last executing test programs: 2.221091873s ago: executing program 2 (id=8173): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_ABORT_SCAN(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r1, 0x200, 0x70bd2d, 0x25dfdbfd, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x50}, 0x4) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r2, 0x400, 0x70bd2a, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x4}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x15}, 0x400) r3 = socket$inet6(0xa, 0x800, 0x2) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000300)={'ip_vti0\x00', &(0x7f0000000280)={'syztnl2\x00', 0x0, 0x8000, 0x1, 0x7fffffff, 0x6, {{0x14, 0x4, 0x1, 0x7, 0x50, 0x68, 0x0, 0x14, 0x2f, 0x0, @rand_addr=0x64010101, @broadcast, {[@noop, @rr={0x7, 0x1f, 0xf0, [@remote, @multicast2, @broadcast, @loopback, @remote, @remote, @loopback]}, @timestamp={0x44, 0x14, 0x30, 0x0, 0x6, [0x405, 0x8, 0x2, 0x73a6]}, @lsrr={0x83, 0x7, 0xf4, [@rand_addr=0x64010101]}]}}}}}) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000340)=0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000380)={{{@in=@broadcast, @in6=@empty, 0x4e22, 0x80, 0x4e20, 0x6, 0xa, 0xa0, 0x80, 0x11, r4, r5}, {0xffffffffffffffff, 0x0, 0x6, 0x3f84, 0x2, 0x5, 0x6, 0x1}, {0x3, 0x57, 0x3, 0x3ff}, 0x800, 0x0, 0x2, 0x1, 0x1, 0x3}, {{@in=@local, 0x4d2, 0x6c}, 0x2, @in=@empty, 0x3502, 0x4, 0x2, 0x2, 0xc4f, 0xba, 0x5}}, 0xe8) r6 = socket$inet6(0xa, 0x1, 0x5) connect$inet6(r6, &(0x7f0000000480)={0xa, 0x4e24, 0x6, @ipv4={'\x00', '\xff\xff', @multicast1}, 0x2}, 0x1c) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000004c0)={{{@in6=@ipv4={""/10, ""/2, @multicast2}, @in=@remote}}, {{@in6=@loopback}, 0x0, @in6}}, &(0x7f00000005c0)=0xe8) r7 = socket$igmp(0x2, 0x3, 0x2) ioctl$SIOCGETSGCNT_IN6(r7, 0x89e1, &(0x7f0000000600)={@local, @private2}) ioctl$sock_SIOCGIFCONF(r7, 0x8912, &(0x7f0000000680)=@req={0x28, &(0x7f0000000640)={'\x00', @ifru_ivalue=0x1000}}) getsockopt$IP_VS_SO_GET_SERVICES(r3, 0x0, 0x482, &(0x7f00000006c0)=""/122, &(0x7f0000000740)=0x7a) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r7, 0x8983, &(0x7f0000000780)={0x2, 'veth1_to_bond\x00', {0x5}, 0xfc}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x44, r2, 0x800, 0x70bd25, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x2, 0x1}}}}, [@NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_DURATION={0x8, 0x57, 0xbca}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_OFFCHANNEL_TX_OK={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x20040004}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000940)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_BEACONS(r0, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x30, r2, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@val={0x8, 0x1, 0x4f}, @val={0x8, 0x3, r8}, @val={0xc, 0x99, {0x7, 0x75}}}}, ["", "", "", "", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x404c000}, 0x4000) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000a40)={0x28, 0x0, 0xdbb7224cd47600db, @host}, 0x10) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x23, &(0x7f0000000c00)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, &(0x7f0000000a80)=""/212, 0xd4, 0x1, &(0x7f0000000b80)=""/89, 0x59}, &(0x7f0000000c40)=0x40) setsockopt$inet6_tcp_TCP_QUEUE_SEQ(r6, 0x6, 0x15, &(0x7f0000000c80)=0x2, 0x4) getsockopt$IP_VS_SO_GET_SERVICES(r7, 0x0, 0x482, &(0x7f0000000cc0)=""/176, &(0x7f0000000d80)=0xb0) sendmsg$NL80211_CMD_DEL_NAN_FUNCTION(r0, &(0x7f0000000ec0)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000e80)={&(0x7f0000000e00)={0x44, r1, 0x400, 0x70bd2a, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_COOKIE={0xc, 0x58, 0x5}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x71}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0x6e}, @NL80211_ATTR_COOKIE={0xc, 0x58, 0xf}]}, 0x44}, 0x1, 0x0, 0x0, 0xd0}, 0x1000) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000f40), r0) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r0, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f80)={0x28, r9, 0x100, 0x70bd26, 0x25dfdbfc, {{}, {}, {0xc, 0x14, 'syz0\x00'}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) syz_80211_inject_frame(&(0x7f0000001040)=@broadcast, &(0x7f0000001080)=@mgmt_frame=@auth={{{0x0, 0x0, 0xb, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1}, {0x160d}, @device_b, @device_a, @initial, {0xe, 0x80}, @value=@ver_80211n={0x0, 0x0, 0x1, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}}, 0x0, 0x4, 0x61, @void, [{0xdd, 0x59, "0a04116cc3b2872cfbbfc8cc5da0828d45bad3d4a8b6edea41d4acac5d385ce332cfc09375cede3cc41ed917b922767438bea28ff0c3b908dd29d1b2484a3514c36bec5a5a5c5e00cf1292f96ba8bb8eff3b27973f6aaddb05"}]}, 0x7d) sendmsg$IEEE802154_LLSEC_DEL_DEV(0xffffffffffffffff, &(0x7f0000001240)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000001200)={&(0x7f00000011c0)={0x1c, 0x0, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x8010) 1.971594688s ago: executing program 0 (id=8178): r0 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x1, 0x803, 0x0) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="5400000010148864e31f8c1d0486c55ea95200010400"/33, @ANYRES32=0x0, @ANYBLOB="0003000000200200240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r4, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r4, @ANYBLOB], 0x54}}, 0x0) socket(0x10, 0x803, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r0) (async) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r1, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x1, 0x803, 0x0) (async) getsockname$packet(r3, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) (async) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="5400000010148864e31f8c1d0486c55ea95200010400"/33, @ANYRES32=0x0, @ANYBLOB="0003000000200200240012800c0001006d6163766c616e00140002800800010008000000060002000100000008000500", @ANYRES32=r4, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r4, @ANYBLOB], 0x54}}, 0x0) (async) 1.853938525s ago: executing program 1 (id=8180): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_buf(r0, 0x29, 0x2a, &(0x7f0000000040)="51e452bbb83aa410b80b4e5c2b0efb318e1675d157f4dbb09cf578c5d695d4c19669d6f75f4dd7fae5ca772264762e2caa7397be8dae54494bcb85b118ce878d2945924a24a25cf9c6672e7904f0301ffa0f360f9526057e1225a4d032ad0cc690cd327c226b57d5a0243bda5f379f6054b1851c1fa2cbad88d3f0039dddd6b426560bc03965da43", 0x88) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f0000000140)="6bc26076ce62735a01185e13afe83ba6aecfec071aea8dd0242ecb48aa39eec56cbb058abe11624f055b46157b9711f7586d933149c2614e32cb500cea10dd1bfe63f664a00b4fc5cb4c9aa620c6302ebd77819c42d80ade3b8d632eba92bffc978b007dde4ce776c7e299b0cd2915647d53c897b897edf1119d7d4ecd7a597e9956547d95ce4e6d8143c85f18ca735287584326cf87e57111f07320bf22bc2ba943fe8129fbafec027d126c7de7711e7db45f2862c41fc5fa714532f56f6f48145457fa905ce11d07ea7c96b7495c2f52f1a43c32d5cc175977d23680b91c1d143314a6d685f6de17c77ef793cc4a0e5ef7fd6dbb35349312937f701343cb28") r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) close(r2) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r3, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r4, 0x400, 0x70bd28, 0x25dfdbfb, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000010}, 0x2000c800) getsockopt(r2, 0x38, 0x4c3fe322, 0x0, &(0x7f0000000000)) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000005000100070000000900020073797a30000000001400078008001240000000000500150004000000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) 1.689226311s ago: executing program 0 (id=8182): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_icmp(0x2, 0x2, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001800010000000000000200001d01080008000a00", @ANYRES32=r1, @ANYBLOB='\b\x00\t\x00', @ANYRES32=r2], 0x24}}, 0x0) 1.678491348s ago: executing program 1 (id=8183): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b405000000000000611087000000000063013800000000009500098300000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet(0x2, 0x3, 0x3) sendmsg$inet(r1, &(0x7f00000005c0)={&(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000080)='\b\x00', 0x2}, {&(0x7f0000000180)="96bc1480bb35", 0x6}], 0x2, &(0x7f0000000240)=[@ip_pktinfo={{0x20, 0x0, 0x8, {0x0, @local, @broadcast}}}], 0x20}, 0x20048894) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001740)='memory.events\x00', 0x275a, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00'}) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="22000000040000001000000012"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000080)={{r3}, &(0x7f0000000000), &(0x7f0000000040)='%pi6 \x00'}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x64}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x80) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername(r4, 0x0, &(0x7f0000000100)) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_RECVRCVINFO(r5, 0x84, 0x20, &(0x7f00000000c0)=0xffff, 0x4) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000340)=""/124, 0x7c}], 0x1, 0xfffffffd, 0x4) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={0x3c, 0x0, 0x8, 0x201, 0x0, 0x0, {0x3, 0x0, 0x5}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @icmpv6=[@CTA_TIMEOUT_ICMPV6_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x7fff}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x88be}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x54}, 0xc044) 1.641367233s ago: executing program 3 (id=8184): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0xa, 0xa, 0x401, 0x0, 0x0, {0x7}}, 0x14}}, 0x0) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f00000001c0)={0x1, [0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000480)={r2, 0x4}, &(0x7f0000000700)=0x8) 1.48883713s ago: executing program 1 (id=8185): r0 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f00000001c0)={r0, &(0x7f0000000000)='cgroup\x00', 0xf0101, &(0x7f0000000080)={@align, {0xc0, 0x2, 0x8, 0x10000}}, 0x3, &(0x7f0000000140)={@_ha_fsid}, &(0x7f0000000180)=0x6}) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000240)={'syz_tun\x00', @remote}) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) ppoll(&(0x7f0000000100)=[{r2, 0x2}, {r2, 0xa063}], 0x2, 0x0, 0x0, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x9, 0x1}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001300)=@newtfilter={0x68, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {}, {0x1, 0xfff1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x38, 0x2, [@TCA_CGROUP_EMATCHES={0x34, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x28, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0x24, 0x1, 0x0, 0x0, {{0x3, 0x9, 0x80}, [@TCA_EM_IPT_HOOK={0x8, 0x1, 0x3}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_MATCH_DATA={0x4}]}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}]}]}}]}, 0x68}}, 0x1) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r5, &(0x7f00000000c0)="f461830000000000", 0xfffffffffffffdc4, 0x4094, &(0x7f0000000100)={0x2, 0x0, @empty}, 0x10) 1.485991871s ago: executing program 3 (id=8186): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000380)={'syz_tun\x00', &(0x7f0000000280)=@ethtool_drvinfo={0x3, "7d506230c4cb9adeab3b5d1a4bee9722a62781011188926cdca05bcd907fce65", "80384175480438184935cb1e013c5fef9edfd55b65a27c61bbdf7d9af93f2bb8", "dba53a062dfc662d78f121f881afbdc2134f52b8e0415761323e9a7a95dcf815", "eaa3c1c78b83ad9414487c0c2303c0a8bbe6adfba6b05e120732b720a17afd44", "dc953a40a4f4bf675cf55b51380f96a7f6226a341dde4acbcb2ff3bfc6b0e563", "7107d524d6f3be3ae200e8c9", 0x4, 0x3ff, 0x8, 0xfffffff7, 0x80}}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000010000000000000006000000180900002020642500000000002320207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000008000000850000000600000069a0fcff0000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e16}, 0x94) (async) sendmsg$TIPC_CMD_SET_LINK_WINDOW(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x68, r2, 0x1, 0x270bd2b, 0x25dfdbfe, {{}, {}, {0x4c, 0x18, {0x4, @link='broadcast-link\x00'}}}}, 0x68}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 1.484889545s ago: executing program 4 (id=8187): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000180)={0x80000220}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001a00010000000000000000001c000000000000000000000014", @ANYRES8=0x0, @ANYRES32=r0], 0x30}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8924, &(0x7f00000000c0)={'wlan0\x00', 0x1}) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000080)={r1, 0x6, 0x4a, 0x40}) 1.468909747s ago: executing program 0 (id=8188): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000030000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000180)={{r0}, &(0x7f0000000100), &(0x7f0000000140)='%pB \x00'}, 0x20) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r0, 0xffffffffffffffff}, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r2) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x28, r3, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_DOI={0x8}]}, 0x28}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000003580)=ANY=[@ANYBLOB="5400000010000108fdffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="000000002000000008001b00000000002c001a80080002800400018020007c0000000700ff0200000000000000000000000000010500080003000000deef9ad15c05df9190bec209d3600fc27c959f19ebe72c4d83a4ba5fecce6bb7b7104536bacbe0753f9ed1fc6ed969f9f49f836a5a7ceec71d23bf0af829d88fc544b21e3ad024b38a5fa712e1c792266ea95841d99f23446cb9eb11d860f08b42d2c65aa2e45b8ad11a364a8acf2f8710bca79e65a87cba38be82982b9789fcbf67e52d69c223eef3133793e10e8886"], 0x54}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x18, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000000000018230000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70500000000000085000000a5000000180100002020640500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000a50000000800000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.360957796s ago: executing program 3 (id=8189): r0 = socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="b4050000000000006110780000000000630122000000000095000000000000008f6a138c9e4eb32e71d7754e127d8d87525e8d57dc3c002fa721249c4cdfd87788947190b59b5af99eaaecbf2ba57aa6ffd750ffd3bef751c89264a6a9ec3b188b69dc1b6a12211cbf01e697342cf987ca2161e2a58904"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) (async) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) (async) r1 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) readv(r1, &(0x7f0000000580)=[{&(0x7f0000000b80)=""/4084, 0xff4}, {&(0x7f0000000140)=""/104, 0x68}, {&(0x7f0000000a80)=""/237, 0xed}, {&(0x7f0000000000)=""/24, 0xf}, {&(0x7f00000001c0)=""/34}, {&(0x7f00000003c0)=""/52, 0x34}], 0x6) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@RTM_GETMDB={0x18, 0x56, 0xd23, 0x3}, 0x18}}, 0x0) 1.289428543s ago: executing program 4 (id=8190): r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x190, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x164, 0x4, 0x0, 0x1, [{0x160, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x150, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8}, @NFTA_MATCH_NAME={0xb, 0x1, 'policy\x00'}, @NFTA_MATCH_INFO={0x138, 0x3, "ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af546f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f4052766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d04a8e3e29360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f5000000"}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x20}}, 0x1b8}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4008000}, 0x20000000) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0b040000000000000000020000000900010073797a30000000000900020073797a320000000014000000110001"], 0x54}}, 0x20004040) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, 0x0, 0x0) connect$inet(r5, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r5, 0x6, 0xd, &(0x7f0000000080)='yeah', 0x4) sendmsg$NFT_BATCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000700000000000000000a38000000060a01040000000000000000020000000900020073797a32000000000900010073797a30000000000c0006400000000000000002140000001100010000000000000000000500000a91aadfc2c509c894076e4cb4853a6082adc96deb027e72320dcf507d9664b24d53d1ce61cb2fbae4ee4c52bf0993838c92aacba5733d910c44536846b288a4c6b82c5cb594535c7c3577dfa01779c56376f1a455f536dd461bb0d60dc5efb2a52c4e2ab006630b7007acc3604ad9b97ef4c1b548c5b6cbccaaa8201a1b4c0920e298ef3a3e897c3ef1ea7951e7d594dada2b01041dfd5cb3932de68752205c738761"], 0x60}, 0x1, 0x0, 0x0, 0x20040804}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000240)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x40009, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="5400000010000104000000000200000000000000", @ANYRES32=r6, @ANYBLOB="0000faffffff000034001280110001006272696467655f736c617665000000001c000580050021000000000006001f0000000000080022"], 0x54}}, 0x0) ioctl$BTRFS_IOC_RM_DEV(r1, 0x5000940b, &(0x7f0000001240)={{r0}, "983e573bc9f0d61dda50e09a1dcb706fe402368eaaad53e7c39ef72dd72facf72dbf7b0c553f12de9f5675b790f55e79021a1c3f7502c74da2547900f5c81595cf1dd654a2ef08eabf1feba5d2505aee7f557bffe343c47bfaf703f63aa92a6a44fc9bf1945d3a3916c2333edd86f41a7dc4923254c2e48beee5b02edd18107fa125ff8a72c0d69c345caf909338d09156d343eab566565a476ab7949f4fe0d4b16aae4524fc5678a459a8c419a35f2ddfde73294416514214f5ac3dcec04a80490ad43031195b27c0f04a79bfe050559bb71cf83bb7677979a4fddc90c7c61ae8638aaf87fcc5b0739ae6e91694309fba597900b88f34a62abd84a0cccc4683c8c9d47d60c4375fa3ee3e26e33bd4c83d5edacc4afa513d50ae017d3f57dea65aa164eb94416d1ae5d66486d34e4c1bbbcbb0ce01b52295a38dabbf75f3f00157337d9dde8fae9f82cbcfff172c150a44e4116e98a139ef2897930197eaef1809538018c4766bc553c069620aed14bc8596a5209bfe5a828176e1950d99defe5aeeb23b1946572e5ddfca739e37d68a62ced46775e54ae3686cce293c2318af9e51dff9e46a5b402cadeaad5ba66bae9c5ff09aef1b0aac1b7744ea5023e54f314af39c2657872537a92bb9f64e1b7528639202fe97e388fd885ca94e55053fa673df3fd25ad352db59bc9b4298f9f47157ea5acc16e5bc6f3f5b3a1af9a1b41174b73b30473dece5834987e66d665c4487b68983d8e01674ffe2a1e7bd4da320a9c0c678736d4c981745f91f76dee080a87d7cba3bc8c28f3b0ed25787d5850d4cdbe922a092be20019b2f2a1b8ec8e1fedb22bc6e05bd089a70ace5f8e0ad499b1fda5f6ebf143f0831b0cd085ad41a40e22bc6175e2f644aee4092b6e4427b01a3fb60aedcf9d9f72e718b6c13e018762d283de194f983d6e0bf3bb3cca6a8382276577dcf0a025311a17a971298041a50c23ca8e556382fa425568610b0aa375084f72a55206e4fb52171453e6314c37c485e0ae2760ae7d708d206cebc9b28ee05c3d43317e4ad19f0e11fe75b12ea5e95a528b51bbd92ee5beb226daa5e1f9d0e57238e8916180374dd7a268193849dfc51818a51e291c1174830edaf6718b7e7a2dfffa107be79a2823812e85b3da1fb7de0ede7f095f3d6c1e691c7440b58057880eb3b5d76242466882690df864c94785747bc7ba4a168fc709e5792b57b3be6f4cea8ab47c054e7bac11e0b246869d5b0ab10c240867107abafb5767f2b766c34314305c8d0c18fded2a00d2bcfa4b18343808785b6a3647b6e6a1496140cb7eb8016c552d6f7ec51bd118ab9a7bb18916cf7a19555a98c6ab01ceb85331539a86e3817a192ae126b4296475058ec8351add69750e5c3bb50439851c6fe968eb6384055d55a7540a890318b6f9063ea0db79b84b3d75613f9ce86adf2e343ff0169e1c8a7404a0257d10a094fb98c2961cfaa005b035398c3c958cc8621c354d9a6c1fb0d4bb76664a61613fa1bb67f8667fd296467c7f78877b95c3b7c74565132c840ad31356ebada021f2e66251b5d3d5b7ab8b03f1d083c370497c17cdcb6432c40c52c88d562cce2de483efe14c70a42a88ee9a811345de2c7cceae1dd42fc4327073aa5e8e68c305df4fbe5b134f7c17f139b28486564dfece915f2454341638122b5e0bff3444f68efb8d17bbca988b035febcefccfe06ada9940629d8a5ac00d34622b1e63eca5cceb0fa2c97d7d28305e22465f6aebd97ea4cb89a604b86cec5c1702fce305c0f7fee3c7723b0bb17359496290c4e3969aee6e7e1b917baef955452ee2592d3a0feb520ece557a2116ccc96d013077b415ad4b1b77e823df9b67c7498d727dd1b48ce80ce374fb1a8d2161dbe3521423e01ffde8bb29e4bab435448e6dee48aa4bbd0229d0b6def5b2f081d58dc653922bc3dbe48aae653737d2d8eb94489cfbca29313fd660725be02dd74b9c31134fa9630e1dd1368120121306be0241db81f69c867c1cb2aedd91adefb8b79add03bb6f973659d705437a33801b06ff54365397e8d498c00bd07238ab1515d4bd605e32a9fc54a6555d07189e676b1eb0a2b151369b6d5e867ed86444ecd609cb44987441d2e5edbdc9b53c771023797bbe9678efd3bdde0d20c856926ec9d3844f2248ca628f839750eed2d81e7e71ed9f21069fe784db1b94f443fe0bc9e417d58d313eec95a1d6f43a31bdf0212a94fcc9a46570364551a8edf7938c4dc6f78a419df5d370778a586024856c64f66acb2ce64eaeb424e22fe82996742b564917c87fed02306ed35979b790b7529e76e88dc48661f1755e7ae76d0c552829c5656de66e8eca427023309b943d95fd9242e164caf674511927668e928f458de7af39cde1eb9f4946b9a0b504db6667ccdffa1db15d0a2f8eb0de8e2560aeda7f9da27b65a438db9418234ab60131d40291e43e23e67d08c0ee3b9199b1ad393b3d715f7f1acb3190f6f272c2c345990f9a8446df65226205af0367c10d7661783a5fe59d4407d4162f5c166281a30eca034abf60763d180eaaa0daa1d4ee6eecb82861793d71dfab18c9566f1c7fa689e4b09cd4086a02ca07425c880d5b0d041391852e1b74eeb24df4f4fa806f5387ff892555680e7c38fdb1b9972621588d05a98b545a403fd3db853d5878dd489059031a8eab57ba8ffa26432491e7da529c85c8e00e5a2554f9d2bea699c7960b89e255f34203c55d0d549277779faa217252ef4d7610690bcd5cab1d006d8e28235c4be7b2a26e4ef9aa329a9291b9f9f893c5f23bfb7f66b683a769c9b93bd649b6e3ab3c14bb377435fa8642425523bc04e25c052cfe28d301424fabf388cb31c9f7db8bcd7a1f22a4d23b8a5e22accb0a2b8d393c27b58fe28372d80cca97dbd238ca361413a49858072b7866506f1845f4bbb52c826505b33f320ce39f119e196f0ce68bf85e737d0e4345163afb2269026fc9f617dc7f43c97cab86c6cb9a8c8158ebe9721f7a949763c453e3a2ba484387d4eba5cd17c089c805981ee7ae1c4972e9355bc4c82f7349126cf52e1d8a3207145d3eaeca3bd43345cc7cc71c30fb392643bbde32e1664af450cf204d17e82963b98e1dcd31e9fedc6dfa654e68a18e01ab0288f3f6f32f4866b6a5f0a3494e182185c7b8b13ae9ed3108a277bd1a37f3b149ea5e23900c91f38e9134202572758e94ee680fda382c4fd4a81510dfe8c05646258f6193c19529db2804ffbbe37ad50423bfe7b9ada1e21af2a6e8bb789768bad8840e07f411a27c684a4737ecf301a83bd7d31e186d5c68f2535669db28cded70a0a74cf0ef461ecc82ed8879d8181cff40e63fc198ee25d57f794867823bfbc6efd714d6e31cff011b7029c560b00f917b90f71916d32df6ed69a8c9b4fcfa406de2625eb67474c7101f8576e4b8d0748e2e8e8fc8c8f6e9eeba6e3a61271745f116b3e19e52c09058a15f06ae1505f9c337ebf6aa57d8cea9727d4037dfe28bcf76c9002024eaf01ed9cd0bde318ede0e314f7c0c80f70fa91b31f4a5d2b17ffe0bd5dcc1b783a53840ad2892291633cd1cca29d427ff08838a1367763adb92430a7751c7c66156faf45e55f9296203723a7ea42f13420e8440d76e95d913fdcdf2724c4f6bdc03867cdae77406df716c3b77c1ad5d78c62f2df273f1be491c71c269605ab27014f745a27f0826f6c071e2e6e8e4780140967ac9143742374f941321ba2fbb9ae0dfaaf671a3b9e17ba97359ecd3bdb4cad3543a6fd9846497f972bc6f7f6742463cd2256de647620ff3ad247f32458612d07f2c6bf2ed0743e19c71d3a5f3b41942e12a382089038699ba936f68651e5b2cd9fa3af02024808e6aaba05a9dfa8306ed0a523bed9d0a5c594edea84f1c991c685ca6312a06570d817a51d901bf1499eb125641e4717bbbd23f2b994e8eafd62379c37c5df749252357ce7aa3484c206bb377210458a8c42d0953bfb23bbfbfac8250010bb2560a7569b70ae5c942a1cd9eff801ba0dcbf08ec6f8d580e53c0a0a4dea8cdf12d94fc4809b53bfebce6449067f286acb12c4c0a85a02f5a8525d72e72c55e4c863215a47c12cf900640425e33e94b65e7375dc0d3ac4abe31c99b138dea6e827579b1676b9f5015ff021b413d6171b03c6b079b29bbd86995aca6bd4e2bd3b802a7409e13b5510208f068f8f4841fdc583a216e0ac1dbd923828b58ac642c4fe36dae81767c577639db46af6afaffb1a0118573b2737884d7fcafa6cf5f362e0afccea7f5431d062cb891df416f11ae84859c11331acfeb9dcf0825838d693a62926fb3dd7e59eed741253a27d87247ca810129f2165361e1be9dbbfb571390281f8d3d3988aab25a897ca850918fe9c09749e16647f1e5725de3c244c2319b9ee884d5ae2700fd36947dd94707bf01be4a6f261c31b434823709bc06a2de28efbba39dc24c11865589842d27ac2751ceb0a0b9d39f64de245717a0e41d0d4933e9a9aa003f785e44aea4829794b9dfeea0f18314c91816351cf48f32fbaa9e320ec467e5ec3bfd60eb5f15c565129439f59e39828bc6a19873c97d2046bb6f707b6beb8dc65cccb8de890d0c665597f956b79b55343112499e05a678ef5f87ab22ddf4f329c5cec1ba120d8d16b14621b8213dea4ac93fe69bd50dd22e66658020f76fb736dee93e8ee940561c80ffc42d25cf1c329cb50bb14b602a480d02d6252cb1749000d668dec8fff7d8f42dec716e5bd5789533ceb2d612e98a97d6e74201abca6807068f6d603a142943bd477117b07efca5b0c36a1e3145950f0826e1923da0cf8a0054fdfa80dd1afb76ed1cc4f75d8477c145f20be42e235e8d6c341a67b4b968a77ff1e617310fbde9f83cc60927683ddc2ef553832b5585e774eaf90b3840b7c50c89ad6c71c9986bba7e094a181536c1233819c1eb13b198c64f9a1a4c521bdce1dad1fd666bbca296ce3c3f87c8749e9643e206e76ae8cb11aace232ab54a202454df4317faaf8be2b2bdf7b0db836b7b7867503950dec3fd725634f34b4cc2304f84d991f1faceafb18ef2218310026bb9e795a4725c745d72beac3b73a8c6804250b65b1a09ad146ba8ef34fd24e8d31875884f3e06ff1aab2963aef28eb1fc609217720b292c5c735344c69a53a4d59782f3b77d63a64fa724f52ec8db8cf1f8944619c7ecc989380b9443f4217bcef2b9f5d7f0ab23967a5a0e8ff846c24ab2aa6c75ae1d1f14b62580bfb6aeeaf563b43ad962ab5cc28d127430385574609cceaa8ada574421d401153cfc754a0c1635b40f4fe288176e1bdb96299b9c4ab755317e1275705976f97db9b1204024098bc60a63b4e09c40684c6f0026c93d3ac6799b913ad77c032dd2ec32cb8f4d28d4123ec288d18ab71a93e3ecc8f446ca9e3cc55bf508b98bbbd8b0c9ecd545f9ccb5205d517b3a0bad0cb88e5fd8d0e4c6e3fbfa1a55db150e13d07c95f26495f8d9a5aaa1b4cff2509c08fabbf6a2e526029f007438b73bd913ae6822755dc16e6435e860b94d43e31a8b95738223bed7d900386d27d365764127cb7dd73e4d58ce8e16cab2feb5e9803454da9a4a87f2a1cecc2e87a4f4d62f87153c158520d593f71d74f4612651fff8c6bd3e48559dc8641d1fe2cdea3d8170d5e928ee8ede043f89e28e35c401a1d4b6fcda38069712df0ab6cf94ec5579501dead19e569b7364dc9fd1b473eebe271258a0321a10bcd5c84dad2d52599fa4acdc45be90cdf1df2178bfc26"}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0xdc, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xf1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_pie={{0x8}, {0x4}}, @TCA_STAB={0xac, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xb, 