last executing test programs: 3.865771526s ago: executing program 4 (id=4428): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) 2.88674169s ago: executing program 4 (id=4442): socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x20004090) syz_emit_ethernet(0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10022, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44}, 0x41) sendmsg$nl_route(r0, 0x0, 0x4040000) syz_genetlink_get_family_id$SEG6(&(0x7f0000004040), 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'vlan0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@setlink={0x2c, 0x13, 0x1, 0x70bd29, 0x25dfdbf8, {0x0, 0x0, 0x0, r2, 0x3007, 0x409}, [@IFLA_ADDRESS={0xa, 0x1, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1b}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8804) 2.808704928s ago: executing program 0 (id=4444): bind$vsock_stream(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000000)=ANY=[], 0x8) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0x806000) mmap$xdp(&(0x7f0000001000/0x2000)=nil, 0x2000, 0xf, 0x11, r1, 0x100000000) ioctl$FS_IOC_RESVSP(r2, 0x40305829, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x9ffffc}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000003, 0x12, r1, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r3, 0x0, 0x80) socket$netlink(0x10, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, 0x0, 0x0) 2.6313855s ago: executing program 2 (id=4446): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd844", 0x4d}], 0x1}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@newlink={0x68, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x42, 0x2021}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x30, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MACADDR_MODE={0x8, 0x3, 0x3}, @IFLA_MACVLAN_MODE={0x8, 0x1, 0x10}, @IFLA_MACVLAN_MACADDR_DATA={0x1c, 0x5, 0x0, 0x1, [{0xa, 0x4, @local}, {0xa, 0x4, @remote}]}]}}}, @IFLA_LINK={0x8, 0x5, r4}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000002) sendmsg(r0, &(0x7f0000000b40)={&(0x7f0000000000)=@ll={0x11, 0x18, r4, 0x1, 0x81, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f00000000c0)}, {&(0x7f0000000380)="c0cd87ca112c211b516221302a4598ad6b68b7", 0x13}, {&(0x7f0000000400)="47fd8402cea3360b4e760761a414032e2337bb682e034f5191d24800ef79d7992ff8208c1aad813d8ba19cf3a873a97f3cca8cf00f0baf5d4c8af707061a2fe2a44af2da9d3761b868c58863a075346947e35497a61b110226f1e0790e67c4d46d87515ed3ada9db82ef5c95a50244b04b50aa9b27c85bceca0b2112ac9e5e955075999080858d0aff90a35dfa6d5aad971ae918b9f817512c6e97a76cd75ac0d553fa704500deab2f46c73e197993", 0xaf}], 0x3, &(0x7f0000000800)=[{0x98, 0x10f, 0xa75, "ee2732f84dd9bf1accc5d48afb2f606afa19b671723f81b9391f364c22cfd9f420050895cbe68057ccd13bdf50939d3cf277dd72c1062e3c26ccec365d99fbcded82d5b048063428f2c286e1dfd26e75ae4f455db6fffd009d667ba25c9284fc14b7a3626948627d9607506edb5988ca8901bd57fc12c7f0f75ae90ef98477cfa164f6c13f2c81"}, {0x30, 0x2, 0x357cfe31, "4d47a93d7b15bc403bc0ef3a38a81ed874160e01e3af8857546cedf691120d70"}, {0xf8, 0x10c, 0xd, "08b3cf810833b614ca132432cb8e55e0c0e5b9f6f08e8e1fb598af6edbb5582a4e28cf477f5468d1622b2cb8a54dbbbde624460dea0a2d12211f45e489c445ba0735b51a4bc4e7f5d027d0e1557ad7cb676bf1e844f04fd41dee44281713abf596ab0d34362f703e1e8832923164497ed5d4444a473cd8287770ea33598e9fb159b28f0c84cd63376c250e8a1c8e38f5deecdc9dba821d186b5865532fb0e1d68ad86c8015bc857533449770084ab5277690c3ad2d3cd2f6e498b71ad0d6047858d4655a6fe547683be7edf55997aa17dcd9f1189b2346e66fa36bf356ce3acfea1fe09331506e"}, {0xa0, 0x10f, 0x4, "977bcc814f99fe5d78558b9b05b83da02d39d6cc2873f96dec8dd2af403d8e809934540e123347b7280d918c78256fc9d99fb10e42bafdb75d0486c89c8aab25be6dcf262a83ae99a144a54b9d09327981775c0643478c24e85399ad37472c06479d9b7a86adccb198fdc49104edd5798f7c3e9c331881cd6ac70343e3d87f7f92da6d9f314926b090c8b34c"}, {0x58, 0x116, 0x3, "e0bd42576a8b2660db90aa452d49774541a92e2c3cc6435a252c3c85d86aa705f3c8b35e9a7c227267b76aabdbf5c30ccbd3ea439571a6b031cad22247aa42f37659"}, {0x40, 0x101, 0x5, "ed25f9e605bf38fab5e650f29425d55d69e73d873da8aecfedb1f49daa0d66e54b87d53bb2431425d5a9346532"}, {0x10, 0x108, 0x8fa}], 0x308}, 0x4000004) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f727400"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) r5 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_int(r5, 0x6, 0x9, 0x0, &(0x7f0000000040)) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="500000000a0601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@loopback={0x200000000000000}, 0x800, 0x0, 0x3, 0x1}, 0x20) 2.5531508s ago: executing program 1 (id=4447): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$fou(&(0x7f0000000b80), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(0xffffffffffffffff, &(0x7f0000000c80)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x40010) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) recvmmsg(r1, &(0x7f0000002800), 0x0, 0x0, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@random="39a90e0000e3", @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @rand_addr=0x64010101, @private=0xa010101}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x4, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6dafe0900"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x8, 0x0, 0x0, 0x41100, 0x40}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0xf0ffffffffffff, 0x0, 0x14004804}, 0x4000860) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000240)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0xffffffffffffff9d, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$FOU_CMD_ADD(r0, 0x0, 0x40080) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20004000) 2.478357741s ago: executing program 2 (id=4448): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000140)) r2 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000040), &(0x7f0000000080)=0x30) close(0x3) r3 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r3, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x1, @empty, 0x1}, 0x1c) getsockopt$inet_sctp6_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f0000000000)={0x0, 0x2, 0x70, 0x1}, &(0x7f0000000040)=0x10) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000100)={r4, 0x7}, 0xc) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000000080)={r4, 0x2}, &(0x7f00000000c0)=0x8) sendto$inet6(r3, 0x0, 0x0, 0x24000088, &(0x7f00000001c0)={0xa, 0x4e20, 0x8, @loopback, 0xfffffffe}, 0x1c) setsockopt$sock_int(r3, 0x1, 0x2b, &(0x7f0000000180)=0x40002, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000098000000060a010400000000000000000100000208000b400000000070000480340001800b000100657874686472000024000280080001400000000c0800034000000002080004400000002205000200070000003800018008000100636d70002c00028018000380090001009c979b32261fbabdae20b34f870e0000080001400000000208000240000000000900010073797a30"], 0x10c}}, 0x0) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) 2.358940348s ago: executing program 0 (id=4449): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=@newtfilter={0x3c, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_KEY_ID={0x8, 0x1a, 0x5b3}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4894}, 0x2) close(r4) socket(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r6, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0000000025c10200000006125ce882cbf400930bf4533f00429c65112a093bbf60b85bcb06", 0x2e}], 0x1}, 0x4005) 2.03721716s ago: executing program 4 (id=4450): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000580), 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xd4}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'ip6gretap0\x00', 0x0}) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000040)={@remote, r4}, 0x14) r5 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001d40)=[{{&(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000f40)=ANY=[], 0x120}}], 0x1, 0x4000) sendmsg$nl_route_sched(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)=@newtfilter={0x24, 0x11, 0x1, 0x70bd24, 0x2000, {0x0, 0x0, 0x74, r4, {0x5, 0x10}, {0x1, 0xb}, {0xfff2, 0x10}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x48000}, 0x840) 1.927098748s ago: executing program 1 (id=4452): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xf, 0xffff}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x9, 0x7b2d2bff, 0x4, 0x2bfe, 0x6, 0x9, 0x3, 0x5, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0x10, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x8, 0x0, 0xffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x240040e0}, 0xc010) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.856756695s ago: executing program 0 (id=4453): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) 1.790980005s ago: executing program 4 (id=4454): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0xa0}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff8}, [@call={0x85, 0x0, 0x0, 0x36}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x24, 0x0, 0x9, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_TUPLE={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000085}, 0x4000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) 1.722689915s ago: executing program 4 (id=4455): socket$xdp(0x2c, 0x3, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_pressure(r0, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r1, &(0x7f0000000080)={'some', 0x20, 0x2000000008, 0x20, 0x10000000fffff}, 0x2f) close(0x4) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, 0x0, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000fc0)={0xffffffffffffffff, 0xffffffffffffffff}) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) sendmsg$inet(r2, &(0x7f0000001580)={0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000080)="3bfdd75fa5717852d59a9367444a2130e72cd4dabc8854532cca0c32a5b9f844a4610c7525650ce3d3b76b15026d93e6dee896115e9364066aa3d14e33ef732b4681335c576902153114bdb9c74b538a71115fb1d1a63d1b04129661b29aab89d0be999a6b7c9bea755adedbf305a79f70b71d3d4c98577b49db4963ce89b0def5e840f459659cb6f86d56b069a5de11d601d348ff88ca6e5e2cfe40176880b33e9e8dbc32ba2e6a99b1b50276dc4f06166000d7069a3cc76f", 0xb9}, {&(0x7f0000000180)="892950e2405ee8629d9384a91c16d1706a3e61f305119f95cac0f1927f4c205b971eb41147cb1f86883d6910e68ac3996551800b3ec64b77f8444b18345a2c8b178eeeba0cde7319a5a46bfe7f5770e019efd9d52069edcced33a758c4e657f3a792dc193a1911b4e82ea800ad7afe03c851a8", 0x73}, {&(0x7f0000000200)="a68cde0d56b170df7710b54f17d9a39c4f98f3547190", 0x20000216}, {&(0x7f0000000240)="45e04400f2b383517a08c397dd0a76e67ecfc8e74573c24dedd3a48fb62418c1412fdcd15e888cb0f5d02e77bfecefda6b064c0bb2b66a9a522e63873dde02330510255eec7dfa1af708cdab59fb71eca786a359a2c3b0cbad35144ec5b069c53f90e43339845dc7fd140c55b0149ab38eb27c140f374bcc2c95b0b121d1a9302f3a01b888243b3fc0d46f0de0", 0x8d}, {&(0x7f0000000300)="87fb74cf4d67adbbd062637f514c1f5eb18d7b442e6457a356c6cb1f71a43dfae773c8489cce5145f92615d4bdb13ef54d6ae90ec7733180fcf5adf3e13fdb05b57b748bd14eda042a97fdd84498304a504a0a159b972e8200c2d0f536a3465ec498ed12b924bd134057df36129d3ebe3dd3ce9f0671e5278143e4afa3d43f444681de1b5f9725fca34fa357fe2154981666fb9dc202fc17a0199eb1c25bdd1005e590e84783ee9894c888998dc25a83c14aeee31d114acfa0bcd235d571cd765f4b9259ba43e6fc30291d8a642146c4771898030b736aeee6b247abb0784b154e104e7dcda401f9b1736fea30a41a4153fe6a9a525bd0a3487571f914f05b590e242341ade289d8f5b842c6be4a93c2755dfd47174def782a2f8f61c068b5a012f02c0801601e860def788121e8808c01fed4c920a3698d0d684920918c95b17f76bbcb4f265c931d8f79560ff8114b70f4dd6791e2ed70cfeb89905791b88be26efe1c5c66b7b50b3d2be0dbc066dfc31618f9507f6f340b85a2f76a6dcac9d6ccc289ace5e5fecd25afe22ffa451f5e365ab33cc985f2e9d7f7fb1be4794740a94215d7db14b0ffcec19e5e3c5ae0d8578ef3b65d2a7a77a11e390a6c3a6b391061c886b961e3c2f42d62047bfe1356a44b840d3d956105f4c0fa95db08c4933f00de77cdc057c28b41fecfc8398c442be1ad065954f6c9dfeb2fd7207e8548a00a1d50bdf522d2abfdafd71723616a34830fbfa8fc81e0c2639cc12f363a4919b7a00ac8189dad3e7e54122a2ef430f623658d5e281c9a19442995bb9b0e3f7d13e3016b6f9523be196bf23bbcc5ec802f43ef8b651d688d9d5a44f35c9847e4c32bce3e9ebed2326adadc76f06a195db32c80b3090d7cd65c9d8518ba4e528c5eb5c7a1c5695b21595fa8a8621734bfda8afddd65e1f37a1990220a00fa9bd2c22b0117ceb08ae6af3c944c2eca924abfddad065d1472d0c3f742a49b1e78c669471873706ad157d831d7482b773f07b0673a6ce1e227a7a4d13744bf459434c0ab1c323a38b1a84cbf1ce9741f2b8fdcc2e073e56171603d035aacd83e71d5132831f4f1e8bf517979f132a33fd03783272e9b8c96dfa4e1d320a58d82acfc8d3d53a5a52daafe4dc8be08f4ad53e11cc21374b6ff4ff5ea2ecc5d3f7c057f74f0098e57d990090475cdaffdef0da917653ed10fb70b94b72e5b4d95cbea0fc1dd2579635ad6ab545ba4d7b6d2f5442bdb78beb6c8ed62942a439117025b4566b48d9f3a17fdf4577e8606a4bc4c26557e58312fd2d1a541ebec3e5ae28eef8b2ab0597083716dd12889335570ee7839530eee879d9b137606cd4dd7103991671b4464bb68529eb19fb7a8845e3491bfbac688a87cf0744f429ea112014402915c4c1f6bae08d689d3cb7d641d7befe8fc74a2242310a9a367a39531b4c86da5b39df524e52f33ff9c40b48cb196ffc9ca855b6e698ade8a83e52b9ddc5031ff09e1907e4f8b0d07e64e1fb8e427f8819a7be907aa216bf8e2a4c7cc87ed53bf9490d4cc788b91f3b9f705e984a7e62c7a495e8421b97c39dc954b35468f17c6682334f4e16308448f457faeffff6d1f818522fa441d3a48168bdb12ffebace436a3915b63076cb6a655718647f87eaaf313b5bbd430421eed3a2215e439600a56eac8c65291eb103326a8034662bd337ab51577d9110ec7151be5cc9c54b2a30891acac5ad006ed537dbeb8f16eecbde7cf4e71373faf3c36b772f6d7ea9346875c8cf1049d49d4f8eb01b946c11e8c8e3ab2015f282167acddcc77fff03e1be9134252af0abfe538b4d25fc4ff874b52b9fb0996b5f32b4141dbd30578ff46e13ef6c63fc1620f62cb11a3dce401993976c272a5f62fde3f2a0e654d19e7a39dcdb622b9526d2a15cc18e6f817c916a00775353dd9c8954e66d0445b59bb0f5e6e3b46447232f52a0e398b057d123ef503afcbd48544db6434d2025bfc8dab72262a4fa5426a03061e7f8966e0086ff8ab5a91ab59f19b830394ee8bc76d6fb4816b8f4cde35b7eb9d3811228d51c54828f97fd1e648196c81bc73ed56249a59f318704e84656a6cedd2b8c1e1808d1cc648749abc643131e494c01336d4a14b8609656f2c972dc23c5c2e43fe40119fb88b5ec2aade35c03646e347354c493de8ab3672ccf94af0df333c6678299129d79be0eec281c5b3858ce3995566a390b674635b356692e3e9c53a089638ba0d69e772b7b410a5ae03de12e7de755ee559e1707b7b8003aabc8e2ce03c01e3183ff2d93262f6d5ceaafecdae66bc7cb3952c5a6571d864d502f281db5a228695badca5d022fdb6da56ab15dc377d1c1f8581ff56e28c2b2a84edb629547d28275c2ed571103b4ca7cdeb0776ba9f9dffcd78d21c3d4caa9289ed199672f4e7b912068c49c817114c37d37ea03954bae87d1ddae3da2ad85feb2fbb735b75a51f7bee5c8d88cc7bf64700d1a46ec6b631ae22ac7b06730a86a26bdcb992e1c7b50142de96b14a8468e4514068a30896fc677fddefaebb125c693a8d460469c7fe535f844781940f66d6abd091191c3122d584f5b0f5b0d443713d7d5186124d73de28aca30b719d4a55e09d259bddbf16995aeb1000880890afbd24d4066b0398985a40999de22ce176348e1c1f57eaf75b92a1e4f1482e89a00ac2cc36b20e36af9ec310599c19a5b1d6f8fadba104c58c801c6633315f82ebfa88faddd0b693e2f827f586c1cc5538e93bcf10f81af6dd7ee727df3b5018c0b4e31e40d040a47503b6ace4d29a1162ce487351825255f5584aff7cbd421f85c3d9fbb3784abd9848f16028b68f0d32ed8bb80106e8cc4acb939ff88bd39976d166b2addebf628b3fcd056da2f60e1b90f7a32702954921908ebccb683622a1f574ceba6951bef5e751c338c8279318dc28e36b9fc2bb17c3ad08aceb00fc388e6db112a738f86a4a1eb11526e1b9d73250b326285ed47c4398d93a3933d9a784249b65ad7d78a1f81d96ef36493ed693045a2150a8eb43cecc0c93e7d20b15b39a0646b081c2923b816365b7fbb41683a41732d942c5aa12faf876ec7f036becde8f3295af6dacff38d076d8e06260fee167703bb610745374a2758a6b88e465ca77d1f3105ae8b6b04a1eb509fb178d6249dbbc84d5d1d069278449a89d03e4a9a395d8170c329a296cfc329798cb9b9f1078d098cf3f989fd4ec53e013fbe917df35292d44fb1f3da4da4432a1847d4721514ade8cda5e5c0b51183580fc35266a970ebba74faeda56d4dcb56df51f96ad237452cedbd0cb2bee112713c3d450835811bf3da9745136d428e148fd0932dc77c8d8e61a16c625241fad8425b4ece394eedd5f165bd94923bfa1172be8edc8a4fcaae5f77ee8cc510192b27964da09c3e84efb4bc7154da1a24da8b7e544b42278d2574687ec76143afa6cf193d52a2a7f4c20ee57b6056a1337d5e408117a6cf1ab49c8980f39597f69902085d3e8d374d44e6ab4ed1185a26be2bc7281e9cfbbeb6bed899aa1924d3faa06d95999fbeaf2337494e0c2c39eef5a73fcde84459a9ea48d4e015d9e5bb5839354967ce02f637bc8678d2595b9a918fc36b927d7501f0ac2e3471ce02b5df355689c87f191ef5390900a41deec29984e45a878ece964b0009aad561316fc3b30ce1b49266d32eb17cd30f3e17e1f59014e8c518940dd0a093d1349c1a7c2581963bbe0ba372b6426e81c33c71b2ec8141c5713e52a37fff0a417a5b259e1420d9fb6a731f5baa0cc494221947895aa8fa14745a986a366bff9d0c239a19f85372497565b5b703da16439019df5f3d29f4247fb528854c9648630f03e9dedde5a08a47728ea6a4d42e62eff6fa3bd402325e0f4387b60171c37c180f958ad80955779c899517e7ea76eed00598e01552eaaf08b723daf9d466e8c57af43a15a46528b1119f5074aa3c51f77357ebe158275bc06b89640d7ce3c0a03af01418d7dc6ae8a1be8ab08c1722d66d1e9277480b8b178447667c024f9b78f8a878a2d7cf8e83e5104f6964b2907a989abafc7d7d0df941abf3d7283b6a11d46c2911a42182ec27ab785d92946e1ee8ef44846d561850d2a98c305c382f36d4cfc9b2bfd3b86ef21a0d187adcafbec8268c7d662a34dda1c83c4967097743133bc8c587edf249f5668c34ddb112fa4eb1bea9c8f6a000f1f34428b54688a5e214a7919868b25dbe930e86a243ecf54afe0b518c647d04873d2cf62cb2ab27f00015537a4fd2ea3dc8777abdf3284622347016566da0b9c406ca8c40694e4013a53fbf2e803d51b0bbe5e9df5fc74f66be618856357ccf803c53ed0e3b3fe79f69f0ede9b565d8f7a8ce5aa8cbb4e8fa61be3fd00ffb07e45065498925c14c0b311942d4ed951ad6237aadb5405bc7b2d79e1fd295b7c2ed8efa883e44c86a5053e2f421c6d4dc0c47d3a05d911db37d6efdb8e50fb3f06139ac147bc7162c21aece79eaf72e9779f19eb5395cec3d15a7594ea70a6b373d98651d2215b210f037ea3f8a57ded74474f6fdb64a08b56af52168da70b30aee03472cd8bee5af04cad7303004a4aba464b99", 0xcb3}], 0x5, &(0x7f0000001480)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @private, @multicast1}}}], 0x20}, 0x0) recvmsg$unix(r3, &(0x7f0000001140)={0x0, 0x0, &(0x7f0000001040)=[{&(0x7f00000015c0)=""/4096, 0x7ffff000}], 0x1, 0x0, 0x2}, 0x40000300) pselect6(0x40, &(0x7f0000000000)={0x4, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x1, 0x0, 0x0, 0x2000000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x80000003}, 0x0, 0x0) 1.656537207s ago: executing program 1 (id=4456): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002340)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0xfff3}, {}, {0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xf, 0xfff2}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24040894}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000002300)="81", 0x1}], 0x1}, 0x4) 1.567866132s ago: executing program 2 (id=4458): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x4, 0xfffffffb}, 0x5, 0x34, 0x91f}}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xa, 0xffe0}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8, 0x2, 0x600}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.350549221s ago: executing program 3 (id=4459): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xb}, {0x4, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240408a0}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) socket$unix(0x1, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.321182493s ago: executing program 1 (id=4460): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000000020010", @ANYRES32, @ANYBLOB="0300"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000ff90850000002d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095", @ANYRES32=r0], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @random="cf3cccaf382f", @void, {@ipv4={0x800, @tcp={{0x7, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0xfe, 0x6, 0x0, @remote, @local, {[@end, @end, @timestamp_addr={0x44, 0x4, 0x7d, 0x1, 0x4}]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff}}}}}}, 0x0) r3 = socket(0x10, 0x80003, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'lo\x00', 0x0}) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="180100002e0001f9ffffffffffffff250501f2800c00180008ac0f000000000014000a0000000000000000000000ffffac14141650bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe9486fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3ed73cfc000000"], 0x118}], 0x1, 0x0, 0x0, 0x400c445}, 0x0) r6 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000340)=@base={0x12, 0x1, 0x8, 0x2}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x1f, 