24313] tipc: Enabled bearer , priority 0 [ 598.671493][T24313] syzkaller0: entered promiscuous mode [ 598.678119][T24313] syzkaller0: entered allmulticast mode [ 598.684637][T24313] tipc: Resetting bearer [ 598.717023][T24317] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 598.731779][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 598.752049][T24317] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 598.805172][T24312] tipc: Resetting bearer [ 600.960227][ T57] net_ratelimit: 4 callbacks suppressed [ 600.960247][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 600.976366][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 601.369160][T24312] tipc: Disabling bearer [ 601.706609][T24348] can: request_module (can-proto-0) failed. [ 601.916020][ T554] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0x45 [ 602.091359][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.125725][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.436549][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.805963][T24396] netlink: 12 bytes leftover after parsing attributes in process `syz.1.8309'. [ 603.016970][T24399] bond5: entered promiscuous mode [ 603.036885][T24399] bond5: entered allmulticast mode [ 603.076322][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.124051][T24403] netlink: 'syz.2.8310': attribute type 1 has an invalid length. [ 603.248941][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.290706][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 603.357173][T24403] 8021q: adding VLAN 0 to HW filter on device bond6 [ 603.448711][T24401] bond3: (slave veth0_to_bond): Releasing active interface [ 603.450479][T24411] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8313'. [ 603.475864][T24401] veth0_to_bond: left promiscuous mode [ 603.485530][T24401] veth0_to_bond: left allmulticast mode [ 603.537489][T24401] bond6: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 603.608295][T24406] macvlan2: entered promiscuous mode [ 603.619166][T24406] macvlan2: entered allmulticast mode [ 603.635686][T24406] bond6: entered promiscuous mode [ 603.655565][T24406] veth0_to_bond: entered promiscuous mode [ 603.677918][T24406] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 603.698221][T24406] bond6: left promiscuous mode [ 603.715427][T24406] veth0_to_bond: left promiscuous mode [ 604.191117][T24436] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8321'. [ 604.229418][T24436] 8021q: adding VLAN 0 to HW filter on device bond6 [ 604.248708][T24436] dummy0: left promiscuous mode [ 604.263541][T24436] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 604.316103][T24431] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 604.371924][T24431] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 604.486667][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.521251][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 604.672262][T24451] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8325'. [ 604.925611][T24459] syzkaller0: entered promiscuous mode [ 604.932395][T24459] syzkaller0: entered allmulticast mode [ 605.283117][T24461] syzkaller0: entered promiscuous mode [ 605.301625][T24461] syzkaller0: entered allmulticast mode [ 606.103048][T24474] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 606.119228][T24474] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 606.155384][T24474] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 606.214445][T24475] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 606.249491][T24474] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 606.370041][T24474] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 606.425775][T24474] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 606.464658][T24474] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 606.518783][T24480] netlink: 'syz.4.8337': attribute type 1 has an invalid length. [ 606.531580][T24474] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 606.569208][T24474] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 606.843629][ T554] net_ratelimit: 2 