0x4, 0xff78, 0x9, 0x1, 0x7, 0x5, 0x7}}, {0x12, 0x2, [0x100, 0x7fff, 0x8, 0x6, 0x9, 0x2, 0x3]}}, {{0x1c, 0x1, {0x0, 0x95, 0x7, 0x382, 0x2, 0x7fff, 0x200008, 0x2}}, {0x8, 0x2, [0xfffe, 0x7f]}}, {{0x1c, 0x1, {0x4, 0x1, 0x3, 0x80, 0x0, 0x2000, 0x1, 0x1}}, {0x6, 0x2, [0xf5d]}}, {{0x1c, 0x1, {0x6, 0xe1, 0xfff, 0x538f6745, 0x1, 0x7fff, 0x1ff, 0x8}}, {0x14, 0x2, [0x200, 0xf, 0x7, 0x9d2, 0x3, 0x4, 0x9, 0x2278]}}]}]}, 0xdc}}, 0x0) 1.288759655s ago: executing program 0 (id=8191): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000017c0)={&(0x7f0000000080)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x11}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x74}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000009112bd000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r1 = socket(0x40000000015, 0x5, 0x0) getsockopt(r1, 0x200000000114, 0x2711, &(0x7f0000019580)=""/102385, &(0x7f0000000400)=0x19018) 1.287463951s ago: executing program 2 (id=8192): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_NEIGHBORS(r1, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x400400c}, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x9c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0xe067d064e23ae3d0}}, [@qdisc_kind_options=@q_drr={0x8}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xe2, 0x79, 0x4, 0x1, 0x1, 0x7, 0x4a}}, {0x4}}]}, @TCA_STAB={0x4c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x8, 0x2, 0x12, 0xd, 0x0, 0x7, 0x4, 0x1}}, {0x6, 0x2, [0x9]}}, {{0x1c, 0x1, {0x7, 0x5, 0xa5e2, 0xff, 0x0, 0xe13, 0x1, 0x1}}, {0x6, 0x2, [0x7d7]}}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000004c0)={'gretap0\x00', &(0x7f00000003c0)={'ip_vti0\x00', 0x0, 0x10, 0x8, 0x6, 0xffff, {{0x27, 0x4, 0x1, 0x3e, 0x9c, 0x66, 0x0, 0x73, 0x29, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@lsrr={0x83, 0x1f, 0xa5, [@empty, @local, @multicast1, @local, @empty, @multicast1, @rand_addr=0x64010101]}, @ssrr={0x89, 0x7, 0xea, [@loopback]}, @end, @timestamp_addr={0x44, 0x34, 0x9d, 0x1, 0x4, [{@loopback, 0xb01}, {@remote, 0x7}, {@rand_addr=0x64010100, 0x93}, {@multicast2, 0x6}, {@remote, 0x1}, {@dev={0xac, 0x14, 0x14, 0x2d}, 0x81}]}, @timestamp_addr={0x44, 0x2c, 0x85, 0x1, 0x6, [{@loopback, 0x1}, {@multicast2, 0x2}, {@remote, 0x1}, {@local, 0xa4e6}, {@private=0xa010101, 0x81}]}]}}}}}) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x6b) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000c80)=ANY=[@ANYBLOB="580000001000390427bd7000e9ffffff000003e4", @ANYRES32=r9, @ANYBLOB="00500600c31006003800128008000100736974002c00028008000100", @ANYRES32, @ANYBLOB="08000300e00000020500090008"], 0x58}}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000500)={0x0, @rand_addr, @remote}, &(0x7f0000000540)=0xc) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000680)={'syztnl1\x00', &(0x7f0000000600)={'syztnl0\x00', 0x0, 0x2f, 0xed, 0x7, 0x3, 0x4a, @private0={0xfc, 0x0, '\x00', 0x1}, @local, 0x700, 0x7800, 0x5, 0x4}}) sendmsg$ETHTOOL_MSG_EEE_GET(r1, &(0x7f00000007c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000780)={&(0x7f00000006c0)={0x84, r2, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x40, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}]}]}, 0x84}, 0x1, 0x0, 0x0, 0x8000}, 0x20000080) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'veth0\x00'}) r12 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r12, &(0x7f00000001c0)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendto$inet6(r12, 0x0, 0x0, 0x0, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) setsockopt$sock_int(r12, 0x1, 0x2a, &(0x7f0000000000)=0x87f4, 0x4) recvmsg(r12, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x40010042) r13 = socket$igmp6(0xa, 0x3, 0x2) sendmsg$inet6(r13, &(0x7f0000000480)={&(0x7f0000000040)={0xa, 0x0, 0x40, @local}, 0x1c, 0x0, 0x0, &(0x7f00000005c0)=[@rthdrdstopts={{0x18, 0x29, 0x37, {0x84}}}], 0x18}, 0x40080) socket$nl_route(0x10, 0x3, 0x0) r14 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(r14, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r15, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) 1.282969485s ago: executing program 1 (id=8193): r0 = socket$inet6(0xa, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000880)=@newtaction={0x14, 0x68, 0x1}, 0x14}}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="81ffffff000000001c0012800b0001006772657461700000", @ANYRES32, @ANYBLOB='\b\x00\r\x00\x00\x00\x00\x00\b\x00?'], 0x4c}}, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e26, 0x380000, @private1={0xfc, 0x1, '\x00', 0x1}, 0x800}, 0x1c) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000300)={@local, 0x3ff, 0x0, 0x0, 0x3}, &(0x7f0000000340)=0x20) syz_emit_ethernet(0x0, 0x0, 0x0) getpid() r2 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04000a", 0x15}], 0x1}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81ffffffffb9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYRESDEC=0x0], 0xfe1b) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) write$cgroup_subtree(r3, &(0x7f0000000000)=ANY=[], 0xfe33) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) getsockopt$sock_int(r0, 0x1, 0x23, &(0x7f0000000040), &(0x7f0000000080)=0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="24000000200081dc000000000000000002000000000000031f0000000500160004000000fe408cccf8293d8c831ed954a22a312d438cc6cd8ec232d029116d143b3fad198d27c5ae7fa2bcc1d7de5fa2bc41101d3742f9b96033e9b53abc89e33736662c37f3d8c5b27885d40bdee0c401660fcdd5ffe80abbc9a4620978f2f06f31af3b3e546d96f8e0bd0c27f8f74d4e9a4171bda64968fe0967d17b532e093faf5f68b01ee8097737d5302c1a330dbba45742763f175328332bbe2ccc12d3b40e3cf33973af4e7f0562d0f7260004c76f5146f00a7093abffd825b8"], 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x44004) unshare(0x22020600) unshare(0x40000) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, &(0x7f0000000d00)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}, 0xfffffffc}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000400)="b8", 0x1}], 0x1}}], 0x1, 0xb576da6dad3801b0) shutdown(r5, 0x1) r6 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x890b, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r6, 0x890c, &(0x7f0000000000)) 1.190998929s ago: executing program 0 (id=8194): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_RENAME(r0, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000040)={0x58, 0x5, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}, 0x1, 0x0, 0x0, 0x44040}, 0x1) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x5, 0x0, 0x1, 0x6432, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x5}, 0x50) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000003c0)={0x73e0, 0x0}, 0x8) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000400)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x64, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x0, 0x3}, 0x50) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_lsm={0x1d, 0x11, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6aea, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@btf_id={0x18, 0x8, 0x3, 0x0, 0x2}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000280)='syzkaller\x00', 0x7ff, 0x4a, &(0x7f00000002c0)=""/74, 0x40f00, 0x39, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000340)={0x9, 0x5}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0x4, 0xa, 0x800}, 0x10, r2, 0x0, 0x3, &(0x7f0000000480)=[r3], &(0x7f00000004c0)=[{0x1, 0x1, 0x3, 0x8}, {0x1, 0x5, 0x3, 0x1}, {0x3, 0x1, 0x1, 0x1}], 0x10, 0x7}, 0x94) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_POWER_SAVE(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0xc000}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x14, r5, 0x4, 0x70bd29, 0x25dfdbfc, {{}, {@void, @void}}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4004800}, 0x20000004) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000800)={@fallback=r3, 0x12, 0x0, 0x8001, &(0x7f0000000700)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8, 0x0, &(0x7f0000000740)=[0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000007c0)=[0x0], 0x0}, 0x40) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000900)={'syztnl0\x00', &(0x7f0000000880)={'syztnl0\x00', 0x0, 0x2f, 0x8, 0x3, 0xff, 0x1, @remote, @mcast1, 0x7, 0x10, 0x200, 0xb393}}) r11 = bpf$ITER_CREATE(0x21, &(0x7f0000000940), 0x8) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000840)={@ifindex=r10, r4, 0xe, 0x16, 0xffffffffffffffff, @void, @value=r11, @void, @void, r9}, 0x20) getsockopt$inet6_mreq(r8, 0x29, 0x7, &(0x7f00000009c0)={@loopback, 0x0}, &(0x7f0000000a00)=0x14) sendmsg$MPTCP_PM_CMD_GET_ADDR(r8, &(0x7f0000000b00)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a40)={0x78, 0x0, 0x800, 0x70bd2a, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x8}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}]}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xbb}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x18}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}]}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}]}, 0x78}, 0x1, 0x0, 0x0, 0x50}, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r11, 0x0, 0x487, &(0x7f0000000b40)={{0x32, @empty, 0x4e20, 0x3, 'lblcr\x00', 0x11, 0x8, 0x1f}, {@private=0x749, 0x4e23, 0x3, 0x4, 0xffffffff}}, 0x44) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000bc0)={'wlan0\x00'}) sendmsg$sock(r6, &(0x7f0000000e40)={&(0x7f0000000c00)=@l2={0x1f, 0x4, @any, 0x2, 0x1}, 0x80, &(0x7f0000000d40)=[{&(0x7f0000000c80)="61de952ff8d4d285b287ff7fd3", 0xd}, {&(0x7f0000000cc0)="b152f116c03f3e75d78607491c7668b65887d7a8c48413c1bc0f850e425dcd4f45b7f33dba1097efb81fe626868bb7397d0e7bd59033eabf2f03aaf1e0e9c5be5f4c5b7d98d97aa1b30a2ad037e3b699bf1b71672c6a41dc6d392a3e8ea0c0020001669cc2de8ccb954d575ebdc98d0f459d445d5c6eed25f42809e713", 0x7d}], 0x2, &(0x7f0000000d80)=[@mark={{0x14, 0x1, 0x24, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x81}}, @timestamping={{0x14, 0x1, 0x25, 0xffffff81}}, @mark={{0x14, 0x1, 0x24, 0x80}}, @timestamping={{0x14, 0x1, 0x25, 0x3}}, @txtime={{0x18, 0x1, 0x3d, 0x8000000000000000}}, @mark={{0x14, 0x1, 0x24, 0x5}}, @mark={{0x14, 0x1, 0x24, 0x1}}], 0xc0}, 0x20000001) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001300)={r4, 0xe0, &(0x7f0000001200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, &(0x7f0000001000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5, &(0x7f0000001040)=[0x0], &(0x7f0000001080)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x90, &(0x7f00000010c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x48, 0x10, &(0x7f0000001140), &(0x7f0000001180), 0x8, 0x87, 0x8, 0x8, &(0x7f00000011c0)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000013c0)={0xe, 0x2, &(0x7f0000000e80)=@raw=[@btf_id={0x18, 0x6, 0x3, 0x0, 0x5}], &(0x7f0000000ec0)='syzkaller\x00', 0x0, 0x51, &(0x7f0000000f00)=""/81, 0x40f00, 0x4, '\x00', 0x0, @sk_skb=0x26, r8, 0x8, &(0x7f0000000f80)={0x3, 0x1}, 0x8, 0x10, &(0x7f0000000fc0)={0x5, 0xa, 0x3, 0x9}, 0x10, r14, 0xffffffffffffffff, 0x3, &(0x7f0000001340)=[r1], &(0x7f0000001380)=[{0x3, 0x3, 0x8, 0xa}, {0x2, 0x5, 0x2, 0x7}, {0x1, 0x2, 0xa, 0x8}], 0x10, 0x7}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001480)={0xffffffffffffffff, r13, 0x25, 0x16, @void}, 0x10) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001500)=@raw={'raw\x00', 0x9, 0x3, 0x370, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x2a0, 0xffffffff, 0xffffffff, 0x2a0, 0xffffffff, 0x3, &(0x7f00000014c0), {[{{@ipv6={@empty, @private0={0xfc, 0x0, '\x00', 0x1}, [0xff000000, 0x0, 0xff000000, 0xff000000], [0x0, 0x0, 0xffffff00, 0xff000000], 'ipvlan0\x00', 'pimreg\x00', {}, {}, 0x5c, 0x51, 0x5, 0x4}, 0x0, 0xf8, 0x130, 0x0, {}, [@common=@eui64={{0x28}}, @inet=@rpfilter={{0x28}, {0xc}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x3, 0x1, 0x2}, {0x3, 0x4, 0x4}, {0x1, 0x3, 0x4}, 0x80, 0x90}}}, {{@uncond, 0x0, 0x108, 0x170, 0x0, {}, [@common=@unspec=@realm={{0x30}, {0x3, 0x2, 0x1}}, @common=@frag={{0x30}, {[0x1, 0x4], 0x4, 0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x12, 0x4, 0xfffffffa, 0x5e8b, 'syz0\x00', 'syz0\x00', {0x3}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001900)={r3, 0xffffffffffffffff}, 0x4) r16 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001bc0)={0x2, 0x4, 0x8, 0x1, 0x80, r1, 0x2a6, '\x00', r10, r8, 0x3, 0x5}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000001d40)=@bpf_ext={0x1c, 0x14, &(0x7f0000001940)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x7}, {{0x18, 0x1, 0x1, 0x0, r11}}, {}, [@call={0x85, 0x0, 0x0, 0x95}, @map_fd={0x18, 0x6, 0x1, 0x0, r3}, @map_val={0x18, 0x0, 0x2, 0x0, r15, 0x0, 0x0, 0x0, 0x5}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000001a00)='GPL\x00', 0x3041dddc, 0xe7, &(0x7f0000001a40)=""/231, 0x41000, 0x2a, '\x00', 0x0, 0x0, r11, 0x8, &(0x7f0000001b40)={0x0, 0x3}, 0x8, 0x10, &(0x7f0000001b80)={0x0, 0xa, 0x9, 0x430}, 0x10, 0x2b268, 0xffffffffffffffff, 0xa, &(0x7f0000001c40)=[r1, r8, r1, r16, r11], &(0x7f0000001c80)=[{0x3, 0x2, 0xd, 0x5}, {0x2, 0x3, 0xb, 0x2}, {0x4, 0x3, 0xc, 0xa}, {0x0, 0x1, 0xe, 0x7}, {0x4, 0x3, 0xa, 0x5}, {0x0, 0x2, 0xf, 0x5}, {0x5, 0x5, 0xa, 0x4}, {0x0, 0x1, 0xf}, {0x3, 0x3, 0xd, 0xc}, {0x3, 0x5, 0x3, 0xb}], 0x10, 0xf}, 0x94) socket$inet6(0xa, 0x4, 0x7) r17 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001e40), r8) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r8, &(0x7f0000001f80)={&(0x7f0000001e00)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001f40)={&(0x7f0000001e80)={0xc0, r17, 0x200, 0x70bd2d, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xff}, @MPTCP_PM_ATTR_ADDR={0x20, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xfa}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x2}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @empty}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xc277f3e1fe1aefe6}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0xa}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}]}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x44, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r12}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x804}, 0x40) sendmsg$NL80211_CMD_UPDATE_FT_IES(r11, &(0x7f00000020c0)={&(0x7f0000001fc0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000002080)={&(0x7f0000002000)={0x4c, r5, 0x200, 0x70bd2a, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MDID={0x6, 0xb1, 0xfa}, @NL80211_ATTR_MDID={0x6, 0xb1, 0xb7}, @NL80211_ATTR_MDID={0x6, 0xb1, 0xd}, @NL80211_ATTR_IE={0x20, 0x2a, [@cf={0x4, 0x6, {0x5, 0x2, 0x1d, 0x10}}, @gcr_ga={0xbd, 0x6, @device_b}, @mesh_chsw={0x76, 0x6, {0xfe, 0x9, 0x2d}}, @ibss={0x6, 0x2, 0x9}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000040}, 0x2000900) 1.138078487s ago: executing program 3 (id=8195): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x10, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081780000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071103b00000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0a00fe000000007203000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afc0513466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea01d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a07f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a126a1bdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0d5d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f10bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d00b07862c4fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52c094016406cdd32abf77fea373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515dca8811922929e08538fab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f57cbc05cd897f40693ec427ea71578130cde48de3b4dda0c7b615b57ccd4f8ac729a80f891d91a89d967948b9d95b1f22480ab48969e86b854a8c17f3e264ce11f9f63552364e759eec94572f2f7b0e2f293573d0b80709815f4344f908c00"/2646], &(0x7f0000001780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffe04, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}, 0xfffffffffffffd00}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="12000000010000000000ffffffff0000000000000000fb8000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="12000000010000000000ffffffff0000000000000000fb8000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000001bc0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@typedef={0x0, 0x0, 0x0, 0x10, 0x2}, @struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x0, 0x1}]}]}}, 0x0, 0x3e, 0x0, 0x2}, 0x20) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, &(0x7f0000000000), 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000c80)={0x1, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$packet(0x11, 0x3, 0x300) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc000000850000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc000000850000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@dellinkprop={0x28, 0x6d, 0x1, 0x0, 0x0, {}, [@IFLA_NET_NS_PID={0x8}]}, 0x28}}, 0x0) socket$key(0xf, 0x3, 0x2) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=ANY=[@ANYBLOB="3801004010000100feffffbf00010000fe880000000000400000000000000001ac1414aa000000000000000000000400400107944e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c0000007f000001000000000000000000000000000000000000000009000000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000ff0100000000000002000000fcffffff000000002abd700004350000020001fd2000000000000000480003006465666c61746500"/240], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x138, 0x18, 0x1, 0xfffffffe, 0x100, {{@in6=@ipv4={'\x00', '\xff\xff', @multicast2}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x71c, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x25}, {0x0, 0x192, 0x9ba3, 0xffff, 0x8251c, 0x5, 0xfffffffffffffffc}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffa, 0xfffffffc}, 0x80, 0x3500, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)={0x10, 0x14, 0x8}, 0x10}], 0x1}, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) (async) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r8, &(0x7f0000000440), &(0x7f0000000040)=@udp=r7}, 0x20) recvmmsg(r7, &(0x7f0000000100), 0x40000000000020d, 0x10140, 0x0) (async) recvmmsg(r7, &(0x7f0000000100), 0x40000000000020d, 0x10140, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0x2300, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0x2300, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) (async) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r9, &(0x7f0000000080)={0x1f, 0x0, @none, 0x4}, 0xe) (async) bind$bt_l2cap(r9, &(0x7f0000000080)={0x1f, 0x0, @none, 0x4}, 0xe) connect$bt_l2cap(r9, &(0x7f0000000200)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_STATS_ENABLED={0x5, 0x29, 0xfe}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x7}, 0x4) setsockopt$packet_int(r2, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[], 0x0) 940.578896ms ago: executing program 4 (id=8196): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x2, 0x5, 0x628, 0x0, 0x488, 0xffffffff, 0x0, 0x268, 0x558, 0x558, 0xffffffff, 0x558, 0x558, 0x5, 0x0, {[{{@uncond, 0x0, 0x220, 0x268, 0x0, {}, [@common=@rt={{0x138}, {0x4, [0x3, 0x800], 0x0, 0xf23d8cefb056ae2b, 0x7, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, @private0, @private1={0xfc, 0x1, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @remote}, @loopback, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, @mcast2, @private0={0xfc, 0x0, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, @empty, @dev={0xfe, 0x80, '\x00', 0x2b}, @dev={0xfe, 0x80, '\x00', 0x39}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @remote], 0x9}}, @common=@unspec=@connlimit={{0x40}, {[0x0, 0xffffffff, 0xffffffff, 0xff000000], 0xffffff7f, 0x1, {0x4}}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@empty, @ipv6=@remote}}}, {{@ipv6={@dev, @loopback, [], [], 'batadv0\x00', 'veth1_vlan\x00'}, 0x0, 0xe8, 0x130, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@loopback, @ipv6=@private0, @icmp_id, @icmp_id}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@dev={0xfe, 0x80, '\x00', 0x1b}, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @gre_key, @gre_key}}}, {{@ipv6={@remote, @mcast1, [0x0, 0xff000000], [], 'ipvlan0\x00', 'pim6reg\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x0, 0xfffffffb}}}}, 0x688) r2 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000400)={0x88, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'syzkaller0\x00'}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14}}, {{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'bridge_slave_0\x00'}}]}, 0x88}, 0x1, 0x0, 0x0, 0x5}, 0x100) r3 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000700)='hugetlb.2MB.failcnt\x00', 0x2, 0x0) poll(&(0x7f0000000740)=[{r2, 0x1003}, {r0}, {r3, 0x90}, {r0, 0x200}], 0x4, 0x40) connect$netlink(r0, &(0x7f00000006c0)=@proc={0x10, 0x0, 0x25dfdbff, 0x800000}, 0xc) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x78, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x64, 0x1, [@m_tunnel_key={0x60, 0x1, 0x0, 0x0, {{0xf}, {0x30, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x20000000}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @loopback}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @broadcast}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x78}}, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x78, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x64, 