0x13, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000000000000000000000400000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000096000000180100002020692500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000f8ffff850000000400000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000002380)={r7, 0x0, 0x2d, 0x0, @val=@netfilter={0x2, 0x4, 0xffffff1f, 0x1}}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x11, 0xc, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x20}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000a00)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000, 0x22}, 0x94) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0xb, "000000000002040000000b00"}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) 1.272646851s ago: executing program 2 (id=4461): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r6, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1a29d}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x8, 0x0, 0x20000000, 0xb2, 0xa8}, 0x38}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x4894}, 0x2) close(r4) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r6, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0000000008002500000088125ce882cbf400930bf4533f00429c65112a093bbf60b85bcb06", 0x2e}], 0x1}, 0x4005) 1.050469347s ago: executing program 2 (id=4462): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x14, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x42804}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r3, 0x0, 0x6, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(r4, 0xc0c89425, &(0x7f00000002c0)={"6b2f3b6a399bc2f1af59106a2a1667f8", 0x0, 0x0, {0x9, 0x9d5f}, {0x8001, 0x43}, 0xffff, [0xde99, 0x8e9, 0xc, 0xbf2, 0x10, 0xfffffffffffffffb, 0x4000000000, 0x1, 0x34e0000, 0x7ffffffffffffffb, 0x6, 0x4, 0x6, 0x8, 0x0, 0x4]}) write$cgroup_subtree(r4, &(0x7f0000000280)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x11fe726f7e78fcf0}, 0x28) write(r1, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x3000007, 0x31, r3, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_CONTEXT(r5, 0x84, 0x11, &(0x7f0000000000)={0x0, 0xfffffffd}, &(0x7f0000000080)=0x8) getsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000040), &(0x7f0000000080)=0x4) 1.028002984s ago: executing program 1 (id=4463): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x403, 0x78bd28, 0x0, {0x0, 0x0, 0x0, 0x0, 0x90646}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x600}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f0000000000), 0x400000000000235, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="3c00000010000305000000000007000000000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) 881.532064ms ago: executing program 0 (id=4464): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) socket$alg(0x26, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000001b40)={0x1c, 0x20000000000000bb, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x1, 0x803, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000600)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f00000001c0)='cgroup.clone_children\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f00000000c0)=ANY=[@ANYRESOCT, @ANYRESDEC=r1], 0x31) 878.619342ms ago: executing program 3 (id=4465): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0xa0}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff8}, [@call={0x85, 0x0, 0x0, 0x36}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x24, 0x0, 0x9, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_TUPLE={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000085}, 0x4000) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) 664.894453ms ago: executing program 3 (id=4466): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000000000000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="02000000000000000c000000000000000000000000000000aacc0000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008000006000000000001000000000000004400050000000000000000000000000000000000fffffffc3c00000002000000ac1414aa000000000000002d000000000600000004"], 0xfc}}, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r3 = socket$inet(0xa, 0x801, 0x0) sendmsg$sock(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) connect$inet6(r2, &(0x7f0000000180)={0xa, 0x4e1d, 0x0, @empty, 0x61}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4f}, {0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}}, {{@in6=@mcast2, 0x404d3, 0x2b}, 0x2, @in6=@loopback}}, 0xe8) r4 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x10}}, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="0213020e02"], 0x10}}, 0x4000050) 595.65113ms ago: executing program 0 (id=4467): sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x5) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0xff6d) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x403, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x400}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_MASTER={0x8, 0xa, r10}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) 485.259346ms ago: executing program 3 (id=4468): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0xa0}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x6, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2, 0x0, 0x0, 0xfffffff8}, [@call={0x85, 0x0, 0x0, 0x36}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x24, 0x0, 0x9, 0x801, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFCTH_NAME={0x9, 0x1, 'syz0\x00'}, @NFCTH_TUPLE={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000085}, 0x4000) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) recvfrom$llc(r2, 0x0, 0x0, 0x10000, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000040)="f7edad00"/14, 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x40, &(0x7f0000000380)=@raw={'raw\x00', 0x4001, 0x3, 0x2e8, 0x128, 0x0, 0x148, 0x0, 0x148, 0x250, 0x240, 0x240, 0x250, 0x240, 0x7fffffe, 0x0, {[{{@ip={@private=0xa010102, @local, 0xff, 0x0, 'ip6gretap0\x00', 'nicvf0\x00', {}, {}, 0x88, 0x3, 0x10}, 0x0, 0xc8, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}, @common=@unspec=@connmark={{0x30}, {0xfffffff9, 0x8}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0x85d, 0xf, [0x10, 0x32, 0x1e, 0x3a, 0x2f, 0x25, 0x3f, 0x17, 0x19, 0x22, 0x2c, 0x3d, 0x7, 0x3f, 0x1e, 0x31], 0x0, 0x2, 0x2}}}, {{@ip={@rand_addr=0x64010101, @local, 0xff, 0x0, 'wg0\x00', 'lo\x00', {0xff}, {}, 0x2e, 0x3, 0x4}, 0x0, 0xc0, 0x128, 0x0, {}, [@common=@unspec=@state={{0x28}, {0xffff}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x1001, 0x7e, 0x1c, 'netbios-ns\x00', 'syz0\x00', {0x3}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x348) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000002000)=@raw={'raw\x00', 0x8, 0x3, 0x3a0, 0x0, 0x11, 0x148, 0x0, 0x0, 0x308, 0x2a8, 0x2a8, 0x308, 0x2a8, 0x3, 0x0, {[{{@ip={@loopback, @loopback, 0xff000000, 0xff, 'syz_tun\x00', 'sit0\x00', {0xff}, {}, 0x6c, 0x1, 0x77}, 0x0, 0x190, 0x1d8, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x9, 0x0, 0x3, 0x3, 0x7, 0x0, 0xb0d452e9002af204}, {0x2}}}, @common=@unspec=@conntrack3={{0xc8}, {{@ipv4=@broadcast, [0xff, 0xff, 0x0, 0xff], @ipv6=@mcast2, [0xffffffff, 0xffffff00, 0x0, 0xffffffff], @ipv4=@empty, [0xff, 0x0, 0x0, 0xff000000], @ipv4=@multicast2, [0x0, 0x0, 0x0, 0xffffff00], 0x6, 0x6, 0x0, 0x4e23, 0x4e24, 0x4e22, 0x4e23, 0x81}, 0x0, 0x480, 0x0, 0x0, 0x0, 0x4e20}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00'}}}, {{@uncond, 0x0, 0xd0, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@quota={{0x38}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x3, [0x2, 0x0, 0x1, 0x7, 0x2, 0x5], 0x3, 0x1}, {0xffffffffffffffff, [0x3, 0x0, 0x2, 0x7, 0x1, 0x2], 0x2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x400) 278.488808ms ago: executing program 3 (id=4469): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x24004000) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x4804) recvmsg(r8, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x40000002) setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, &(0x7f0000000000), 0x4) sendmsg$inet(r0, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x4000000) recvmsg$unix(r1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffff64}, 0x40000040) 266.144787ms ago: executing program 1 (id=4470): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) r3 = bpf$ITER_CREATE(0xb, &(0x7f00000002c0)={r2}, 0x8) write$cgroup_int(r3, &(0x7f00000001c0), 0xfffffdef) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, 0x0) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r4, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x15) setsockopt$netlink_NETLINK_BROADCAST_ERROR(0xffffffffffffffff, 0x10e, 0x4, 0x0, 0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000340), 0xffffffffffffffff) sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, 0x0, 0xc1) 166.053234ms ago: executing program 2 (id=4471): socket(0x2000000015, 0x80005, 0x0) socket(0x40000000015, 0x5, 0x0) r0 = socket(0x15, 0x5, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000a00)=@nat={'nat\x00', 0x1b, 0x5, 0x338, 0x0, 0x190, 0xffffffff, 0x190, 0x190, 0x360, 0x360, 0xffffffff, 0x360, 0x360, 0x5, 0x0, {[{{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x1, @dev={0xac, 0x14, 0x14, 0x72}, @local, @icmp_id=0x65, @gre_key=0xfffe}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x2, @private=0xa010102, @rand_addr=0x64010101, @icmp_id=0x65, @port=0x4e22}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x14, @multicast1, @loopback, @gre_key=0x40, @port=0x4e22}}}}, {{@ip={@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, 0xff, 0xff, 'vxcan1\x00', 'ip6_vti0\x00', {0xff}, {}, 0x21, 0x5, 0x1}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @broadcast, @dev={0xac, 0x14, 0x14, 0x1e}, @gre_key=0x8, @icmp_id=0x64}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x398) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$F2FS_IOC_DECOMPRESS_FILE(r4, 0xf517, 0x0) setsockopt$packet_int(r4, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x48890}, 0x0) recvmmsg(r4, &(0x7f0000000480)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/11, 0x17}}], 0x400000000000179, 0x0, 0x0) write$tun(r2, &(0x7f00000004c0)={@val={0x0, 0x86dd}, @val={0x0, 0x1, 0x9, 0x4, 0x0, 0xca6}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0xff, @local, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0xa888, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x3, 0x5}, 0x1, {0x88a8}}}, {0x8, 0x22eb, 0x20000, {{0x0, 0x2, 0xc, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) 162.531355ms ago: executing program 4 (id=4472): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0a00000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000017c0)={r0, 0x0, 0x0, 0x804a1fd732309e49}, 0x20) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0xf, 0x4, 0x8, 0x7, 0x0, 0xffffffffffffffff, 0x2000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000b0ffffffb702000008000000b703000000000000850000000600000095"], 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000c3a0f8ff5000000095"], &(0x7f0000000040)='GPL\x00', 0x4, 0x92, &(0x7f00000015c0)=""/146}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1500000000"], 0x0}, 0x94) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r2, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000800)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x5}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4040084}, 0x24040000) sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, 0x0, 0x10) r3 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3400000011000100000000000000000007000000", @ANYRES32=r5, @ANYBLOB="000700000000040014001a8010000480"], 0x34}, 0x1, 0x0, 0x0, 0x60}, 0x0) r6 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000040)=0x1c) setsockopt$inet6_buf(r6, 0x29, 0x2e, &(0x7f0000000080)="2d8c5e2b4fc8dcd46df51395a64c2cab9f51ac84494c7d575a6e56a83566d41563f8c555f046286a522cc4f1d6b524933ea57c7cd13bd3717b2af9a9dc47eb19fc8bd4b80b67594f26a41c8056bce4ced634603c092f26c5d5bb29441754705a48fe75d1cb80998417c0fafdbcc14ed5038d1486dc3b707cec97358ac004c7c60399c4576b92faeff232859ec4dffbeba51df930", 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af0ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 157.250512ms ago: executing program 3 (id=4473): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c00000010001fff109e00008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000440012800b00010067656e6576650000340002800500030003000000060005004e20000005000400ab000000050009000100000005000a0001000000050009000100000008000a00", @ANYRES32=r3], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r5 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r5, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) getsockname$packet(r5, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r4, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0xfc, &(0x7f0000000300), 0x0, 0x10, &(0x7f0000000340), &(0x7f0000000380), 0x8, 0xe0, 0x8, 0x8, &(0x7f00000003c0)}}, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r6, {}, {0x0, 0x3}, {0x4, 0x9}}}, 0x24}}, 0x0) 0s ago: executing program 0 (id=4474): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) bind$bt_sco(r1, &(0x7f0000001440)={0x1f, @none}, 0x8) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r2, &(0x7f0000000000), 0x8) listen(r0, 0x0) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f0000000440)={0x0, "bb8b6106da07ba45e03873720c53b0b1"}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001200), 0x8a400, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r4, 0x4004743d, 0x110e22fff6) close(r3) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r4, &(0x7f00000001c0)={0x40000008}) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f0000001480)={'tunl0\x00', {0x2, 0x4e23, @multicast2}}) kernel console output (not intermixed with test programs): etlink: 4 bytes leftover after parsing attributes in process `syz.0.2775'. [ 286.805189][T13123] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2775'. [ 286.818043][ T36] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 286.832636][ T36] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.852953][ T36] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 286.866605][ T36] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 286.973174][T13125] syzkaller1: entered promiscuous mode [ 286.988515][T13125] syzkaller1: entered allmulticast mode [ 287.074561][T13135] netlink: 'syz.0.2780': attribute type 4 has an invalid length. [ 287.088663][T13135] netlink: 'syz.0.2780': attribute type 4 has an invalid length. [ 287.179690][T13139] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2782'. [ 287.356443][T13147] netlink: 'syz.2.2785': attribute type 1 has an invalid length. [ 287.400007][T13153] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2788'. [ 287.413167][T13151] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2787'. [ 287.449754][T13147] 8021q: adding VLAN 0 to HW filter on device bond6 [ 287.505574][T13155] bond6: (slave macvlan0): making interface the new active one [ 287.514578][T13155] bond6: (slave macvlan0): Enslaving as an active interface with an up link [ 287.535236][T13158] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2789'. [ 287.903316][T13174] netlink: 840 bytes leftover after parsing attributes in process `syz.3.2795'. [ 288.073871][T13181] netlink: 'syz.4.2799': attribute type 1 has an invalid length. [ 288.084184][T13181] netlink: 63811 bytes leftover after parsing attributes in process `syz.4.2799'. [ 288.173868][T13183] syzkaller1: entered promiscuous mode [ 288.180744][T13183] syzkaller1: entered allmulticast mode [ 288.314639][T13193] netlink: 'syz.0.2804': attribute type 30 has an invalid length. [ 288.368486][T13196] netlink: 'syz.2.2805': attribute type 1 has an invalid length. [ 288.396807][T13196] bond7: entered promiscuous mode [ 288.399601][T13193] netlink: 'syz.0.2804': attribute type 30 has an invalid length. [ 288.402915][T13196] 8021q: adding VLAN 0 to HW filter on device bond7 [ 288.450273][T13196] bond7: (slave bridge2): making interface the new active one [ 288.458097][T13196] bridge2: entered promiscuous mode [ 288.465830][T13196] bridge2: left promiscuous mode [ 288.587234][T13199] netlink: 'syz.0.2806': attribute type 4 has an invalid length. [ 288.620659][T13199] netlink: 'syz.0.2806': attribute type 4 has an invalid length. [ 289.192261][T13225] netlink: 'syz.3.2817': attribute type 30 has an invalid length. [ 289.255735][ T7648] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 289.453421][ T7648] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 289.469746][ T7648] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 289.508157][ T7648] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 290.814662][T13292] sctp: [Deprecated]: syz.3.2846 (pid 13292) Use of struct sctp_assoc_value in delayed_ack socket option. [ 290.814662][T13292] Use struct sctp_sack_info instead [ 290.855769][T13291] __nla_validate_parse: 9 callbacks suppressed [ 290.855787][T13291] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2845'. [ 291.001971][T13296] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2848'. [ 291.261229][T13307] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2853'. [ 292.114019][T13342] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2865'. [ 293.037178][T13374] validate_nla: 1 callbacks suppressed [ 293.037194][T13374] netlink: 'syz.0.2877': attribute type 13 has an invalid length. [ 293.082515][T13374] gretap0: refused to change device tx_queue_len [ 293.099142][T13374] net_ratelimit: 11 callbacks suppressed [ 293.099156][T13374] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 293.140756][T13380] GUP no longer grows the stack in syz.0.2877 (13380): 200000003000-20000000a000 (200000001000) [ 293.185009][T13380] CPU: 0 UID: 0 PID: 13380 Comm: syz.0.2877 Not tainted syzkaller #0 PREEMPT(full) [ 293.185033][T13380] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 293.185052][T13380] Call Trace: [ 293.185063][T13380] [ 293.185072][T13380] dump_stack_lvl+0xe8/0x150 [ 293.185101][T13380] __get_user_pages+0x2378/0x2730 [ 293.185147][T13380] ? __gup_longterm_locked+0xc4e/0x1630 [ 293.185171][T13380] ? down_read_killable+0x1bb/0x340 [ 293.185202][T13380] __gup_longterm_locked+0xdcf/0x1630 [ 293.185231][T13380] ? lock_acquire+0x106/0x350 [ 293.185271][T13380] gup_fast_fallback+0x1d84/0x20d0 [ 293.185325][T13380] ? __pfx_gup_fast_fallback+0x10/0x10 [ 293.185352][T13380] ? is_valid_gup_args+0x11f/0x200 [ 293.185377][T13380] ? get_user_pages_fast+0x4d/0xb0 [ 293.185403][T13380] __iov_iter_get_pages_alloc+0x370/0xa10 [ 293.185433][T13380] ? __pfx_pipe_clear_nowait+0x10/0x10 [ 293.185465][T13380] iov_iter_get_pages2+0x5e/0xa0 [ 293.185491][T13380] __se_sys_vmsplice+0x7c7/0x1620 [ 293.185529][T13380] ? tomoyo_path_number_perm+0x219/0x630 [ 293.185559][T13380] ? __pfx___se_sys_vmsplice+0x10/0x10 [ 293.185587][T13380] ? do_vfs_ioctl+0x1166/0x1530 [ 293.185609][T13380] ? __lock_acquire+0x6b5/0x2cf0 [ 293.185633][T13380] ? do_raw_spin_lock+0x12b/0x2f0 [ 293.185689][T13380] ? kfree+0x4d/0x640 [ 293.185721][T13380] ? __pfx_kcov_ioctl+0x10/0x10 [ 293.185754][T13380] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.185775][T13380] do_syscall_64+0x174/0x580 [ 293.185795][T13380] ? trace_irq_disable+0x3b/0x140 [ 293.185823][T13380] ? clear_bhb_loop+0x40/0x90 [ 293.185845][T13380] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 293.185870][T13380] RIP: 0033:0x7fdbeed9ce59 [ 293.185896][T13380] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 293.185912][T13380] RSP: 002b:00007fdbefc42028 EFLAGS: 00000246 ORIG_RAX: 0000000000000116 [ 293.185936][T13380] RAX: ffffffffffffffda RBX: 00007fdbef016090 RCX: 00007fdbeed9ce59 [ 293.185949][T13380] RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000006 [ 293.185959][T13380] RBP: 00007fdbeee32d6f R08: 0000000000000000 R09: 0000000000000000 [ 