callbacks suppressed [ 606.843648][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 606.860453][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.002702][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.012044][ T554] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 608.760771][T24480] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 609.127931][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 609.147178][T24500] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 609.163837][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.129619][T24510] netlink: 'syz.3.8346': attribute type 2 has an invalid length. [ 610.159693][T24516] netlink: 'syz.4.8348': attribute type 1 has an invalid length. [ 610.176376][T24510] netlink: 'syz.3.8346': attribute type 2 has an invalid length. [ 610.364772][T24520] 8021q: adding VLAN 0 to HW filter on device bond8 [ 610.390588][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.399172][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 610.412951][T24520] bond7: (slave bond8): making interface the new active one [ 610.422836][T24520] bond7: (slave bond8): Enslaving as an active interface with an up link [ 610.469711][T24521] bond7: (slave gretap1): Enslaving as a backup interface with an up link [ 611.098932][T24547] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 611.191375][T24541] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 611.387308][T24560] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8358'. [ 611.517075][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 611.773776][T24563] syzkaller0: entered promiscuous mode [ 611.795525][T24563] syzkaller0: entered allmulticast mode [ 611.820345][T24567] netlink: 'syz.3.8362': attribute type 1 has an invalid length. [ 612.049177][T24577] netlink: 4 bytes leftover after parsing attributes in process `syz.3.8362'. [ 612.158085][T24574] tipc: Enabled bearer , priority 0 [ 612.196492][T24562] tipc: Resetting bearer [ 612.250942][T24562] tipc: Disabling bearer [ 612.351296][T24577] bridge4: entered promiscuous mode [ 612.387816][T24577] bond7: (slave bridge4): making interface the new active one [ 612.420317][T24577] bond7: (slave bridge4): Enslaving as an active interface with an up link [ 612.621587][T24593] syzkaller0: entered promiscuous mode [ 612.646224][T24593] syzkaller0: entered allmulticast mode [ 612.677732][ T550] net_ratelimit: 1 callbacks suppressed [ 612.677746][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 612.713027][T24597] netlink: 'syz.3.8367': attribute type 1 has an invalid length. [ 612.725182][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 613.112910][T24603] bridge5: entered promiscuous mode [ 613.168916][T24603] bond9: (slave bridge5): making interface the new active one [ 613.199054][T24603] bond9: (slave bridge5): Enslaving as an active interface with an up link [ 613.239902][T24605] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.8368'. [ 613.338062][T24602] netlink: 16402 bytes leftover after parsing attributes in process `syz.1.8368'. [ 613.613492][T24618] netlink: 36 bytes leftover after parsing attributes in process `syz.2.8374'. [ 613.736149][T24626] syzkaller0: entered promiscuous mode [ 613.756446][T24626] syzkaller0: entered allmulticast mode [ 613.780591][T24630] netlink: 20 bytes leftover after parsing attributes in process `syz.2.8377'. [ 613.793332][T24624] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 613.810492][T24625] syzkaller0: entered promiscuous mode [ 613.819638][T24625] syzkaller0: entered allmulticast mode [ 613.847633][T24630] ip6gre3: entered promiscuous mode [ 613.852989][T24630] ip6gre3: entered allmulticast mode [ 613.876477][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 613.895145][ T550] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 614.094304][T24630] netlink: 'syz.2.8377': attribute type 6 has an invalid length. [ 614.108677][T24630] netlink: 72 bytes leftover after parsing attributes in process `syz.2.8377'. [ 614.158493][T24636] netlink: 'syz.1.8376': attribute type 1 has an invalid