0x1, [@m_tunnel_key={0x60, 0x1, 0x0, 0x0, {{0xf}, {0x30, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x0, 0x0, 0x20000000}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @loopback}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @broadcast}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x78}}, 0x0) 915.491123ms ago: executing program 1 (id=8197): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000040)={0x0, 0xea60}, 0x10) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TTY_SET(r2, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x18, 0x3f9, 0x400, 0x70bd2b, 0x25dfdbfe, {0x0, 0x1}, ["", "", "", ""]}, 0x18}, 0x1, 0x0, 0x0, 0x2800}, 0x80) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000000)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000140)=0x1, 0x4) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0xa4e4, @empty, 0x3}, 0x1c) sendmmsg$inet6(r1, &(0x7f000000c540)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000240)='=', 0x1}], 0x1}}], 0x1, 0x800) 844.08781ms ago: executing program 2 (id=8198): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000007c0)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1701, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000580)="d76e", 0x1}, 0x50) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000000)={'wlan1\x00', &(0x7f0000000180)=@ethtool_rxnfc={0x2d, 0x7, 0x5c, {0x2, @udp_ip4_spec={@initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x4e32, 0x1}, {0x0, @broadcast, 0x200, 0x9a32, [0x3, 0x10]}, @usr_ip4_spec={@initdev={0xac, 0x1e, 0x1, 0x0}, @remote, 0xa8b9289b, 0x9, 0x1, 0xd}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 0x9ab, 0x4, [0x6, 0x8]}, 0x2, 0x2}}}) syz_genetlink_get_family_id$devlink(&(0x7f0000000180), 0xffffffffffffffff) r2 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r2, 0x8982, &(0x7f0000000100)) 724.651436ms ago: executing program 2 (id=8199): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x98, 0x0, 0x1, 0x3, 0x0, 0x0, {0x3}, [@CTA_NAT_SRC={0x28, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MAXIP={0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x1c}}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @CTA_NAT_V4_MINIP={0x8, 0x1, @rand_addr=0x64010101}]}, @CTA_LABELS_MASK={0x1c, 0x17, [0x180, 0x6, 0x80, 0xfe, 0x0, 0xaf2]}, @CTA_SEQ_ADJ_REPLY={0x24, 0x10, 0x0, 0x1, [@CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0xfff}, @CTA_SEQADJ_OFFSET_BEFORE={0x8, 0x2, 0x1, 0x0, 0x9}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0xe}, @CTA_SEQADJ_CORRECTION_POS={0x8, 0x1, 0x1, 0x0, 0x3}]}, @CTA_SYNPROXY={0x1c, 0x18, 0x0, 0x1, [@CTA_SYNPROXY_TSOFF={0x8, 0x3, 0x1, 0x0, 0x6}, @CTA_SYNPROXY_ISN={0x8, 0x1, 0x1, 0x0, 0x5d}, @CTA_SYNPROXY_ITS={0x8, 0x2, 0x1, 0x0, 0xfbb}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x44}, 0x20000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB=','], 0x2c}, 0x1, 0x0, 0x0, 0x40010}, 0x880) 718.940714ms ago: executing program 4 (id=8200): r0 = socket(0x2000000000000021, 0x2, 0x2) shutdown(r0, 0x2) (async) shutdown(r0, 0x2) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@deltaction={0x44, 0x18, 0x1, 0x70bdac, 0x25dfdbfc, {0xa}, [@TCA_ACT_TAB={0x30, 0x1, [{0xc, 0x8d, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7}}, {0x14, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x44010}, 0x20040844) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) (async) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x33fe0) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xffe0}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x4000010) (async) socket$nl_route(0x10, 0x3, 0x0) 716.99275ms ago: executing program 0 (id=8201): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x213) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv6_getroute={0x28, 0x1a, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x9}, [@RTA_MULTIPATH={0xc, 0x1d, {0xb, 0x1, 0x60}}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x1, 0xfffffffe, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2e}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="580000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000300012800c0001006d6163766c616e00200002800800010010000000080003000000000008000400"], 0x58}}, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000280)=@gcm_256={{0x304}, "4ab27a5bbf34f8bb", "801f5316346f6be5e67ad1b39021558717e2a4267e0661c1025ae933d34a275f", "1e4fba9a", "c6bbc09f5c48fece"}, 0x38) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_GETPARENTS(r1, 0xc028583e, &(0x7f0000000180)={{[0x7, 0x7, 0x6, 0x2]}, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000100)=[{{@align=0x2, {0x6cc0, 0x0, 0x8001, 0x4}}, 0x0, 0x0, 'freezer.state\x00'}]}) socket$nl_route(0x10, 0x3, 0x0) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000200), r3) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r5, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x2c, r6, 0x100, 0x70bd29, 0x25dfdbfb, {{}, {}, {0x10, 0x13, @udp='udp:syz2\x00'}}, ["", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x44004040}, 0x24044050) sendmsg$NBD_CMD_CONNECT(r3, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010029bd7000fbdbdf25010000000c00020000000000000000001c0007801800018008000100", @ANYBLOB="04"], 0x3c}, 0x1, 0x0, 0x0, 0x4000004}, 0x4000) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000000), 0xffffff6a) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_MSG_GETCHAIN(0xffffffffffffffff, 0x0, 0x80) listen(0xffffffffffffffff, 0x3) sendfile(r0, r7, 0x0, 0x20000000002) socket$inet6(0xa, 0x80002, 0x0) setsockopt$MRT6_ADD_MIF(r7, 0x29, 0xca, &(0x7f0000000240)={0x1, 0x1, 0x6, 0x0, 0x8}, 0xc) 655.717326ms ago: executing program 2 (id=8202): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000140)={0xa, 0xe22}, 0x1c) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x2, 0x4, 0x4, 0x1}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x6, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018200000", @ANYRES32=r2, @ANYBLOB="000000000000000073000c000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) listen(r1, 0x0) r3 = socket$netlink(0x10, 0x3, 0x4) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r4, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f00000002c0)=0x7, 0x4) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r5, &(0x7f0000000100)={0xa, 0x4e20, 0x3, @local, 0x1}, 0x1c) r6 = socket$kcm(0x2, 0x1, 0x84) setsockopt$sock_attach_bpf(r6, 0x84, 0x84, &(0x7f0000000000), 0x90) sendmsg$inet(r6, &(0x7f0000000e40)={&(0x7f0000000280)={0x2, 0x4e23, @remote}, 0x10, &(0x7f0000000600)=[{&(0x7f0000000400)="d4", 0x1}], 0x1}, 0x40) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000004c0)={'tunl0\x00', &(0x7f00000003c0)={'gretap0\x00', 0x0, 0x700, 0x700, 0x2, 0x100, {{0x5, 0x4, 0x1, 0x29, 0x14, 0x64, 0x0, 0x0, 0x29, 0x0, @private=0xa010102, @local}}}}) sendmsg$xdp(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000580)={0x2c, 0x8, r7, 0x1c}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000640)="70e89a934bd02a634e90bc1d8c329af0ecfe3c147204a2161d4279ff7356f365527f15df4e673c98a8608f1eeabbf38492114345f9c6b7e32b675746f104d382908315943d21da3aa9180f27c975936981a28d9186ab79a141602d39d090e4c8368a9d7911dc105271babdac6158", 0x6e}], 0x1, 0x0, 0x0, 0x48005}, 0x24040001) accept4(r6, &(0x7f0000000300)=@ax25={{0x3, @null}, [@null, @default, @remote, @remote, @netrom, @rose, @rose, @bcast]}, &(0x7f0000000380)=0x80, 0x800) bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r5, 0x0) writev(r3, &(0x7f00000000c0)=[{&(0x7f0000000180)="580000001500add427323b470c45b45602067fffffff81004e22030d00ff0028925aa8002000eaa57b00090080020efffeffe809020000ff0004f03adcac4b74ffffffffffffffffffffffe7ee0000000000000000020000", 0x58}], 0x1) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x608, 0x3, 0x200, 0x8a8, 0x7, 0x18000000, 0x8a8, 0x1c0, 0x978, 0x290, 0x290, 0x978, 0x290, 0x3, 0x0, {[{{@ip={@private, @multicast2, 0x0, 0x0, 'batadv_slave_0\x00', 'bridge_slave_1\x00'}, 0x0, 0x70, 0x98, 0x0, {0x36020000}}, @common=@inet=@SET1={0x28}}, {{@ip={@loopback, @remote, 0x0, 0x0, 'erspan0\x00', 'veth1_vlan\x00'}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @link_local}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x260) r8 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r8, 0x1, 0x3c, &(0x7f0000000000)={0x0, 0x0}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)=ANY=[@ANYRESHEX], 0x7c}, 0x1, 0x0, 0x0, 0x20000080}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01080000000000000000020000000900020073797a2a0000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[], 0x74}}, 0x0) 651.431111ms ago: executing program 3 (id=8203): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xc, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0xab}]}, &(0x7f0000000100)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x11, &(0x7f0000000000)={&(0x7f0000000180)={0x4c, 0x0, 0x100, 0x2, 0x0, {0x4f}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8}, {0x6, 0x11, 0x2}}]}, 0x4c}}, 0x20000011) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 565.695911ms ago: executing program 1 (id=8204): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x280081, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000080)={'pim6reg\x00', @broadcast}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000940)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="b5c176104c34f1e4ba00010000000c00018008000400ee"], 0x20}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b40)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PROTO={0x6, 0x4, 0x22eb}, @TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x1}}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) 482.03564ms ago: executing program 4 (id=8205): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x74, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0xa, 0x1, 'quota\x00'}, @NFTA_MATCH_INFO={0x1c, 0x3, "4cb4fc4ba7906e8f58c2052fade1bc2c62cdeb7521cf85ee"}, @NFTA_MATCH_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x9c}}, 0x0) ioctl$sock_inet_SIOCGIFNETMASK(0xffffffffffffffff, 0x891b, &(0x7f0000000000)={'pimreg0\x00', {0x2, 0x0, @local}}) 337.187291ms ago: executing program 2 (id=8206): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="4ff3c74a360001000000000000000100040000806d9c2a734ac244a5ee806b6bf19bbcb55e2708d499758efb"], 0x14}], 0x1, 0x0, 0x0, 0x4000080}, 0x0) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="34010000", @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000400048008000200010000000800010000000000080108805400078008000500000000000800050000000000080005009d2c690d08000500000000000800050000000000080005000000000008000500"], 0x134}}, 0x4048014) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000880)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x16}]}}}]}]}], {0x14}}, 0x70}}, 0x0) 332.319181ms ago: executing program 4 (id=8207): r0 = socket$nl_generic(0x10, 0x3, 0x10) unshare(0x46000480) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) r1 = socket$igmp6(0xa, 0x3, 0x2) socket$inet6(0xa, 0x800000000000002, 0x0) (async) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x340, 0x270, 0x5c, 0x160, 0x0, 0x3e0, 0x270, 0x228, 0x25a, 0x270, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0x0, 0xff, 0xff], 'veth0_to_batadv\x00', 'pim6reg\x00', {}, {}, 0x3a, 0x1}, 0x5002, 0xf8, 0x160, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x28}, {0x12, "d176", 0x1}}, @common=@unspec=@connlabel={{0x28}, {0x0, 0x1}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x1, 0x9, 0x10, '\x00', 'syz0\x00', {0x4}}}}, {{@ipv6={@local, @empty, [0xffffffff, 0x0, 0xffffffff], [0xffffff00], 'veth1_to_hsr\x00', 'dummy0\x00', {0xff}}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x9f, 0x0, 0x0, 'snmp\x00', 'syz0\x00', {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) (async) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x340, 0x270, 0x5c, 0x160, 0x0, 0x3e0, 0x270, 0x228, 0x25a, 0x270, 0x228, 0x4, 0x0, {[{{@ipv6={@remote, @dev, [], [0x0, 0x0, 0xff, 0xff], 'veth0_to_batadv\x00', 'pim6reg\x00', {}, {}, 0x3a, 0x1}, 0x5002, 0xf8, 0x160, 0x52020000, {0x0, 0x6802000000000000}, [@common=@icmp6={{0x28}, {0x12, "d176", 0x1}}, @common=@unspec=@connlabel={{0x28}, {0x0, 0x1}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x1, 0x9, 0x10, '\x00', 'syz0\x00', {0x4}}}}, {{@ipv6={@local, @empty, [0xffffffff, 0x0, 0xffffffff], [0xffffff00], 'veth1_to_hsr\x00', 'dummy0\x00', {0xff}}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x10, 0x9f, 0x0, 0x0, 'snmp\x00', 'syz0\x00', {0x2}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3a0) setsockopt$inet6_int(r1, 0x29, 0x7, &(0x7f00000003c0)=0x80000001, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000002f00090027bd7000eddbdf250400000008001a8004000480"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x84) 0s ago: executing program 3 (id=8208): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000000)={r0, 0x84, 0x5, 0x2}) bind$bt_hci(r1, &(0x7f00000005c0)={0x1f, 0x1, 0x2}, 0x6) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000a40)=ANY=[@ANYBLOB="030000018000000000000021e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000760000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014c5da4de4d92"], 0x90) close(r0) kernel console output (not intermixed with test programs): 9879] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6486'. [ 762.640192][T29879] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6486'. [ 762.697287][T29882] netlink: 'syz.0.6485': attribute type 1 has an invalid length. [ 763.003549][T29883] bond1: (slave veth3): Enslaving as an active interface with a down link [ 763.045757][T29886] 8021q: adding VLAN 0 to HW filter on device bond1 [ 763.237097][T29900] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6490'. [ 763.252056][T29499] 8021q: adding VLAN 0 to HW filter on device bond0 [ 763.383384][T29499] 8021q: adding VLAN 0 to HW filter on device team0 [ 763.441755][T18897] bridge0: port 1(bridge_slave_0) entered blocking state [ 763.448976][T18897] bridge0: port 1(bridge_slave_0) entered forwarding state [ 763.468551][T29912] netlink: 88 bytes leftover after parsing attributes in process `syz.4.6493'. [ 763.515267][T11285] bridge0: port 2(bridge_slave_1) entered blocking state [ 763.522688][T11285] bridge0: port 2(bridge_slave_1) entered forwarding state [ 763.576404][T29919] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6494'. [ 763.615379][T29921] Bluetooth: MGMT ver 1.23 [ 765.015315][T29499] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 765.450306][T29499] veth0_vlan: entered promiscuous mode [ 765.649689][T30010] ip6gretap0: left promiscuous mode [ 765.675880][T30010] bond0: left promiscuous mode [ 765.688244][T30010] bond_slave_0: left promiscuous mode [ 765.706581][T30010] bond_slave_1: left promiscuous mode [ 765.756170][T30010] 8021q: adding VLAN 0 to HW filter on device bond0 [ 765.898247][T30010] ipvlan2: left promiscuous mode [ 766.050147][T30008] lo speed is unknown, defaulting to 1000 [ 766.125184][T29499] veth1_vlan: entered promiscuous mode [ 766.524445][T30040] x_tables: unsorted underflow at hook 4 [ 766.548537][T30029] bridge0: port 2(veth1_to_bridge) entered disabled state [ 766.556257][T30029] bridge0: port 1(dummy0) entered disabled state [ 766.859573][T30029] batman_adv: batadv0: Interface deactivated: ipvlan3 [ 766.908157][T29133] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 766.908649][T30008] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 766.915267][T29133] syú2: Port: 1 Link DOWN [ 766.979791][T18897] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 766.988747][T18897] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.083834][T29499] veth0_macvtap: entered promiscuous mode [ 767.114904][T18897] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.158558][T18897] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.201976][T30052] xt_CT: You must specify a L4 protocol and not use inversions on it [ 767.216317][T18897] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.274869][T18897] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.286769][T29499] veth1_macvtap: entered promiscuous mode [ 767.454540][T30048] bridge0: port 2(bridge_slave_1) entered blocking state [ 767.461883][T30048] bridge0: port 2(bridge_slave_1) entered forwarding state [ 767.470965][T30048] bridge0: port 1(bridge_slave_0) entered blocking state [ 767.478233][T30048] bridge0: port 1(bridge_slave_0) entered forwarding state [ 767.492221][T30048] bridge0: entered promiscuous mode [ 767.519175][T30048] bridge0: entered allmulticast mode [ 767.536038][T18897] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 767.544960][T18897] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 767.589807][T29499] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 767.607997][T29499] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 767.643703][T18895] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 767.655954][T18895] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 767.723645][T30062] netlink: 'syz.4.6517': attribute type 1 has an invalid length. [ 767.731506][ T5760] syzkaller1: tun_net_xmit 90 [ 767.762796][T18895] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 767.779302][T18895] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.423901][T18892] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 768.431805][T18892] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 768.486486][T30079] __nla_validate_parse: 3 callbacks suppressed [ 768.486511][T30079] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6520'. [ 768.602460][T18892] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 768.649914][T18892] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 768.837337][T30099] netlink: 288 bytes leftover after parsing attributes in process `syz.4.6524'. [ 768.849223][T30099] xt_cluster: you have exceeded the maximum number of cluster nodes (2048 > 32) [ 768.869060][T30097] openvswitch: netlink: Encap mask attribute is set for non-VLAN frame. [ 769.296047][T30116] netlink: 'syz.2.6528': attribute type 1 has an invalid length. [ 769.303957][T30116] netlink: 232 bytes leftover after parsing attributes in process `syz.2.6528'. [ 769.313224][T30116] netlink: 'syz.2.6528': attribute type 1 has an invalid length. [ 769.323863][T30116] Cannot find add_set index 0 as target [ 769.350842][T30119] xt_cgroup: path and classid specified [ 769.414432][T30114] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6530'. [ 769.781645][T30132] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 770.321686][ T5631] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 770.338316][ T5631] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 770.347161][ T5631] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 770.358691][ T5631] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 770.367892][ T5631] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 771.151653][T30164] syzkaller0: entered promiscuous mode [ 771.172950][T30164] syzkaller0: entered allmulticast mode [ 772.523947][T27802] Bluetooth: hci3: command tx timeout [ 774.612586][T27802] Bluetooth: hci3: command tx timeout [ 776.554827][T30163] lo speed is unknown, defaulting to 1000 [ 776.697432][ T5631] Bluetooth: hci3: command tx timeout [ 776.918232][T30226] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6547'. [ 777.108331][T30150] lo speed is unknown, defaulting to 1000 [ 777.264450][T30163] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 777.708648][ T5631] Bluetooth: hci1: command 0x0406 tx timeout [ 778.045049][T30263] xt_hashlimit: size too large, truncated to 1048576 [ 778.167938][T30269] gre1: entered promiscuous mode [ 778.197015][T30269] gre1: entered allmulticast mode [ 778.334604][T30263] netlink: 288 bytes leftover after parsing attributes in process `syz.1.6558'. [ 778.345230][T30150] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 778.823409][T27802] Bluetooth: hci3: command tx timeout [ 779.238437][T30299] bond1: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-xor(2) [ 779.288550][T30299] bond1 (unregistering): Released all slaves [ 779.465885][T30317] bridge0: port 2(bridge_slave_1) entered disabled state [ 779.486181][T30317] bridge0: port 1(bridge_slave_0) entered disabled state [ 779.574134][T30318] bridge0: port 2(bridge_slave_1) entered blocking state [ 779.581570][T30318] bridge0: port 2(bridge_slave_1) entered forwarding state [ 779.589148][T30318] bridge0: port 1(bridge_slave_0) entered blocking state [ 779.596390][T30318] bridge0: port 1(bridge_slave_0) entered forwarding state [ 779.610143][T30318] bridge0: entered allmulticast mode [ 779.692583][T30322] geneve2: entered promiscuous mode [ 779.782117][T30328] netlink: 'syz.3.6574': attribute type 1 has an invalid length. [ 779.917216][T30328] bond1: entered promiscuous mode [ 779.929952][T30328] 8021q: adding VLAN 0 to HW filter on device bond1 [ 780.007535][T30333] bond1: (slave bridge2): making interface the new active one [ 780.015094][T30333] bridge2: entered promiscuous mode [ 780.021809][T30333] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 780.364991][T30343] netlink: 244 bytes leftover after parsing attributes in process `syz.0.6580'. [ 780.682774][T30346] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6580'. [ 780.778176][T30346] team0: Port device team_slave_0 removed [ 780.887582][T30362] netlink: 'syz.2.6584': attribute type 11 has an invalid length. [ 780.895494][T30362] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6584'. [ 781.017737][T30356] bond4: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 781.068027][T30356] bond4 (unregistering): Released all slaves [ 781.179954][T18895] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 781.220872][T18895] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 781.247821][T18895] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 781.260850][T30150] bridge0: port 1(bridge_slave_0) entered blocking state [ 781.268284][T30150] bridge0: port 1(bridge_slave_0) entered disabled state [ 781.278572][T30150] bridge_slave_0: entered allmulticast mode [ 781.290301][T30150] bridge_slave_0: entered promiscuous mode [ 781.299844][T18895] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 781.311220][T30150] bridge0: port 2(bridge_slave_1) entered blocking state [ 781.327271][T30150] bridge0: port 2(bridge_slave_1) entered disabled state [ 781.347694][T30150] bridge_slave_1: entered allmulticast mode [ 781.377398][T30150] bridge_slave_1: entered promiscuous mode [ 781.448776][T30150] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 781.462370][T30150] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 781.521849][T30374] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6588'. [ 781.530928][T30374] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6588'. [ 781.677963][T30374] vlan0: entered promiscuous mode [ 781.690709][T30150] team0: Port device team_slave_0 added [ 781.700069][T30150] team0: Port device team_slave_1 added [ 781.828600][T30150] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 781.846539][T30150] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 781.928333][T30150] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 