293.185970][T13380] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 293.185981][T13380] R13: 00007fdbef016128 R14: 00007fdbef016090 R15: 00007ffc2d9a45b8 [ 293.186011][T13380] [ 293.237892][T13383] netlink: 'syz.3.2881': attribute type 1 has an invalid length. [ 293.705371][T13383] 8021q: adding VLAN 0 to HW filter on device bond3 [ 293.751824][T13386] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 293.779170][T13386] bond3: (slave batadv1): making interface the new active one [ 293.803632][T13386] bond3: (slave batadv1): Enslaving as an active interface with an up link [ 294.020024][T13408] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2890'. [ 294.045686][T13408] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2890'. [ 294.104156][T13412] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2891'. [ 294.133590][T13412] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2891'. [ 294.316476][T13426] netlink: 'syz.1.2896': attribute type 1 has an invalid length. [ 294.388725][T13426] gretap1: entered allmulticast mode [ 294.398530][T13426] bond6: (slave gretap1): making interface the new active one [ 294.420938][T13426] bond6: (slave gretap1): Enslaving as an active interface with an up link [ 294.460177][T13431] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2897'. [ 294.510329][T13433] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2899'. [ 294.974594][T13454] geneve2: entered promiscuous mode [ 294.990866][ T7648] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.016540][ T7648] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.051824][ T7648] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.082387][ T7648] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 295.560201][T13484] netlink: 'syz.4.2918': attribute type 13 has an invalid length. [ 296.570800][T13483] infiniband syz1: set down [ 296.601331][T13483] infiniband syz1: added bond0 [ 296.633079][T13509] __nla_validate_parse: 3 callbacks suppressed [ 296.633096][T13509] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2927'. [ 296.699278][T13483] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 296.722123][T13483] infiniband syz1: Couldn't open port 1 [ 296.784139][T13483] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 296.788573][T13524] netlink: 'syz.3.2932': attribute type 2 has an invalid length. [ 296.842108][T13483] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 296.863671][T13483] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 296.939167][T13483] RDS/IB: syz1: added [ 296.952249][T13483] smc: adding ib device syz1 with port count 1 [ 296.969860][T13483] smc: ib device syz1 port 1 has no pnetid [ 297.046046][T13530] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2934'. [ 297.418651][T13543] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2939'. [ 297.781935][T13562] syzkaller1: entered promiscuous mode [ 297.801761][T13562] syzkaller1: entered allmulticast mode [ 298.320997][T13572] netlink: 84 bytes leftover after parsing attributes in process `syz.0.2952'. [ 298.561570][T13572] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2952'. [ 298.588574][T13583] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2956'. [ 298.832187][T13587] erspan0: left promiscuous mode [ 298.878627][T13587] 8021q: adding VLAN 0 to HW filter on device team0 [ 298.893294][T13587] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 298.948428][T13587] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 298.956956][T13587] batadv0: mtu less than device minimum [ 298.964423][T13587] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 298.976592][T13587] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 298.988151][T13587] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 298.999696][T13587] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 299.011312][T13587] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 299.022856][T13587] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 299.034391][T13587] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 299.045895][T13587] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 299.057526][T13587] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 299.088579][T13598] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2962'. [ 299.099321][T13587] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 299.134190][T13587] veth1_vlan: left promiscuous mode [ 299.140348][T13587] veth0_vlan: left promiscuous mode [ 299.146667][T13587] veth0_vlan: entered promiscuous mode [ 299.155403][T13587] veth1_vlan: entered promiscuous mode [ 299.164137][T13587] tipc: Resetting bearer [ 299.170620][T13587] tipc: Resetting bearer [ 299.177642][T13587] veth1_macvtap: left promiscuous mode [ 299.184140][T13587] veth0_macvtap: left promiscuous mode [ 299.190874][T13587] veth0_macvtap: entered promiscuous mode [ 299.198308][T13587] veth1_macvtap: entered promiscuous mode [ 299.209656][T13587] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 299.217736][T13587] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 299.226067][T13587] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 299.234323][T13587] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 299.262814][T13587] 8021q: adding VLAN 0 to HW filter on device bond0 [ 299.650825][T13608] syzkaller1: entered promiscuous mode [ 299.659445][T13608] syzkaller1: entered allmulticast mode [ 299.778343][T13613] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2967'. [ 299.843928][T13618] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2969'. [ 299.870720][T13613] 8021q: adding VLAN 0 to HW filter on device bond7 [ 299.894675][T13619] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 300.400520][T13639] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2977'. [ 300.422109][T13641] netlink: 'syz.1.2978': attribute type 1 has an invalid length. [ 301.648116][T13669] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2986'. [ 301.989036][T13685] syzkaller1: entered promiscuous mode [ 301.990602][T13687] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2994'. [ 301.996547][T13685] syzkaller1: entered allmulticast mode [ 302.020067][T13687] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2994'. [ 302.219221][T13696] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2997'. [ 302.269752][T13696] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2997'. [ 302.547213][T13713] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3005'. [ 302.576937][T13713] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3005'. [ 302.847261][T13724] syzkaller1: entered promiscuous mode [ 302.853923][T13724] syzkaller1: entered allmulticast mode [ 303.573147][T13646] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 303.769777][T13751] 8021q: adding VLAN 0 to HW filter on device bond8 [ 303.829943][T13756] bond6 (unregistering): Released all slaves [ 303.979229][T13763] netlink: 'syz.0.3023': attribute type 1 has an invalid length. [ 304.029068][T13764] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3023'. [ 304.114420][T13764] 8021q: adding VLAN 0 to HW filter on device bond7 [ 304.204994][ T7648] net_ratelimit: 50 callbacks suppressed [ 304.205011][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 304.226468][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 304.348100][T13777] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3027'. [ 304.362722][T13779] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3029'. [ 304.402187][T13782] syzkaller0: entered promiscuous mode [ 304.571080][T13788] syzkaller1: entered promiscuous mode [ 304.596324][T13788] syzkaller1: entered allmulticast mode [ 304.775029][ T1108] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 304.789435][ T1108] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 305.364978][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 305.380088][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 305.936210][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 305.950595][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 306.488228][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 306.503405][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 307.080836][T13870] syzkaller1: entered promiscuous mode [ 307.087101][T13870] syzkaller1: entered allmulticast mode [ 307.096648][T13870] af_packet: tpacket_rcv: packet too big, clamped from 64993 to 3944. macoff=96 [ 307.372222][T13876] syz_tun: entered allmulticast mode [ 307.385475][T13876] pimreg: entered allmulticast mode [ 307.394784][T13875] syz_tun: left allmulticast mode [ 307.441425][T13878] __nla_validate_parse: 1 callbacks suppressed [ 307.441436][T13878] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3057'. [ 307.596863][T13790] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 307.606763][T13804] netlink: 220 bytes leftover after parsing attributes in process `syz.4.3035'. [ 307.616441][T13804] NCSI netlink: No device for ifindex 566712438 [ 307.754513][T13887] netlink: 'syz.3.3060': attribute type 1 has an invalid length. [ 307.789172][T13887] 8021q: adding VLAN 0 to HW filter on device bond6 [ 307.844678][T13887] bond6: (slave veth13): Enslaving as an active interface with a down link [ 307.881498][T13890] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3062'. [ 307.895621][T13890] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3062'. [ 307.911052][T13887] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 307.927024][T13887] bond6: (slave batadv2): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 308.744987][T13926] netlink: 'syz.0.3077': attribute type 1 has an invalid length. [ 308.884511][T13926] bond8: (slave veth25): Enslaving as an active interface with a down link [ 308.948709][T13931] bond8: (slave dummy0): making interface the new active one [ 308.988456][T13926] netlink: 'syz.0.3077': attribute type 10 has an invalid length. [ 308.999555][T13931] bond8: (slave dummy0): Enslaving as an active interface with an up link [ 309.021477][T13926] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3077'. [ 309.049364][T13926] dummy0: entered promiscuous mode [ 309.066446][T13926] bond8: (slave dummy0): Releasing active interface [ 309.500437][T13954] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3089'. [ 309.516474][T13954] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3089'. [ 309.625917][ T7648] net_ratelimit: 10 callbacks suppressed [ 309.625934][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 309.646340][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 309.776110][T13970] netlink: 'syz.0.3093': attribute type 4 has an invalid length. [ 309.805348][T13970] netlink: 'syz.0.3093': attribute type 4 has an invalid length. [ 310.215090][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 310.229511][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 310.328009][T13956] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 310.774972][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 310.789369][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 310.909083][T14004] tipc: Started in network mode [ 310.914118][T14004] tipc: Node identity 6acfaf832c96, cluster identity 4711 [ 310.922153][T14004] tipc: Enabled bearer , priority 0 [ 310.976194][T14004] syzkaller0: entered promiscuous mode [ 310.983682][T14004] syzkaller0: entered allmulticast mode [ 310.993721][T14004] tipc: Resetting bearer [ 311.012354][T14003] tipc: Resetting bearer [ 311.336720][ T7650] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 311.351099][ T7650] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 311.915116][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 311.929693][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 312.695120][T14003] tipc: Disabling bearer [ 312.723862][T10627] tipc: Node number set to 1180282755 [ 312.966931][ T1108] nci: nci_rsp_packet: unsupported rsp opcode 0xf00 [ 313.663725][T14085] netlink: 'syz.1.3133': attribute type 1 has an invalid length. [ 313.764488][T14085] 8021q: adding VLAN 0 to HW filter on device bond9 [ 313.779449][T14091] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3132'. [ 313.884637][T14090] 8021q: adding VLAN 0 to HW filter on device bond9 [ 313.917711][T14090] bond9: (slave gre4): The slave device specified does not support setting the MAC address [ 313.941502][T14090] bond9: (slave gre4): Error -95 calling set_mac_address [ 314.006975][T14085] gretap2: entered promiscuous mode [ 314.019116][T14085] bond9: (slave gretap2): making interface the new active one [ 314.059315][T14085] bond9: (slave gretap2): Enslaving as an active interface with an up link [ 314.262916][T14105] netlink: 'syz.3.3138': attribute type 1 has an invalid length. [ 314.296358][T14105] 8021q: adding VLAN 0 to HW filter on device bond7 [ 314.325002][T14105] vlan2: entered allmulticast mode [ 314.330305][T14105] bond7: entered allmulticast mode [ 314.350777][T14105] bond7: (slave geneve3): making interface the new active one [ 314.358534][T14105] geneve3: entered allmulticast mode [ 314.368496][T14105] bond7: (slave geneve3): Enslaving as an active interface with an up link [ 314.396687][T14105] syz.3.3138 (14105) used greatest stack depth: 18912 bytes left [ 314.600445][T14122] bond8: entered allmulticast mode [ 314.637543][T14122] ipip3: entered promiscuous mode [ 314.642628][T14122] ipip3: entered allmulticast mode [ 314.655316][T14122] bond8: (slave ipip3): The slave device specified does not support setting the MAC address [ 314.671805][T14122] bond8: (slave ipip3): Error -95 calling set_mac_address [ 314.863535][T14125] syzkaller1: entered promiscuous mode [ 314.869189][T14125] syzkaller1: entered allmulticast mode [ 315.005069][ T7648] net_ratelimit: 10 callbacks suppressed [ 315.005087][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 315.025685][ T7648] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 315.257808][T14137] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3151'. [ 315.625349][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 315.640020][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 316.122221][T14179] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3165'. [ 316.171998][T14179] 8021q: adding VLAN 0 to HW filter on device bond9 [ 316.194954][ T1108] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 316.209446][ T1108] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 316.223643][T14179] ipvlan2: entered allmulticast mode [ 316.229405][T14179] bond9: entered allmulticast mode [ 316.273739][T14179] bond9: (slave ipip0): refused to change device type [ 316.613180][T14203] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3171'. [ 316.749831][ T1118] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 316.764427][ T1118] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 316.799258][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.034020][T14218] tipc: Enabled bearer , priority 0 [ 317.141283][T14218] syzkaller0: entered promiscuous mode [ 317.147080][T14218] syzkaller0: entered allmulticast mode [ 317.153515][T14218] tipc: Resetting bearer [ 317.162658][T14227] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3179'. [ 317.222538][T14217] tipc: Resetting bearer [ 317.420570][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 317.435452][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 318.568272][T14265] netlink: 'syz.0.3192': attribute type 13 has an invalid length. [ 319.003902][T14275] netlink: 'syz.4.3195': attribute type 11 has an invalid length. [ 319.647559][T14217] tipc: Disabling bearer [ 319.758907][T14286] netlink: 'syz.1.3197': attribute type 4 has an invalid length. [ 319.792590][T14276] 8021q: adding VLAN 0 to HW filter on device bond0 [ 319.800509][T14276] 8021q: adding VLAN 0 to HW filter on device team0 [ 319.811664][T14276] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 319.815726][T14289] netlink: 'syz.1.3197': attribute type 4 has an invalid length. [ 319.863982][T14276] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 319.874398][T14276] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 319.886545][T14276] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 319.896994][T14276] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 319.911687][T14276] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 319.921170][T14276] veth1_vlan: left promiscuous mode [ 319.928459][T14276] veth0_vlan: left promiscuous mode [ 319.934644][T14276] veth0_vlan: entered promiscuous mode [ 319.943720][T14276] veth1_vlan: entered promiscuous mode [ 319.954542][T14276] veth1_macvtap: left promiscuous mode [ 319.961655][T14276] veth0_macvtap: left promiscuous mode [ 319.968258][T14276] veth0_macvtap: entered promiscuous mode [ 319.975355][T14276] veth1_macvtap: entered promiscuous mode [ 319.985944][T14276] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 319.993848][T14276] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 320.002634][T14276] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 320.011247][T14276] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 320.022748][T14276] ip6erspan0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 320.036101][ T141] net_ratelimit: 8 callbacks suppressed [ 320.036116][ T141] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 320.056261][ T141] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 320.080912][T14276] A link change request failed with some changes committed already. Interface vxlan1 may have been left with an inconsistent configuration, please check. [ 320.099979][T14277] mac80211_hwsim hwsim10 wlan0: entered promiscuous mode [ 320.107140][T14277] mac80211_hwsim hwsim10 wlan0: entered allmulticast mode [ 320.309766][T14298] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3201'. [ 320.341580][ T1108] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 320.352277][ T1108] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.363217][ T1108] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 320.374943][ T1108] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.384240][ T1108] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 320.393840][ T1108] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.447074][ T1108] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 320.464431][ T1108] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 320.562234][ T5753] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 320.576246][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 320.590723][ T48] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 321.137238][ T1118] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 321.151964][ T1118] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 321.175047][ T808] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 321.277030][ T57] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 321.341879][T14341] syzkaller1: entered promiscuous mode [ 321.367250][T14341] syzkaller1: entered allmulticast mode [ 321.512471][T14354] netlink: 'syz.2.3225': attribute type 1 has an invalid length. [ 321.701781][T14354] 8021q: adding VLAN 0 to HW filter on device bond8 [ 321.715158][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 321.729640][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 321.761688][T14358] bond8: (slave dummy0): making interface the new active one [ 321.770310][T14358] bond8: (slave dummy0): Enslaving as an active interface with an up link [ 322.265222][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 322.323478][ T141] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 322.332384][ T141] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 322.944663][T14376] netlink: 'syz.1.3234': attribute type 4 has an invalid length. [ 323.356300][ T5753] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 324.492687][T14349] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 325.356354][ T36] net_ratelimit: 11 callbacks suppressed [ 