length. [ 614.331780][T24639] syzkaller0: entered promiscuous mode [ 614.362655][T24639] syzkaller0: entered allmulticast mode [ 614.422873][T24645] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8380'. [ 614.572762][T24650] netlink: 'syz.1.8381': attribute type 1 has an invalid length. [ 614.732081][T24650] bond6: entered promiscuous mode [ 614.748292][T24650] 8021q: adding VLAN 0 to HW filter on device bond6 [ 614.874204][T24653] vlan6: entered allmulticast mode [ 614.884289][T24653] bond6: entered allmulticast mode [ 614.942928][T24659] bond6: (slave bridge2): making interface the new active one [ 614.951984][T24659] bridge2: entered promiscuous mode [ 614.976279][T24659] bridge2: entered allmulticast mode [ 614.992133][T24659] bond6: (slave bridge2): Enslaving as an active interface with an up link [ 615.026626][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 615.040970][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 615.063846][T24670] syzkaller0: entered promiscuous mode [ 615.086539][T24670] syzkaller0: entered allmulticast mode [ 615.931395][T24689] syzkaller0: entered promiscuous mode [ 615.959059][T24689] syzkaller0: entered allmulticast mode [ 615.980994][T24694] netlink: 52 bytes leftover after parsing attributes in process `syz.3.8393'. [ 616.017177][T24695] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8394'. [ 616.131417][T24695] team0: Port device team_slave_0 removed [ 616.221907][ T1105] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 616.252840][ T1105] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 616.276595][T24703] bond9: entered promiscuous mode [ 616.303053][T24703] bond9: entered allmulticast mode [ 616.345426][T24707] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 616.433886][T24711] syzkaller0: entered promiscuous mode [ 616.443038][T24707] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 616.462940][T24711] syzkaller0: entered allmulticast mode [ 616.481035][T24714] __nla_validate_parse: 3 callbacks suppressed [ 616.481051][T24714] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8400'. [ 616.551616][T24717] block nbd3: NBD_DISCONNECT [ 616.569126][T24717] block nbd3: Send disconnect failed -32 [ 616.580793][T24717] block nbd3: Send disconnect failed -32 [ 616.588567][T24717] block nbd3: shutting down sockets [ 616.683568][T24707] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 616.964124][T24732] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8406'. [ 617.067865][T24732] vlan5: entered allmulticast mode [ 617.075554][T24732] bridge4: entered allmulticast mode [ 617.083732][T24738] netlink: 'syz.4.8409': attribute type 1 has an invalid length. [ 617.097308][T24739] bridge4: port 1(erspan0) entered blocking state [ 617.105374][T24739] bridge4: port 1(erspan0) entered disabled state [ 617.113324][T24739] erspan0: entered allmulticast mode [ 617.121877][T24739] erspan0: entered promiscuous mode [ 617.128913][T24739] bridge4: port 1(erspan0) entered blocking state [ 617.135524][T24739] bridge4: port 1(erspan0) entered forwarding state [ 617.215169][T24738] 8021q: adding VLAN 0 to HW filter on device bond10 [ 617.370353][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 617.386521][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 617.416115][T24743] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 617.470445][T24743] bond10: (slave batadv1): making interface the new active one [ 617.500035][T24743] bond10: (slave batadv1): Enslaving as an active interface with an up link [ 617.647108][T24740] bond10: (slave veth9): Enslaving as an active interface with a down link [ 617.782001][T24738] bond10: (slave veth11): Enslaving as an active interface with a down link [ 618.147794][T24761] syzkaller0: entered promiscuous mode [ 618.175691][T24761] syzkaller0: entered allmulticast mode [ 618.526919][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 618.560869][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.078334][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 619.539614][T24797] pim6reg: entered allmulticast