782.029613][T30150] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 782.051914][T30150] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 782.097886][T30150] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 782.111505][T30379] lo speed is unknown, defaulting to 1000 [ 782.169697][T30384] gretap0: entered promiscuous mode [ 782.175598][T30384] vlan2: entered promiscuous mode [ 782.442042][T30402] bond1 (unregistering): Released all slaves [ 782.539106][T30150] hsr_slave_0: entered promiscuous mode [ 782.548573][T30150] hsr_slave_1: entered promiscuous mode [ 782.576657][T30150] debugfs: 'hsr0' already exists in 'hsr' [ 782.584754][T30150] Cannot create hsr debugfs directory [ 782.937221][T30379] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 783.072874][T30415] xt_CT: You must specify a L4 protocol and not use inversions on it [ 783.608075][T30432] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6605'. [ 783.713520][T18890] bond0: (slave bond_slave_0): interface is now down [ 783.762824][T18890] bond0: (slave bond_slave_1): interface is now down [ 783.796135][T18890] bond0: now running without any active interface! [ 784.549507][T30453] xt_addrtype: ipv6 PROHIBIT (THROW, NAT ..) matching not supported [ 784.588422][T30453] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 784.633409][T30453] netlink: 'syz.2.6611': attribute type 9 has an invalid length. [ 784.908409][T30477] syzkaller0: entered promiscuous mode [ 784.916435][T30477] syzkaller0: entered allmulticast mode [ 785.540784][T30491] tipc: Enabling of bearer rejected, media not registered [ 785.607935][T30493] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6623'. [ 785.846384][T30505] netlink: 'syz.0.6629': attribute type 10 has an invalid length. [ 786.226339][T30150] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 786.397243][T30150] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 786.426992][T30150] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 786.513379][T30150] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 786.527580][T30150] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 786.561608][T30150] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 786.570943][T30521] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6634'. [ 786.612041][T30150] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 786.619891][T30525] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6636'. [ 786.630965][T30150] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 787.161810][T30150] 8021q: adding VLAN 0 to HW filter on device bond0 [ 787.217532][T30150] 8021q: adding VLAN 0 to HW filter on device team0 [ 787.288148][T18892] bridge0: port 1(bridge_slave_0) entered blocking state [ 787.295458][T18892] bridge0: port 1(bridge_slave_0) entered forwarding state [ 787.352932][T18883] bridge0: port 2(bridge_slave_1) entered blocking state [ 787.360135][T18883] bridge0: port 2(bridge_slave_1) entered forwarding state [ 787.548037][T30522] infiniband syz0: set active [ 787.561853][T30522] infiniband syz0: added bond_slave_0 [ 787.570537][T30522] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 787.572864][T30522] infiniband syz0: Couldn't open port 1 [ 787.622129][T30522] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 787.650498][T30150] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 787.661113][T30522] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 787.678377][T30522] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 787.854016][T30522] RDS/IB: syz0: added [ 787.866826][T30564] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6643'. [ 787.877652][T30564] netlink: 65011 bytes leftover after parsing attributes in process `syz.1.6643'. [ 787.881304][T30522] smc: adding ib device syz0 with port count 1 [ 787.903374][T30564] IPVS: length: 24 != 6744 [ 787.918755][T30566] ipt_REJECT: TCP_RESET invalid for non-tcp [ 787.933039][T30522] smc: ib device syz0 port 1 has no pnetid [ 787.947464][T30564] tipc: Failed to remove unknown binding: 66,1,1/11578026:1171912174/1171912176 [ 788.299107][T30577] netlink: 'syz.1.6646': attribute type 12 has an invalid length. [ 788.334219][T30577] netlink: 'syz.1.6646': attribute type 29 has an invalid length. [ 788.351694][T30577] netlink: 'syz.1.6646': attribute type 7 has an invalid length. [ 788.370792][T30577] netlink: 'syz.1.6646': attribute type 39 has an invalid length. [ 788.448983][T30582] netlink: 27 bytes leftover after parsing attributes in process `syz.3.6647'. [ 788.454519][T11285] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 788.469915][T11285] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 788.479055][T11285] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 788.690610][T11285] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 788.803779][T30592] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 788.904301][T30597] ipt_REJECT: TCP_RESET invalid for non-tcp [ 789.032576][T30150] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 789.103926][T30597] netlink: 'syz.2.6652': attribute type 1 has an invalid length. [ 789.111739][T30597] netlink: 'syz.2.6652': attribute type 2 has an invalid length. [ 789.128007][T30602] bridge_slave_1: left allmulticast mode [ 789.133733][T30602] bridge_slave_1: left promiscuous mode [ 789.139709][T30602] bridge0: port 2(bridge_slave_1) entered disabled state [ 789.185869][T30602] bridge_slave_0: left allmulticast mode [ 789.191603][T30602] bridge_slave_0: left promiscuous mode [ 789.197439][T30602] bridge0: port 1(bridge_slave_0) entered disabled state [ 789.843450][T30620] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6658'. [ 790.020125][T30624] bridge0: port 3(ipvlan3) entered blocking state [ 790.029960][T30624] bridge0: port 3(ipvlan3) entered disabled state [ 790.041351][T30624] ipvlan3: entered allmulticast mode [ 790.047154][T30624] bridge0: entered allmulticast mode [ 790.058134][T30624] ipvlan3: left allmulticast mode [ 790.064998][T30624] bridge0: left allmulticast mode [ 790.216479][T30630] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6660'. [ 790.225539][T30630] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 790.268769][T30150] veth0_vlan: entered promiscuous mode [ 790.346678][T30150] veth1_vlan: entered promiscuous mode [ 790.454691][T30150] veth0_macvtap: entered promiscuous mode [ 790.477023][T30150] veth1_macvtap: entered promiscuous mode [ 790.575045][T30150] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 790.609734][T30150] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 790.667052][T11285] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.694009][T11285] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.702939][T11285] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 790.714076][T11285] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 791.217837][T30643] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6666'. [ 791.271609][T18892] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 791.305703][T18892] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 791.340256][T30643] syzkaller1: entered promiscuous mode [ 791.359922][T30643] syzkaller1: entered allmulticast mode [ 791.572382][T18866] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 791.580333][T18866] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 791.943278][T30650] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 792.268911][T30663] IPVS: set_ctl: invalid protocol: 41 255.255.255.255:20004 [ 792.429538][T30665] sctp: [Deprecated]: syz.4.6536 (pid 30665) Use of int in max_burst socket option. [ 792.429538][T30665] Use struct sctp_assoc_value instead [ 794.445754][T30691] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6675'. [ 794.687164][T30692] team0: Device xfrm0 is of different type [ 795.033136][T30695] tipc: Enabling of bearer rejected, already enabled [ 795.222027][T30701] netlink: 'syz.4.6676': attribute type 21 has an invalid length. [ 795.233182][T30701] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6676'. [ 795.692852][T30713] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 795.746044][T30715] macvtap0: entered allmulticast mode [ 795.808014][T30715] veth0_macvtap: entered allmulticast mode [ 796.458811][T30729] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 796.810781][T30733] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6686'. [ 796.846616][T30737] x_tables: duplicate underflow at hook 3 [ 796.972384][T30739] netlink: 'syz.3.6688': attribute type 2 has an invalid length. [ 797.049468][T30739] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 797.094362][T30742] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6689'. [ 797.112902][T30743] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6686'. [ 797.157892][T30733] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6686'. [ 797.175986][T30744] xt_hashlimit: size too large, truncated to 1048576 [ 797.290895][T30638] Set syz1 is full, maxelem 65536 reached [ 797.623840][T30752] geneve2: entered promiscuous mode [ 797.799313][T30757] Cannot find add_set index 46338 as target [ 797.823342][T30757] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6693'. [ 797.863554][T30760] Cannot find add_set index 46338 as target [ 798.474812][T30781] netlink: 180 bytes leftover after parsing attributes in process `syz.2.6699'. [ 798.584134][T30779] mac80211_hwsim hwsim52 ÿ: renamed from wlan1 (while UP) [ 799.178781][T30793] netlink: 172 bytes leftover after parsing attributes in process `syz.4.6703'. [ 799.301525][T30795] tap0: tun_chr_ioctl cmd 1074812117 [ 799.336306][T30797] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6704'. [ 799.386997][T30795] tap0: tun_chr_ioctl cmd 1074025676 [ 799.392386][T30795] tap0: owner set to 0 [ 799.415759][T30799] openvswitch: netlink: Missing key (keys=40, expected=100) [ 799.475935][T30799] openvswitch: netlink: Missing key (keys=40, expected=100) [ 799.835916][T30818] netlink: 'syz.0.6712': attribute type 10 has an invalid length. [ 799.909988][T30828] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6714'. [ 799.986202][T30829] tipc: Enabled bearer , priority 0 [ 800.099638][T30829] syzkaller0: entered promiscuous mode [ 800.105212][T30829] syzkaller0: entered allmulticast mode [ 800.112014][T30829] tipc: Resetting bearer [ 800.270712][T30826] tipc: Resetting bearer [ 804.198358][T30826] tipc: Disabling bearer [ 804.408243][T30880] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6728'. [ 805.038497][T30908] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6737'. [ 805.124024][T30914] netlink: 'syz.1.6739': attribute type 1 has an invalid length. [ 805.135373][T30916] netlink: 144 bytes leftover after parsing attributes in process `syz.3.6740'. [ 805.167452][T30918] netlink: 'syz.4.6741': attribute type 2 has an invalid length. [ 805.175257][T30918] netlink: 'syz.4.6741': attribute type 11 has an invalid length. [ 805.183117][T30918] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6741'. [ 805.195380][T30919] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6739'. [ 805.301462][T30910] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 805.312452][T30914] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 805.580726][T30939] netlink: 104 bytes leftover after parsing attributes in process `syz.2.6746'. [ 805.921405][T30965] lo speed is unknown, defaulting to 1000 [ 805.996390][T30973] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 806.119140][T30977] netlink: 180 bytes leftover after parsing attributes in process `syz.1.6756'. [ 806.437049][T30984] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6758'. [ 806.646914][T30965] ±ÿª¨úrBº“ speed is unknown, defaulting to 1000 [ 806.676791][T30995] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 806.915351][T31004] xt_CT: You must specify a L4 protocol and not use inversions on it [ 807.008994][T31009] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6768'. [ 807.020343][T31009] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6768'. [ 807.035166][T31004] tipc: Enabled bearer , priority 0 [ 807.202431][T31004] syzkaller0: entered promiscuous mode [ 807.207992][T31004] syzkaller0: entered allmulticast mode [ 807.214751][T31004] tipc: Resetting bearer [ 807.743555][T11285] tipc: Resetting bearer [ 807.761989][T31003] tipc: Resetting bearer [ 810.916654][T31003] tipc: Disabling bearer [ 810.937468][T31040] team0: Device xfrm0 is of different type [ 810.990693][T31045] tipc: Started in network mode [ 810.995691][T31045] tipc: Node identity aaaaaaaaaa1a, cluster identity 4711 [ 811.004938][T31045] tipc: Enabled bearer , priority 0 [ 811.014007][T31048] __nla_validate_parse: 7 callbacks suppressed [ 811.014024][T31048] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6776'. [ 811.555871][ T1316] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 811.715425][T31072] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 812.113354][T31096] siw: device registration error -23 [ 812.122473][ T8173] tipc: Node number set to 11578026 [ 812.172543][T31096] smbdirect: ib_dev[syz2] removed [ 812.334939][T31098] bridge2: entered promiscuous mode [ 812.349539][T31105] syz.2.6791: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 812.365056][T31105] CPU: 1 UID: 0 PID: 31105 Comm: syz.2.6791 Not tainted syzkaller #0 PREEMPT(full) [ 812.365090][T31105] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 812.365121][T31105] Call Trace: [ 812.365133][T31105] [ 812.365146][T31105] dump_stack_lvl+0xe8/0x150 [ 812.365203][T31105] warn_alloc+0x24c/0x270 [ 812.365241][T31105] ? stack_depot_save_flags+0x33/0x800 [ 812.365278][T31105] ? __pfx_warn_alloc+0x10/0x10 [ 812.365311][T31105] ? kasan_save_track+0x3e/0x80 [ 812.365344][T31105] ? __kasan_kmalloc+0x93/0xb0 [ 812.365378][T31105] ? xsk_setsockopt+0x52a/0x960 [ 812.365530][T31105] ? do_sock_setsockopt+0x17c/0x1b0 [ 812.365571][T31105] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 812.365604][T31105] ? do_syscall_64+0x174/0x580 [ 812.365640][T31105] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 812.365679][T31105] __vmalloc_node_range_noprof+0x12c/0x1730 [ 812.365744][T31105] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 812.365775][T31105] ? __kasan_kmalloc+0x93/0xb0 [ 812.365814][T31105] ? __kmalloc_cache_noprof+0x32d/0x660 [ 812.365845][T31105] ? __kmalloc_cache_noprof+0x150/0x660 [ 812.365878][T31105] vmalloc_user_noprof+0xad/0xe0 [ 812.365908][T31105] ? xskq_create+0xbf/0x170 [ 812.365940][T31105] xskq_create+0xbf/0x170 [ 812.365972][T31105] xsk_init_queue+0x8a/0xe0 [ 812.366000][T31105] xsk_setsockopt+0x52a/0x960 [ 812.366025][T31105] ? __fget_files+0x2a/0x420 [ 812.366061][T31105] ? __pfx_xsk_setsockopt+0x10/0x10 [ 812.366088][T31105] ? __pfx_aa_sk_perm+0x10/0x10 [ 812.366129][T31105] ? aa_sock_opt_perm+0xff/0x1a0 [ 812.366155][T31105] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 812.366221][T31105] ? __pfx_xsk_setsockopt+0x10/0x10 [ 812.366250][T31105] do_sock_setsockopt+0x17c/0x1b0 [ 812.366297][T31105] __x64_sys_setsockopt+0x13d/0x1b0 [ 812.366331][T31105] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 812.366352][T31105] do_syscall_64+0x174/0x580 [ 812.366393][T31105] ? trace_irq_disable+0x3b/0x140 [ 812.366422][T31105] ? clear_bhb_loop+0x40/0x90 [ 812.366447][T31105] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 812.366468][T31105] RIP: 0033:0x7ff28d99de59 [ 812.366489][T31105] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 812.366509][T31105] RSP: 002b:00007ff28e895028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 812.366542][T31105] RAX: ffffffffffffffda RBX: 00007ff28dc25fa0 RCX: 00007ff28d99de59 [ 812.366558][T31105] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000003 [ 812.366572][T31105] RBP: 00007ff28da33e6f R08: 0000000000000004 R09: 0000000000000000 [ 812.366585][T31105] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 812.366599][T31105] R13: 00007ff28dc26038 R14: 00007ff28dc25fa0 R15: 00007ffe15d489c8 [ 812.366633][T31105] [ 812.366655][T31105] Mem-Info: [ 812.367575][T31098] bridge2: entered allmulticast mode [ 812.376114][T31105] active_anon:5719 inactive_anon:0 isolated_anon:0 [ 812.376114][T31105] active_file:0 inactive_file:43696 isolated_file:0 [ 812.376114][T31105] unevictable:768 dirty:57 writeback:0 [ 812.376114][T31105] slab_reclaimable:13276 slab_unreclaimable:153491 [ 812.376114][T31105] mapped:30486 shmem:1295 pagetables:3580 [ 812.376114][T31105] sec_pagetables:0 bounce:0 [ 812.376114][T31105] kernel_misc_reclaimable:0 [ 812.376114][T31105] free:1259117 free_pcp:12418 free_cma:0 [ 812.376237][T31105] Node 0 active_anon:22876kB inactive_anon:0kB active_file:0kB inactive_file:174580kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:121944kB dirty:224kB writeback:0kB shmem:3644kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:18924kB pagetables:14180kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 812.376300][T31105] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 812.376364][T31105] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 812.376486][T31105] lowmem_reserve[]: 0 2489 2489 2489 2489 [ 812.376547][T31105] Node 0 DMA32 free:1079812kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:22876kB inactive_anon:0kB active_file:0kB inactive_file:174580kB unevictable:1536kB writepending:224kB zspages:0kB present:3129332kB managed:2548796kB mlocked:0kB bounce:0kB free_pcp:41364kB local_pcp:20204kB free_cma:0kB [ 812.376618][T31105] lowmem_reserve[]: 0 0 0 0 0 [ 812.376667][T31105] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:264kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 812.902204][T31098] team0: Port device bridge2 added [ 812.969697][T31103] bridge0: port 3(team0) entered blocking state [ 812.976174][T31103] bridge0: port 3(team0) entered disabled state [ 812.979958][T31105] lowmem_reserve[]: 0 0 0 0 0 [ 812.993140][T31103] team0: entered allmulticast mode [ 812.998589][T31103] team_slave_0: entered allmulticast mode [ 813.009265][T31105] Node 1 Normal free:3941496kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:8056kB local_pcp:6548kB free_cma:0kB [ 813.048703][T31103] team_slave_1: entered allmulticast mode [ 813.069266][T31105] lowmem_reserve[]: 0 0 0 0 0 [ 813.076295][T31105] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 813.163609][T31112] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6792'. [ 813.180251][T31105] Node 0 DMA32: 544*4kB (UME) 150*8kB (UME) 411*16kB (UME) 814*32kB (UME) 501*64kB (UME) 409*128kB (UME) 326*256kB (UME) 232*512kB (UE) 171*1024kB (UME) 7*2048kB (UM) 138*4096kB (UM) = 1077344kB [ 813.199600][T31105] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 813.211187][T31105] Node 1 Normal: 1*4kB (U) 3*8kB (UM) 3*16kB (UM) 1*32kB (M) 3*64kB (UM) 3*128kB (UM) 6*256kB (UM) 4*512kB (UM) 1*1024kB (M) 0*2048kB 961*4096kB (UM) = 3941548kB [ 813.227606][T31105] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 813.237182][T31105] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 813.266252][T31105] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 813.299884][T31105] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 813.331533][T31103] team0: entered promiscuous mode [ 813.336692][T31103] team_slave_0: entered promiscuous mode [ 813.342585][T31103] team_slave_1: entered promiscuous mode [ 813.349377][T31103] bridge0: port 3(team0) entered blocking state [ 813.355766][T31103] bridge0: port 3(team0) entered forwarding state [ 813.404876][T31105] 44986 total pagecache pages [ 813.409813][T31105] 0 pages in swap cache [ 813.434523][T31105] Free swap = 124996kB [ 813.438751][T31105] Total swap = 124996kB [ 813.449380][T31105] 2097051 pages RAM [ 813.453231][T31105] 0 pages HighMem/MovableOnly [ 813.457929][T31105] 428171 pages reserved [ 813.468509][T31094] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6789'. [ 813.503134][T31105] 0 pages cma reserved [ 813.519154][T31111] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6792'. [ 813.590356][T31117] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6793'. [ 813.636624][T31117] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6793'. [ 813.997253][T31140] xt_TPROXY: Can be used only with -p tcp or -p udp [ 814.882433][T31190] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 815.136625][T31203] netlink: 'syz.4.6823': attribute type 21 has an invalid length. [ 815.145521][T31203] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6823'. [ 815.246207][T31203] syzkaller0: entered promiscuous mode [ 815.262851][T31203] syzkaller0: entered allmulticast mode [ 815.424821][T31217] netlink: 'syz.3.6826': attribute type 1 has an invalid length. [ 815.432646][T31217] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6826'. [ 815.581075][T31222] Bluetooth: MGMT ver 1.23 [ 815.608509][T31222] netlink: 'syz.0.6830': attribute type 1 has an invalid length. [ 815.714522][T31234] netlink: 'syz.4.6834': attribute type 32 has an invalid length. [ 815.746141][T31229] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6831'. [ 815.756863][T31234] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6834'. [ 815.909206][T31234] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 816.010550][T31246] netlink: 'syz.1.6836': attribute type 1 has an invalid length. [ 816.075201][T31246] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 816.271100][T31263] __nla_validate_parse: 1 callbacks suppressed [ 816.271125][T31263] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6840'. [ 816.366964][T31263] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 816.458090][T31263] netlink: 152 bytes leftover after parsing attributes in process `syz.2.6840'. [ 816.706030][T31282] netlink: 'syz.3.6844': attribute type 1 has an invalid length. [ 816.912066][T31282] bond3: entered promiscuous mode [ 816.934534][T31282] 8021q: adding VLAN 0 to HW filter on device bond3 [ 817.021697][T31301] netlink: 60 bytes leftover after parsing attributes in process `syz.0.6845'. [ 817.044005][T31283] 8021q: adding VLAN 0 to HW filter on device bond3 [ 817.084606][T31283] bond3: (slave vti0): The slave device specified does not support setting the MAC address [ 817.094702][T31283] bond3: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 817.238176][T31283] bond3: (slave vti0): making interface the new active one [ 817.245475][T31283] vti0: entered promiscuous mode [ 817.252596][T31283] bond3: (slave vti0): Enslaving as an active interface with an up link [ 817.282333][T31307] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6848'. [ 817.772269][T31329] netlink: 'syz.1.6856': attribute type 4 has an invalid length. [ 817.804379][T31329] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6856'. [ 817.838905][T31329] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 818.143235][T31352] nbd: must specify at least one socket [ 821.913094][T31358] tipc: Invalid UDP bearer configuration [ 821.913159][T31358] tipc: Enabling of bearer rejected, failed to enable media [ 822.041038][T31387] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 822.152437][T31396] netlink: 256 bytes leftover after parsing attributes in process `syz.2.6868'. [ 822.251209][T31401] batadv_slave_1: entered allmulticast mode [ 822.294994][T31402] dvmrp8: entered allmulticast mode [ 822.352374][T31411] netlink: 576 bytes leftover after parsing