325.356372][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 325.376475][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 325.929796][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 325.944445][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 325.995039][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 326.489364][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 326.504243][ T57] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 326.788383][T14462] bond9: entered allmulticast mode [ 327.055045][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 327.069535][ T36] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 327.222591][T14483] syzkaller1: entered promiscuous mode [ 327.236612][T14483] syzkaller1: entered allmulticast mode [ 327.656225][ T141] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 327.670619][ T141] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 328.553159][T14537] netlink: 'syz.4.3283': attribute type 11 has an invalid length. [ 328.845712][ T5814] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 328.888787][T14544] rdma_rxe: rxe_newlink: failed to add bond0 [ 328.913436][T14544] netlink: 'syz.1.3286': attribute type 13 has an invalid length. [ 329.560151][T14577] netlink: 'syz.1.3299': attribute type 1 has an invalid length. [ 329.598940][T14577] 8021q: adding VLAN 0 to HW filter on device bond10 [ 329.638838][T14577] bond10: (slave veth13): Enslaving as a backup interface with a down link [ 329.663035][T14577] bond10: (slave dummy0): Enslaving as a backup interface with an up link [ 329.677265][T14577] netlink: 'syz.1.3299': attribute type 10 has an invalid length. [ 329.685342][T14577] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3299'. [ 329.694448][T14577] dummy0: entered promiscuous mode [ 329.702871][T14577] bond10: (slave dummy0): Releasing backup interface [ 329.845647][T10627] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 330.188549][T14600] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.195970][T14600] bridge0: port 1(bridge_slave_0) entered disabled state [ 330.627462][T14626] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3312'. [ 330.775322][ T1118] net_ratelimit: 11 callbacks suppressed [ 330.775341][ T1118] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 330.796047][ T1118] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 330.852701][ T1108] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 330.888088][ T1108] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.923520][ T1108] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 330.942584][ T1108] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 330.953508][T14630] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3313'. [ 330.963811][T14630] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3313'. [ 330.982761][ T1108] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 331.005863][ T1108] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.101200][ T1108] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 331.120456][ T1108] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 331.365039][ T1118] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 331.379567][ T1118] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 331.905116][ T141] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 331.919778][ T141] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 332.019178][T14639] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 332.182696][T14661] netlink: 'syz.3.3323': attribute type 4 has an invalid length. [ 332.240493][T14661] netlink: 'syz.3.3323': attribute type 4 has an invalid length. [ 332.455551][ T141] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 33:33:ff:aa:aa:2a [ 332.469970][ T141] batman_adv: batadv0: Local translation table size (92) exceeds maximum packet size (-320); Ignoring new local tt entry: 01:00:5e:00:00:01 [ 332.550470][T14670] tipc: Failed to remove unknown binding: 66,1,1/0:2790321623/2790321625 [ 332.560550][T14670] tipc: Failed to remove unknown binding: 66,1,1/0:2790321623/2790321625 [ 332.571106][T14670] tipc: Failed to remove unknown binding: 66,1,1/0:2790321623/2790321625 [ 332.601478][T14664] bond10: entered promiscuous mode [ 332.619988][T14672] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3328'. [ 332.641826][T14672] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3328'. [ 332.790297][T14676] netlink: set zone limit has 4 unknown bytes [ 332.932452][T14684] netlink: 'syz.3.3333': attribute type 1 has an invalid length. [ 333.052880][T14684] 8021q: adding VLAN 0 to HW filter on device bond11 [ 333.075220][T14691] batman_adv: batadv0: Interface deactivated: dummy0 [ 333.076836][T14697] netlink: 'syz.3.3333': attribute type 10 has an invalid length. [ 333.090063][T14697] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3333'. [ 333.118655][T14691] batman_adv: batadv0: Removing interface: dummy0 [ 333.159447][T14691] bond11: (slave dummy0): Enslaving as a backup interface with an up link [ 333.168843][ T1118] bond11: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 333.170048][T14697] dummy0: entered promiscuous mode [ 333.189157][T14697] bond11: (slave dummy0): Removing an active aggregator [ 333.220310][T14697] bond11: (slave dummy0): Releasing backup interface [ 333.336225][T14708] netlink: 192 bytes leftover after parsing attributes in process `syz.1.3337'. [ 333.435264][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 333.667343][T14720] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3343'. [ 333.711892][T14720] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3343'. [ 334.151534][T14740] syzkaller1: entered promiscuous mode [ 334.159894][T14740] syzkaller1: entered allmulticast mode [ 335.069168][T14776] lo: Caught tx_queue_len zero misconfig [ 336.031568][T14693] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 336.806418][T14843] __nla_validate_parse: 5 callbacks suppressed [ 336.806438][T14843] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3392'. [ 336.825953][T14843] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3392'. [ 336.844199][T14843] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3392'. [ 336.867989][T14843] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3392'. [ 338.031901][T14878] bond11: entered allmulticast mode [ 338.066270][T14878] bond11: entered promiscuous mode [ 338.071877][T14878] macvlan2: entered promiscuous mode [ 338.079340][T14878] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 338.094977][T14883] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 338.173594][T14885] k˙: entered promiscuous mode [ 338.583245][T14893] syzkaller1: entered promiscuous mode [ 338.597436][T14893] syzkaller1: entered allmulticast mode [ 339.938029][T14850] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 340.098239][T14904] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3414'. [ 341.019349][T14928] tipc: Started in network mode [ 341.037493][T14928] tipc: Node identity 3edd32d10256, cluster identity 4711 [ 341.063591][T14928] tipc: Enabled bearer , priority 0 [ 341.181014][T14928] syzkaller0: entered promiscuous mode [ 341.192753][T14928] syzkaller0: entered allmulticast mode [ 341.207328][T14928] tipc: Resetting bearer [ 341.258054][T14927] tipc: Resetting bearer [ 342.013177][T14947] sctp: [Deprecated]: syz.0.3429 (pid 14947) Use of struct sctp_assoc_value in delayed_ack socket option. [ 342.013177][T14947] Use struct sctp_sack_info instead [ 342.931616][ T141] nci: nci_rx_work: unknown MT 0x1 [ 343.348855][T14927] tipc: Disabling bearer [ 343.362637][T10627] tipc: Node number set to 1015755473 [ 343.614514][T14968] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 343.822157][T14993] bond12: entered promiscuous mode [ 343.933464][T15000] geneve3: entered promiscuous mode [ 343.940426][ T7650] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 46368 - 0 [ 343.958734][ T7650] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 46368 - 0 [ 343.975974][ T7650] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 46368 - 0 [ 344.001142][ T7650] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 46368 - 0 [ 344.252494][T15017] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3449'. [ 344.458671][T15023] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3450'. [ 344.500360][T15026] IPv6: sit1: Disabled Multicast RS [ 344.570153][T15023] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3450'. [ 344.663672][T15036] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3456'. [ 344.793837][T15042] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3459'. [ 344.813672][T15042] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3459'. [ 344.911574][T15048] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 344.984374][T15048] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 345.075102][T15048] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 345.290847][T15071] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3466'. [ 345.315603][T15071] syzkaller1: entered promiscuous mode [ 345.321258][T15071] syzkaller1: entered allmulticast mode [ 347.752102][T15110] 8021q: adding VLAN 0 to HW filter on device team0 [ 347.791763][T15110] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 347.899503][T15110] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 347.917188][T15110] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 347.942331][T15110] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 347.970790][T15110] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 348.043282][T15110] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 348.072664][T15110] veth1_vlan: left promiscuous mode [ 348.081069][T15110] veth0_vlan: left promiscuous mode [ 348.092715][T15110] veth0_vlan: entered promiscuous mode [ 348.112979][T15110] veth1_vlan: entered promiscuous mode [ 348.145477][T15110] veth1_macvtap: left promiscuous mode [ 348.153128][T15110] veth0_macvtap: left promiscuous mode [ 348.161276][T15110] veth0_macvtap: entered promiscuous mode [ 348.168307][T15110] veth1_macvtap: entered promiscuous mode [ 348.181706][T15110] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 348.190967][T15110] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 348.209903][T15110] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 348.227469][T15110] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 348.321573][T15110] A link change request failed with some changes committed already. Interface vxlan0 may have been left with an inconsistent configuration, please check. [ 348.447601][ T1128] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.469882][ T1128] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.502257][ T1128] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.705429][ T1128] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.749629][ T1128] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 348.768977][ T808] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 348.780232][ T1128] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 348.796204][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 349.283627][T15192] netlink: 'syz.2.3496': attribute type 1 has an invalid length. [ 349.315997][ T808] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 349.494448][T15194] bond9: Unable to set down delay as MII monitoring is disabled [ 349.515726][ T808] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 349.525179][T15194] bond9 (unregistering): Released all slaves [ 349.669729][T15192] 8021q: adding VLAN 0 to HW filter on device bond9 [ 349.699110][T15199] bond9: (slave ip6gretap1): making interface the new active one [ 349.710050][T15199] bond9: (slave ip6gretap1): Enslaving as an active interface with an up link [ 349.723871][T15213] bond3: entered allmulticast mode [ 349.739212][T15213] ipip1: entered allmulticast mode [ 350.252998][T15238] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3509'. [ 350.869412][T15249] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3512'. [ 351.801106][ T7648] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 351.825275][ T7648] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 352.875038][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 353.063951][T15313] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3536'. [ 353.720845][T15339] netlink: 10184 bytes leftover after parsing attributes in process `syz.2.3544'. [ 353.746406][T15339] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3544'. [ 354.064089][T15343] syz.4.3546 (15343) used greatest stack depth: 17496 bytes left [ 354.197636][T15351] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3549'. [ 354.477864][ T1118] wlan1: Trigger new scan to find an IBSS to join [ 354.534045][T15358] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3552'. [ 355.223109][T15380] syzkaller1: entered promiscuous mode [ 355.240995][T15380] syzkaller1: entered allmulticast mode [ 355.283274][T15386] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3559'. [ 355.454781][T15398] netlink: 'syz.2.3561': attribute type 4 has an invalid length. [ 355.508252][T15393] netlink: 'syz.2.3561': attribute type 4 has an invalid length. [ 355.525518][T15396] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3559'. [ 355.778769][T15409] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3564'. [ 356.026662][T15419] tipc: Started in network mode [ 356.053438][T15419] tipc: Node identity 080211000001, cluster identity 4711 [ 356.078862][T15422] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3567'. [ 356.088274][T15419] tipc: Enabled bearer , priority 0 [ 356.107882][T15423] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 356.120761][T15423] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 356.189405][T15419] tipc: Resetting bearer [ 356.743470][T15463] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3576'. [ 356.930024][T15471] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3579'. [ 356.968204][T15471] 8021q: adding VLAN 0 to HW filter on device bond12 [ 357.184669][ T9] tipc: Node number set to 134418688 [ 357.286972][T15482] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3582'. [ 357.307880][T15482] hsr_slave_0: left promiscuous mode [ 357.314766][T15482] hsr_slave_1: left promiscuous mode [ 357.382466][T15486] netdevsim netdevsim2: loading /lib/firmware/. failed with error -22 [ 357.393287][T15486] netdevsim netdevsim2: Direct firmware load for . failed with error -22 [ 357.414767][T15486] netdevsim netdevsim2: Falling back to sysfs fallback for: . [ 357.515668][ T7650] wlan1: Trigger new scan to find an IBSS to join [ 357.707004][T15489] syzkaller0: entered promiscuous mode [ 357.720054][T15489] syzkaller0: entered allmulticast mode [ 357.940099][ T48] nci: nci_data_exchange_complete: no rx callback, dropping rx data... [ 359.263768][T15502] batman_adv: batadv0: Adding interface: dummy0 [ 359.270423][T15502] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 359.295807][T15502] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 359.311591][T15514] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 359.320063][T15514] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 359.624515][T15519] bond11: left promiscuous mode [ 359.704069][ T7650] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 46368 - 0 [ 359.725240][ T7650] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 46368 - 0 [ 359.744495][ T7650] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 46368 - 0 [ 359.775023][ T7650] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 46368 - 0 [ 359.938071][T15532] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.3600'. [ 360.002632][T15534] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3601'. [ 360.485691][ T57] wlan1: Trigger new scan to find an IBSS to join [ 360.841834][T15504] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 360.958416][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 361.206874][T15588] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3614'. [ 361.358734][T15589] syzkaller0: entered promiscuous mode [ 361.376036][T15589] syzkaller0: entered allmulticast mode [ 361.417267][ T57] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 361.543378][T15595] netlink: 76 bytes leftover after parsing attributes in process `syz.2.3615'. [ 363.519187][T15602] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3617'. [ 363.591280][T15622] xt_hashlimit: size too large, truncated to 1048576 [ 364.827664][T15664] netlink: 'syz.4.3634': attribute type 10 has an invalid length. [ 364.841242][T15664] 8021q: adding VLAN 0 to HW filter on device team0 [ 364.854682][T15664] bond0: (slave team0): Enslaving as an active interface with an up link [ 365.081595][T15672] xt_CT: You must specify a L4 protocol and not use inversions on it [ 365.082631][T15672] netlink: 'syz.0.3638': attribute type 21 has an invalid length. [ 365.172481][T15678] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3640'. [ 365.353531][T15688] syzkaller0: entered promiscuous mode [ 365.361411][T15688] syzkaller0: entered allmulticast mode [ 365.783487][T15711] tipc: Enabling of bearer rejected, already enabled [ 365.793550][T15711] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 365.801480][T15711] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 366.457882][T15737] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3661'. [ 366.738662][T15742] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3663'. [ 366.748997][T15742] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3663'. [ 366.821700][T15746] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3664'. [ 368.239857][T15761] netlink: 'syz.4.3668': attribute type 1 has an invalid length. [ 368.292631][T15761] 8021q: adding VLAN 0 to HW filter on device bond5 [ 368.381798][T15761] vlan2: entered allmulticast mode [ 368.392794][T15761] bond5: entered allmulticast mode [ 368.425198][T15764] bond5: (slave geneve2): making interface the new active one [ 368.432812][T15764] geneve2: entered allmulticast mode [ 368.440155][T15764] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 368.917369][T15790] batman_adv: batadv0: Adding interface: dummy0 [ 368.923757][T15790] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 368.953056][T15790] batman_adv: batadv0: Interface activated: dummy0 [ 368.976042][T15790] batadv0: mtu less than device minimum [ 368.984637][T15790] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 368.996219][T15790] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 369.007786][T15790] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 369.019102][T15790] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 369.030310][T15790] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 369.041808][T15790] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 369.053054][T15790] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 369.064452][T15790] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 369.076042][T15790] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 369.270177][T15805] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3680'. [ 369.629519][T15821] 8021q: adding VLAN 0 to HW filter on device bond11 [ 369.656691][T15821] bond10: (slave bond11): Enslaving as an active interface with an up link [ 369.730068][T15815] bond10: (slave gretap1): Enslaving as an active interface with an up link [ 370.270764][T15859] netlink: 'syz.2.3698': attribute type 4 has an invalid length. [ 370.417507][T15864] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3700'. [ 370.461668][T15869] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3701'. [ 372.011444][T15922] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 372.062014][T15922] ipip1: entered promiscuous mode [ 372.199421][T15925] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3711'. [ 372.448674][T15931] 8021q: adding VLAN 0 to HW filter on device bond11 [ 