mode [ 619.647978][T24800] TC_ACT_REPEAT abuse ? [ 619.797222][ T1105] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.823183][ T1105] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 619.872333][T24803] syzkaller0: entered promiscuous mode [ 619.886715][T24803] syzkaller0: entered allmulticast mode [ 620.225471][T24814] syzkaller0: entered promiscuous mode [ 620.243690][T24814] syzkaller0: entered allmulticast mode [ 620.382420][ T550] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 620.425124][T24816] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 620.541186][T24823] syzkaller0: entered promiscuous mode [ 620.580642][T24823] syzkaller0: entered allmulticast mode [ 620.725275][T24833] netlink: 'syz.4.8437': attribute type 1 has an invalid length. [ 620.908537][T24833] 8021q: adding VLAN 0 to HW filter on device bond11 [ 620.940261][ T1105] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 620.964922][ T1105] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 621.069227][T24839] vlan5: entered promiscuous mode [ 621.102329][T24839] bond11: entered promiscuous mode [ 621.124402][T24839] vlan5: entered allmulticast mode [ 621.142873][T24839] bond11: entered allmulticast mode [ 621.283759][T24841] bond11: (slave bridge4): making interface the new active one [ 621.319783][T24841] bridge4: entered promiscuous mode [ 621.349215][T24841] bridge4: entered allmulticast mode [ 621.370991][T24841] bond11: (slave bridge4): Enslaving as an active interface with an up link [ 621.729720][T24871] nbd: socks must be embedded in a SOCK_ITEM attr [ 622.051932][T24881] netlink: 'syz.1.8450': attribute type 1 has an invalid length. [ 622.157469][T24887] netlink: 'syz.0.8452': attribute type 1 has an invalid length. [ 622.186840][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 622.206305][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 622.335692][T24887] bond7: entered promiscuous mode [ 622.360243][T24887] 8021q: adding VLAN 0 to HW filter on device bond7 [ 622.460188][T24895] bond7: (slave bridge5): making interface the new active one [ 622.503498][T24895] bridge5: entered promiscuous mode [ 622.530680][T24895] bond7: (slave bridge5): Enslaving as an active interface with an up link [ 622.580168][T24899] mac80211_hwsim hwsim5 syzkaller0: left promiscuous mode [ 622.610018][T24899] mac80211_hwsim hwsim5 syzkaller0: left allmulticast mode [ 622.744515][T24901] syzkaller0: entered promiscuous mode [ 622.764578][T24901] syzkaller0: entered allmulticast mode [ 623.185852][T24926] netlink: 40 bytes leftover after parsing attributes in process `syz.2.8465'. [ 623.327621][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 623.365928][T24930] macvtap2: entered promiscuous mode [ 623.400746][T24930] macvtap2: entered allmulticast mode [ 623.433596][T24930] veth1_to_bridge: entered promiscuous mode [ 623.456516][T24930] veth1_to_bridge: entered allmulticast mode [ 623.487777][T24930] team0: Device macvtap2 failed to register rx_handler [ 623.507619][T24930] veth1_to_bridge: left allmulticast mode [ 623.527494][T24930] veth1_to_bridge: left promiscuous mode [ 623.609304][T24930] [ 623.611635][T24930] ====================================================== [ 623.618633][T24930] WARNING: possible circular locking dependency detected [ 623.625652][T24930] syzkaller #0 Not tainted [ 623.630062][T24930] ------------------------------------------------------ [ 623.637068][T24930] syz.1.8467/24930 is trying to acquire lock: [ 623.643123][T24930] ffff88801c2952a0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove+0x35/0x80 [ 623.652972][T24930] [ 623.652972][T24930] but task is already holding lock: [ 623.660332][T24930] ffffffff8f5e4520 (gdp_mutex){+.+.}-{4:4}, at: cleanup_glue_dir+0xc3/0x220 [ 623.669122][T24930] [ 623.669122][T24930] which lock already depends on the new lock. [ 623.669122][T24930] [ 623.679508][T24930] [ 623.679508][T24930] the existing dependency chain (in reverse order) is: [ 623.688522][T24930] [ 623.688522][T24930] -> #10 (gdp_mutex){+.+.