attributes in process `syz.3.6866'. [ 822.383771][T31413] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6872'. [ 822.385838][T31410] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 822.394833][T31413] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6872'. [ 822.422474][T31402] batadv_slave_1: left allmulticast mode [ 822.444514][T31392] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6866'. [ 822.473160][T31410] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6870'. [ 822.521076][T31392] 8021q: adding VLAN 0 to HW filter on device bond4 [ 822.715148][T31411] netlink: 'syz.3.6866': attribute type 1 has an invalid length. [ 822.756607][T31411] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6866'. [ 822.781168][T31414] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 822.910805][T31427] macvlan3: entered promiscuous mode [ 822.916208][T31427] macvlan3: entered allmulticast mode [ 822.922232][T31427] bond1: (slave macvlan3): Error -98 calling set_mac_address [ 822.967561][T31440] netlink: 'syz.0.6877': attribute type 1 has an invalid length. [ 823.006807][T31442] netlink: 68 bytes leftover after parsing attributes in process `syz.4.6879'. [ 823.127027][T31440] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 823.295998][T31461] netlink: 'syz.2.6883': attribute type 3 has an invalid length. [ 823.315399][T31461] netlink: 3 bytes leftover after parsing attributes in process `syz.2.6883'. [ 823.418630][T31467] netlink: 52 bytes leftover after parsing attributes in process `syz.4.6885'. [ 823.627255][T31475] xt_hashlimit: size too large, truncated to 1048576 [ 823.840840][T27802] Bluetooth: hci5: command 0x0406 tx timeout [ 824.058148][T31495] netlink: 'syz.3.6894': attribute type 3 has an invalid length. [ 824.096471][T18875] bond0: (slave bond_slave_0): interface is now down [ 824.159106][T18875] bond0: (slave bond_slave_1): interface is now down [ 824.339748][T31506] macvlan0: entered promiscuous mode [ 824.353009][T31506] netlink: 'syz.0.6895': attribute type 13 has an invalid length. [ 824.367383][T31506] veth1_macvtap: left promiscuous mode [ 824.381549][T31506] macsec0: entered allmulticast mode [ 824.859440][T31526] 8021q: adding VLAN 0 to HW filter on device bond3 [ 824.962688][T31537] siw: device registration error -23 [ 824.970446][T31537] ±ÿª¨úrBº“: renamed from lo (while UP) [ 825.075845][T31537] syzkaller1: entered promiscuous mode [ 825.081497][T31537] syzkaller1: entered allmulticast mode [ 825.712647][T31564] tipc: Started in network mode [ 825.720728][T31564] tipc: Node identity ac14140f, cluster identity 4711 [ 825.732072][T31564] tipc: Enabled bearer , priority 10 [ 825.837309][T31568] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 825.902507][T31572] FAULT_INJECTION: forcing a failure. [ 825.902507][T31572] name failslab, interval 1, probability 0, space 0, times 0 [ 825.915246][T31572] CPU: 1 UID: 0 PID: 31572 Comm: syz.4.6915 Not tainted syzkaller #0 PREEMPT(full) [ 825.915279][T31572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 825.915294][T31572] Call Trace: [ 825.915304][T31572] [ 825.915315][T31572] dump_stack_lvl+0xe8/0x150 [ 825.915359][T31572] should_fail_ex+0x40c/0x560 [ 825.915392][T31572] should_failslab+0xa8/0x100 [ 825.915427][T31572] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 825.915453][T31572] ? local_lock_release+0x9c/0x160 [ 825.915487][T31572] ? __alloc_skb+0x1d7/0x7a0 [ 825.915511][T31572] ? __alloc_skb+0x1d7/0x7a0 [ 825.915545][T31572] __alloc_skb+0x1d7/0x7a0 [ 825.915586][T31572] netlink_ack+0x136/0xb30 [ 825.915618][T31572] ? __pfx_genl_rcv_msg+0x10/0x10 [ 825.915643][T31572] ? __pfx_nl80211_post_doit+0x10/0x10 [ 825.915758][T31572] ? __pfx_ref_tracker_free+0x10/0x10 [ 825.915800][T31572] netlink_rcv_skb+0x2a4/0x4a0 [ 825.915833][T31572] ? __pfx_genl_rcv_msg+0x10/0x10 [ 825.915859][T31572] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 825.915908][T31572] ? down_read+0x2be/0x330 [ 825.915945][T31572] genl_rcv+0x28/0x40 [ 825.915968][T31572] netlink_unicast+0x7bb/0x940 [ 825.916011][T31572] netlink_sendmsg+0x813/0xb40 [ 825.916080][T31572] ? __pfx_netlink_sendmsg+0x10/0x10 [ 825.916120][T31572] ? aa_sock_msg_perm+0xf1/0x1b0 [ 825.916151][T31572] ? __pfx_netlink_sendmsg+0x10/0x10 [ 825.916182][T31572] sock_sendmsg_nosec+0x13a/0x180 [ 825.916212][T31572] ____sys_sendmsg+0x54e/0x850 [ 825.916253][T31572] ? __pfx_____sys_sendmsg+0x10/0x10 [ 825.916297][T31572] ? import_iovec+0x73/0xa0 [ 825.916343][T31572] ___sys_sendmsg+0x2a5/0x360 [ 825.916371][T31572] ? __lock_acquire+0x683/0x2cf0 [ 825.916407][T31572] ? __pfx____sys_sendmsg+0x10/0x10 [ 825.916474][T31572] ? __fget_files+0x2a/0x420 [ 825.916501][T31572] ? __fget_files+0x3a2/0x420 [ 825.916539][T31572] __x64_sys_sendmsg+0x1b1/0x290 [ 825.916578][T31572] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 825.916627][T31572] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 825.916651][T31572] do_syscall_64+0x174/0x580 [ 825.916677][T31572] ? trace_irq_disable+0x3b/0x140 [ 825.916704][T31572] ? clear_bhb_loop+0x40/0x90 [ 825.916740][T31572] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 825.916760][T31572] RIP: 0033:0x7fd36899de59 [ 825.916779][T31572] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 825.916796][T31572] RSP: 002b:00007fd3698b5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 825.916819][T31572] RAX: ffffffffffffffda RBX: 00007fd368c25fa0 RCX: 00007fd36899de59 [ 825.916832][T31572] RDX: 0000000000008000 RSI: 0000200000000780 RDI: 0000000000000004 [ 825.916845][T31572] RBP: 00007fd3698b5090 R08: 0000000000000000 R09: 0000000000000000 [ 825.916857][T31572] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 825.916868][T31572] R13: 00007fd368c26038 R14: 00007fd368c25fa0 R15: 00007ffde0980e88 [ 825.916900][T31572] [ 826.721230][T18866] bond0: (slave bond_slave_0): interface is now down [ 826.788821][T18866] bond0: (slave bond_slave_1): interface is now down [ 826.820219][T31594] bridge_slave_0: left allmulticast mode [ 826.837461][T31594] bridge_slave_0: left promiscuous mode [ 826.852018][T31594] bridge0: port 1(bridge_slave_0) entered disabled state [ 826.924680][T31594] bridge_slave_1: left allmulticast mode [ 826.942730][T31594] bridge_slave_1: left promiscuous mode [ 826.966300][T31594] bridge0: port 2(bridge_slave_1) entered disabled state [ 827.008813][T31594] bond0: (slave bond_slave_0): Releasing backup interface [ 827.116609][T31594] bond0: (slave bond_slave_1): Releasing backup interface [ 827.214945][T31594] team0: Port device team_slave_0 removed [ 827.222149][T31614] __nla_validate_parse: 4 callbacks suppressed [ 827.222171][T31614] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6924'. [ 827.252728][T31614] xt_hashlimit: size too large, truncated to 1048576 [ 827.329227][T31594] team0: Port device team_slave_1 removed [ 827.336448][T31594] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 827.343884][T31594] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 827.360445][T31594] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 827.367889][T31594] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 827.377587][T31594] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 827.402873][T31092] veth1_to_bridge: left allmulticast mode [ 827.432863][T31092] veth1_to_bridge: left promiscuous mode [ 827.439067][T31092] bridge0: port 2(veth1_to_bridge) entered disabled state [ 827.469732][T31092] dummy0: left allmulticast mode [ 827.475996][T31092] dummy0: left promiscuous mode [ 827.483164][T31092] bridge0: port 1(dummy0) entered disabled state [ 827.674074][T31092] bond2 (unregistering): (slave vti0): Releasing backup interface [ 827.682056][T31092] vti0 (unregistering): left promiscuous mode [ 827.794365][T31092] bond8 (unregistering): (slave geneve3): Releasing active interface [ 827.934194][T31092] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 827.943696][T31092] batadv0: left allmulticast mode [ 827.949299][T31092] bond0 (unregistering): Released all slaves [ 827.961260][T31092] bond1 (unregistering): Released all slaves [ 827.982228][T31092] bond2 (unregistering): Released all slaves [ 827.999792][T31092] bond3 (unregistering): Released all slaves [ 828.016510][T31092] bond4 (unregistering): Released all slaves [ 828.032625][T31092] bond5 (unregistering): Released all slaves [ 828.053465][T31092] bond6 (unregistering): (slave veth9): Releasing active interface [ 828.061426][T31092] batadv1: entered promiscuous mode [ 828.070139][T31092] bond6 (unregistering): (slave batadv1): Releasing active interface [ 828.105215][T31092] bond6 (unregistering): (slave veth11): Releasing active interface [ 828.114931][T31092] bond6 (unregistering): Released all slaves [ 828.136117][T31092] bond7 (unregistering): Released all slaves [ 828.156017][T31092] bond8 (unregistering): Released all slaves [ 828.176343][T31092] bond9 (unregistering): (slave bond10): Releasing active interface [ 828.185272][T31092] bond9 (unregistering): Released all slaves [ 828.221292][T31092] bond10 (unregistering): Released all slaves [ 828.236907][T31092] bond11 (unregistering): Released all slaves [ 828.252920][T31092] bond12 (unregistering): Released all slaves [ 828.271661][ T8173] tipc: Node number set to 2886997007 [ 828.290019][T18893] tipc: Resetting bearer [ 828.367538][T31620] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6929'. [ 828.376501][T31620] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6929'. [ 828.385469][T31620] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6929'. [ 828.595547][T31092] tipc: Left network mode [ 828.759131][T31629] block nbd3: Unsupported socket: should be TCP or UNIX. [ 828.793839][T31632] netlink: 'syz.0.6933': attribute type 1 has an invalid length. [ 829.199654][T31643] bond5: Unable to set peer notification delay as MII monitoring is disabled [ 829.222511][T31638] netlink: 'syz.2.6935': attribute type 1 has an invalid length. [ 829.257285][T31638] netlink: 'syz.2.6935': attribute type 3 has an invalid length. [ 829.265108][T31638] netlink: 172 bytes leftover after parsing attributes in process `syz.2.6935'. [ 829.274177][T31638] NCSI netlink: No device for ifindex 813332851 [ 829.281561][T31638] netlink: 'syz.2.6935': attribute type 1 has an invalid length. [ 829.289356][T31638] netlink: 'syz.2.6935': attribute type 3 has an invalid length. [ 829.297124][T31643] bond5 (unregistering): Released all slaves [ 829.297133][T31638] netlink: 172 bytes leftover after parsing attributes in process `syz.2.6935'. [ 829.297156][T31638] NCSI netlink: No device for ifindex 813332851 [ 829.362458][T18904] bond0: (slave bond_slave_0): interface is now down [ 829.369234][T18904] bond0: (slave bond_slave_1): interface is now down [ 829.386574][T18904] bond0: now running without any active interface! [ 829.789399][T31664] netlink: 112 bytes leftover after parsing attributes in process `syz.1.6945'. [ 829.968131][T31671] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6947'. [ 829.979434][T31668] ipt_rpfilter: unknown options [ 830.010250][T31671] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6947'. [ 830.047486][T31675] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6949'. [ 830.456607][T31679] bond1: option lp_interval: invalid value (0) [ 830.463261][T31679] bond1: option lp_interval: allowed values 1 - 2147483647 [ 830.533300][T31679] bond1 (unregistering): Released all slaves [ 830.749110][T31701] netlink: 'syz.0.6956': attribute type 25 has an invalid length. [ 831.062908][T31092] hsr_slave_0: left promiscuous mode [ 831.070343][T31092] hsr_slave_1: left promiscuous mode [ 831.076860][T31092] batman_adv: batadv0: Removing interface: ipvlan3 [ 831.125957][T31715] nbd: couldn't find a device at index 0 [ 831.221864][T31722] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 831.288724][T31721] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 831.959059][T31752] netlink: 'syz.3.6970': attribute type 49 has an invalid length. [ 832.020297][ C1] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 832.389922][T18895] smbdirect: ib_dev[syú2] removed [ 832.591453][T31752] ip6gretap0: entered promiscuous mode [ 832.603831][T31752] ip6gretap0: entered allmulticast mode [ 832.665729][T31768] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 833.078093][T31092] IPVS: stop unused estimator thread 0... [ 833.157049][T31792] __nla_validate_parse: 3 callbacks suppressed [ 833.157071][T31792] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6980'. [ 833.215973][T31793] netlink: 36 bytes leftover after parsing attributes in process `syz.3.6980'. [ 833.382700][T31806] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6984'. [ 833.412755][T31806] netlink: 'syz.3.6984': attribute type 8 has an invalid length. [ 833.705200][T31825] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6989'. [ 833.767420][T31829] lo speed is unknown, defaulting to 1000 [ 833.773312][T31829] lo speed is unknown, defaulting to 1000 [ 833.779951][T31829] lo speed is unknown, defaulting to 1000 [ 833.826516][T31829] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 833.843278][T31829] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 833.860457][T31829] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 833.882520][T31829] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 833.993599][T31829] lo speed is unknown, defaulting to 1000 [ 834.000997][T31829] lo speed is unknown, defaulting to 1000 [ 834.008175][T31829] lo speed is unknown, defaulting to 1000 [ 834.053375][T31829] lo speed is unknown, defaulting to 1000 [ 834.061168][T31829] lo speed is unknown, defaulting to 1000 [ 834.068925][T31829] lo speed is unknown, defaulting to 1000 [ 834.076627][T31829] lo speed is unknown, defaulting to 1000 [ 834.084332][T31829] lo speed is unknown, defaulting to 1000 [ 834.091921][T31829] lo speed is unknown, defaulting to 1000 [ 834.099356][T31829] lo speed is unknown, defaulting to 1000 [ 834.107019][T31829] lo speed is unknown, defaulting to 1000 [ 834.114623][T31829] lo speed is unknown, defaulting to 1000 [ 834.324617][T31846] netlink: 'syz.2.6998': attribute type 13 has an invalid length. [ 834.345563][T31846] tipc: Resetting bearer [ 834.398380][ T5760] lo speed is unknown, defaulting to 1000 [ 834.704583][T31852] team0: Device ipvlan3 failed to register rx_handler [ 835.009065][T31757] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 835.298252][T31861] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7002'. [ 835.637358][T31876] xt_nfacct: accounting object `syz1' does not exist [ 835.776825][T31882] netlink: 'syz.3.7007': attribute type 5 has an invalid length. [ 835.863670][T31882] tipc: Started in network mode [ 835.868606][T31882] tipc: Node identity d67960b54706, cluster identity 4711 [ 835.876750][T31882] tipc: Enabled bearer , priority 0 [ 836.017476][T31882] syzkaller0: entered promiscuous mode [ 836.023459][T31882] syzkaller0: entered allmulticast mode [ 836.031194][T31882] tipc: Resetting bearer [ 836.049291][T31878] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 836.097227][T31882] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7007'. [ 836.109630][T31878] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 836.148247][T31900] xfrm0: Caught tx_queue_len zero misconfig [ 836.293344][T31896] ip6_vti0: entered promiscuous mode [ 836.297034][T31913] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7014'. [ 836.309066][T31913] netlink: 'syz.2.7014': attribute type 7 has an invalid length. [ 836.317753][T31913] netlink: 'syz.2.7014': attribute type 8 has an invalid length. [ 836.327111][T31913] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7014'. [ 836.338012][T31896] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7006'. [ 836.347561][T31881] tipc: Resetting bearer [ 836.475820][T31917] netlink: 'syz.0.7015': attribute type 8 has an invalid length. [ 836.788760][T31924] netlink: 16 bytes leftover after parsing attributes in process `syz.1.7017'. [ 839.029057][T31881] tipc: Disabling bearer [ 839.139951][T31925] team0: Device xfrm0 is of different type [ 839.234092][T31926] tipc: Enabling of bearer rejected, already enabled [ 839.272894][ T5760] tipc: Node number set to 2441044149 [ 839.454228][T31949] netlink: 'syz.2.7022': attribute type 1 has an invalid length. [ 839.545884][T18893] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 839.566544][T31940] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 839.917087][T31971] tipc: Failed to remove unknown binding: 66,0,0/11578026:453954173/453954175 [ 839.957736][T31971] tipc: Failed to remove unknown binding: 66,0,0/11578026:453954173/453954174 [ 839.987491][T31973] syzkaller0: entered promiscuous mode [ 840.013373][T31973] syzkaller0: entered allmulticast mode [ 840.022389][T31975] tipc: Failed to remove unknown binding: 66,0,0/11578026:453954173/453954175 [ 840.049784][T31975] tipc: Failed to remove unknown binding: 66,0,0/11578026:453954173/453954174 [ 840.089664][T31978] netlink: 'syz.0.7030': attribute type 1 has an invalid length. [ 840.372962][T31994] vlan2: entered promiscuous mode [ 840.434116][T31996] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7036'. [ 840.443062][T31996] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7036'. [ 840.460329][T31992] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7033'. [ 840.469268][T31992] netlink: 'syz.1.7033': attribute type 10 has an invalid length. [ 840.477114][T31992] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7033'. [ 841.272206][T32034] netlink: 'syz.4.7051': attribute type 2 has an invalid length. [ 841.482011][T32052] netlink: 256 bytes leftover after parsing attributes in process `syz.0.7055'. [ 841.559714][T32052] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7055'. [ 841.573383][T32059] netlink: 'syz.1.7059': attribute type 1 has an invalid length. [ 841.582436][T32059] netlink: 'syz.1.7059': attribute type 7 has an invalid length. [ 841.592480][T32059] netlink: 'syz.1.7059': attribute type 8 has an invalid length. [ 841.613671][T32059] netlink: 208 bytes leftover after parsing attributes in process `syz.1.7059'. [ 841.624270][T32059] NCSI netlink: No device for ifindex 65584 [ 841.786562][T32069] netlink: 'syz.0.7062': attribute type 2 has an invalid length. [ 841.794762][T32069] netlink: 244 bytes leftover after parsing attributes in process `syz.0.7062'. [ 842.042207][T32082] netlink: 'syz.2.7068': attribute type 1 has an invalid length. [ 842.109322][T32082] bond2: (slave geneve3): making interface the new active one [ 842.117909][T32082] bond2: (slave geneve3): Enslaving as an active interface with an up link [ 842.127301][T18893] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 842.168085][T18893] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 842.236354][T32082] tipc: Resetting bearer [ 842.242544][T32082] tipc: Resetting bearer [ 842.309092][T32096] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7068'. [ 842.331223][ T5760] lo speed is unknown, defaulting to 1000 [ 842.337113][T18893] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 842.359765][T18893] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 842.417881][T32096] 8021q: adding VLAN 0 to HW filter on device bond2 [ 842.831165][T32118] bridge0: port 2(bridge_slave_1) entered disabled state [ 843.006948][T32130] netlink: 'syz.0.7082': attribute type 2 has an invalid length. [ 843.138825][ T5746] IPVS: starting estimator thread 0... [ 843.235829][T32125] syzkaller1: entered promiscuous mode [ 843.241403][T32125] syzkaller1: entered allmulticast mode [ 843.382183][T32138] netlink: 36 bytes leftover after parsing attributes in process `syz.2.7085'. [ 843.405503][T32146] syzkaller0: entered promiscuous mode [ 843.413257][T32135] IPVS: using max 30 ests per chain, 72000 per kthread [ 843.417697][T32146] syzkaller0: entered allmulticast mode [ 843.745196][T32159] openvswitch: netlink: IPv4 tunnel dst address is zero [ 843.753431][T32159] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 844.040938][T32178] 8021q: adding VLAN 0 to HW filter on device bond1 [ 844.097978][T32179] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 844.436108][T32200] veth5: entered promiscuous mode [ 844.525739][T32207] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 844.547519][T32214] bond5: entered promiscuous mode [ 844.553117][T32214] 8021q: adding VLAN 0 to HW filter on device bond5 [ 844.569360][T32204] openvswitch: netlink: IPv6 tunnel dst address is zero [ 844.623229][T32204] 8021q: adding VLAN 0 to HW filter on device bond3 [ 844.634007][T32204] bond0: (slave bond3): Enslaving as an active interface with a down link [ 844.684751][T32214] 8021q: adding VLAN 0 to HW filter on device bond5 [ 844.692031][T32214] bond5: (slave sit1): The slave device specified does not support setting the MAC address [ 844.703638][T32214] bond5: (slave sit1): Error -95 calling set_mac_address [ 844.935481][T32233] validate_nla: 3 callbacks suppressed [ 844.935503][T32233] netlink: 'syz.4.7113': attribute type 1 has an invalid length. [ 845.516013][T32267] __nla_validate_parse: 11 callbacks suppressed [ 845.516037][T32267] netlink: 256 bytes leftover after parsing attributes in process `syz.1.7122'. [ 845.580219][T32267] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7122'. [ 845.613970][T32271] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7123'. [ 845.629391][T32279] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 845.672764][T32271] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 845.710786][T32279] tipc: Enabling of bearer rejected, failed to enable media [ 845.848345][T32286] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7126'. [ 846.043239][T32294] netlink: 40 bytes leftover after parsing attributes in process `syz.1.7128'. [ 846.072766][T32294] Bluetooth: MGMT ver 1.23 [ 846.178840][T32304] lo: entered allmulticast mode [ 846.540309][T32314] syzkaller1: entered promiscuous mode [ 846.547627][T32314] syzkaller1: entered allmulticast mode [ 846.557179][T32312] netlink: 'syz.3.7135': attribute type 1 has an invalid length. [ 846.607986][T32314] netlink: 'syz.0.7133': attribute type 61 has an invalid length. [ 846.916812][T32332] netlink: 'syz.2.7141': attribute type 1 has an invalid length. [ 846.942114][T32332] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 846.962648][T32338] netlink: 72 bytes leftover after parsing attributes in process `syz.1.7142'. [ 847.141066][T32351] netlink: 'syz.2.7146': attribute type 21 has an invalid length. [ 847.411599][T32347] tipc: Resetting bearer [ 847.565221][T32372] netlink: 1116 bytes leftover after parsing attributes in process `syz.4.7147'. [ 847.717890][T32347] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 847.757561][T32347] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 847.840387][T32381] netlink: 1068 bytes leftover after parsing attributes in process `syz.3.7148'. [ 847.947728][T32347] veth0_macvtap: left allmulticast mode [ 848.149894][T32351] netlink: 132 bytes leftover after parsing attributes in process `syz.2.7146'. [ 848.228167][T32394] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7150'. [ 848.277989][T32352] veth1_to_bond: entered allmulticast mode [ 848.381077][T32388] 8021q: adding VLAN 0 to HW filter on device bond2 [ 848.394543][T32388] 8021q: adding VLAN 0 to HW