372.464492][T15931] bond11 (unregistering): Released all slaves [ 373.717831][T15966] sit0: left promiscuous mode [ 373.737624][T15966] syz_tun: left promiscuous mode [ 373.884015][T15966] mac80211_hwsim hwsim10 wlan0: left promiscuous mode [ 373.893950][T15966] mac80211_hwsim hwsim10 wlan0: left allmulticast mode [ 373.907358][T15966] ip6erspan0: left allmulticast mode [ 373.936162][ T808] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 374.065380][ T808] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 374.150840][T15989] xt_CT: You must specify a L4 protocol and not use inversions on it [ 374.171791][T15989] netlink: 'syz.1.3731': attribute type 21 has an invalid length. [ 374.820638][T16005] netlink: 'syz.4.3736': attribute type 3 has an invalid length. [ 374.830672][T16005] netlink: 'syz.4.3736': attribute type 3 has an invalid length. [ 375.001916][T16013] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3739'. [ 375.067074][T16013] bond12: entered promiscuous mode [ 375.072543][T16013] 8021q: adding VLAN 0 to HW filter on device bond12 [ 375.103800][T16013] 8021q: adding VLAN 0 to HW filter on device bond12 [ 375.111505][T16013] bond12: (slave sit5): The slave device specified does not support setting the MAC address [ 375.122724][T16013] bond12: (slave sit5): Error -95 calling set_mac_address [ 376.191262][T16070] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3755'. [ 377.605600][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 378.151276][T16070] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 378.157599][T16074] gretap5: entered allmulticast mode [ 378.239648][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.525232][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 379.674615][T16129] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 379.679815][T16130] netlink: 'syz.0.3766': attribute type 1 has an invalid length. [ 379.701076][T16129] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 379.859380][T16130] 8021q: adding VLAN 0 to HW filter on device bond13 [ 379.892044][T16134] bond13: entered allmulticast mode [ 379.949420][T16135] bond13: (slave ip6gretap1): making interface the new active one [ 379.961004][T16135] ip6gretap1: entered allmulticast mode [ 379.968873][T16135] bond13: (slave ip6gretap1): Enslaving as an active interface with an up link [ 380.453771][T16158] syzkaller0: entered promiscuous mode [ 380.460068][T16158] syzkaller0: entered allmulticast mode [ 380.608136][T16167] netlink: 'syz.3.3777': attribute type 11 has an invalid length. [ 381.108185][T16176] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3781'. [ 382.267976][T16183] ip6gre1: entered promiscuous mode [ 382.273286][T16183] ip6gre1: entered allmulticast mode [ 382.413941][T16192] netlink: 76 bytes leftover after parsing attributes in process `syz.0.3785'. [ 382.491531][T16195] netlink: 'syz.3.3786': attribute type 11 has an invalid length. [ 382.716792][T16201] block nbd1: server does not support multiple connections per device. [ 382.730607][T16205] netlink: 'syz.4.3790': attribute type 1 has an invalid length. [ 382.753047][T16201] block nbd1: shutting down sockets [ 382.828354][T16205] 8021q: adding VLAN 0 to HW filter on device bond6 [ 382.916715][T16210] bond6: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 382.971847][T16210] bond6: entered allmulticast mode [ 383.018809][T16212] bond6: (slave ip6gretap1): Enslaving as an active interface with an up link [ 383.176819][T16228] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3796'. [ 383.453001][T16206] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 383.459184][T16206] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 383.472701][T16206] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 383.478855][T16206] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 383.490626][T16206] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 383.497524][T16206] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 383.510417][T16206] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 383.517035][T16206] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 383.594654][T16206] tipc: Resetting bearer [ 383.840029][T16251] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3803'. [ 383.885740][T16251] RDS: rds_bind could not find a transport for fe80::1a, load rds_tcp or rds_rdma? [ 384.012544][T16257] netlink: 'syz.3.3804': attribute type 14 has an invalid length. [ 384.140307][T16264] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3807'. [ 384.322419][T16272] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3811'. [ 384.456612][T16277] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3814'. [ 384.751701][T16288] netlink: 'syz.0.3819': attribute type 1 has an invalid length. [ 384.840502][T16292] netlink: 200 bytes leftover after parsing attributes in process `syz.1.3821'. [ 384.848620][T16288] 8021q: adding VLAN 0 to HW filter on device bond15 [ 384.878415][T16288] bond14: (slave bond15): making interface the new active one [ 384.904338][T16296] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3819'. [ 384.938971][T16288] bond14: (slave bond15): Enslaving as an active interface with an up link [ 384.981711][T16296] 8021q: adding VLAN 0 to HW filter on device bond14 [ 385.046657][T16303] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3824'. [ 385.077407][T16303] bond7: entered promiscuous mode [ 385.083005][T16303] 8021q: adding VLAN 0 to HW filter on device bond7 [ 385.163170][T16303] bridge5: entered promiscuous mode [ 385.186519][T16303] bond7: (slave bridge5): Enslaving as an active interface with an up link [ 385.245420][T16311] bond7 (unregistering): (slave bridge5): Releasing backup interface [ 385.262915][T16311] bridge5: left promiscuous mode [ 385.270704][T16311] bond7 (unregistering): Released all slaves [ 385.300848][T16319] xt_TCPMSS: Only works on TCP SYN packets [ 385.606238][T16330] syzkaller0: entered promiscuous mode [ 385.612040][T16330] syzkaller0: entered allmulticast mode [ 385.920252][T16351] netlink: 'syz.2.3839': attribute type 10 has an invalid length. [ 385.933203][T16351] team0: Port device veth1_to_hsr added [ 386.020742][T16356] netlink: 'syz.2.3840': attribute type 11 has an invalid length. [ 386.636829][T16380] syzkaller0: entered promiscuous mode [ 386.653955][T16380] syzkaller0: entered allmulticast mode [ 387.394570][T16405] __nla_validate_parse: 4 callbacks suppressed [ 387.394659][T16405] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3851'. [ 387.452559][T16407] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3852'. [ 387.600373][T16414] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3855'. [ 387.677436][T16414] bridge6: port 1(vlan3) entered blocking state [ 387.694265][T16414] bridge6: port 1(vlan3) entered disabled state [ 387.707975][T16414] vlan3: entered allmulticast mode [ 387.722433][T16414] bridge6: entered allmulticast mode [ 387.733532][T16421] IPv6: Can't replace route, no match found [ 387.748926][T16421] IPv6: Can't replace route, no match found [ 387.876225][T16414] vlan3: left allmulticast mode [ 387.890432][T16414] bridge6: left allmulticast mode [ 387.938395][T16429] syzkaller0: entered promiscuous mode [ 387.955283][T16429] syzkaller0: entered allmulticast mode [ 388.186074][T16445] netlink: 'syz.3.3865': attribute type 1 has an invalid length. [ 388.287934][T16428] syzkaller0: entered promiscuous mode [ 388.300178][T16428] syzkaller0: entered allmulticast mode [ 388.311925][T16452] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3865'. [ 388.406479][T16450] bond13: (slave bridge9): making interface the new active one [ 388.415340][T16450] bond13: (slave bridge9): Enslaving as an active interface with an up link [ 390.122203][T16468] mac80211_hwsim hwsim8 syzkaller0: Caught tx_queue_len zero misconfig [ 390.218798][T16480] syzkaller0: entered promiscuous mode [ 390.224426][T16480] syzkaller0: entered allmulticast mode [ 391.765891][T16485] : entered promiscuous mode [ 392.758737][T16542] syzkaller0: entered promiscuous mode [ 392.764504][T16542] syzkaller0: entered allmulticast mode [ 393.026802][T16547] netlink: 'syz.0.3892': attribute type 1 has an invalid length. [ 393.175218][T16547] 8021q: adding VLAN 0 to HW filter on device bond16 [ 393.227168][T16553] bond16: (slave geneve3): making interface the new active one [ 393.238620][T16553] bond16: (slave geneve3): Enslaving as an active interface with an up link [ 393.515187][T16564] syzkaller0: entered promiscuous mode [ 393.534864][T16564] syzkaller0: entered allmulticast mode [ 393.923174][T16581] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3901'. [ 393.963608][T16585] syzkaller0: entered promiscuous mode [ 393.974092][T16585] syzkaller0: entered allmulticast mode [ 394.032417][T16588] netlink: 'syz.3.3903': attribute type 11 has an invalid length. [ 395.099436][T16611] smc: net device wlan0 applied user defined pnetid SYZ0 [ 395.785397][T16627] netlink: 'syz.2.3914': attribute type 10 has an invalid length. [ 395.815155][T16627] bond8: (slave dummy0): Releasing active interface [ 395.846828][T16630] netlink: 'syz.2.3914': attribute type 10 has an invalid length. [ 395.848114][T16627] team0: Port device dummy0 added [ 395.902589][T16630] team0: Port device dummy0 removed [ 395.933914][T16630] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 395.960196][T16629] syzkaller0: entered promiscuous mode [ 395.974893][T16629] syzkaller0: entered allmulticast mode [ 396.158735][T16633] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 396.175566][T16633] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 396.558126][T16644] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3918'. [ 396.751420][T16649] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3921'. [ 396.984469][T16636] netlink: 45 bytes leftover after parsing attributes in process `syz.1.3916'. [ 396.993465][T16656] bond11: entered promiscuous mode [ 397.007173][T16656] bond11: entered allmulticast mode [ 397.353628][T16665] syzkaller1: entered promiscuous mode [ 397.362570][T16663] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 397.377412][T16665] syzkaller1: entered allmulticast mode [ 397.415056][T16663] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 399.042708][T16699] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3935'. [ 399.202874][T16705] lo: Caught tx_queue_len zero misconfig [ 399.213967][T16706] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3940'. [ 399.223963][T16706] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3940'. [ 399.227351][T16705] sch_tbf: burst 19872 is lower than device lo mtu (32783) ! [ 399.409240][T16714] lo: Caught tx_queue_len zero misconfig [ 399.453741][T16714] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3943'. [ 399.619632][T16725] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3945'. [ 399.648598][T16725] netlink: 'syz.0.3945': attribute type 10 has an invalid length. [ 399.689970][T16725] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 399.717848][T16725] team0: Failed to send port change of device netdevsim1 via netlink (err -105) [ 399.748267][T16725] team0: Failed to send options change via netlink (err -105) [ 399.764930][T16725] team0: Port device netdevsim1 added [ 400.216366][T16739] sit0: Caught tx_queue_len zero misconfig [ 400.645281][T16745] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 400.667657][T16745] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 400.847424][T16745] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 400.858004][T16745] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 400.964691][T16745] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 400.989399][T16745] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.009585][T16758] syzkaller0: entered promiscuous mode [ 401.015493][T16758] syzkaller0: entered allmulticast mode [ 401.080632][T16764] syzkaller0: entered promiscuous mode [ 401.088021][T16764] syzkaller0: entered allmulticast mode [ 401.130300][T16745] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 401.154038][T16745] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.308422][T16768] net_ratelimit: 12 callbacks suppressed [ 401.308508][T16768] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 401.389172][T16773] syzkaller0: entered promiscuous mode [ 401.395538][T16773] syzkaller0: entered allmulticast mode [ 401.473140][T16774] tap0: tun_chr_ioctl cmd 2148553947 [ 401.629079][ T48] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 401.644984][ T48] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.697951][ T7650] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 401.709918][ T7650] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.741213][ T7650] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 401.759147][ T7650] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.800261][ T7650] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 401.816066][ T7650] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 402.099481][T16790] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3967'. [ 402.126549][T16787] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3965'. [ 402.139022][T16788] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3967'. [ 402.298141][T16797] lo speed is unknown, defaulting to 1000 [ 402.323094][T16797] lo speed is unknown, defaulting to 1000 [ 402.345290][T16797] lo speed is unknown, defaulting to 1000 [ 402.370836][T16800] syzkaller0: entered promiscuous mode [ 402.392626][T16800] syzkaller0: entered allmulticast mode [ 402.850531][T16797] infiniband syz0: set active [ 402.855441][ T2178] lo speed is unknown, defaulting to 1000 [ 402.863798][T16797] infiniband syz0: added lo [ 402.913964][T16797] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 402.929516][T16797] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 402.947103][T16797] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 403.014279][T16797] RDS/IB: syz0: added [ 403.018417][T16797] smc: adding ib device syz0 with port count 1 [ 403.024701][T16797] smc: ib device syz0 port 1 has no pnetid [ 403.031420][ T5753] lo speed is unknown, defaulting to 1000 [ 403.040186][T16797] lo speed is unknown, defaulting to 1000 [ 403.189662][T16815] syzkaller0: entered promiscuous mode [ 403.209804][T16815] syzkaller0: entered allmulticast mode [ 403.233368][T16815] tipc: Enabled bearer , priority 0 [ 403.254988][T16814] tipc: Resetting bearer [ 403.289299][T16814] tipc: Disabling bearer [ 403.515885][T16797] lo speed is unknown, defaulting to 1000 [ 403.529521][T16823] syzkaller0: entered promiscuous mode [ 403.551599][T16823] syzkaller0: entered allmulticast mode [ 403.946035][T16797] lo speed is unknown, defaulting to 1000 [ 404.376260][T16797] lo speed is unknown, defaulting to 1000 [ 404.579001][T16853] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3990'. [ 404.588255][T16853] netlink: 'syz.3.3990': attribute type 7 has an invalid length. [ 404.596691][T16853] netlink: 'syz.3.3990': attribute type 8 has an invalid length. [ 404.604623][T16853] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3990'. [ 404.627438][T16853] ip6gretap0: entered promiscuous mode [ 404.637811][T16853] syz_tun: entered promiscuous mode [ 404.650557][T16853] erspan0: entered promiscuous mode [ 404.667657][T16853] erspan0: left promiscuous mode [ 404.674294][T16853] ip6gretap0: left promiscuous mode [ 404.681968][T16853] syz_tun: left promiscuous mode [ 404.759205][T16797] lo speed is unknown, defaulting to 1000 [ 405.364994][T16885] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4002'. [ 405.535443][T16892] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4002'. [ 405.926757][T16896] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4006'. [ 405.962229][T16896] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4006'. [ 406.087548][T16898] syzkaller0: entered promiscuous mode [ 406.093146][T16898] syzkaller0: entered allmulticast mode [ 406.229584][T16902] syzkaller0: entered promiscuous mode [ 406.254966][T16902] syzkaller0: entered allmulticast mode [ 406.359343][T16912] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4014'. [ 406.427760][T16917] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4016'. [ 406.459975][T16912] netlink: 'syz.4.4014': attribute type 5 has an invalid length. [ 406.476936][T16912] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4014'. [ 406.543351][T16921] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4018'. [ 406.594529][T16921] netlink: 'syz.1.4018': attribute type 1 has an invalid length. [ 406.665740][T16921] 8021q: adding VLAN 0 to HW filter on device bond13 [ 407.213095][T16948] dummy0: left promiscuous mode [ 407.255709][T16948] A link change request failed with some changes committed already. Interface @ may have been left with an inconsistent configuration, please check. [ 407.283838][T16951] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 407.405842][T16956] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 407.431478][T16956] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 407.930140][T16988] syzkaller0: entered promiscuous mode [ 407.942324][T16988] syzkaller0: entered allmulticast mode [ 407.957085][T16985] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 407.966342][T16985] tipc: Enabled bearer , priority 0 [ 408.094963][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 408.364883][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 408.377063][T16984] tipc: Resetting bearer [ 408.837355][T16984] tipc: Disabling bearer [ 408.853136][T16993] bond2: (slave lo): Releasing backup interface [ 408.862132][T16993] bond2: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 408.875544][T16993] bond0: (slave dummy0): Releasing backup interface [ 408.888829][T16993] bridge_slave_0: left allmulticast mode [ 408.904051][T16993] bridge_slave_0: left promiscuous mode [ 408.916982][T16993] bridge0: port 1(bridge_slave_0) entered disabled state [ 408.944104][T16993] bridge_slave_1: left allmulticast mode [ 408.955915][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 408.976575][T16993] bridge_slave_1: left promiscuous mode [ 408.987360][T16993] bridge0: port 2(bridge_slave_1) entered disabled state [ 409.015771][T16993] vlan2: left promiscuous mode [ 409.032162][T16993] geneve0: left promiscuous mode [ 409.051159][T16993] bond0: (slave bond_slave_0): Releasing backup interface [ 409.073498][T16993] bond0: (slave bond_slave_1): Releasing backup interface [ 409.099992][T16993] team0: Port device team_slave_0 removed [ 409.117180][T16993] team0: Port device team_slave_1 removed [ 409.130937][T16993] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 409.308467][T17012] netlink: 'syz.2.4046': attribute type 13 has an invalid length. [ 409.379292][T17018] mac80211_hwsim hwsim8 syzkaller0: Caught tx_queue_len zero misconfig [ 409.430665][T17016] syzkaller0: entered promiscuous mode [ 409.436579][T17016] syzkaller0: entered allmulticast mode [ 409.864497][T17033] syzkaller0: entered promiscuous mode [ 409.870399][T17033] syzkaller0: entered allmulticast mode [ 410.429417][T17047] 8021q: adding VLAN 0 to HW filter on device bond0 [ 410.447271][T17047] 8021q: adding VLAN 0 to HW filter on device team0 [ 410.495808][T17047] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 410.506482][T17047] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 410.527266][T17047] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 410.543487][T17047] veth1_vlan: left promiscuous mode [ 410.550791][T17047] veth0_vlan: left promiscuous mode [ 410.557897][T17047] veth0_vlan: entered promiscuous mode [ 410.570463][T17047] veth1_vlan: entered promiscuous mode [ 410.582315][T17047] veth1_macvtap: left promiscuous mode [ 410.590025][T17047] veth0_macvtap: left promiscuous mode [ 410.602705][T17047] veth0_macvtap: entered promiscuous mode [ 410.610888][T17047] veth1_macvtap: entered