}-{4:4}: [ 623.695722][T24930] __mutex_lock+0x19d/0x1550 [ 623.700905][T24930] get_device_parent+0x16f/0x3a0 [ 623.706365][T24930] device_add+0x2d4/0xb80 [ 623.711231][T24930] device_create+0x269/0x300 [ 623.716336][T24930] msr_device_create+0x33/0x50 [ 623.721642][T24930] cpuhp_invoke_callback+0x434/0x810 [ 623.727451][T24930] cpuhp_thread_fun+0x362/0x780 [ 623.732816][T24930] smpboot_thread_fn+0x57c/0xa80 [ 623.738280][T24930] kthread+0x388/0x470 [ 623.742865][T24930] ret_from_fork+0x514/0xb70 [ 623.748001][T24930] ret_from_fork_asm+0x1a/0x30 [ 623.753275][T24930] [ 623.753275][T24930] -> #9 (cpuhp_state-up){+.+.}-{0:0}: [ 623.760825][T24930] cpuhp_thread_fun+0x127/0x780 [ 623.766192][T24930] smpboot_thread_fn+0x57c/0xa80 [ 623.771643][T24930] kthread+0x388/0x470 [ 623.776223][T24930] ret_from_fork+0x514/0xb70 [ 623.781326][T24930] ret_from_fork_asm+0x1a/0x30 [ 623.786600][T24930] [ 623.786600][T24930] -> #8 (cpu_hotplug_lock){++++}-{0:0}: [ 623.794319][T24930] cpus_read_lock+0x42/0x160 [ 623.799419][T24930] static_key_slow_inc+0x12/0x30 [ 623.804899][T24930] nbd_genl_reconfigure+0x1301/0x1e80 [ 623.810846][T24930] genl_family_rcv_msg_doit+0x233/0x340 [ 623.816998][T24930] genl_rcv_msg+0x614/0x7a0 [ 623.822015][T24930] netlink_rcv_skb+0x226/0x4a0 [ 623.827285][T24930] genl_rcv+0x28/0x40 [ 623.831778][T24930] netlink_unicast+0x7bb/0x940 [ 623.837045][T24930] netlink_sendmsg+0x813/0xb40 [ 623.842317][T24930] sock_sendmsg_nosec+0x13a/0x180 [ 623.847942][T24930] ____sys_sendmsg+0x54e/0x850 [ 623.853215][T24930] ___sys_sendmsg+0x2a5/0x360 [ 623.858398][T24930] __x64_sys_sendmsg+0x1b1/0x290 [ 623.863846][T24930] do_syscall_64+0x174/0x580 [ 623.868949][T24930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.875348][T24930] [ 623.875348][T24930] -> #7 (&nsock->tx_lock){+.+.}-{4:4}: [ 623.882985][T24930] __mutex_lock+0x19d/0x1550 [ 623.888084][T24930] nbd_queue_rq+0x373/0x1150 [ 623.893179][T24930] blk_mq_dispatch_rq_list+0x499/0x1990 [ 623.899327][T24930] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 623.906209][T24930] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 623.912719][T24930] blk_mq_run_work_fn+0x16c/0x300 [ 623.918286][T24930] process_scheduled_works+0xa8e/0x14e0 [ 623.924338][T24930] worker_thread+0xa47/0xfb0 [ 623.929437][T24930] kthread+0x388/0x470 [ 623.934018][T24930] ret_from_fork+0x514/0xb70 [ 623.939140][T24930] ret_from_fork_asm+0x1a/0x30 [ 623.944410][T24930] [ 623.944410][T24930] -> #6 (&cmd->lock){+.+.}-{4:4}: [ 623.951610][T24930] __mutex_lock+0x19d/0x1550 [ 623.956713][T24930] nbd_queue_rq+0xc1/0x1150 [ 623.961723][T24930] blk_mq_dispatch_rq_list+0x499/0x1990 [ 623.967783][T24930] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 623.974622][T24930] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 623.981112][T24930] blk_mq_run_work_fn+0x16c/0x300 [ 623.986644][T24930] process_scheduled_works+0xa8e/0x14e0 [ 623.992697][T24930] worker_thread+0xa47/0xfb0 [ 623.997794][T24930] kthread+0x388/0x470 [ 624.002384][T24930] ret_from_fork+0x514/0xb70 [ 624.007490][T24930] ret_from_fork_asm+0x1a/0x30 [ 624.012759][T24930] [ 624.012759][T24930] -> #5 (set->srcu){.+.+}-{0:0}: [ 624.019883][T24930] __synchronize_srcu+0xc9/0x2f0 [ 624.025386][T24930] elevator_switch+0x1e8/0x7b0 [ 624.030741][T24930] elevator_change+0x2fa/0x480 [ 624.036021][T24930] elevator_set_default+0x375/0x440 [ 624.041734][T24930] blk_register_queue+0x3f3/0x4e0 [ 624.047303][T24930] __add_disk+0x6cb/0xe30 [ 624.052212][T24930] add_disk_fwnode+0x100/0x3a0 [ 624.057494][T24930] nbd_dev_add+0x733/0xb60 [ 624.062425][T24930] nbd_init+0x15f/0x1e0 [ 624.067156][T24930] do_one_initcall+0x250/0x870 [ 624.072435][T24930] do_initcall_level+0x10a/0x1a0 [ 624.077877][T24930] do_initcalls+0x59/0xa0 [ 624.082710][T24930] kernel_init_freeable+0x29d/0x3e0 [ 624.088426][T24930] kernel_init+0x1d/0x1d0 [ 624.093272][T24930] ret_from_fork+0x514/0xb70 [ 624.098374][T24930] ret_from_fork_asm+0x1a/0x30 [ 624.103646][T24930] [ 624.103646][T24930] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 624.111451][T24930] __mutex_lock+0x19d/0x1550 [ 