filter on device bond5 [ 848.402158][T18897] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 848.411090][T18897] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 848.439222][T18897] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 848.448243][T18897] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 848.506369][T32352] veth1_to_bond: left allmulticast mode [ 848.530711][T18897] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 848.565469][T18897] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 848.630923][T18897] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 848.644605][T18897] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 848.786687][T32401] nbd: must specify a device to reconfigure [ 849.063768][T32421] team0: Device xfrm0 is of different type [ 849.099623][T32421] tipc: Enabled bearer , priority 0 [ 849.263510][T32433] netlink: 'syz.0.7160': attribute type 11 has an invalid length. [ 849.333303][T32440] 8021q: adding VLAN 0 to HW filter on device bond0 [ 849.412719][T32438] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 849.434941][T32438] IPVS: set_ctl: invalid protocol: 22 172.20.20.187:19999 [ 849.717656][T32454] IPVS: set_ctl: invalid protocol: 1 0.0.0.0:0 [ 850.339824][T32479] syzkaller1: entered promiscuous mode [ 850.345434][T32479] syzkaller1: entered allmulticast mode [ 850.404535][T32479] vlan0: mtu greater than device maximum [ 850.421159][T32479] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 850.452572][T32483] ÿÿÿÿÿÿ: renamed from virt_wifi0 [ 850.642896][T32479] macvtap1: entered promiscuous mode [ 850.648295][T32479] vlan0: entered promiscuous mode [ 850.654092][T32479] macvtap1: entered allmulticast mode [ 850.659528][T32479] vlan0: entered allmulticast mode [ 850.664683][T32479] veth0_vlan: entered allmulticast mode [ 850.809576][T32494] pim6reg: entered allmulticast mode [ 851.076209][T32503] __nla_validate_parse: 9 callbacks suppressed [ 851.076232][T32503] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7176'. [ 851.140254][T32503] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7176'. [ 851.191978][T32504] netlink: 576 bytes leftover after parsing attributes in process `syz.1.7177'. [ 851.254368][T32419] lo speed is unknown, defaulting to 1000 [ 851.574090][T32523] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7179'. [ 852.576730][T32418] lo speed is unknown, defaulting to 1000 [ 852.849252][T32565] netlink: 'syz.0.7187': attribute type 4 has an invalid length. [ 853.221414][T32579] xt_hashlimit: invalid rate [ 853.254273][T32580] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7191'. [ 853.366342][T32580] tipc: Enabling of bearer rejected, already enabled [ 853.514088][T32585] team0: Device xfrm0 is of different type [ 853.712768][T32600] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7197'. [ 853.767413][T32600] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7197'. [ 853.895403][T32602] tipc: Invalid UDP bearer configuration [ 853.895464][T32602] tipc: Enabling of bearer rejected, failed to enable media [ 853.937485][T32604] netlink: 45349 bytes leftover after parsing attributes in process `syz.2.7199'. [ 854.027717][T32608] netlink: 'syz.0.7202': attribute type 30 has an invalid length. [ 854.037211][T32604] 0ªX¹¦Dö»: renamed from gretap0 (while UP) [ 854.055524][T32604] 0ªX¹¦Dö»: entered allmulticast mode [ 854.353354][T32620] netlink: 'syz.2.7205': attribute type 2 has an invalid length. [ 854.488890][T32625] veth1_to_bond: entered allmulticast mode [ 854.495825][T32625] veth1_to_bond: entered promiscuous mode [ 854.503249][T32626] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7207'. [ 854.526409][T32627] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7206'. [ 854.649199][T32625] veth1_to_bond (unregistering): left allmulticast mode [ 854.701056][T32625] veth1_to_bond (unregistering): left promiscuous mode [ 854.718556][T32625] bond0: (slave bond_slave_1): Releasing backup interface [ 854.773808][T32632] team0: Port device xfrm0 added [ 855.094409][T32648] netlink: 'syz.1.7210': attribute type 16 has an invalid length. [ 855.123109][T32648] netlink: 'syz.1.7210': attribute type 17 has an invalid length. [ 855.239080][T32652] netlink: 'syz.3.7214': attribute type 1 has an invalid length. [ 855.411216][T32648] 8021q: adding VLAN 0 to HW filter on device team0 [ 855.438028][T32648] tipc: Resetting bearer [ 855.452958][T32648] tipc: Resetting bearer [ 855.489694][T32648] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 855.588962][T32648] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 855.599046][T32648] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 855.611999][T32648] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 855.643739][T32648] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 855.663232][T32648] veth1_vlan: left promiscuous mode [ 855.670055][T32648] veth0_vlan: left promiscuous mode [ 855.686509][T32648] veth0_vlan: entered promiscuous mode [ 855.712397][T32648] veth1_vlan: entered promiscuous mode [ 855.726729][T32648] veth1_macvtap: left promiscuous mode [ 855.734361][T32648] veth0_macvtap: left promiscuous mode [ 855.743930][T32648] veth0_macvtap: entered promiscuous mode [ 855.749731][T32648] veth0_macvtap: entered allmulticast mode [ 855.756079][T32648] macvtap0: left allmulticast mode [ 855.762646][T32648] veth0_macvtap: left allmulticast mode [ 855.769973][T32648] veth1_macvtap: entered promiscuous mode [ 855.792154][T32648] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 855.801136][T32648] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 855.809699][T32648] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 855.818513][T32648] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 855.866417][T32648] 8021q: adding VLAN 0 to HW filter on device bond1 [ 855.876941][T32648] 8021q: adding VLAN 0 to HW filter on device bond2 [ 855.895572][T32648] 8021q: adding VLAN 0 to HW filter on device bond3 [ 855.910628][T32648] bond3: entered allmulticast mode [ 855.915823][T32648] bridge2: entered allmulticast mode [ 855.930015][T32648] macvtap1: left allmulticast mode [ 855.935193][T32648] bond3: left allmulticast mode [ 855.941314][T32648] bridge2: left allmulticast mode [ 855.947112][T32648] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 855.955719][T32648] bond3: entered allmulticast mode [ 855.960851][T32648] bridge2: entered allmulticast mode [ 855.966349][T32648] macvtap2: left allmulticast mode [ 855.971484][T32648] bond3: left allmulticast mode [ 855.976340][T32648] bridge2: left allmulticast mode [ 856.001270][T32648] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 856.011895][T32648] bridge2: entered promiscuous mode [ 856.045603][T32648] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 856.062070][T32652] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 856.184157][T18893] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.221380][T18893] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.230244][T18893] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.245082][T18893] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.254601][T18893] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.263848][T18893] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.275623][T18893] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 856.284758][T18893] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 856.461587][T32675] __nla_validate_parse: 2 callbacks suppressed [ 856.461609][T32675] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7220'. [ 856.522397][T32675] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7220'. [ 856.637772][T32639] lo speed is unknown, defaulting to 1000 [ 856.696417][T32680] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7222'. [ 856.909901][T32682] xfrm0: entered promiscuous mode [ 856.927772][T32682] xfrm0: entered allmulticast mode [ 856.939288][T32682] team0: Device xfrm0 is of different type [ 857.114603][T32689] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 857.694959][T32709] bond6: option lacp_active: mode dependency failed, not supported in mode active-backup(1) [ 857.729216][T32709] bond6 (unregistering): Released all slaves [ 857.785868][T32714] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7231'. [ 858.394087][T32736] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7236'. [ 858.437897][T32738] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7236'. [ 858.469087][T32736] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7236'. [ 858.498687][T32738] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7236'. [ 858.518551][T32739] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7237'. [ 858.730017][T18849] tipc: Resetting bearer [ 858.837633][T32756] syzkaller1: entered promiscuous mode [ 858.843794][T32756] syzkaller1: entered allmulticast mode [ 858.888650][T32759] netlink: 60 bytes leftover after parsing attributes in process `syz.3.7241'. [ 859.105051][T32764] syzkaller0: entered promiscuous mode [ 859.114037][T32764] syzkaller0: entered allmulticast mode [ 859.937366][ T331] netlink: 'syz.1.7256': attribute type 9 has an invalid length. [ 860.292866][ T345] syzkaller0: entered promiscuous mode [ 860.298433][ T345] syzkaller0: entered allmulticast mode [ 860.458460][ T360] SET target dimension over the limit! [ 860.497947][ T363] netlink: 'syz.4.7264': attribute type 1 has an invalid length. [ 860.511504][ T363] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 860.726166][ T376] syzkaller0: entered promiscuous mode [ 860.740745][ T376] syzkaller0: entered allmulticast mode [ 861.313231][ T399] team0: Device xfrm0 is of different type [ 861.380331][ T395] macvlan0: left promiscuous mode [ 861.547140][ T413] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 861.667192][ T422] netlink: 'syz.4.7283': attribute type 32 has an invalid length. [ 861.710074][ T422] __nla_validate_parse: 13 callbacks suppressed [ 861.710102][ T422] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7283'. [ 861.784873][ T422] bond3: Setting coupled_control to off (0) [ 861.859184][ T424] vlan2: entered promiscuous mode [ 861.864251][ T424] bridge0: entered promiscuous mode [ 861.885483][ T430] syzkaller0: entered promiscuous mode [ 861.891366][ T430] syzkaller0: entered allmulticast mode [ 862.195459][ T445] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7290'. [ 862.227060][ T448] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7291'. [ 862.259429][ T445] team0: Device xfrm0 is of different type [ 862.324084][ T452] netlink: 'syz.1.7294': attribute type 25 has an invalid length. [ 862.338199][ T452] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7294'. [ 862.397594][ T454] netlink: 52 bytes leftover after parsing attributes in process `syz.4.7293'. [ 862.413856][ T452] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7294'. [ 862.417311][ T454] netlink: 52 bytes leftover after parsing attributes in process `syz.4.7293'. [ 862.456153][ T452] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 862.496301][ T452] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 862.516777][ T452] gretap2: entered promiscuous mode [ 862.522064][ T452] gretap2: entered allmulticast mode [ 862.601145][ T462] netlink: 4552 bytes leftover after parsing attributes in process `syz.0.7296'. [ 862.622312][ T462] netlink: 4552 bytes leftover after parsing attributes in process `syz.0.7296'. [ 863.127337][ T492] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 863.255376][ T507] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7310'. [ 863.398385][ T515] netlink: 'syz.3.7313': attribute type 1 has an invalid length. [ 863.507146][ T515] 8021q: adding VLAN 0 to HW filter on device bond6 [ 863.576075][ T526] vlan3: entered allmulticast mode [ 864.081846][ T553] batadv_slave_0: entered promiscuous mode [ 864.092496][ T556] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 864.211831][ T556] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 864.721299][T27802] Bluetooth: hci2: command 0x0406 tx timeout [ 864.783811][ T578] netlink: 'syz.1.7332': attribute type 10 has an invalid length. [ 864.838400][ T578] team0: Port device geneve1 added [ 864.993730][ T584] IPv6: addrconf: prefix option has invalid lifetime [ 865.200138][ T565] lo speed is unknown, defaulting to 1000 [ 866.204004][ T639] netlink: 'syz.3.7354': attribute type 1 has an invalid length. [ 866.328489][ T639] 8021q: adding VLAN 0 to HW filter on device bond7 [ 867.089052][ T696] __nla_validate_parse: 16 callbacks suppressed [ 867.089085][ T696] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7366'. [ 867.376558][ T708] FAULT_INJECTION: forcing a failure. [ 867.376558][ T708] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 867.394706][ T708] CPU: 0 UID: 0 PID: 708 Comm: syz.4.7370 Not tainted syzkaller #0 PREEMPT(full) [ 867.394739][ T708] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 867.394757][ T708] Call Trace: [ 867.394768][ T708] [ 867.394778][ T708] dump_stack_lvl+0xe8/0x150 [ 867.394823][ T708] should_fail_ex+0x40c/0x560 [ 867.394857][ T708] _copy_from_user+0x2d/0xb0 [ 867.394893][ T708] __copy_msghdr+0x390/0x590 [ 867.394934][ T708] ___sys_sendmsg+0x213/0x360 [ 867.394964][ T708] ? __lock_acquire+0x683/0x2cf0 [ 867.395012][ T708] ? __pfx____sys_sendmsg+0x10/0x10 [ 867.395078][ T708] ? __fget_files+0x2a/0x420 [ 867.395106][ T708] ? __fget_files+0x3a2/0x420 [ 867.395144][ T708] __x64_sys_sendmsg+0x1b1/0x290 [ 867.395176][ T708] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 867.395225][ T708] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 867.395250][ T708] do_syscall_64+0x174/0x580 [ 867.395279][ T708] ? trace_irq_disable+0x3b/0x140 [ 867.395307][ T708] ? clear_bhb_loop+0x40/0x90 [ 867.395333][ T708] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 867.395377][ T708] RIP: 0033:0x7fd36899de59 [ 867.395398][ T708] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 867.395417][ T708] RSP: 002b:00007fd3698b5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 867.395440][ T708] RAX: ffffffffffffffda RBX: 00007fd368c25fa0 RCX: 00007fd36899de59 [ 867.395456][ T708] RDX: 0000000000008000 RSI: 0000200000000780 RDI: 0000000000000004 [ 867.395469][ T708] RBP: 00007fd3698b5090 R08: 0000000000000000 R09: 0000000000000000 [ 867.395482][ T708] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 867.395495][ T708] R13: 00007fd368c26038 R14: 00007fd368c25fa0 R15: 00007ffde0980e88 [ 867.395530][ T708] [ 867.826409][ T721] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7375'. [ 867.846256][ T722] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7374'. [ 867.905503][ T721] bond4 (unregistering): Released all slaves [ 867.939724][ T726] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7372'. [ 867.953234][ T718] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7372'. [ 867.964296][ T733] netlink: 36 bytes leftover after parsing attributes in process `syz.0.7377'. [ 867.971639][ T728] x_tables: duplicate underflow at hook 2 [ 867.989880][ T723] netlink: 60 bytes leftover after parsing attributes in process `syz.4.7375'. [ 867.999897][ T723] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7375'. [ 868.009453][ T725] netlink: 256 bytes leftover after parsing attributes in process `syz.4.7375'. [ 868.012238][ T723] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7375'. [ 868.226570][ T747] netlink: 'syz.3.7380': attribute type 1 has an invalid length. [ 868.276823][ T747] 8021q: adding VLAN 0 to HW filter on device bond8 [ 868.321273][ T747] bond8: (slave syz_tun): Enslaving as a backup interface with an up link [ 868.538202][ T760] syzkaller0: entered promiscuous mode [ 868.551539][ T760] syzkaller0: entered allmulticast mode [ 868.764911][ T764] syzkaller0: entered promiscuous mode [ 868.772723][ T764] syzkaller0: entered allmulticast mode [ 868.825540][ T773] netlink: 'syz.4.7388': attribute type 1 has an invalid length. [ 868.850450][ T773] 8021q: adding VLAN 0 to HW filter on device bond4 [ 868.884281][ T773] bond4: (slave ip6erspan0): making interface the new active one [ 868.895878][ T773] bond4: (slave ip6erspan0): Enslaving as an active interface with an up link [ 868.921305][ T773] macvlan2: entered promiscuous mode [ 868.926648][ T773] macvlan2: entered allmulticast mode [ 868.933161][ T773] bond4: entered allmulticast mode [ 868.938328][ T773] ip6erspan0: entered allmulticast mode [ 868.944091][ T773] ip6erspan0: entered promiscuous mode [ 868.950033][ T773] bond4: entered promiscuous mode [ 868.956798][ T773] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 868.968610][ T773] team0: Port device macvlan2 added [ 869.438248][ T744] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 869.816646][ T803] syzkaller0: entered promiscuous mode [ 869.822792][ T803] syzkaller0: entered allmulticast mode [ 870.188478][ T824] siw: device registration error -23 [ 870.504593][ T831] netlink: 'syz.1.7404': attribute type 30 has an invalid length. [ 870.615584][ T831] bond6: option arp_missed_max: invalid value (0) [ 870.625944][ T831] bond6: option arp_missed_max: allowed values 1 - 255 [ 870.637411][ T831] bond6 (unregistering): Released all slaves [ 870.677842][ T836] 8021q: VLANs not supported on sit0 [ 870.924927][ T840] team0: Device ipvlan2 is already an upper device of the team interface [ 871.151828][ T846] SET target dimension over the limit! [ 872.490742][ T920] sctp: [Deprecated]: syz.1.7424 (pid 920) Use of struct sctp_assoc_value in delayed_ack socket option. [ 872.490742][ T920] Use struct sctp_sack_info instead [ 872.634401][ T932] __nla_validate_parse: 6 callbacks suppressed [ 872.634425][ T932] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7427'. [ 872.869530][ T944] netlink: 32 bytes leftover after parsing attributes in process `syz.4.7432'. [ 872.911919][ T1316] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 873.078301][ T959] netlink: 36 bytes leftover after parsing attributes in process `syz.1.7435'. [ 873.136731][ T965] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7433'. [ 873.190915][ T965] ip6t_srh: unknown srh match flags 4000 [ 873.217242][ T899] lo speed is unknown, defaulting to 1000 [ 873.538815][ T974] netlink: 'syz.1.7440': attribute type 9 has an invalid length. [ 873.559443][ T975] netlink: 'syz.1.7440': attribute type 9 has an invalid length. [ 873.644129][ T990] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7441'. [ 874.307312][ T1012] IPVS: set_ctl: invalid protocol: 59 172.20.20.38:20000 [ 874.467862][ T5760] IPVS: starting estimator thread 0... [ 874.791892][ T1018] IPVS: using max 35 ests per chain, 84000 per kthread [ 874.850845][ T1035] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7452'. [ 874.869937][ T1037] netlink: 'syz.2.7453': attribute type 32 has an invalid length. [ 874.877826][ T1037] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7453'. [ 875.033859][ T1037] bond5: option coupled_control: invalid value (192) [ 875.047011][ T1037] bond5 (unregistering): Released all slaves [ 875.092756][ T1041] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7454'. [ 875.191829][ T1041] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7454'. [ 875.300810][ T1056] bond0: entered promiscuous mode [ 875.306005][ T1056] bond_slave_0: entered promiscuous mode [ 875.311851][ T1041] can: request_module (can-proto-0) failed. [ 875.322653][ T1056] bond_slave_1: entered promiscuous mode [ 875.487025][ T1079] A link change request failed with some changes committed already. Interface 26±ÿª¨úrBº“ may have been left with an inconsistent configuration, please check. [ 876.044949][ T1108] netlink: 'syz.2.7466': attribute type 2 has an invalid length. [ 876.053723][ T1108] netlink: 'syz.2.7466': attribute type 1 has an invalid length. [ 876.064192][ T1108] netlink: 'syz.2.7466': attribute type 2 has an invalid length. [ 876.140228][ T1112] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7466'. [ 876.656722][ T1086] lo speed is unknown, defaulting to 1000 [ 877.098371][ T1152] netlink: 'syz.3.7479': attribute type 1 has an invalid length. [ 877.752416][ T1183] __nla_validate_parse: 4 callbacks suppressed [ 877.752457][ T1183] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7490'. [ 877.832116][ T1186] netlink: 'syz.4.7488': attribute type 21 has an invalid length. [ 877.840009][ T1186] netlink: 128 bytes leftover after parsing attributes in process `syz.4.7488'. [ 877.854798][ T1187] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7489'. [ 877.864024][ T1187] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7489'. [ 877.873234][ T1187] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7489'. [ 877.882426][ T1187] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7489'. [ 877.891632][ T1187] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7489'. [ 877.959465][ T1188] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7489'. [ 877.975021][ T1188] netlink: 'syz.0.7489': attribute type 3 has an invalid length. [ 878.262749][ T1197] bridge0: adding interface bridge0 with same address as a received packet (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 878.315838][ T1186] netlink: 3 bytes leftover after parsing attributes in process `syz.4.7488'. [ 878.564953][ T1208] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7497'. [ 878.832132][ T1208] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 879.043438][ T1205] nbd3: detected capacity change from 0 to 63 [ 879.059727][ T1220] block nbd3: NBD_DISCONNECT [ 879.064602][ T1220] block nbd3: Disconnected due to user request. [ 879.070886][ T1220] block nbd3: shutting down sockets [ 879.122153][ T1227] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 879.150856][ C1] blk_print_req_error: 112 callbacks suppressed [ 879.150881][ C1] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 879.166311][ C1] buffer_io_error: 138 callbacks suppressed [ 879.166331][ C1] Buffer I/O error on dev nbd3, logical block 0, async page read [ 879.180062][ C1] Buffer I/O error on dev nbd3, logical block 1, async page read [ 879.187922][ C1] Buffer I/O error on dev nbd3, logical block 2, async page read [ 879.195745][ C1] Buffer I/O error on dev nbd3, logical block 3, async page read [ 879.214599][ T1569] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 879.226290][ T1569] Buffer I/O error on dev nbd3, logical block 0, async page read [ 879.234137][ T1569] Buffer I/O error on dev nbd3, logical block 1, async page read [ 879.284376][ T1569] Buffer I/O error on dev nbd3, logical block 2, async page read [ 879.292320][ T1569] Buffer I/O error on dev nbd3, logical block 3, async page read [ 879.300737][ T1569] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 879.309885][ T1569] Buffer I/O error on dev nbd3, logical block 0, async page read [ 879.317682][ T1569] Buffer I/O error on dev nbd3, logical block 1, async page read [ 879.325858][ T1569] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 879.335646][ T1569] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 879.345288][ T1569] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 879.375401][ T1569] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 879.388017][ T1569] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 879.397286][ T550] ldm_validate_partition_table(): Disk read failed. [ 879.404121][ T1569] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 879.417550][ T1569] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 879.427545][ T550] Dev nbd3: unable to read RDB block 0 [ 879.434874][ T550] nbd3: unable to read partition table [ 879.449362][ T550] ldm_validate_partition_table(): Disk read failed. [ 879.458341][ T550] Dev nbd3: unable to read RDB block 0 [ 879.480142][ T550] nbd3: unable to read partition table [ 879.716851][ T1175] lo speed is unknown, defaulting to 1000 [ 879.755566][ T1230] syzkaller1: entered promiscuous mode [ 879.774546][ T1230] syzkaller1: entered allmulticast mode [ 879.907441][ T1243] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 879.943712][T11285] nci: nci_ntf_packet: unknown ntf opcode 0x25 [ 880.177709][ T1263] netlink: 'syz.2.7510': attribute type 4 has an invalid length. [ 880.205898][T32357] lo speed is unknown, defaulting to 1000 [ 880.211715][T32357] syz2: Port: 1 Link DOWN [ 880.781129][ T1246] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 881.178574][ T1285] netlink: 'syz.4.7516': attribute type 2 has an invalid length. [ 881.247621][ T1288] netlink: 'syz.3.7517': attribute type 1 has an invalid length. [ 881.386367][ T1288] 8021q: adding VLAN 0 to HW filter on device bond9 [ 881.455408][ T1290] bond9: (slave gretap1): making interface the new active one [ 881.464097][ T1290] bond9: (slave gretap1): Enslaving as an active interface with an up link [ 881.861485][ T1302] bond6: entered promiscuous mode [ 881.866638][ T1302] bond6: entered allmulticast mode [ 882.122253][ T1334] netlink: 'syz.4.7530': attribute type 1 has an invalid length. [ 882.138733][ T1337] xt_recent: hitcount (4294901760) is larger than allowed maximum (65535) [ 882.211616][ T1334] netlink: 'syz.4.7530': attribute type 2 has an invalid length. [ 882.298045][ T1340] No such timeout policy "syz0" [ 882.463912][ T1350] ip6gre1: entered promiscuous mode [ 882.469201][ T1350] ip6gre1: entered allmulticast mode [ 882.846224][ T1378] netlink: 'syz.4.7542': attribute type 1 has an invalid length. [ 882.865304][ T1378] netlink: 'syz.4.7542': attribute type 3 has an invalid length. [ 882.873105][ T1378] __nla_validate_parse: 9 callbacks suppressed [ 882.873130][ T1378] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7542'. [ 883.511036][ T1417] netlink: 524 bytes leftover after parsing attributes in process `syz.2.7554'. [ 883.542805][ T1422] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 883.636673][ T1427] netlink: 'syz.3.7557': attribute type 39 has an invalid length. [ 883.680684][ T1427] hsr_slave_0: left promiscuous mode [ 883.687620][ T1427] hsr_slave_1: left promiscuous mode [ 883.790186][ T1433] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7560'. [ 883.905151][ T1411] openvswitch: netlink: Unexpected mask (mask=8000, allowed=10048) [ 884.087899][ T1441] netlink: 204 bytes leftover after parsing attributes in process `syz.4.7563'. [ 884.102613][ T1440] netlink: 204 bytes leftover after parsing attributes in process `syz.4.7563'. [ 884.147351][ T1447] netlink: 64985 bytes leftover after parsing attributes in process `syz.0.7565'. [ 884.200276][ T1446] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7564'. [ 884.564526][ T1466] netlink: 'syz.1.7571': attribute type 10 has an invalid length. [ 884.648573][ T1466] veth0_to_bond: entered promiscuous mode [ 884.662911][ T1468] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7572'. [ 884.704523][ T1468] 8021q: adding VLAN 0 to HW filter on device bond7 [ 884.847243][ T1482] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7576'. [ 885.111870][ T1492] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 885.119217][ T1492] IPv6: NLM_F_CREATE should be set when creating new route [ 885.126575][ T1492] IPv6: NLM_F_CREATE should be set when creating new route [ 885.133863][ T1492] IPv6: NLM_F_CREATE should be set when creating new route [ 885.201827][ T1494] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 885.309480][ T1507] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7583'. [ 885.647081][ T1523] syzkaller1: entered allmulticast mode [ 885.978366][ T1546] nbd: must specify a device to reconfigure [ 888.082324][ T1651] netlink: 'syz.2.7624': attribute type 1 has an invalid length. [ 888.172794][ T1652] netlink: 'syz.0.7625': attribute type 13 has an invalid length. [ 888.183752][ T1652] __nla_validate_parse: 7 callbacks suppressed [ 888.183772][ T1652] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7625'. [ 888.226054][ T1660] tipc: Enabling of bearer rejected, failed to enable media [ 888.628835][ T1660] syzkaller0: entered promiscuous mode [ 888.638118][ T1660] syzkaller0: entered allmulticast mode [ 888.892313][ T1666] bridge0: port 2(bridge_slave_1) entered disabled state [ 888.899953][ T1666] bridge0: port 1(bridge_slave_0) entered disabled state [ 888.915847][ T1666] tipc: Resetting bearer [ 888.987302][ T1666] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 889.172190][ T1666] gre1: left promiscuous mode [ 889.176927][ T1666] gre1: left allmulticast mode [ 889.226040][ T1666] bond1: left promiscuous mode [ 889.235405][ T1666] bridge2: left promiscuous mode [ 889.256291][ T1666] bond3: left promiscuous mode [ 889.261320][ T1666] vti0: left promiscuous mode [ 889.286295][ T1666] vlan2: left promiscuous mode [ 889.291169][ T1666] bridge0: left promiscuous mode [ 889.307827][ T1674] tipc: New replicast peer: 255.255.255.255 [ 889.316112][ T1674] tipc: Enabled bearer , priority 10 [ 889.323905][ T1675] tipc: Enabling of bearer rejected, already enabled [ 889.506164][ T1690] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7635'. [ 892.681401][T18873] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 892.690342][T18873] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.728720][T18873] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 892.737752][T18873] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.793384][T18873] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 892.810646][T18873] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 892.888859][T18873] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 892.906095][T18873] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 893.025126][ T1707] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7638'. [ 893.050852][ T1707] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7638'. [ 893.065934][ T1707] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7638'. [ 893.105054][ T1707] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7638'. [ 893.114457][ T1707] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7638'. [ 893.607056][ T1738] netlink: 'syz.1.7649': attribute type 2 has an invalid length. [ 893.719127][ T1744] netlink: 'syz.3.7651': attribute type 1 has an invalid length. [ 893.805968][ T1744] 8021q: adding VLAN 0 to HW filter on device bond10 [ 894.046160][ T1740] bond10: (slave geneve2): making interface the new active one [ 894.078930][ T1740] bond10: (slave geneve2): Enslaving as an active interface with an up link [ 894.117643][T18876] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.141065][T18876] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.150287][T18876] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.162026][T18876] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 894.235320][ T1756] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7656'. [ 895.144072][ T1788] netlink: 'syz.3.7665': attribute type 1 has an invalid length. [ 895.350102][ T1817] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 895.357404][ T1817] IPv6: NLM_F_CREATE should be set when creating new route [ 895.383474][ T1788] 8021q: adding VLAN 0 to HW filter on device bond11 [ 895.716484][ T1833] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7679'. [ 895.837664][ T1840] netlink: 60 bytes leftover after parsing attributes in process `syz.4.7681'. [ 895.849918][ T1840] netlink: 60 bytes leftover after parsing attributes in process `syz.4.7681'. [ 896.008699][ T1846] netlink: 'syz.3.7684': attribute type 7 has an invalid length. [ 896.038826][ T1846] netlink: 140 bytes leftover after parsing attributes in process `syz.3.7684'. [ 896.197828][ T1855] sctp: [Deprecated]: syz.4.7686 (pid 1855) Use of int in max_burst socket option deprecated. [ 896.197828][ T1855] Use struct sctp_assoc_value instead [ 896.217708][ T1856] sctp: [Deprecated]: syz.4.7686 (pid 1856) Use of int in max_burst socket option deprecated. [ 896.217708][ T1856] Use struct sctp_assoc_value instead [ 896.309158][ T1854] Cannot find add_set index 1 as target [ 896.408190][ T1867] ipt_REJECT: TCP_RESET invalid for non-tcp [ 896.436424][T18873] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 896.444355][T18873] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 896.535819][ T1869] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 896.602306][ T1882] bridge0: port 3(veth1_to_bridge) entered blocking state [ 896.609912][ T1882] bridge0: port 3(veth1_to_bridge) entered disabled state [ 896.618896][ T1882] veth1_to_bridge: entered allmulticast mode [ 896.675899][ T1882] veth1_to_bridge: entered promiscuous mode [ 896.760010][ T1887] batadv_slave_0: entered promiscuous mode [ 896.769014][ T1887] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7695'. [ 897.151750][ T1908] netlink: 52 bytes leftover after parsing attributes in process `syz.4.7702'. [ 897.163156][ T1906] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7704'. [ 897.172101][ T1906] netlink: 'syz.0.7704': attribute type 10 has an invalid length. [ 897.192692][ T1908] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7702'. [ 897.201697][ T1908] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7702'. [ 897.427269][ T1910] syz.4.7705 (1910) used obsolete PPPIOCDETACH ioctl [ 898.091542][ T1958] nbd: nbd1 already in use [ 898.096378][ T1958] block nbd1: NBD_DISCONNECT [ 898.101113][ T1958] block nbd1: Send disconnect failed -32 [ 898.106907][ T1958] block nbd1: Send disconnect failed -32 [ 898.304632][ T1962] netlink: 'syz.4.7722': attribute type 2 has an invalid length. [ 898.355083][ T1967] IPv6: NLM_F_CREATE should be specified when creating new route [ 898.391703][ T1967] netlink: 'syz.2.7721': attribute type 1 has an invalid length. [ 898.515264][ T1974] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 898.592295][ T1983] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 898.634502][ T1985] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 899.256023][ T2025] __nla_validate_parse: 18 callbacks suppressed [ 899.256048][ T2025] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7741'. [ 899.310133][ T2028] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7740'. [ 899.450908][ T2036] sit1: entered allmulticast mode [ 899.783725][ T2051] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7751'. [ 899.792943][ T2051] nbd: couldn't find a device at index 0 [ 899.863792][ T2058] netlink: 'syz.1.7755': attribute type 1 has an invalid length. [ 899.884207][ T2058] netlink: 228 bytes leftover after parsing attributes in process `syz.1.7755'. [ 900.048744][ T2071] syz_tun: entered allmulticast mode [ 900.121428][ T2071] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7757'. [ 900.193611][ T2070] syz_tun: left allmulticast mode [ 900.508539][ T2107] netlink: 'syz.2.7766': attribute type 1 has an invalid length. [ 900.694363][ T2107] 8021q: adding VLAN 0 to HW filter on device bond6 [ 900.822238][ T2109] macvlan4: entered promiscuous mode [ 900.827674][ T2109] macvlan4: entered allmulticast mode [ 900.852626][ T2109] bond6: entered promiscuous mode [ 900.931547][ T2109] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 900.948963][ T2109] bond6: left promiscuous mode [ 901.269899][ T2137] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 901.732189][ T2154] syzkaller1: entered promiscuous mode [ 901.737744][ T2154] syzkaller1: entered allmulticast mode [ 901.776511][ T2152] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7778'. [ 901.855771][ T2161] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7780'. [ 901.932790][ T2161] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7780'. [ 901.942509][ T2161] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7780'. [ 901.952743][ T2161] netlink: 40 bytes leftover after parsing attributes in process `syz.3.7780'. [ 903.023394][ T2208] syzkaller0: entered promiscuous mode [ 903.029018][ T2208] syzkaller0: entered allmulticast mode [ 906.260744][ T2239] __nla_validate_parse: 62 callbacks suppressed [ 906.260784][ T2239] netlink: 36 bytes leftover after parsing attributes in process `syz.3.7799'. [ 906.365050][ T2239] syzkaller0: entered promiscuous mode [ 906.370605][ T2239] syzkaller0: entered allmulticast mode [ 906.526151][ T2243] bond0: (slave ip6gre0): Error: Device can not be enslaved while up [ 906.694308][ T2263] siw: device registration error -23 [ 906.812368][ T2268] sctp: [Deprecated]: syz.2.7807 (pid 2268) Use of struct sctp_assoc_value in delayed_ack socket option. [ 906.812368][ T2268] Use struct sctp_sack_info instead [ 907.078017][ T2284] netlink: 52 bytes leftover after parsing attributes in process `syz.0.7812'. [ 907.211615][ T2288] netlink: 'syz.2.7813': attribute type 32 has an invalid length. [ 907.552320][ T2297] dvmrp0: left allmulticast mode [ 907.614496][ T2309] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7821'. [ 907.673135][ T2311] netlink: 'syz.2.7822': attribute type 1 has an invalid length. [ 907.706166][ T2296] 8021q: adding VLAN 0 to HW filter on device bond6 [ 907.715600][ T2296] bond0: (slave bond6): Enslaving as an active interface with an up link [ 907.790846][ T2311] 8021q: adding VLAN 0 to HW filter on device bond7 [ 907.935983][ T2311] bond7: (slave bridge2): making interface the new active one [ 907.987298][ T2311] bond7: (slave bridge2): Enslaving as an active interface with an up link [ 908.154437][ T2336] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7827'. [ 908.328713][ T2346] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7828'. [ 908.377810][ T2345] syzkaller0: entered promiscuous mode [ 908.383369][ T2345] syzkaller0: entered allmulticast mode [ 908.453844][ T2333] digital: digital_start_poll: Unknown protocol [ 908.469205][ T2354] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7833'. [ 908.579985][ T2359] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7833'. [ 908.624365][ T2356] 8021q: adding VLAN 0 to HW filter on device bond6 [ 908.632831][ T2356] bond6: entered promiscuous mode [ 908.638576][ T2356] bond0: (slave bond6): Enslaving as an active interface with an up link [ 908.842170][ T2374] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7836'. [ 908.896136][ T2378] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7838'. [ 908.905083][ T2378] netlink: 176 bytes leftover after parsing attributes in process `syz.0.7838'. [ 908.914186][ T2378] netlink: 'syz.0.7838': attribute type 5 has an invalid length. [ 909.128822][ T2396] openvswitch: netlink: Multiple metadata blocks provided [ 909.371925][ T2396] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 909.486039][ T2396] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 909.570122][ T2414] syzkaller0: entered promiscuous mode [ 909.576468][ T2414] syzkaller0: entered allmulticast mode [ 909.638337][ T2423] gre1: entered promiscuous mode [ 909.878274][ T2437] sctp: [Deprecated]: syz.0.7854 (pid 2437) Use of int in maxseg socket option. [ 909.878274][ T2437] Use struct sctp_assoc_value instead [ 910.092787][ T2448] netlink: 'syz.3.7862': attribute type 2 has an invalid length. [ 910.132919][ T2453] syz_tun: entered allmulticast mode [ 910.171157][ T2453] syz_tun: left allmulticast mode [ 910.258466][ T2460] netlink: 'syz.0.7863': attribute type 13 has an invalid length. [ 910.267820][ T2460] netlink: 'syz.0.7863': attribute type 58 has an invalid length. [ 910.291860][ T2462] netlink: 'syz.4.7865': attribute type 1 has an invalid length. [ 910.325166][ T2462] netlink: 'syz.4.7865': attribute type 4 has an invalid length. [ 910.478963][ T2477] team0: Device is already in use. [ 910.639699][ T2490] sctp: [Deprecated]: syz.2.7870 (pid 2490) Use of struct sctp_assoc_value in delayed_ack socket option. [ 910.639699][ T2490] Use struct sctp_sack_info instead [ 910.798320][ T2503] tc_dump_action: action bad kind [ 911.096181][ T2527] sctp: [Deprecated]: syz.0.7880 (pid 2527) Use of int in max_burst socket option. [ 911.096181][ T2527] Use struct sctp_assoc_value instead [ 911.243949][ T2541] netlink: 'syz.1.7876': attribute type 1 has an invalid length. [ 911.325179][ T2541] bond7: entered promiscuous mode [ 911.356624][ T2541] 8021q: adding VLAN 0 to HW filter on device bond7 [ 911.394282][T32364] IPVS: starting estimator thread 0... [ 911.407319][ T2553] IPVS: lc: FWM 3 0x00000003 - no destination available [ 911.500159][ T2558] nbd: couldn't find a device at index 0 [ 911.604776][ T2564] netlink: 'syz.3.7887': attribute type 1 has an invalid length. [ 911.644539][ T2564] __nla_validate_parse: 8 callbacks suppressed [ 911.644558][ T2564] netlink: 224 bytes leftover after parsing attributes in process `syz.3.7887'. [ 911.791240][ T2556] IPVS: using max 28 ests per chain, 67200 per kthread [ 911.875533][ T2574] 8021q: adding VLAN 0 to HW filter on device bond7 [ 911.922853][ T2583] netlink: 68 bytes leftover after parsing attributes in process `syz.3.7892'. [ 911.976528][ T2586] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7893'. [ 912.123066][ T2583] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7892'. [ 912.888142][ T2574] bond7: (slave ip6gretap1): making interface the new active one [ 912.908263][ T2574] bond7: (slave ip6gretap1): Enslaving as an active interface with an up link [ 913.338910][ T2614] x_tables: ip_tables: REDIRECT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 913.387887][ T2618] netlink: 256 bytes leftover after parsing attributes in process `syz.0.7900'. [ 914.131419][ T2653] validate_nla: 1 callbacks suppressed [ 914.131442][ T2653] netlink: 'syz.0.7909': attribute type 1 has an invalid length. [ 914.198586][ T2653] 8021q: adding VLAN 0 to HW filter on device bond8 [ 914.227164][ T2664] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 914.237489][ T2664] bond8: (slave batadv1): making interface the new active one [ 914.246153][ T2664] bond8: (slave batadv1): Enslaving as an active interface with an up link [ 914.396063][ T2671] tipc: Enabled bearer , priority 0 [ 914.437831][ T2670] tipc: Disabling bearer [ 914.579251][ T2678] bond9: option all_slaves_active: invalid value (222) [ 914.596157][ T2678] bond9 (unregistering): Released all slaves [ 915.037704][ T2694] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7918'. [ 915.079695][ T2700] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7919'. [ 915.348093][ T2711] syzkaller0: entered promiscuous mode [ 915.373015][ T2711] syzkaller0: entered allmulticast mode [ 915.447599][ T2716] netlink: 'syz.1.7925': attribute type 21 has an invalid length. [ 915.458259][ T2715] xt_CT: You must specify a L4 protocol and not use inversions on it [ 915.466491][ T2713] vlan4: entered allmulticast mode [ 915.473683][ T2715] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7924'. [ 915.483789][ T2713] veth1_virt_wifi: entered allmulticast mode [ 915.523113][ T2716] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7925'. [ 915.707557][ T2730] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7928'. [ 915.725684][ T2730] netlink: 'syz.2.7928': attribute type 3 has an invalid length. [ 916.013844][ T2757] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 916.583855][ T2778] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 916.633992][ T2780] bond9: Unable to set peer notification delay as MII monitoring is disabled [ 916.648641][ T2780] bond9 (unregistering): Released all slaves [ 917.110943][ T2807] syzkaller1: entered promiscuous mode [ 917.116512][ T2807] syzkaller1: entered allmulticast mode [ 917.176450][ T30] audit: type=1804 audit(1783094566.522:18): pid=2815 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.7948" name="/newroot/271/cgroup.controllers" dev="tmpfs" ino=1396 res=1 errno=0 [ 917.250703][ T30] audit: type=1800 audit(1783094566.522:19): pid=2815 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.7948" name="cgroup.controllers" dev="tmpfs" ino=1396 res=0 errno=0 [ 917.399493][ T2809] bond12: entered promiscuous mode [ 917.405157][ T2809] bond12: entered allmulticast mode [ 917.412646][ T2809] 8021q: adding VLAN 0 to HW filter on device bond12 [ 917.937323][ T2798] lo speed is unknown, defaulting to 1000 [ 918.313420][ T2880] macvlan0: entered promiscuous mode [ 918.445163][ T2888] netlink: 'syz.4.7962': attribute type 13 has an invalid length. [ 918.490678][ T2888] __nla_validate_parse: 3 callbacks suppressed [ 918.490704][ T2888] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7962'. [ 918.571254][ T2888] netlink: 'syz.4.7962': attribute type 13 has an invalid length. [ 918.592389][T18849] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 918.601401][T18884] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 918.610596][ T2888] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7962'. [ 918.619759][T18884] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 918.639451][T18884] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 918.682625][ T2894] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7966'. [ 918.814921][ T2892] syzkaller1: entered promiscuous mode [ 918.840618][ T2892] syzkaller1: entered allmulticast mode [ 919.023066][ T2900] openvswitch: netlink: Flow actions attr not present in new flow. [ 919.301464][ T2905] netdevsim netdevsim1 : renamed from netdevsim0 (while UP) [ 919.602019][ T2905] xt_TCPMSS: Only works on TCP SYN packets [ 920.075484][ T2933] netlink: 'syz.1.7975': attribute type 3 has an invalid length. [ 920.622580][ T2950] netlink: 'syz.3.7978': attribute type 17 has an invalid length. [ 920.630483][ T2950] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7978'. [ 920.658393][ T2950] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7978'. [ 920.747907][ T2952] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7979'. [ 921.241724][ T2971] bond8: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 921.254764][ T2971] bond8 (unregistering): Released all slaves [ 921.299567][ T2979] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7987'. [ 921.561347][ T2983] netlink: 32 bytes leftover after parsing attributes in process `syz.3.7989'. [ 921.690394][ T2985] netlink: 'syz.4.7990': attribute type 1 has an invalid length. [ 921.820791][ T2991] netlink: 232 bytes leftover after parsing attributes in process `syz.3.7992'. [ 921.832668][ T2985] macvtap1: entered allmulticast mode [ 921.855742][ T2991] ksmbd: Unknown IPC event: 6, ignore. [ 921.925379][ T2985] macvtap2: entered allmulticast mode [ 921.963874][ T2996] netlink: 'syz.1.7993': attribute type 1 has an invalid length. [ 922.005013][ T2996] netlink: 'syz.1.7993': attribute type 2 has an invalid length. [ 922.116154][ T2996] 0: reclassify loop, rule prio 0, protocol 700 [ 922.129942][ T3004] netlink: 36 bytes leftover after parsing attributes in process `syz.4.7994'. [ 923.081447][ T3017] 8021q: adding VLAN 0 to HW filter on device