promiscuous mode [ 410.628450][T17047] bridge0: port 3(vlan2) entered blocking state [ 410.634960][T17047] bridge0: port 3(vlan2) entered forwarding state [ 410.653805][T17047] geneve0: entered promiscuous mode [ 410.665864][T17047] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 410.686061][T17047] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 410.704636][T17047] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 410.713137][T17047] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 410.724198][T17047] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 410.732024][T17047] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 410.764007][T17047] xfrm1: left promiscuous mode [ 410.769016][T17047] xfrm1: left allmulticast mode [ 410.776668][T17047] 8021q: adding VLAN 0 to HW filter on device bond1 [ 410.787291][T17047] bridge1: left promiscuous mode [ 410.792427][T17047] bridge1: left allmulticast mode [ 410.799735][T17047] 8021q: adding VLAN 0 to HW filter on device bond2 [ 410.810629][T17047] 8021q: adding VLAN 0 to HW filter on device bond3 [ 410.818286][T17047] gretap2: left allmulticast mode [ 410.828732][T17047] 8021q: adding VLAN 0 to HW filter on device bond4 [ 410.836543][T17047] gretap3: left allmulticast mode [ 410.843593][T17047] gretap4: default qdisc (pfifo_fast) fail, fallback to noqueue [ 410.851696][T17047] gretap4: left promiscuous mode [ 410.859386][T17047] 8021q: adding VLAN 0 to HW filter on device bond5 [ 410.880476][T17047] 8021q: adding VLAN 0 to HW filter on device bond6 [ 410.888148][T17047] bond7: left promiscuous mode [ 410.894026][T17047] 8021q: adding VLAN 0 to HW filter on device bond7 [ 410.906971][T17047] 8021q: adding VLAN 0 to HW filter on device bond8 [ 410.917568][T17047] 8021q: adding VLAN 0 to HW filter on device bond9 [ 410.928653][T17047] 8021q: adding VLAN 0 to HW filter on device bond10 [ 410.936110][T17047] ip6gre1: left promiscuous mode [ 410.941057][T17047] ip6gre1: left allmulticast mode [ 410.947756][T17047] bond11: left promiscuous mode [ 410.952683][T17047] bond11: left allmulticast mode [ 410.958173][T17047] 8021q: adding VLAN 0 to HW filter on device bond11 [ 410.970041][ T1108] bond6: (slave macvlan0): link status definitely down, disabling slave [ 410.979736][ T1108] bond6: now running without any active interface! [ 410.998078][T17052] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 411.137009][T17058] syzkaller0: entered promiscuous mode [ 411.157343][T17058] syzkaller0: entered allmulticast mode [ 411.183558][ T36] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 411.202511][ T36] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.211580][ T36] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 411.221031][ T36] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.277788][ T7648] bond6: (slave macvlan0): link status definitely up, 10000 Mbps full duplex [ 411.299319][ T7648] bond6: (slave macvlan0): making interface the new active one [ 411.318863][ T7648] bond6: active interface up! [ 411.454065][ T36] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 411.496544][ T36] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.580470][ T36] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 411.615252][ T36] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.635761][ T5738] IPVS: starting estimator thread 0... [ 411.682695][T17085] __nla_validate_parse: 6 callbacks suppressed [ 411.682710][T17085] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4066'. [ 411.734977][T17083] IPVS: using max 31 ests per chain, 74400 per kthread [ 411.955601][T17091] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4067'. [ 412.001092][T17094] syzkaller0: entered promiscuous mode [ 412.010059][T17094] syzkaller0: entered allmulticast mode [ 412.502274][T17116] syzkaller0: entered promiscuous mode [ 412.517218][T17116] syzkaller0: entered allmulticast mode [ 412.539639][T17119] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 412.688967][T17132] syzkaller0: entered promiscuous mode [ 412.694634][T17132] syzkaller0: entered allmulticast mode [ 412.785693][T17132] tipc: Enabled bearer , priority 0 [ 412.803166][T17131] tipc: Resetting bearer [ 412.835986][T17138] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 412.860876][T17131] tipc: Disabling bearer [ 413.086449][T17128] lo speed is unknown, defaulting to 1000 [ 413.134556][T17141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4082'. [ 413.161248][T17141] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4082'. [ 413.255248][T17153] syzkaller0: entered promiscuous mode [ 413.281084][T17153] syzkaller0: entered allmulticast mode [ 413.835809][ T5753] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 413.857331][ T2178] lo speed is unknown, defaulting to 1000 [ 414.388437][T17188] netlink: 'syz.3.4094': attribute type 4 has an invalid length. [ 414.467987][ T5753] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 414.979203][T17211] syzkaller0: entered promiscuous mode [ 414.985117][T17211] syzkaller0: entered allmulticast mode [ 414.995152][T17217] netlink: 'syz.1.4101': attribute type 1 has an invalid length. [ 415.065697][T17217] netlink: 'syz.1.4101': attribute type 1 has an invalid length. [ 415.089632][T17221] bond12: entered allmulticast mode [ 415.148869][T17224] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4103'. [ 415.211547][T17226] netlink: 149 bytes leftover after parsing attributes in process `syz.3.4104'. [ 415.293736][T17230] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4106'. [ 415.378167][T17230] bond17: entered promiscuous mode [ 415.383464][T17230] bond17: entered allmulticast mode [ 415.656520][ T2178] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 415.779090][T17252] netlink: 'syz.1.4114': attribute type 1 has an invalid length. [ 415.869218][T17259] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4114'. [ 415.895087][T17254] veth0_virt˙ifi: renamed from syz_tun (while UP) [ 415.904629][T17254] veth0_virt˙ifi: refused to change device tx_queue_len [ 415.912096][T17254] A link change request failed with some changes committed already. Interface veth0_virt˙ifi may have been left with an inconsistent configuration, please check. [ 415.961977][T17259] bond14: entered promiscuous mode [ 415.976600][T17259] bond14: entered allmulticast mode [ 416.056396][T17252] bond14: (slave geneve4): making interface the new active one [ 416.083473][T17252] geneve4: entered promiscuous mode [ 416.094655][T17252] geneve4: entered allmulticast mode [ 416.110534][T17252] bond14: (slave geneve4): Enslaving as an active interface with an up link [ 416.123991][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 416.133760][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 416.143800][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 416.153067][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 416.217403][T17267] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 416.314719][T17270] lo speed is unknown, defaulting to 1000 [ 416.324022][T17270] lo speed is unknown, defaulting to 1000 [ 416.338655][T17270] lo speed is unknown, defaulting to 1000 [ 416.350421][T17270] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 416.367229][T17270] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 416.384741][T17272] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4121'. [ 416.385405][T17270] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 416.409992][T17270] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 416.474258][T17270] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 416.490499][T17277] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4121'. [ 416.556567][ T2178] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 416.574026][T17270] lo speed is unknown, defaulting to 1000 [ 416.596089][T17270] lo speed is unknown, defaulting to 1000 [ 416.616368][T17270] lo speed is unknown, defaulting to 1000 [ 416.633485][T17270] lo speed is unknown, defaulting to 1000 [ 416.657046][T17270] lo speed is unknown, defaulting to 1000 [ 416.783298][T17284] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 416.810486][T17284] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 417.008314][T17293] tipc: Enabling of bearer rejected, already enabled [ 417.198338][T17303] syzkaller0: entered promiscuous mode [ 417.211825][T17303] syzkaller0: entered allmulticast mode [ 417.237706][T17313] syzkaller0: entered promiscuous mode [ 417.250444][T17313] syzkaller0: entered allmulticast mode [ 418.438305][T17355] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4139'. [ 419.740501][T17360] bridge0: port 1(macvlan2) entered blocking state [ 419.771684][T17360] bridge0: port 1(macvlan2) entered disabled state [ 419.799530][T17360] macvlan2: entered allmulticast mode [ 419.822641][T17360] ip6gretap0: entered allmulticast mode [ 419.836511][T17360] macvlan2: entered promiscuous mode [ 419.842269][T17360] vlan2: entered promiscuous mode [ 419.850424][T17360] bridge0: port 1(macvlan2) entered blocking state [ 419.857857][T17360] bridge0: port 1(macvlan2) entered forwarding state [ 419.892245][T17362] syzkaller0: entered promiscuous mode [ 419.919273][T17362] syzkaller0: entered allmulticast mode [ 420.222048][T17372] tipc: Resetting bearer [ 420.400827][T17381] syzkaller0: entered promiscuous mode [ 420.413372][T17381] syzkaller0: entered allmulticast mode [ 420.572826][T17378] syzkaller0: entered promiscuous mode [ 420.587484][T17378] syzkaller0: entered allmulticast mode [ 420.641403][T17404] netlink: 'syz.2.4147': attribute type 1 has an invalid length. [ 420.699886][T17406] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4147'. [ 420.778090][T17380] syzkaller0: entered promiscuous mode [ 420.790989][T17380] syzkaller0: entered allmulticast mode [ 422.626796][T17406] 8021q: adding VLAN 0 to HW filter on device bond12 [ 422.640208][T17408] 8021q: adding VLAN 0 to HW filter on device bond12 [ 422.650602][T17408] bond12: (slave geneve3): making interface the new active one [ 422.659328][T17408] bond12: (slave geneve3): Enslaving as an active interface with an up link [ 422.755821][T17447] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4153'. [ 424.264712][ T36] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 424.295022][ T36] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 424.378005][T17453] tipc: Enabling of bearer rejected, already enabled [ 424.403945][ T36] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 424.445564][ T36] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 424.489942][T17459] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4155'. [ 424.541994][T17462] netlink: 256 bytes leftover after parsing attributes in process `syz.0.4156'. [ 424.561808][T17459] team1: entered promiscuous mode [ 424.564226][T17462] netlink: 72 bytes leftover after parsing attributes in process `syz.0.4156'. [ 424.568959][T17459] team1: entered allmulticast mode [ 424.578254][T17461] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4157'. [ 424.583094][T17459] 8021q: adding VLAN 0 to HW filter on device team1 [ 424.704927][T17466] netlink: 'syz.2.4159': attribute type 10 has an invalid length. [ 424.780525][T17472] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4160'. [ 424.793581][T17474] syzkaller0: entered promiscuous mode [ 424.800663][T17474] syzkaller0: entered allmulticast mode [ 425.239407][T17492] netlink: 'syz.1.4166': attribute type 1 has an invalid length. [ 425.283572][T17492] 8021q: adding VLAN 0 to HW filter on device bond15 [ 425.346049][T17495] bond15: (slave veth19): Enslaving as an active interface with a down link [ 425.411679][T17492] dummy0: left promiscuous mode [ 425.422475][T17492] batman_adv: batadv0: Removing interface: dummy0 [ 425.430928][T17495] netlink: 14 bytes leftover after parsing attributes in process `syz.1.4166'. [ 425.451529][T17492] bond15: (slave dummy0): making interface the new active one [ 425.460711][T17492] dummy0: entered promiscuous mode [ 425.466805][T17492] bond15: (slave dummy0): Enslaving as an active interface with an up link [ 425.488426][T17495] bond15: (slave dummy0): Releasing active interface [ 425.505411][T17495] dummy0 (unregistering): left promiscuous mode [ 425.904031][T17516] netlink: 'syz.1.4174': attribute type 1 has an invalid length. [ 425.958263][T17516] bond16: entered promiscuous mode [ 425.983838][T17516] 8021q: adding VLAN 0 to HW filter on device bond16 [ 426.008181][T17522] netlink: 'syz.0.4175': attribute type 1 has an invalid length. [ 426.059697][T17522] 8021q: adding VLAN 0 to HW filter on device bond18 [ 426.071667][T17525] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4175'. [ 426.107259][T17519] bond16: (slave bridge9): making interface the new active one [ 426.115544][T17519] bridge9: entered promiscuous mode [ 426.122084][T17519] bond16: (slave bridge9): Enslaving as an active interface with an up link [ 426.154255][T17516] bond16: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 426.166929][T17516] bond16: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 426.215872][T17525] bond18: entered promiscuous mode [ 426.247226][T17525] bond18: entered allmulticast mode [ 426.276180][T17522] batman_adv: batadv0: Interface deactivated: dummy0 [ 426.321381][T17522] dummy0: left promiscuous mode [ 426.348431][T17522] batman_adv: batadv0: Removing interface: dummy0 [ 426.391256][T17522] bond18: (slave dummy0): making interface the new active one [ 426.412051][T17522] dummy0: entered promiscuous mode [ 426.422341][T17537] netlink: 'syz.1.4179': attribute type 6 has an invalid length. [ 426.437476][T17522] dummy0: entered allmulticast mode [ 426.447857][T17522] bond18: (slave dummy0): Enslaving as an active interface with an up link [ 426.465100][T17537] netlink: 232 bytes leftover after parsing attributes in process `syz.1.4179'. [ 426.534753][T17542] netlink: 5252 bytes leftover after parsing attributes in process `syz.1.4179'. [ 426.682581][T17547] sctp: [Deprecated]: syz.4.4181 (pid 17547) Use of struct sctp_assoc_value in delayed_ack socket option. [ 426.682581][T17547] Use struct sctp_sack_info instead [ 427.697362][T17563] lo speed is unknown, defaulting to 1000 [ 427.807527][T17582] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 427.821691][T17582] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 427.840241][T17582] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 428.010065][T17582] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.034768][T17582] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.059788][T17582] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 428.082918][T17563] lo speed is unknown, defaulting to 1000 [ 428.171233][T17598] netlink: 'syz.0.4192': attribute type 1 has an invalid length. [ 428.188343][T17582] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.201359][T17582] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.224614][T17582] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 428.348092][T17598] 8021q: adding VLAN 0 to HW filter on device bond19 [ 428.376313][T17601] bond19: (slave macvlan0): making interface the new active one [ 428.388070][T17601] bond19: (slave macvlan0): Enslaving as an active interface with an up link [ 428.489515][T17582] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 428.520716][T17582] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.543940][T17582] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 428.591815][ T5296] veth0_vlan: left promiscuous mode [ 428.693820][ T5296] veth0_vlan: entered promiscuous mode [ 428.962870][ T48] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 428.981899][ T48] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 429.002817][ T48] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 429.135770][ T1118] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.153894][ T1118] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 429.172985][ T1118] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 429.263489][ T7648] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.272390][ T7648] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 429.281344][ T7648] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 429.307770][ T36] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 429.316164][ T36] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 429.324428][ T36] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 429.345965][T17627] tipc: Enabled bearer , priority 0 [ 429.354049][T17627] syzkaller0: entered promiscuous mode [ 429.361765][T17627] syzkaller0: entered allmulticast mode [ 429.407323][T17627] tipc: Resetting bearer [ 429.431350][T17626] tipc: Resetting bearer [ 429.501267][T17634] netlink: 'syz.4.4199': attribute type 1 has an invalid length. [ 429.510472][T17626] tipc: Disabling bearer [ 429.636929][T17634] 8021q: adding VLAN 0 to HW filter on device bond7 [ 429.748816][T17640] bond7: (slave veth15): Enslaving as an active interface with a down link [ 429.838284][T17645] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 429.853712][T17645] bond7: (slave batadv1): making interface the new active one [ 429.867475][T17645] batadv1: entered promiscuous mode [ 429.873281][T17645] bond7: (slave batadv1): Enslaving as an active interface with an up link [ 429.891910][T17648] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4202'. [ 429.981592][T17634] bond7 (unregistering): (slave veth15): Releasing active interface [ 430.055929][T17634] bond7 (unregistering): (slave batadv1): Releasing active interface [ 430.087266][T17634] bond7 (unregistering): Released all slaves [ 430.264608][T17650] syzkaller0: entered promiscuous mode [ 430.295535][T17650] syzkaller0: entered allmulticast mode [ 430.503048][T17686] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4207'. [ 431.177602][T17690] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4208'. [ 432.040312][T17686] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 432.041863][T17688] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 432.144464][T17691] vlan3: entered allmulticast mode [ 432.192583][T17691] bridge3: entered allmulticast mode [ 432.199241][T17692] bridge3: port 1(erspan0) entered blocking state [ 432.206329][T17692] bridge3: port 1(erspan0) entered disabled state [ 432.212928][T17692] erspan0: entered allmulticast mode [ 432.226829][T17692] erspan0: entered promiscuous mode [ 432.244332][T17692] bridge3: port 1(erspan0) entered blocking state [ 432.250944][T17692] bridge3: port 1(erspan0) entered forwarding state [ 432.296102][T17705] netlink: 'syz.0.4219': attribute type 1 has an invalid length. [ 432.371413][T17707] tipc: Resetting bearer [ 432.388944][T17707] tipc: Resetting bearer [ 432.519530][T17705] bond20: entered promiscuous mode [ 432.531431][T17705] 8021q: adding VLAN 0 to HW filter on device bond20 [ 432.576807][T17712] macvtap1: entered allmulticast mode [ 432.638966][T17713] bond20: (slave bridge8): making interface the new active one [ 432.648200][T17713] bridge8: entered promiscuous mode [ 432.657046][T17713] bond20: (slave bridge8): Enslaving as an active interface with an up link [ 432.827615][T17733] syzkaller0: entered promiscuous mode [ 432.843322][T17733] syzkaller0: entered allmulticast mode [ 432.942123][T17739] tipc: Can't bind to reserved service type 2 [ 433.078812][T17745] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4223'. [ 433.111752][T17745] netlink: 'syz.3.4223': attribute type 1 has an invalid length. [ 433.607413][T17759] tipc: Resetting bearer [ 433.609234][ T30] audit: type=1804 audit(1780762920.310:4): pid=17764 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.4229" name="/newroot/853/cgroup.controllers" dev="tmpfs" ino=4390 res=1 errno=0 [ 433.634260][T17759] tipc: Resetting bearer [ 433.695578][ T30] audit: type=1800 audit(1780762920.350:5): pid=17764 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.4229" name="cgroup.controllers" dev="tmpfs" ino=4390 