624.116553][T24930] elevator_change+0x1af/0x480 [ 624.121825][T24930] elevator_set_none+0xb5/0x140 [ 624.127188][T24930] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 624.133501][T24930] nbd_start_device+0x189/0xb30 [ 624.138858][T24930] nbd_genl_connect+0x1597/0x1c10 [ 624.144386][T24930] genl_family_rcv_msg_doit+0x233/0x340 [ 624.150457][T24930] genl_rcv_msg+0x614/0x7a0 [ 624.155486][T24930] netlink_rcv_skb+0x226/0x4a0 [ 624.160759][T24930] genl_rcv+0x28/0x40 [ 624.165257][T24930] netlink_unicast+0x7bb/0x940 [ 624.170529][T24930] netlink_sendmsg+0x813/0xb40 [ 624.175803][T24930] sock_sendmsg_nosec+0x13a/0x180 [ 624.181342][T24930] ____sys_sendmsg+0x54e/0x850 [ 624.186613][T24930] ___sys_sendmsg+0x2a5/0x360 [ 624.191794][T24930] __x64_sys_sendmsg+0x1b1/0x290 [ 624.197238][T24930] do_syscall_64+0x174/0x580 [ 624.202337][T24930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.208739][T24930] [ 624.208739][T24930] -> #3 (&q->q_usage_counter(io)#52){++++}-{0:0}: [ 624.217338][T24930] blk_alloc_queue+0x544/0x690 [ 624.222617][T24930] __blk_mq_alloc_disk+0x194/0x390 [ 624.228232][T24930] nbd_dev_add+0x494/0xb60 [ 624.233156][T24930] nbd_init+0x15f/0x1e0 [ 624.237819][T24930] do_one_initcall+0x250/0x870 [ 624.243096][T24930] do_initcall_level+0x10a/0x1a0 [ 624.248536][T24930] do_initcalls+0x59/0xa0 [ 624.253370][T24930] kernel_init_freeable+0x29d/0x3e0 [ 624.259078][T24930] kernel_init+0x1d/0x1d0 [ 624.263923][T24930] ret_from_fork+0x514/0xb70 [ 624.269024][T24930] ret_from_fork_asm+0x1a/0x30 [ 624.274293][T24930] [ 624.274293][T24930] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 624.281488][T24930] fs_reclaim_acquire+0x71/0x100 [ 624.286936][T24930] kmem_cache_alloc_lru_noprof+0x65/0x5f0 [ 624.293192][T24930] alloc_inode+0xb8/0x1b0 [ 624.298039][T24930] iget_locked+0x131/0x6a0 [ 624.302963][T24930] kernfs_get_inode+0x4f/0x770 [ 624.308242][T24930] kernfs_get_tree+0x5cd/0x980 [ 624.313520][T24930] vfs_get_tree+0x92/0x2a0 [ 624.318445][T24930] do_new_mount+0x319/0xdc0 [ 624.323458][T24930] __se_sys_mount+0x31d/0x420 [ 624.328641][T24930] do_syscall_64+0x174/0x580 [ 624.333737][T24930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.340133][T24930] [ 624.340133][T24930] -> #1 (&root->kernfs_rwsem){++++}-{4:4}: [ 624.348111][T24930] down_write+0x96/0x200 [ 624.352862][T24930] kernfs_remove_by_name_ns+0x4e/0x140 [ 624.358832][T24930] device_links_driver_bound+0x4ab/0x1440 [ 624.365136][T24930] driver_bound+0xd8/0x2e0 [ 624.370089][T24930] really_probe+0x774/0xae0 [ 624.375102][T24930] __driver_probe_device+0x1e8/0x360 [ 624.380901][T24930] driver_probe_device+0x4f/0x240 [ 624.386433][T24930] __device_attach_driver+0x270/0x410 [ 624.392313][T24930] bus_for_each_drv+0x258/0x2f0 [ 624.397674][T24930] __device_attach+0x2c4/0x450 [ 624.402941][T24930] device_initial_probe+0xa1/0xd0 [ 624.408470][T24930] bus_probe_device+0x12a/0x220 [ 624.413831][T24930] device_add+0x7d7/0xb80 [ 624.418662][T24930] faux_device_create_with_groups+0x1a5/0x2b0 [ 624.425284][T24930] regulator_dummy_init+0x19/0x40 [ 624.430870][T24930] regulator_init+0xca/0x110 [ 624.435973][T24930] do_one_initcall+0x250/0x870 [ 624.441246][T24930] do_initcall_level+0x10a/0x1a0 [ 624.446687][T24930] do_initcalls+0x59/0xa0 [ 624.451517][T24930] kernel_init_freeable+0x29d/0x3e0 [ 624.457229][T24930] kernel_init+0x1d/0x1d0 [ 624.462074][T24930] ret_from_fork+0x514/0xb70 [ 624.467174][T24930] ret_from_fork_asm+0x1a/0x30 [ 624.472442][T24930] [ 624.472442][T24930] -> #0 (&root->kernfs_supers_rwsem){++++}-{4:4}: [ 624.481026][T24930] __lock_acquire+0x1520/0x2cf0 [ 624.486387][T24930] lock_acquire+0x106/0x350 [ 624.491400][T24930] down_read+0x4a/0x330 [ 624.496065][T24930] kernfs_remove+0x35/0x80 [ 624.500988][T24930] __kobject_del+0xe0/0x310 [ 624.506086][T24930] kobject_del+0x45/0x60 [ 624.510852][T24930] cleanup_glue_dir+0x1a3/0x220 [ 624.516213][T24930] device_del+0x77d/0x8f0 [ 624.521045][T24930] device_destroy+0xb2/0x1a0 [ 624.526152][T24930] macvtap_device_event+0x226/0x400 [ 624.531928][T24930] notifier_call_chain+0x1a5/0x3d0 [ 