bond2 [ 923.129973][ T3017] 8021q: adding VLAN 0 to HW filter on device bond3 [ 923.172341][ T3017] 8021q: adding VLAN 0 to HW filter on device bond5 [ 923.182213][ T3017] 8021q: adding VLAN 0 to HW filter on device bond6 [ 923.194824][ T3017] 8021q: adding VLAN 0 to HW filter on device bond8 [ 923.269040][ T3017] 8021q: adding VLAN 0 to HW filter on device bond9 [ 923.277818][ T3017] bond9: entered allmulticast mode [ 923.283617][ T3017] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 923.303383][ T3017] 8021q: adding VLAN 0 to HW filter on device macvtap2 [ 923.343531][ T2975] lo speed is unknown, defaulting to 1000 [ 923.354195][ T3018] FAULT_INJECTION: forcing a failure. [ 923.354195][ T3018] name failslab, interval 1, probability 0, space 0, times 0 [ 923.372044][ T3018] CPU: 0 UID: 0 PID: 3018 Comm: syz.3.7997 Not tainted syzkaller #0 PREEMPT(full) [ 923.372071][ T3018] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 923.372083][ T3018] Call Trace: [ 923.372092][ T3018] [ 923.372101][ T3018] dump_stack_lvl+0xe8/0x150 [ 923.372156][ T3018] should_fail_ex+0x40c/0x560 [ 923.372186][ T3018] should_failslab+0xa8/0x100 [ 923.372220][ T3018] __kmalloc_cache_noprof+0xa8/0x660 [ 923.372249][ T3018] ? nfc_genl_rcv_nl_event+0xa8/0x2d0 [ 923.372391][ T3018] ? nfc_genl_rcv_nl_event+0xa8/0x2d0 [ 923.372421][ T3018] nfc_genl_rcv_nl_event+0xa8/0x2d0 [ 923.372464][ T3018] notifier_call_chain+0x1a5/0x3d0 [ 923.372508][ T3018] blocking_notifier_call_chain+0x6a/0x90 [ 923.372542][ T3018] netlink_release+0x11f8/0x1a80 [ 923.372589][ T3018] ? netlink_release+0x106/0x1a80 [ 923.372625][ T3018] ? __pfx_netlink_release+0x10/0x10 [ 923.372656][ T3018] ? down_write+0x16d/0x200 [ 923.372689][ T3018] ? __pfx_down_write+0x10/0x10 [ 923.372729][ T3018] sock_close+0xad/0x220 [ 923.372755][ T3018] ? __pfx_sock_close+0x10/0x10 [ 923.372777][ T3018] __fput+0x418/0xa50 [ 923.372815][ T3018] task_work_run+0x1d9/0x270 [ 923.372852][ T3018] ? __pfx_task_work_run+0x10/0x10 [ 923.372887][ T3018] ? kick_process+0xeb/0x160 [ 923.372960][ T3018] get_signal+0x1181/0x12c0 [ 923.373002][ T3018] ? __fput_deferred+0x216/0x380 [ 923.373035][ T3018] arch_do_signal_or_restart+0xbb/0x860 [ 923.373091][ T3018] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 923.373115][ T3018] ? __x64_sys_sendmsg+0x25d/0x290 [ 923.373179][ T3018] exit_to_user_mode_loop+0x104/0x730 [ 923.373236][ T3018] ? rcu_is_watching+0x15/0xb0 [ 923.373271][ T3018] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 923.373298][ T3018] do_syscall_64+0x353/0x580 [ 923.373326][ T3018] ? trace_irq_disable+0x3b/0x140 [ 923.373354][ T3018] ? clear_bhb_loop+0x40/0x90 [ 923.373382][ T3018] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 923.373404][ T3018] RIP: 0033:0x7ff26f59de59 [ 923.373427][ T3018] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 923.373445][ T3018] RSP: 002b:00007ff2703bf028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 923.373470][ T3018] RAX: 0000000000000134 RBX: 00007ff26f825fa0 RCX: 00007ff26f59de59 [ 923.373486][ T3018] RDX: 0000000000008000 RSI: 0000200000000780 RDI: 0000000000000004 [ 923.373500][ T3018] RBP: 00007ff2703bf090 R08: 0000000000000000 R09: 0000000000000000 [ 923.373514][ T3018] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 923.373525][ T3018] R13: 00007ff26f826038 R14: 00007ff26f825fa0 R15: 00007fffc97de1d8 [ 923.373562][ T3018] [ 923.373976][T18849] bridge0: port 2(bridge_slave_1) entered blocking state [ 923.674414][T18849] bridge0: port 2(bridge_slave_1) entered forwarding state [ 923.890557][ T3036] __nla_validate_parse: 4 callbacks suppressed [ 923.890580][ T3036] netlink: 1363 bytes leftover after parsing attributes in process `syz.3.7998'. [ 924.217276][ T3052] netlink: 4 bytes leftover after parsing attributes in process `syz.1.8001'. [ 924.342577][ T2989] lo speed is unknown, defaulting to 1000 [ 925.348490][ T3080] syzkaller0: entered promiscuous mode [ 925.354140][ T3080] syzkaller0: entered allmulticast mode [ 925.444298][ T3084] netlink: 8 bytes leftover after parsing attributes in process `syz.4.8012'. [ 925.453336][ T3084] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8012'. [ 925.704148][ T3083] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 926.408679][ T3125] netlink: 76 bytes leftover after parsing attributes in process `syz.2.8025'. [ 926.447807][ T3125] nbd: illegal input index -8454144 [ 926.500648][ T3131] ip6t_srh: unknown srh match flags 5F28 [ 926.507590][ T3131] netlink: 24 bytes leftover after parsing attributes in process `syz.2.8026'. [ 926.912063][ T3148] netlink: 'syz.0.8032': attribute type 11 has an invalid length. [ 926.919971][ T3148] netlink: 224 bytes leftover after parsing attributes in process `syz.0.8032'. [ 927.059863][ T3161] xt_hashlimit: size too large, truncated to 1048576 [ 927.215766][ T3165] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8036'. [ 927.251749][ T3165] netlink: 28 bytes leftover after parsing attributes in process `syz.2.8036'. [ 927.321722][ T3165] bridge0: entered promiscuous mode [ 927.357515][ T3165] 0ªX¹¦Dö»: entered promiscuous mode [ 927.379050][ T3165] hsr1: Slave A (bridge0) is not up; please bring it up to get a fully working HSR network [ 927.929008][ T3203] netlink: 12 bytes leftover after parsing attributes in process `syz.4.8044'. [ 927.966502][ T3203] openvswitch: netlink: Missing key (keys=40, expected=100) [ 927.966720][ T3204] openvswitch: netlink: Missing key (keys=40, expected=100) [ 928.125622][ T3229] netlink: 'syz.1.8048': attribute type 21 has an invalid length. [ 928.584898][ T3258] netlink: 'syz.4.8059': attribute type 10 has an invalid length. [ 928.773691][ T3266] tipc: Enabling of bearer rejected, media not registered [ 928.835388][ T3271] bridge8: port 1(veth7) entered blocking state [ 928.841821][ T3271] bridge8: port 1(veth7) entered disabled state [ 928.848469][ T3271] veth7: entered allmulticast mode [ 928.855462][ T3271] veth7: entered promiscuous mode [ 929.009497][ T3279] bond8: (slave gretap0): Device is not bonding slave [ 929.016366][ T3279] bond8: option active_slave: invalid value (gretap0) [ 929.027064][ T3279] bond8 (unregistering): Released all slaves [ 929.051735][ T3284] bridge8: port 2(veth0_to_bond) entered blocking state [ 929.058863][ T3284] bridge8: port 2(veth0_to_bond) entered disabled state [ 929.066283][ T3284] veth0_to_bond: entered allmulticast mode [ 929.074660][ T3284] veth0_to_bond: entered promiscuous mode [ 929.083733][ T3290] tipc: Resetting bearer [ 929.104979][ T3293] netlink: 'syz.4.8068': attribute type 2 has an invalid length. [ 929.121377][ T3293] netlink: 'syz.4.8068': attribute type 11 has an invalid length. [ 929.129268][ T3293] __nla_validate_parse: 7 callbacks suppressed [ 929.129287][ T3293] netlink: 132 bytes leftover after parsing attributes in process `syz.4.8068'. [ 929.169094][ T3290] tipc: Disabling bearer [ 929.194708][ T3290] team0 (unregistering): Port device xfrm0 removed [ 929.283615][ T3297] atomic_op ffff88802df33998 conn xmit_atomic 0000000000000000 [ 929.382725][ T3302] veth3: entered allmulticast mode [ 929.515370][ T3311] netlink: 4 bytes leftover after parsing attributes in process `syz.4.8073'. [ 929.551643][ T3312] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.8074'. [ 929.582626][ T3312] openvswitch: netlink: Message has 512 unknown bytes. [ 930.249685][ T3363] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8086'. [ 930.259481][ T3367] xt_TCPMSS: Only works on TCP SYN packets [ 930.357516][ T3367] Cannot find add_set index 65532 as target [ 930.450753][ T3375] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 930.524213][ T3379] netlink: 220 bytes leftover after parsing attributes in process `syz.0.8091'. [ 930.553246][T32357] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 930.642528][ T3379] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8091'. [ 930.667523][ T3389] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8092'. [ 930.676555][ T3389] netlink: 16 bytes leftover after parsing attributes in process `syz.3.8092'. [ 930.708844][ T3379] netlink: 12 bytes leftover after parsing attributes in process `syz.0.8091'. [ 930.752327][ T3388] netlink: 'syz.1.8093': attribute type 2 has an invalid length. [ 930.788091][ T3394] netlink: 'syz.4.8094': attribute type 1 has an invalid length. [ 930.861987][ T3394] 8021q: adding VLAN 0 to HW filter on device bond10 [ 930.893842][ T5760] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 931.023013][ T3397] bond10: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 931.047813][ T3394] macvlan3: entered promiscuous mode [ 931.053193][ T3407] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8099'. [ 931.069249][ T3394] macvlan3: entered allmulticast mode [ 931.076785][ T3394] bond10: entered promiscuous mode [ 931.092527][ T3394] veth0_to_bond: entered promiscuous mode [ 931.103300][ T3394] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 931.117733][ T3394] bond10: left promiscuous mode [ 931.124257][ T3394] veth0_to_bond: left promiscuous mode [ 931.731910][ T3447] netlink: 'syz.0.8112': attribute type 21 has an invalid length. [ 931.802640][ T3440] bond11: entered promiscuous mode [ 931.836437][ T3444] macvlan3: entered promiscuous mode [ 931.858132][ T3444] macvlan3: entered allmulticast mode [ 931.879248][ T3444] bond11: (slave macvlan3): Opening slave failed [ 931.995655][ T3454] IPVS: length: 28 != 24 [ 932.333980][ T3431] lo speed is unknown, defaulting to 1000 [ 932.419979][ T3468] syzkaller1: entered promiscuous mode [ 932.425550][ T3468] syzkaller1: entered allmulticast mode [ 933.995509][ T3521] veth0_to_bond: entered allmulticast mode [ 934.005131][ T3522] netlink: 'syz.0.8132': attribute type 19 has an invalid length. [ 934.289103][ T3533] __nla_validate_parse: 12 callbacks suppressed [ 934.289127][ T3533] netlink: 9 bytes leftover after parsing attributes in process `syz.0.8136'. [ 934.307293][ T3533] 0·: renamed from hsr0 (while UP) [ 934.355558][ T3533] 0·: entered allmulticast mode [ 934.365774][ T3533] hsr_slave_0: entered allmulticast mode [ 934.372264][ T3533] hsr_slave_1: entered allmulticast mode [ 934.379174][ T3533] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 934.401785][ T1316] aoe: packet could not be sent on ipvlan1. consider increasing tx_queue_len [ 934.556620][ T3538] netlink: 256 bytes leftover after parsing attributes in process `syz.0.8138'. [ 934.761575][ T3548] netlink: 'syz.0.8140': attribute type 58 has an invalid length. [ 934.769488][ T3548] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8140'. [ 934.939849][ T3565] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8142'. [ 934.949039][ T3565] veth0: Caught tx_queue_len zero misconfig [ 934.975211][ T3562] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8142'. [ 935.216176][ T3573] team0: Device ipvlan2 is already an upper device of the team interface [ 935.304040][ T3585] netlink: 'syz.0.8147': attribute type 1 has an invalid length. [ 935.364424][ T3585] bond9: option mode: invalid value (11) [ 935.412476][ T3585] bond9 (unregistering): Released all slaves [ 935.452370][ T3591] netlink: 'syz.4.8153': attribute type 1 has an invalid length. [ 935.638659][ T3600] netlink: 56 bytes leftover after parsing attributes in process `syz.4.8153'. [ 935.667513][ T3591] 8021q: adding VLAN 0 to HW filter on device bond12 [ 935.683966][ T3604] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.8156'. [ 935.693423][ T3604] openvswitch: netlink: Message has 4 unknown bytes. [ 935.729618][T31082] bond0: (slave bond_slave_0): link status definitely up, 10000 Mbps full duplex [ 935.760884][T31082] bond0: (slave bond_slave_1): link status definitely up, 10000 Mbps full duplex [ 935.767349][ T3604] netlink: 256 bytes leftover after parsing attributes in process `syz.2.8156'. [ 935.782614][T31082] bond0: active interface up! [ 935.825665][ T3607] SET target dimension over the limit! [ 935.831981][ T3604] netlink: 'syz.2.8156': attribute type 9 has an invalid length. [ 935.877826][ T3609] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 935.908694][ T3611] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8157'. [ 936.060458][ T3618] pimreg: entered allmulticast mode [ 936.094071][ T3618] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8161'. [ 936.132431][ T3624] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 936.165212][ T3623] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 936.943645][ T3659] IPVS: length: 176 != 8 [ 936.984538][ T3659] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 937.101284][ T3675] 8021q: adding VLAN 0 to HW filter on device bond9 [ 937.147169][ T3679] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 937.226841][ T3679] geneve3: entered promiscuous mode [ 937.459194][ T3702] netlink: 'syz.4.8187': attribute type 4 has an invalid length. [ 937.784367][ T3718] netlink: 'syz.1.8193': attribute type 1 has an invalid length. [ 937.803392][ T3718] netlink: 'syz.1.8193': attribute type 4 has an invalid length. [ 937.813512][ T3718] netlink: 'syz.1.8193': attribute type 1 has an invalid length. [ 937.827756][ T3718] netlink: 'syz.1.8193': attribute type 4 has an invalid length. [ 938.010890][ T3733] rdma_rxe: rxe_newlink: failed to add bridge_slave_0 [ 938.154542][ T3740] IPv6: NLM_F_CREATE should be specified when creating new route [ 938.184247][ T3740] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 938.191552][ T3740] IPv6: NLM_F_CREATE should be set when creating new route [ 938.265387][ T3749] gretap0: entered promiscuous mode [ 938.272993][ T3749] gretap0: left promiscuous mode [ 938.963662][ T5631] block nbd4: Receive control failed (result -1) [ 938.975854][ T5631] [ 938.978241][ T5631] ====================================================== [ 938.985280][ T5631] WARNING: possible circular locking dependency detected [ 938.992391][ T5631] syzkaller #0 Not tainted [ 938.996856][ T5631] ------------------------------------------------------ [ 939.003892][ T5631] kworker/u9:3/5631 is trying to acquire lock: [ 939.010053][ T5631] ffff8880298a8260 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}, at: inet_shutdown+0x6a/0x390 [ 939.019538][ T5631] [ 939.019538][ T5631] but task is already holding lock: [ 939.026915][ T5631] ffff888036eb0668 (&nsock->tx_lock){+.+.}-{4:4}, at: recv_work+0x1cd9/0x1e10 [ 939.035915][ T5631] [ 939.035915][ T5631] which lock already depends on the new lock. [ 939.035915][ T5631] [ 939.046424][ T5631] [ 939.046424][ T5631] the existing dependency chain (in reverse order) is: [ 939.055458][ T5631] [ 939.055458][ T5631] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 939.063203][ T5631] __mutex_lock+0x19d/0x1550 [ 939.068350][ T5631] nbd_queue_rq+0x373/0x1150 [ 939.073494][ T5631] blk_mq_dispatch_rq_list+0x499/0x1990 [ 939.079641][ T5631] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 939.086532][ T5631] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 939.093076][ T5631] blk_mq_run_work_fn+0x16c/0x300 [ 939.095191][ T3762] lo speed is unknown, defaulting to 1000 [ 939.098649][ T5631] process_scheduled_works+0xa8e/0x14e0 [ 939.110449][ T5631] worker_thread+0xa47/0xfb0 [ 939.115597][ T5631] kthread+0x388/0x470 [ 939.120229][ T5631] ret_from_fork+0x514/0xb70 [ 939.125427][ T5631] ret_from_fork_asm+0x1a/0x30 [ 939.130735][ T5631] [ 939.130735][ T5631] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 939.137978][ T5631] __mutex_lock+0x19d/0x1550 [ 939.143138][ T5631] nbd_queue_rq+0xc1/0x1150 [ 939.148203][ T5631] blk_mq_dispatch_rq_list+0x499/0x1990 [ 939.154296][ T5631] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 939.161189][ T5631] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 939.167730][ T5631] blk_mq_run_work_fn+0x16c/0x300 [ 939.173317][ T5631] process_scheduled_works+0xa8e/0x14e0 [ 939.179410][ T5631] worker_thread+0xa47/0xfb0 [ 939.184543][ T5631] kthread+0x388/0x470 [ 939.189184][ T5631] ret_from_fork+0x514/0xb70 [ 939.194328][ T5631] ret_from_fork_asm+0x1a/0x30 [ 939.199629][ T5631] [ 939.199629][ T5631] -> #4 (set->srcu){.+.+}-{0:0}: [ 939.206830][ T5631] __synchronize_srcu+0xc9/0x2f0 [ 939.212325][ T5631] elevator_switch+0x1e8/0x7b0 [ 939.217644][ T5631] elevator_change+0x2fa/0x480 [ 939.222955][ T5631] elevator_set_default+0x375/0x440 [ 939.228701][ T5631] blk_register_queue+0x3f3/0x4e0 [ 939.234275][ T5631] __add_disk+0x6cb/0xe30 [ 939.239144][ T5631] add_disk_fwnode+0xfb/0x4b0 [ 939.244348][ T5631] nbd_dev_add+0x733/0xb60 [ 939.249293][ T5631] nbd_init+0x15f/0x1e0 [ 939.254111][ T5631] do_one_initcall+0x250/0x870 [ 939.259414][ T5631] do_initcall_level+0x10a/0x1a0 [ 939.264902][ T5631] do_initcalls+0x59/0xa0 [ 939.269759][ T5631] kernel_init_freeable+0x29d/0x3e0 [ 939.275488][ T5631] kernel_init+0x1d/0x1d0 [ 939.280337][ T5631] ret_from_fork+0x514/0xb70 [ 939.285455][ T5631] ret_from_fork_asm+0x1a/0x30 [ 939.290744][ T5631] [ 939.290744][ T5631] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 939.298596][ T5631] __mutex_lock+0x19d/0x1550 [ 939.303734][ T5631] elevator_change+0x1af/0x480 [ 939.309040][ T5631] elevator_set_none+0xb5/0x140 [ 939.314427][ T5631] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 939.320792][ T5631] nbd_start_device+0x189/0xb30 [ 939.326185][ T5631] nbd_genl_connect+0x1597/0x1c10 [ 939.331749][ T5631] genl_family_rcv_msg_doit+0x233/0x340 [ 939.337829][ T5631] genl_rcv_msg+0x614/0x7a0 [ 939.342863][ T5631] netlink_rcv_skb+0x226/0x4a0 [ 939.348167][ T5631] genl_rcv+0x28/0x40 [ 939.352673][ T5631] netlink_unicast+0x7bb/0x940 [ 939.357970][ T5631] netlink_sendmsg+0x813/0xb40 [ 939.363273][ T5631] sock_sendmsg_nosec+0x13a/0x180 [ 939.368838][ T5631] ____sys_sendmsg+0x54e/0x850 [ 939.374165][ T5631] ___sys_sendmsg+0x2a5/0x360 [ 939.379395][ T5631] __x64_sys_sendmsg+0x1b1/0x290 [ 939.384881][ T5631] do_syscall_64+0x174/0x580 [ 939.390003][ T5631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 939.396422][ T5631] [ 939.396422][ T5631] -> #2 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 939.405063][ T5631] blk_alloc_queue+0x544/0x690 [ 939.410365][ T5631] __blk_mq_alloc_disk+0x194/0x390 [ 939.416028][ T5631] nbd_dev_add+0x494/0xb60 [ 939.421000][ T5631] nbd_init+0x15f/0x1e0 [ 939.425698][ T5631] do_one_initcall+0x250/0x870 [ 939.431014][ T5631] do_initcall_level+0x10a/0x1a0 [ 939.436489][ T5631] do_initcalls+0x59/0xa0 [ 939.441353][ T5631] kernel_init_freeable+0x29d/0x3e0 [ 939.447079][ T5631] kernel_init+0x1d/0x1d0 [ 939.451934][ T5631] ret_from_fork+0x514/0xb70 [ 939.457059][ T5631] ret_from_fork_asm+0x1a/0x30 [ 939.462359][ T5631] [ 939.462359][ T5631] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 939.469584][ T5631] fs_reclaim_acquire+0x71/0x100 [ 939.475057][ T5631] __kmalloc_noprof+0xbc/0x720 [ 939.480350][ T5631] tls_sw_sendmsg+0x599/0x2860 [ 939.485727][ T5631] sock_sendmsg_nosec+0x90/0x180 [ 939.491233][ T5631] sock_sendmsg+0x1ca/0x2d0 [ 939.496291][ T5631] splice_to_socket+0xb5e/0x12a0 [ 939.501787][ T5631] direct_splice_actor+0x101/0x160 [ 939.507474][ T5631] splice_direct_to_actor+0x57b/0xcb0 [ 939.513415][ T5631] do_splice_direct+0x195/0x290 [ 939.518844][ T5631] do_sendfile+0x52e/0x7c0 [ 939.523825][ T5631] __se_sys_sendfile64+0x144/0x1a0 [ 939.529501][ T5631] do_syscall_64+0x174/0x580 [ 939.534662][ T5631] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 939.541104][ T5631] [ 939.541104][ T5631] -> #0 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}: [ 939.549246][ T5631] __lock_acquire+0x1520/0x2cf0 [ 939.554677][ T5631] lock_acquire+0x106/0x350 [ 939.559735][ T5631] lock_sock_nested+0x41/0x100 [ 939.565044][ T5631] inet_shutdown+0x6a/0x390 [ 939.570106][ T5631] nbd_mark_nsock_dead+0x2cb/0x550 [ 939.575795][ T5631] recv_work+0x1cee/0x1e10 [ 939.580750][ T5631] process_scheduled_works+0xa8e/0x14e0 [ 939.586834][ T5631] worker_thread+0xa47/0xfb0 [ 939.592049][ T5631] kthread+0x388/0x470 [ 939.596659][ T5631] ret_from_fork+0x514/0xb70 [ 939.601790][ T5631] ret_from_fork_asm+0x1a/0x30 [ 939.607085][ T5631] [ 939.607085][ T5631] other info that might help us debug this: [ 939.607085][ T5631] [ 939.617332][ T5631] Chain exists of: [ 939.617332][ T5631] sk_lock-AF_INET6-NBD --> &cmd->lock --> &nsock->tx_lock [ 939.617332][ T5631] [ 939.630407][ T5631] Possible unsafe locking scenario: [ 939.630407][ T5631] [ 939.637871][ T5631] CPU0 CPU1 [ 939.643321][ T5631] ---- ---- [ 939.648720][ T5631] lock(&nsock->tx_lock); [ 939.653196][ T5631] lock(&cmd->lock); [ 939.659722][ T5631] lock(&nsock->tx_lock); [ 939.666671][ T5631] lock(sk_lock-AF_INET6-NBD); [ 939.671534][ T5631] [ 939.671534][ T5631] *** DEADLOCK *** [ 939.671534][ T5631] [ 939.679691][ T5631] 3 locks held by kworker/u9:3/5631: [ 939.685001][ T5631] #0: ffff8880260ee140 ((wq_completion)nbd4-recv){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 939.696285][ T5631] #1: ffffc900045ffc40 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 939.708075][ T5631] #2: ffff888036eb0668 (&nsock->tx_lock){+.+.}-{4:4}, at: recv_work+0x1cd9/0x1e10 [ 939.717411][ T5631] [ 939.717411][ T5631] stack backtrace: [ 939.723311][ T5631] CPU: 0 UID: 0 PID: 5631 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full) [ 939.723333][ T5631] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 939.723348][ T5631] Workqueue: nbd4-recv recv_work [ 939.723367][ T5631] Call Trace: [ 939.723378][ T5631] [ 939.723396][ T5631] dump_stack_lvl+0xe8/0x150 [ 939.723427][ T5631] print_circular_bug+0x2e1/0x300 [ 939.723447][ T5631] check_noncircular+0x12e/0x150 [ 939.723480][ T5631] __lock_acquire+0x1520/0x2cf0 [ 939.723507][ T5631] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 939.723532][ T5631] ? preempt_schedule_notrace+0x57/0x90 [ 939.723557][ T5631] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 939.723577][ T5631] ? __pfx_inet_shutdown+0x10/0x10 [ 939.723616][ T5631] ? inet_shutdown+0x6a/0x390 [ 939.723635][ T5631] lock_acquire+0x106/0x350 [ 939.723657][ T5631] ? inet_shutdown+0x6a/0x390 [ 939.723694][ T5631] lock_sock_nested+0x41/0x100 [ 939.723724][ T5631] ? inet_shutdown+0x6a/0x390 [ 939.723743][ T5631] inet_shutdown+0x6a/0x390 [ 939.723782][ T5631] nbd_mark_nsock_dead+0x2cb/0x550 [ 939.723810][ T5631] recv_work+0x1cee/0x1e10 [ 939.723826][ T5631] ? __lock_acquire+0x683/0x2cf0 [ 939.723848][ T5631] ? register_lock_class+0x31/0x2e0 [ 939.723870][ T5631] ? __lock_acquire+0x683/0x2cf0 [ 939.723897][ T5631] ? __pfx_recv_work+0x10/0x10 [ 939.723911][ T5631] ? do_raw_spin_lock+0x12b/0x2f0 [ 939.723929][ T5631] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 939.723947][ T5631] ? process_scheduled_works+0xa20/0x14e0 [ 939.723968][ T5631] ? rcu_is_watching+0x15/0xb0 [ 939.723994][ T5631] ? process_scheduled_works+0xa20/0x14e0 [ 939.724011][ T5631] process_scheduled_works+0xa8e/0x14e0 [ 939.724040][ T5631] ? __pfx_process_scheduled_works+0x10/0x10 [ 939.724060][ T5631] ? assign_work+0x3cf/0x5d0 [ 939.724079][ T5631] worker_thread+0xa47/0xfb0 [ 939.724109][ T5631] kthread+0x388/0x470 [ 939.724131][ T5631] ? __pfx_worker_thread+0x10/0x10 [ 939.724148][ T5631] ? __pfx_kthread+0x10/0x10 [ 939.724170][ T5631] ret_from_fork+0x514/0xb70 [ 939.724195][ T5631] ? __pfx_ret_from_fork+0x10/0x10 [ 939.724217][ T5631] ? __switch_to+0xc89/0x1420 [ 939.724238][ T5631] ? __pfx_kthread+0x10/0x10 [ 939.724260][ T5631] ret_from_fork_asm+0x1a/0x30 [ 939.724281][ T5631]