res=0 errno=0 [ 433.751523][T17767] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 433.762673][T17767] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 433.775685][T17767] IPVS: set_ctl: invalid protocol: 92 127.0.0.1:20000 [ 433.971894][T17774] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4233'. [ 434.032969][T17778] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 434.050029][T17778] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 434.082968][T17774] bridge4: port 1(veth17) entered blocking state [ 434.102912][T17774] bridge4: port 1(veth17) entered disabled state [ 434.122814][T17774] veth17: entered allmulticast mode [ 434.136629][T17774] veth17: entered promiscuous mode [ 434.167490][T17779] bridge4: port 2(veth0_to_bond) entered blocking state [ 434.191909][T17779] bridge4: port 2(veth0_to_bond) entered disabled state [ 434.214997][T17779] veth0_to_bond: entered allmulticast mode [ 434.250809][T17779] veth0_to_bond: entered promiscuous mode [ 434.337739][T17782] bridge4: port 3(veth19) entered blocking state [ 434.346330][T17782] bridge4: port 3(veth19) entered disabled state [ 434.352838][T17782] veth19: entered allmulticast mode [ 434.359824][T17782] veth19: entered promiscuous mode [ 434.368308][T17792] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 434.403697][T17792] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 434.480437][ T30] audit: type=1107 audit(1780762921.180:6): pid=17799 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 434.492716][T17801] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4240'. [ 434.492775][T17801] openvswitch: netlink: Unexpected mask (mask=c0, allowed=10048) [ 434.532285][T17795] ip6_vti0: entered promiscuous mode [ 434.572491][T17795] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4238'. [ 434.590028][T17806] syzkaller1: entered promiscuous mode [ 434.596949][T17806] syzkaller1: entered allmulticast mode [ 434.612684][T17794] syzkaller0: entered promiscuous mode [ 434.624171][T17794] syzkaller0: entered allmulticast mode [ 434.773870][T17815] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4246'. [ 434.796579][T17815] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4246'. [ 435.063532][T17830] netlink: 'syz.0.4250': attribute type 1 has an invalid length. [ 435.188825][T17830] bond21: entered promiscuous mode [ 435.215854][T17830] 8021q: adding VLAN 0 to HW filter on device bond21 [ 435.277460][T17833] ipvlan3: entered allmulticast mode [ 435.305594][T17833] bond21: entered allmulticast mode [ 435.388304][T17834] bond21: (slave bridge9): making interface the new active one [ 435.416924][T17834] bridge9: entered promiscuous mode [ 435.426702][T17834] bridge9: entered allmulticast mode [ 435.461704][T17834] bond21: (slave bridge9): Enslaving as an active interface with an up link [ 435.532182][T17843] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 435.563789][T17843] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 435.579473][T17843] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 435.684655][T17843] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 435.719463][T17843] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 435.764923][T17843] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 435.828072][T17850] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4256'. [ 435.905365][T17843] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 435.950807][T17843] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 435.984976][T17843] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 436.058583][T17855] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4258'. [ 436.079389][T17843] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 436.089687][T17843] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 20004 - 0 [ 436.099633][T17843] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 436.288292][T17860] syzkaller0: entered promiscuous mode [ 436.301314][T17860] syzkaller0: entered allmulticast mode [ 436.342301][T17866] syzkaller0: entered promiscuous mode [ 436.355733][T17866] syzkaller0: entered allmulticast mode [ 436.553316][T17874] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4262'. [ 436.659766][T17878] netlink: 'syz.1.4264': attribute type 4 has an invalid length. [ 436.712067][T17881] netlink: 'syz.1.4264': attribute type 4 has an invalid length. [ 436.724660][T17882] netlink: 'syz.3.4265': attribute type 1 has an invalid length. [ 436.874061][T17887] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4265'. [ 438.188228][T17882] workqueue: Failed to create a rescuer kthread for wq "bond14": -EINTR [ 438.519209][T17892] team_slave_1: Caught tx_queue_len zero misconfig [ 438.626107][T17903] netlink: 'syz.1.4270': attribute type 2 has an invalid length. [ 438.669639][ T29] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 438.725894][ T151] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 20004 - 0 [ 438.743548][ T151] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 438.804145][ T151] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 438.829674][ T151] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 438.906342][T17906] tipc: Enabled bearer , priority 0 [ 438.923730][ T151] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 438.944323][ T151] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 438.966768][ T151] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 438.984268][T17910] syzkaller0: entered promiscuous mode [ 438.993230][T17910] syzkaller0: entered allmulticast mode [ 439.053923][T17920] syzkaller0: entered promiscuous mode [ 439.061890][T17920] syzkaller0: entered allmulticast mode [ 439.079539][ T151] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 439.100062][ T151] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 439.124422][ T151] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 439.143729][ T151] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 439.161755][ T151] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 439.179290][ T151] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 439.219629][T17906] tipc: Resetting bearer [ 439.294602][ T1118] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 439.310097][ T1118] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 439.337722][ T1118] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 439.369278][T17905] tipc: Resetting bearer [ 439.442386][T17905] tipc: Disabling bearer [ 439.472721][T17936] netlink: 'syz.1.4274': attribute type 1 has an invalid length. [ 439.548499][T17936] 8021q: adding VLAN 0 to HW filter on device bond17 [ 439.606361][T17943] bond17: (slave veth21): Enslaving as an active interface with a down link [ 439.623639][T17946] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4275'. [ 439.650868][T17936] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 439.660631][T17936] bond17: (slave batadv2): making interface the new active one [ 439.669821][T17936] batadv2: entered promiscuous mode [ 439.680041][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 439.691905][T17936] bond17: (slave batadv2): Enslaving as an active interface with an up link [ 439.755035][ T5753] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 439.793246][T17936] bond17 (unregistering): (slave veth21): Releasing active interface [ 439.836323][T17936] bond17 (unregistering): (slave batadv2): Releasing active interface [ 439.854162][T17936] bond17 (unregistering): Released all slaves [ 441.892218][T17914] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 442.395041][T17985] netlink: 14 bytes leftover after parsing attributes in process `syz.1.4288'. [ 442.712706][T18000] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4295'. [ 442.827352][T18000] veth23: entered allmulticast mode [ 442.870230][T18000] bond17: (slave veth23): Enslaving as an active interface with an up link [ 442.957261][T18018] netlink: 'syz.2.4299': attribute type 1 has an invalid length. [ 442.966872][T18006] bond17 (unregistering): (slave veth23): Releasing backup interface [ 443.010199][T18006] bond17 (unregistering): Released all slaves [ 443.102910][T18022] bond13: entered promiscuous mode [ 443.109648][T18022] bond13: entered allmulticast mode [ 443.116107][T18022] 8021q: adding VLAN 0 to HW filter on device bond13 [ 443.230164][T18025] bridge5: entered promiscuous mode [ 443.276834][T18025] bridge5: entered allmulticast mode [ 443.291665][T18025] bond13: (slave bridge5): Enslaving as a backup interface with an up link [ 443.335202][ T7650] bond13: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 443.439564][T18018] bridge6: entered promiscuous mode [ 443.465316][T18018] bridge6: entered allmulticast mode [ 443.472912][T18018] bond13: (slave bridge6): Enslaving as a backup interface with a down link [ 443.500102][T18030] tipc: Enabled bearer , priority 0 [ 443.507870][ T151] bond13: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 443.532013][T18031] syzkaller0: entered promiscuous mode [ 443.544965][T18031] syzkaller0: entered allmulticast mode [ 443.606424][T18030] tipc: Resetting bearer [ 444.048759][T18029] tipc: Resetting bearer [ 444.075875][T18029] tipc: Disabling bearer [ 444.189609][T18050] syzkaller0: entered promiscuous mode [ 444.202739][T18050] syzkaller0: entered allmulticast mode [ 444.385431][T18062] syzkaller0: entered promiscuous mode [ 444.396310][ T50] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 444.413915][T18062] syzkaller0: entered allmulticast mode [ 444.448472][T18066] netlink: 180 bytes leftover after parsing attributes in process `syz.2.4310'. [ 444.458557][T18062] TC_ACT_REPEAT abuse ? [ 444.662217][T18073] syzkaller0: entered promiscuous mode [ 444.687748][T18073] syzkaller0: entered allmulticast mode [ 444.718872][T18081] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4313'. [ 444.796513][ C1] ip6_tunnel: ip6erspan0 xmit: Local address not yet configured! [ 445.070552][T18100] netlink: 'syz.2.4317': attribute type 1 has an invalid length. [ 445.229172][T18100] 8021q: adding VLAN 0 to HW filter on device bond14 [ 445.342368][T18103] vlan4: entered promiscuous mode [ 445.356899][T18103] bond14: entered promiscuous mode [ 445.372649][T18103] vlan4: entered allmulticast mode [ 445.397736][T18103] bond14: entered allmulticast mode [ 445.463360][T18108] bond14: (slave bridge7): making interface the new active one [ 445.473099][T18108] bridge7: entered promiscuous mode [ 445.478703][T18108] bridge7: entered allmulticast mode [ 445.488615][T18108] bond14: (slave bridge7): Enslaving as an active interface with an up link [ 445.498045][T18109] netlink: 'syz.0.4318': attribute type 14 has an invalid length. [ 445.633312][T18131] netlink: 'syz.2.4323': attribute type 4 has an invalid length. [ 446.439130][T18135] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 446.463731][T18135] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 446.482556][T18148] netlink: 'syz.2.4328': attribute type 1 has an invalid length. [ 446.646101][T18148] 8021q: adding VLAN 0 to HW filter on device bond15 [ 446.751199][T18155] 8021q: adding VLAN 0 to HW filter on device bond15 [ 446.791703][T18155] bond15: (slave gre4): The slave device specified does not support setting the MAC address [ 446.831545][T18155] bond15: (slave gre4): Error -95 calling set_mac_address [ 446.899087][T18150] syzkaller0: entered promiscuous mode [ 446.910792][T18150] syzkaller0: entered allmulticast mode [ 446.967051][T18160] tipc: Enabled bearer , priority 0 [ 447.009724][T18148] macvlan3: entered promiscuous mode [ 447.033641][T18148] macvlan3: entered allmulticast mode [ 447.049289][T18148] bond15: entered promiscuous mode [ 447.064946][T18148] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 447.087783][T18148] bond15: left promiscuous mode [ 447.125209][T18135] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.135733][T18135] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.153475][T18144] tipc: Resetting bearer [ 447.178185][T18144] tipc: Disabling bearer [ 447.222532][T18135] team0: Port device netdevsim1 removed [ 447.241602][T18135] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.265446][T18135] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.431054][T18135] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 447.455781][T18135] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 449.288173][ T151] netdevsim netdevsim0 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 449.300492][ T151] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.342457][ T151] netdevsim netdevsim0 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 449.350791][ T151] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.380231][ T151] netdevsim netdevsim0 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 449.389182][ T151] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.415927][ T151] netdevsim netdevsim0 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 449.424450][ T151] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 449.617134][T18223] syzkaller0: entered promiscuous mode [ 449.622927][T18223] syzkaller0: entered allmulticast mode [ 449.787490][T18232] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4345'. [ 450.023448][T18167] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 450.375973][T18243] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4350'. [ 450.412702][T18251] bond0: (slave syz_tun): Releasing backup interface [ 450.434023][T18251] bond0: (slave team0): Releasing backup interface [ 450.469596][T18251] bond0: (slave bond_slave_0): Releasing backup interface [ 450.486097][T18251] bond0: (slave bond_slave_1): Releasing backup interface [ 450.506054][T18251] team0: Port device team_slave_1 removed [ 450.513782][T18251] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 450.524328][T18251] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 450.537888][T18251] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 450.578777][ T29] lo speed is unknown, defaulting to 1000 [ 450.584663][T18247] tipc: Enabled bearer , priority 0 [ 450.596091][ T29] syz0: Port: 1 Link DOWN [ 450.606211][T18253] syzkaller0: entered promiscuous mode [ 450.613676][T18253] syzkaller0: entered allmulticast mode [ 450.638437][T18252] mac80211_hwsim hwsim8 syzkaller0: left promiscuous mode [ 450.657203][T18252] mac80211_hwsim hwsim8 syzkaller0: left allmulticast mode [ 450.690598][ T5747] lo speed is unknown, defaulting to 1000 [ 450.697988][T18247] tipc: Resetting bearer [ 450.724269][T18246] tipc: Resetting bearer [ 450.762840][T18246] tipc: Disabling bearer [ 450.779674][T18260] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4354'. [ 450.900206][T18268] netlink: 'syz.4.4357': attribute type 1 has an invalid length. [ 450.928602][T18268] 8021q: adding VLAN 0 to HW filter on device bond8 [ 450.964120][T18268] vlan3: entered promiscuous mode [ 450.969520][T18268] bond8: entered promiscuous mode [ 450.974825][T18268] vlan3: entered allmulticast mode [ 450.980227][T18268] bond8: entered allmulticast mode [ 451.080954][T18268] bond8: (slave bridge10): making interface the new active one [ 451.110974][T18268] bridge10: entered promiscuous mode [ 451.128143][T18268] bridge10: entered allmulticast mode [ 451.141647][T18268] bond8: (slave bridge10): Enslaving as an active interface with an up link [ 451.306212][T18284] TC_ACT_REPEAT abuse ? [ 451.490738][T18288] syzkaller0: entered promiscuous mode [ 451.497242][T18288] syzkaller0: entered allmulticast mode [ 451.771942][T18298] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4365'. [ 451.807115][T18300] mac80211_hwsim hwsim8 syzkaller0: entered promiscuous mode [ 451.823760][T18300] mac80211_hwsim hwsim8 syzkaller0: entered allmulticast mode [ 451.861768][T18298] bond14: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 451.917870][T18298] bond14 (unregistering): Released all slaves [ 452.111224][T18303] syzkaller0: entered promiscuous mode [ 452.118406][T18303] syzkaller0: entered allmulticast mode [ 452.853955][T18311] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4370'. [ 454.712448][T18323] tipc: Enabling of bearer rejected, failed to enable media [ 455.508563][T18339] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 455.544251][T18339] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 455.754427][T18339] tipc: Resetting bearer [ 456.077428][ T36] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 456.098371][ T36] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 456.128902][ T36] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 456.154443][ T36] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 456.178774][ T36] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 456.190866][ T36] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 456.214654][ T36] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 456.231280][ T36] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 456.696921][T18367] lo speed is unknown, defaulting to 1000 [ 457.120198][T18367] lo speed is unknown, defaulting to 1000 [ 457.439155][T18410] syzkaller1: entered promiscuous mode [ 457.466451][T18410] syzkaller1: entered allmulticast mode [ 457.538859][T18419] netlink: 'syz.2.4399': attribute type 16 has an invalid length. [ 457.639532][T18422] netlink: 'syz.2.4400': attribute type 1 has an invalid length. [ 457.665266][T18420] syzkaller0: entered promiscuous mode [ 457.681312][T18420] syzkaller0: entered allmulticast mode [ 457.823920][T18422] bond16: entered promiscuous mode [ 457.830345][T18422] 8021q: adding VLAN 0 to HW filter on device bond16 [ 457.886619][T18425] ipvlan2: entered allmulticast mode [ 457.892307][T18425] bond16: entered allmulticast mode [ 457.955363][T18429] ipvlan3: entered allmulticast mode [ 458.001532][T18428] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 458.093241][T18433] netlink: 'syz.4.4402': attribute type 1 has an invalid length. [ 458.101499][T18431] bond16: (slave bridge8): making interface the new active one [ 458.109389][T18431] bridge8: entered promiscuous mode [ 458.115026][T18431] bridge8: entered allmulticast mode [ 458.122846][T18431] bond16: (slave bridge8): Enslaving as an active interface with an up link [ 458.178904][T18433] 8021q: adding VLAN 0 to HW filter on device bond9 [ 458.261972][T18436] bond9: (slave veth17): Enslaving as an active interface with a down link [ 458.343039][T18433] bond9: (slave veth19): Enslaving as an active interface with a down link [ 458.356995][T18449] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4405'. [ 458.371271][T18441] vlan4: entered promiscuous mode [ 458.377746][T18441] hsr0: entered promiscuous mode [ 458.386378][T18450] netlink: 'syz.2.4406': attribute type 83 has an invalid length. [ 458.394610][T18441] vlan4: entered allmulticast mode [ 458.400116][T18441] hsr0: entered allmulticast mode [ 458.406860][T18441] hsr_slave_0: entered allmulticast mode [ 458.412696][T18441] hsr_slave_1: entered allmulticast mode [ 458.434169][T18436] bond9: entered allmulticast mode [ 458.447760][T18449] hsr_slave_0: left promiscuous mode [ 458.458967][T18449] hsr_slave_1: left promiscuous mode [ 458.527789][T18452] syzkaller0: entered promiscuous mode [ 458.533466][T18452] syzkaller0: entered allmulticast mode [ 458.694600][T18455] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4408'. [ 458.802271][T18457] syzkaller0: entered promiscuous mode [ 458.808341][T18457] syzkaller0: entered allmulticast mode [ 459.223035][T18472] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4416'. [ 459.234552][T18468] syzkaller0: entered promiscuous mode [ 459.246974][T18468] syzkaller0: entered allmulticast mode [ 459.260190][T18470] syzkaller0: entered promiscuous mode [ 459.266671][T18470] syzkaller0: entered allmulticast mode [ 459.455857][T18479] netlink: 'syz.0.4418': attribute type 1 has an invalid length. [ 459.570285][T18479] 8021q: adding VLAN 0 to HW filter on device bond22 [ 459.611640][T18489] bond22 (unregistering): Released all slaves [ 459.792584][T18484] veth31: entered allmulticast mode [ 459.886046][T18500] Cannot find set identified by id 65534 to match [ 460.389403][T18512] ip6tnl0: Caught tx_queue_len zero misconfig [ 460.408898][T18513] syzkaller0: entered promiscuous mode [ 460.420299][T18513] syzkaller0: entered allmulticast mode [ 460.431301][ T36] 0: reclassify loop, rule prio 0, protocol 800 [ 460.461309][T18512] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4426'. [ 460.477427][T18512] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4426'. [ 460.511717][T18512] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4426'. [ 460.562306][T18506] netlink: 196 bytes leftover after parsing attributes in process `syz.1.4423'. [ 460.585192][T18518] syzkaller0: entered promiscuous mode [ 460.590803][T18518] syzkaller0: entered allmulticast mode [ 460.773829][T18525] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4431'. [ 460.787418][T18525] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4431'. [ 460.929079][T18532] openvswitch: netlink: push_nsh: missing base or metadata attributes [ 460.950712][T18532] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 461.103530][T18542] syzkaller0: entered promiscuous mode [ 461.109699][T18542] syzkaller0: entered allmulticast mode [ 461.122850][T18542] tipc: Enabled bearer , priority 0 [ 461.134513][T18542] tipc: Resetting bearer [ 461.141753][T18541] tipc: Resetting bearer [ 461.175992][T18541] tipc: Disabling bearer [ 461.209462][T18544] tipc: Enabled bearer , priority 0 [ 461.228292][T18544] syzkaller0: entered promiscuous mode [ 461.233834][T18544] syzkaller0: entered allmulticast mode [ 461.274726][T18544] tipc: Resetting bearer [ 461.292929][T18543] tipc: Resetting bearer [ 461.315466][T18543] tipc: Disabling bearer [ 461.331659][T18546] syzkaller0: entered promiscuous mode [ 461.339002][T18546] syzkaller0: entered allmulticast mode [ 461.347117][T18548] netlink: 'syz.0.4440': attribute type 2 has an invalid length. [ 461.368533][T18548] netlink: 'syz.0.4440': attribute type 2 has an invalid length. [ 461.543036][T18558] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4443'. [ 461.626574][T18558] bond14: ARP target 9.0.0.0 is already present [ 461.647677][T18558] bond14: option arp_ip_target: invalid value (9) [ 461.682595][T18558] bond14 (unregistering): Released all slaves [ 462.037499][T18575] syzkaller0: entered promiscuous mode [ 462.043361][T18575] syzkaller0: entered allmulticast mode [ 462.406684][T18580] tipc: Enabled bearer , priority 0 [ 462.418219][T18580] syzkaller0: entered promiscuous mode [ 462.424727][T18580] syzkaller0: entered allmulticast mode [ 462.480512][T18580] tipc: Resetting bearer [ 462.498823][T18579] tipc: Resetting bearer [ 462.524137][T18579] tipc: Disabling bearer [ 462.543329][T18582] syzkaller0: entered promiscuous mode [ 462.550206][T18582] syzkaller0: entered allmulticast mode [ 462.659511][T18592] syzkaller0: entered promiscuous mode [ 462.665936][T18592] syzkaller0: entered allmulticast mode [ 462.768124][T18596] netlink: 'syz.3.4457': attribute type 17 has an invalid length. [ 462.906927][T18599] tipc: Enabling of bearer rejected, already enabled [ 462.931746][T18599] sch_tbf: burst 255 is lower than device syzkaller0 mtu (313) ! [ 463.040978][T18602] syzkaller0: entered promiscuous mode [ 463.055488][T18604] netlink: 'syz.1.4460': attribute type 10 has an invalid length. [ 463.057326][T18602] syzkaller0: entered allmulticast mode [ 463.108487][T18604] smc: removing net device wlan0 with user defined pnetid SYZ0 [ 463.395032][T18617] netlink: 'syz.1.4463': attribute type 1 has an invalid length. [ 463.493488][T18617] bond17: entered promiscuous mode [ 463.530909][T18617] 8021q: adding VLAN 0 to HW filter on device bond17 [ 463.642232][T18626] macvtap1: entered allmulticast mode [ 463.741203][T18617] macvtap2: entered allmulticast mode [ 463.763083][T18635] netlink: 'syz.0.4467': attribute type 1 has an invalid length. [ 463.800576][T18626] bond17: (slave bridge10): making interface the new active one [ 463.820116][T18626] bridge10: entered promiscuous mode [ 463.844556][T18626] bond17: (slave bridge10): Enslaving as an active interface with an up link [ 463.973905][T18642] xt_CT: You must specify a L4 protocol and not use inversions on it [ 464.016403][T18635] 8021q: adding VLAN 0 to HW filter on device bond22 [ 464.149867][T18638] macvlan2: entered promiscuous mode [ 464.166961][T18638] macvlan2: entered allmulticast mode [ 464.180377][T18638] bond22: entered allmulticast mode [ 464.196696][T18638] bond22: entered promiscuous mode [ 464.208919][T18638] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 464.226941][T18651] netlink: 'syz.3.4473': attribute type 1 has an invalid length. [ 464.248095][T18638] team0: Port device macvlan2 added [ 464.360856][T18658] bond14: (slave geneve4): making interface the new active one [ 464.398816][T18658] bond14: (slave geneve4): Enslaving as an active interface with an up link [ 464.439028][ T7648] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 20000 - 0 [ 464.442302][ C0] ================================================================== [ 464.455389][ C0] BUG: KASAN: use-after-free in qdisc_pkt_len_segs_init+0x7f8/0xa30 [ 464.463541][ C0] Read of size 2 at addr ffff8881914e7134 by task syz.2.4471/18667 [ 464.471472][ C0] [ 464.473844][ C0] CPU: 0 UID: 0 PID: 18667 Comm: syz.2.4471 Not tainted syzkaller #0 PREEMPT(full) [ 464.473886][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 464.473902][ C0] Call Trace: [ 464.473931][ C0] [ 464.473962][ C0] dump_stack_lvl+0xe8/0x150 [ 464.474054][ C0] print_address_description+0x55/0x1e0 [ 464.474075][ C0] ? qdisc_pkt_len_segs_init+0x7f8/0xa30 [ 464.474114][ C0] print_report+0x58/0x70 [ 464.474127][ C0] kasan_report+0x117/0x150 [ 464.474164][ C0] ? qdisc_pkt_len_segs_init+0x7f8/0xa30 [ 464.474187][ C0] qdisc_pkt_len_segs_init+0x7f8/0xa30 [ 464.474211][ C0] __dev_queue_xmit+0x29a/0x3950 [ 464.474234][ C0] ? ebt_do_table+0x2665/0x2830 [ 464.474288][ C0] ? __local_bh_enable_ip+0xd0/0x130 [ 464.474319][ C0] ? ebt_do_table+0x2665/0x2830 [ 464.474337][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 464.474366][ C0] ? br_nf_post_routing+0x219/0xfe0 [ 464.474379][ C0] ? lock_acquire+0x106/0x350 [ 464.474411][ C0] br_dev_queue_push_xmit+0x370/0x4b0 [ 464.474496][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 464.474517][ C0] NF_HOOK+0x360/0x3f0 [ 464.474537][ C0] ? NF_HOOK+0xa2/0x3f0 [ 464.474555][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 464.474575][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 464.474600][ C0] br_forward_finish+0xd3/0x130 [ 464.474618][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 464.474638][ C0] ? __pfx_br_forward_finish+0x10/0x10 [ 464.474658][ C0] NF_HOOK+0x360/0x3f0 [ 464.474678][ C0] ? NF_HOOK+0xa2/0x3f0 [ 464.474696][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 464.474716][ C0] ? __pfx_br_forward_finish+0x10/0x10 [ 464.474737][ C0] ? br_switchdev_frame_uses_tx_fwd_offload+0x14/0x70 [ 464.474777][ C0] ? br_handle_vlan+0x3e7/0x530 [ 464.474824][ C0] __br_forward+0x397/0x540 [ 464.474855][ C0] ? __pfx_br_forward_finish+0x10/0x10 [ 464.474882][ C0] br_handle_frame_finish+0x1521/0x1c80 [ 464.474918][ C0] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 464.474947][ C0] ? net_generic+0x1e/0x240 [ 464.474974][ C0] ? net_generic+0x1e/0x240 [ 464.474998][ C0] ? net_generic+0x1e/0x240 [ 464.475024][ C0] ? br_cfm_status_fill_info+0x211/0xd90 [ 464.475048][ C0] ? br_nf_pre_routing+0xc4e/0x14c0 [ 464.475074][ C0] br_handle_frame+0x80f/0x1510 [ 464.475091][ C0] ? __pfx_br_handle_frame+0x10/0x10 [ 464.475112][ C0] ? sock_def_readable+0xae/0x550 [ 464.475159][ C0] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 464.475180][ C0] ? packet_rcv+0x11e4/0x1730 [ 464.475220][ C0] ? __pfx_br_handle_frame+0x10/0x10 [ 464.475241][ C0] __netif_receive_skb_core+0x98f/0x3170 [ 464.475282][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 464.475299][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 464.475315][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 464.475331][ C0] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 464.475354][ C0] ? unwind_next_frame+0xa6/0x2550 [ 464.475380][ C0] ? lock_acquire+0x106/0x350 [ 464.475405][ C0] __netif_receive_skb_list_core+0x24d/0x810 [ 464.475426][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 464.475444][ C0] ? __pfx___netif_receive_skb_list_core+0x10/0x10 [ 464.475466][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 464.475501][ C0] netif_receive_skb_list_internal+0x995/0xcf0 [ 464.475521][ C0] ? lock_acquire+0x106/0x350 [ 464.475537][ C0] ? netif_receive_skb_list_internal+0x501/0xcf0 [ 464.475558][ C0] ? __pfx_netif_receive_skb_list_internal+0x10/0x10 [ 464.475579][ C0] ? dev_gro_receive+0x1108/0x23c0 [ 464.475613][ C0] ? dev_gro_receive+0x1773/0x23c0 [ 464.475627][ C0] ? dev_gro_receive+0x1108/0x23c0 [ 464.475643][ C0] napi_complete_done+0x299/0x730 [ 464.475665][ C0] ? __pfx_napi_complete_done+0x10/0x10 [ 464.475687][ C0] ? gro_cell_poll+0x16c/0x5d0 [ 464.475731][ C0] gro_cell_poll+0x5a9/0x5d0 [ 464.475748][ C0] ? gro_cell_poll+0x16c/0x5d0 [ 464.475761][ C0] __napi_poll+0xae/0x340 [ 464.475780][ C0] ? skb_defer_free_flush+0x233/0x260 [ 464.475803][ C0] net_rx_action+0x627/0xf70 [ 464.475833][ C0] ? lock_acquire+0x106/0x350 [ 464.475860][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 464.475879][ C0] ? sched_clock+0x3f/0x60 [ 464.475914][ C0] handle_softirqs+0x22a/0x840 [ 464.475930][ C0] ? do_softirq+0x76/0xd0 [ 464.475946][ C0] ? tun_rx_batched+0x185/0x790 [ 464.475984][ C0] do_softirq+0x76/0xd0 [ 464.475997][ C0] [ 464.476021][ C0] [ 464.476046][ C0] __local_bh_enable_ip+0xf8/0x130 [ 464.476060][ C0] ? tun_rx_batched+0x185/0x790 [ 464.476074][ C0] tun_rx_batched+0x617/0x790 [ 464.476091][ C0] ? __pfx_tun_rx_batched+0x10/0x10 [ 464.476104][ C0] ? tun_get_user+0x2787/0x43e0 [ 464.476119][ C0] ? tun_get_user+0x2787/0x43e0 [ 464.476133][ C0] ? tun_get_user+0x2394/0x43e0 [ 464.476147][ C0] ? tun_get_user+0x2394/0x43e0 [ 464.476160][ C0] ? __local_bh_enable_ip+0xd0/0x130 [ 464.476176][ C0] tun_get_user+0x2bbc/0x43e0 [ 464.476191][ C0] ? tun_get_user+0x2787/0x43e0 [ 464.476208][ C0] ? aa_file_perm+0x192/0x15e0 [ 464.476265][ C0] ? aa_file_perm+0x50e/0x15e0 [ 464.476278][ C0] ? __pfx_tun_get_user+0x10/0x10 [ 464.476300][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 464.476365][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 464.476415][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 464.476436][ C0] ? tun_get+0x1c/0x2f0 [ 464.476452][ C0] tun_chr_write_iter+0x113/0x200 [ 464.476467][ C0] vfs_write+0x61d/0xb90 [ 464.476503][ C0] ? __pfx_vfs_write+0x10/0x10 [ 464.476528][ C0] ? __fget_files+0x2a/0x420 [ 464.476549][ C0] ksys_write+0x150/0x270 [ 464.476570][ C0] ? __pfx_ksys_write+0x10/0x10 [ 464.476590][ C0] ? __pfx_kcov_ioctl+0x10/0x10 [ 464.476629][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.476656][ C0] do_syscall_64+0x174/0x580 [ 464.476672][ C0] ? trace_irq_disable+0x3b/0x140 [ 464.476698][ C0] ? clear_bhb_loop+0x40/0x90 [ 464.476714][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 464.476728][ C0] RIP: 0033:0x7f5fb139ce59 [ 464.476742][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 464.476774][ C0] RSP: 002b:00007f5fb218f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 464.476816][ C0] RAX: ffffffffffffffda RBX: 00007f5fb1616180 RCX: 00007f5fb139ce59 [ 464.476827][ C0] RDX: 000000000000007a RSI: 00002000000004c0 RDI: 0000000000000007 [ 464.476836][ C0] RBP: 00007f5fb1432d6f R08: 0000000000000000 R09: 0000000000000000 [ 464.476851][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 464.476859][ C0] R13: 00007f5fb1616218 R14: 00007f5fb1616180 R15: 00007ffef60d5d68 [ 464.476877][ C0] [ 464.476882][ C0] [ 465.127372][ C0] The buggy address belongs to the physical page: [ 465.133807][ C0] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1914e7 [ 465.142655][ C0] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 465.149877][ C0] raw: 057ff00000000000 ffffea00064539c8 ffffea00064539c8 0000000000000000 [ 465.158460][ C0] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 465.167042][ C0] page dumped because: kasan: bad access detected [ 465.173483][ C0] page_owner info is not present (never set?) [ 465.179580][ C0] [ 465.181911][ C0] Memory state around the buggy address: [ 465.187604][ C0] ffff8881914e7000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 465.195671][ C0] ffff8881914e7080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 465.203807][ C0] >ffff8881914e7100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 465.211866][ C0] ^ [ 465.217498][ C0] ffff8881914e7180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 465.225573][ C0] ffff8881914e7200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 465.233655][ C0] ================================================================== [ 465.241880][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 465.249092][ C0] CPU: 0 UID: 0 PID: 18667 Comm: syz.2.4471 Not tainted syzkaller #0 PREEMPT(full) [ 465.258465][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 465.268519][ C0] Call Trace: [ 465.271802][ C0] [ 465.274662][ C0] vpanic+0x56c/0xa60 [ 465.278652][ C0] ? __pfx_vpanic+0x10/0x10 [ 465.283170][ C0] panic+0xc5/0xd0 [ 465.286897][ C0] ? __pfx_panic+0x10/0x10 [ 465.291324][ C0] ? qdisc_pkt_len_segs_init+0x7f8/0xa30 [ 465.296979][ C0] ? qdisc_pkt_len_segs_init+0x7f8/0xa30 [ 465.302619][ C0] check_panic_on_warn+0x89/0xb0 [ 465.307592][ C0] ? qdisc_pkt_len_segs_init+0x7f8/0xa30 [ 465.313226][ C0] end_report+0x73/0x170 [ 465.317472][ C0] ? qdisc_pkt_len_segs_init+0x7f8/0xa30 [ 465.323110][ C0] kasan_report+0x128/0x150 [ 465.327615][ C0] ? qdisc_pkt_len_segs_init+0x7f8/0xa30 [ 465.333280][ C0] qdisc_pkt_len_segs_init+0x7f8/0xa30 [ 465.338752][ C0] __dev_queue_xmit+0x29a/0x3950 [ 465.343707][ C0] ? ebt_do_table+0x2665/0x2830 [ 465.348602][ C0] ? __local_bh_enable_ip+0xd0/0x130 [ 465.353896][ C0] ? ebt_do_table+0x2665/0x2830 [ 465.358777][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 465.364163][ C0] ? br_nf_post_routing+0x219/0xfe0 [ 465.369374][ C0] ? lock_acquire+0x106/0x350 [ 465.374062][ C0] br_dev_queue_push_xmit+0x370/0x4b0 [ 465.379446][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 465.385377][ C0] NF_HOOK+0x360/0x3f0 [ 465.389479][ C0] ? NF_HOOK+0xa2/0x3f0 [ 465.393646][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 465.398256][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 465.404172][ C0] br_forward_finish+0xd3/0x130 [ 465.409033][ C0] ? __pfx_br_dev_queue_push_xmit+0x10/0x10 [ 465.414961][ C0] ? __pfx_br_forward_finish+0x10/0x10 [ 465.420427][ C0] NF_HOOK+0x360/0x3f0 [ 465.424502][ C0] ? NF_HOOK+0xa2/0x3f0 [ 465.428696][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 465.433296][ C0] ? __pfx_br_forward_finish+0x10/0x10 [ 465.438760][ C0] ? br_switchdev_frame_uses_tx_fwd_offload+0x14/0x70 [ 465.445543][ C0] ? br_handle_vlan+0x3e7/0x530 [ 465.450424][ C0] __br_forward+0x397/0x540 [ 465.454937][ C0] ? __pfx_br_forward_finish+0x10/0x10 [ 465.460421][ C0] br_handle_frame_finish+0x1521/0x1c80 [ 465.465984][ C0] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 465.471896][ C0] ? net_generic+0x1e/0x240 [ 465.476408][ C0] ? net_generic+0x1e/0x240 [ 465.480917][ C0] ? net_generic+0x1e/0x240 [ 465.485433][ C0] ? br_cfm_status_fill_info+0x211/0xd90 [ 465.491074][ C0] ? br_nf_pre_routing+0xc4e/0x14c0 [ 465.496285][ C0] br_handle_frame+0x80f/0x1510 [ 465.501142][ C0] ? __pfx_br_handle_frame+0x10/0x10 [ 465.506434][ C0] ? sock_def_readable+0xae/0x550 [ 465.511469][ C0] ? __pfx_br_handle_frame_finish+0x10/0x10 [ 465.517367][ C0] ? packet_rcv+0x11e4/0x1730 [ 465.522055][ C0] ? __pfx_br_handle_frame+0x10/0x10 [ 465.527352][ C0] __netif_receive_skb_core+0x98f/0x3170 [ 465.533004][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 465.537979][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 465.542948][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 465.547890][ C0] ? __pfx___netif_receive_skb_core+0x10/0x10 [ 465.553987][ C0] ? unwind_next_frame+0xa6/0x2550 [ 465.559109][ C0] ? lock_acquire+0x106/0x350 [ 465.563827][ C0] __netif_receive_skb_list_core+0x24d/0x810 [ 465.569820][ C0] ? __lock_acquire+0x6b5/0x2cf0 [ 465.574766][ C0] ? __pfx___netif_receive_skb_list_core+0x10/0x10 [ 465.581290][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 465.587457][ C0] netif_receive_skb_list_internal+0x995/0xcf0 [ 465.593636][ C0] ? lock_acquire+0x106/0x350 [ 465.599018][ C0] ? netif_receive_skb_list_internal+0x501/0xcf0 [ 465.605357][ C0] ? __pfx_netif_receive_skb_list_internal+0x10/0x10 [ 465.612045][ C0] ? dev_gro_receive+0x1108/0x23c0 [ 465.617176][ C0] ? dev_gro_receive+0x1773/0x23c0 [ 465.622316][ C0] ? dev_gro_receive+0x1108/0x23c0 [ 465.627435][ C0] napi_complete_done+0x299/0x730 [ 465.632479][ C0] ? __pfx_napi_complete_done+0x10/0x10 [ 465.638042][ C0] ? gro_cell_poll+0x16c/0x5d0 [ 465.642814][ C0] gro_cell_poll+0x5a9/0x5d0 [ 465.647407][ C0] ? gro_cell_poll+0x16c/0x5d0 [ 465.652178][ C0] __napi_poll+0xae/0x340 [ 465.656519][ C0] ? skb_defer_free_flush+0x233/0x260 [ 465.661901][ C0] net_rx_action+0x627/0xf70 [ 465.666492][ C0] ? lock_acquire+0x106/0x350 [ 465.671180][ C0] ? __pfx_net_rx_action+0x10/0x10 [ 465.676306][ C0] ? sched_clock+0x3f/0x60 [ 465.680742][ C0] handle_softirqs+0x22a/0x840 [ 465.685523][ C0] ? do_softirq+0x76/0xd0 [ 465.689883][ C0] ? tun_rx_batched+0x185/0x790 [ 465.694745][ C0] do_softirq+0x76/0xd0 [ 465.698911][ C0] [ 465.701854][ C0] [ 465.704796][ C0] __local_bh_enable_ip+0xf8/0x130 [ 465.709948][ C0] ? tun_rx_batched+0x185/0x790 [ 465.714822][ C0] tun_rx_batched+0x617/0x790 [ 465.719513][ C0] ? __pfx_tun_rx_batched+0x10/0x10 [ 465.724720][ C0] ? tun_get_user+0x2787/0x43e0 [ 465.729576][ C0] ? tun_get_user+0x2787/0x43e0 [ 465.734434][ C0] ? tun_get_user+0x2394/0x43e0 [ 465.739293][ C0] ? tun_get_user+0x2394/0x43e0 [ 465.744145][ C0] ? __local_bh_enable_ip+0xd0/0x130 [ 465.749454][ C0] tun_get_user+0x2bbc/0x43e0 [ 465.754150][ C0] ? tun_get_user+0x2787/0x43e0 [ 465.759025][ C0] ? aa_file_perm+0x192/0x15e0 [ 465.763814][ C0] ? aa_file_perm+0x50e/0x15e0 [ 465.768587][ C0] ? __pfx_tun_get_user+0x10/0x10 [ 465.773621][ C0] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 465.779434][ C0] ? lockdep_hardirqs_on+0x7a/0x110 [ 465.784664][ C0] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 465.790531][ C0] ? tun_get+0x1c/0x2f0 [ 465.794695][ C0] tun_chr_write_iter+0x113/0x200 [ 465.799729][ C0] vfs_write+0x61d/0xb90 [ 465.803998][ C0] ? __pfx_vfs_write+0x10/0x10 [ 465.808778][ C0] ? __fget_files+0x2a/0x420 [ 465.813379][ C0] ksys_write+0x150/0x270 [ 465.817737][ C0] ? __pfx_ksys_write+0x10/0x10 [ 465.822617][ C0] ? __pfx_kcov_ioctl+0x10/0x10 [ 465.827494][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.833569][ C0] do_syscall_64+0x174/0x580 [ 465.838168][ C0] ? trace_irq_disable+0x3b/0x140 [ 465.843244][ C0] ? clear_bhb_loop+0x40/0x90 [ 465.847924][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.853824][ C0] RIP: 0033:0x7f5fb139ce59 [ 465.858257][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 465.877871][ C0] RSP: 002b:00007f5fb218f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 465.886286][ C0] RAX: ffffffffffffffda RBX: 00007f5fb1616180 RCX: 00007f5fb139ce59 [ 465.894263][ C0] RDX: 000000000000007a RSI: 00002000000004c0 RDI: 0000000000000007 [ 465.902278][ C0] RBP: 00007f5fb1432d6f R08: 0000000000000000 R09: 0000000000000000 [ 465.910251][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 465.918222][ C0] R13: 00007f5fb1616218 R14: 00007f5fb1616180 R15: 00007ffef60d5d68 [ 465.926207][ C0] [ 465.929843][ C0] Kernel Offset: disabled [ 465.934176][ C0] Rebooting in 86400 seconds..