624.537562][T24930] unregister_netdevice_many_notify+0x17de/0x2150 [ 624.544566][T24930] rtnl_newlink_create+0x7d9/0xb00 [ 624.550244][T24930] rtnl_newlink+0x167f/0x1bd0 [ 624.555426][T24930] rtnetlink_rcv_msg+0x802/0xc00 [ 624.560869][T24930] netlink_rcv_skb+0x226/0x4a0 [ 624.566150][T24930] netlink_unicast+0x7bb/0x940 [ 624.571417][T24930] netlink_sendmsg+0x813/0xb40 [ 624.576689][T24930] sock_sendmsg_nosec+0x13a/0x180 [ 624.582225][T24930] ____sys_sendmsg+0x54e/0x850 [ 624.587494][T24930] ___sys_sendmsg+0x2a5/0x360 [ 624.592677][T24930] __x64_sys_sendmsg+0x1b1/0x290 [ 624.598119][T24930] do_syscall_64+0x174/0x580 [ 624.603216][T24930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.609614][T24930] [ 624.609614][T24930] other info that might help us debug this: [ 624.609614][T24930] [ 624.619825][T24930] Chain exists of: [ 624.619825][T24930] &root->kernfs_supers_rwsem --> cpuhp_state-up --> gdp_mutex [ 624.619825][T24930] [ 624.633200][T24930] Possible unsafe locking scenario: [ 624.633200][T24930] [ 624.640630][T24930] CPU0 CPU1 [ 624.645974][T24930] ---- ---- [ 624.651315][T24930] lock(gdp_mutex); [ 624.655194][T24930] lock(cpuhp_state-up); [ 624.662025][T24930] lock(gdp_mutex); [ 624.668436][T24930] rlock(&root->kernfs_supers_rwsem); [ 624.673878][T24930] [ 624.673878][T24930] *** DEADLOCK *** [ 624.673878][T24930] [ 624.682000][T24930] 3 locks held by syz.1.8467/24930: [ 624.687526][T24930] #0: ffffffff9057da90 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 624.697200][T24930] #1: ffffffff9002dac0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 [ 624.706256][T24930] #2: ffffffff8f5e4520 (gdp_mutex){+.+.}-{4:4}, at: cleanup_glue_dir+0xc3/0x220 [ 624.715410][T24930] [ 624.715410][T24930] stack backtrace: [ 624.721287][T24930] CPU: 0 UID: 0 PID: 24930 Comm: syz.1.8467 Not tainted syzkaller #0 PREEMPT(full) [ 624.721305][T24930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 624.721316][T24930] Call Trace: [ 624.721322][T24930] [ 624.721328][T24930] dump_stack_lvl+0xe8/0x150 [ 624.721354][T24930] print_circular_bug+0x2e1/0x300 [ 624.721372][T24930] check_noncircular+0x12e/0x150 [ 624.721390][T24930] __lock_acquire+0x1520/0x2cf0 [ 624.721419][T24930] ? kernfs_remove+0x35/0x80 [ 624.721433][T24930] lock_acquire+0x106/0x350 [ 624.721452][T24930] ? kernfs_remove+0x35/0x80 [ 624.721470][T24930] down_read+0x4a/0x330 [ 624.721489][T24930] ? kernfs_remove+0x35/0x80 [ 624.721509][T24930] kernfs_remove+0x35/0x80 [ 624.721522][T24930] __kobject_del+0xe0/0x310 [ 624.721545][T24930] kobject_del+0x45/0x60 [ 624.721564][T24930] cleanup_glue_dir+0x1a3/0x220 [ 624.721583][T24930] device_del+0x77d/0x8f0 [ 624.721601][T24930] ? __pfx_device_del+0x10/0x10 [ 624.721618][T24930] ? kobject_put+0x50f/0x550 [ 624.721639][T24930] device_destroy+0xb2/0x1a0 [ 624.721656][T24930] ? __pfx_device_destroy+0x10/0x10 [ 624.721675][T24930] ? kernfs_remove_by_name_ns+0x101/0x140 [ 624.721691][T24930] macvtap_device_event+0x226/0x400 [ 624.721715][T24930] ? __pfx_macvtap_device_event+0x10/0x10 [ 624.721741][T24930] notifier_call_chain+0x1a5/0x3d0 [ 624.721765][T24930] unregister_netdevice_many_notify+0x17de/0x2150 [ 624.721792][T24930] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 624.721814][T24930] ? netdev_upper_dev_unlink+0x99/0xe0 [ 624.721829][T24930] ? __pfx_netdev_upper_dev_unlink+0x10/0x10 [ 624.721844][T24930] ? macvlan_dellink+0x3e4/0x470 [ 624.721891][T24930] rtnl_newlink_create+0x7d9/0xb00 [ 624.721912][T24930] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 624.721930][T24930] ? __pfx___mutex_lock+0x10/0x10 [ 624.721951][T24930] ? ns_capable+0x89/0xe0 [ 624.721970][T24930] rtnl_newlink+0x167f/0x1bd0 [ 624.721990][T24930] ? __pfx_rtnl_newlink+0x10/0x10 [ 624.722004][T24930] ? do_syscall_64+0x174/0x580 [ 624.722021][T24930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.722049][T24930] ? kasan_quarantine_put+0xbb/0x1f0 [ 624.722075][T24930] ? lockdep_hardirqs_on+0x7a/0x110 [ 624.722093][T24930] ? nlmon_xmit+0xb0/0x100 [ 624.722203][T24930] ? kmem_cache_free+0x182/0x650 [ 624.722228][T24930] ? __lock_acquire+0x683/0x2cf0 [ 624.722250][T24930] ? __dev_queue_xmit+0x29b/0x3820 [ 624.722297][T24930] ? __local_bh_enable_ip+0xd0/0x130 [ 624.722315][T24930] ? lockdep_hardirqs_on+0x7a/0x110 [ 624.722331][T24930] ? __dev_queue_xmit+0x29b/0x3820 [ 624.722348][T24930] ? __local_bh_enable_ip+0xd0/0x130 [ 624.722364][T24930] ? __dev_queue_xmit+0x29b/0x3820 [ 624.722384][T24930] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 624.722404][T24930] ? __pfx_rtnl_newlink+0x10/0x10 [ 624.722417][T24930] rtnetlink_rcv_msg+0x802/0xc00 [ 624.722433][T24930] ? rtnetlink_rcv_msg+0x1c9/0xc00 [ 624.722447][T24930] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 624.722460][T24930] ? ref_tracker_free+0x689/0x830 [ 624.722534][T24930] ? __pfx_ref_tracker_free+0x10/0x10 [ 624.722557][T24930] netlink_rcv_skb+0x226/0x4a0 [ 624.722575][T24930] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 624.722592][T24930] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 624.722612][T24930] ? netlink_deliver_tap+0x2e/0x1b0 [ 624.722629][T24930] ? netlink_deliver_tap+0x2e/0x1b0 [ 624.722647][T24930] netlink_unicast+0x7bb/0x940 [ 624.722666][T24930] netlink_sendmsg+0x813/0xb40 [ 624.722686][T24930] ? __pfx_netlink_sendmsg+0x10/0x10 [ 624.722705][T24930] ? aa_sock_msg_perm+0xf1/0x1b0 [ 624.722765][T24930] ? __pfx_netlink_sendmsg+0x10/0x10 [ 624.722782][T24930] sock_sendmsg_nosec+0x13a/0x180 [ 624.722805][T24930] ____sys_sendmsg+0x54e/0x850 [ 624.722824][T24930] ? __pfx_____sys_sendmsg+0x10/0x10 [ 624.722843][T24930] ? import_iovec+0x73/0xa0 [ 624.722859][T24930] ___sys_sendmsg+0x2a5/0x360 [ 624.722875][T24930] ? __lock_acquire+0x683/0x2cf0 [ 624.722896][T24930] ? __pfx____sys_sendmsg+0x10/0x10 [ 624.722914][T24930] ? futex_wake+0x51b/0x5f0 [ 624.722942][T24930] ? __fget_files+0x2a/0x420 [ 624.722962][T24930] ? __fget_files+0x3a2/0x420 [ 624.722985][T24930] __x64_sys_sendmsg+0x1b1/0x290 [ 624.723004][T24930] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 624.723027][T24930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.723042][T24930] do_syscall_64+0x174/0x580 [ 624.723059][T24930] ? trace_irq_disable+0x3b/0x140 [ 624.723078][T24930] ? clear_bhb_loop+0x40/0x90 [ 624.723095][T24930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 624.723110][T24930] RIP: 0033:0x7fd69359e0d9 [ 624.723124][T24930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 624.723138][T24930] RSP: 002b:00007fd694455028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 624.723154][T24930] RAX: ffffffffffffffda RBX: 00007fd693825fa0 RCX: 00007fd69359e0d9 [ 624.723165][T24930] RDX: 0000000008000002 RSI: 0000200000000000 RDI: 0000000000000003 [ 624.723175][T24930] RBP: 00007fd693635024 R08: 0000000000000000 R09: 0000000000000000 [ 624.723185][T24930] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 624.723195][T24930] R13: 00007fd693826038 R14: 00007fd693825fa0 R15: 00007ffd0acc3988 [ 624.723212][T24930] [ 625.264436][ T1317] ieee802154 phy0 wpan0: encryption failed: -22 [ 626.016364][ T57] net_ratelimit: 1 callbacks suppressed [ 626.016383][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 626.030880][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 627.136238][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 627.144565][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 627.396266][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 628.246220][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 628.254549][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 629.359308][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 629.368724][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 630.476754][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 631.576253][ T57] net_ratelimit: 1 callbacks suppressed [ 631.576273][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 631.590914][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 632.516300][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 632.697127][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 632.705423][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog