last executing test programs: 49.685693683s ago: executing program 2 (id=3187): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="bc010000130001010000000000000000ac141415000000000000000000000000fe8000000000000000000000000000bb4e20000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="020000000000000000050000000000000000000000000000000000000000000006000000000000000300000000000000050000000000000008000000000000000000000000000000010000000000000000000000000000000001000000000000080000000000000000000000000000000401050020010000000000000000000000000002000004d02b0000000a000000000000000000000000000000000000000000000001010100050000000200000009000080ff010000000000000000000000000001000004d5320000000a000000fc0000000000000000000000000000010200000000064800040000000080000005000000fe880000000000000000000000000001000004d46c0000000a000000fe8000000000000000000000000000bb0000000003020300000000000200000006000000e0000002000000000000000000000000000004d42b0000000a00000064010100000000000000000000000000000000000100"], 0x1bc}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) 49.587927667s ago: executing program 2 (id=3188): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@updpolicy={0xc4, 0x19, 0x1, 0x0, 0x10, {{@in=@multicast1=0xe0000002, @in=@rand_addr=0x64010102, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80, 0x6}, {0x0, 0x0, 0x1abe1019, 0x0, 0x0, 0x8, 0x0, 0xfffffffffffffffd}, {}, 0x0, 0x6e6bb8, 0x0, 0x1, 0x0, 0x1}, [@lastused={0xc, 0xf, 0x5}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4008011}, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=ANY=[@ANYBLOB="d40000001b001d0328bd7000fcdbdf25ffffffff000000000000000000000000fe8000000000000000000003000000264e2000014e2404000200000087000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="08000000000000000100010000000000f4ffffffffffffff04000000000000000200000000000000ba410000000091ad07000000000000000000008000000000ffffff7f0000000003000000000000000400000000000000080000000000000003000000b86b6e000000030100000000040000000000000008001f0001"], 0xd4}}, 0x0) 49.105479511s ago: executing program 2 (id=3191): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000740), 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000000)=@nat={'nat\x00', 0x1d, 0x5, 0x470, 0x0, 0x488, 0xffffffff, 0x0, 0x268, 0x558, 0x558, 0xffffffff, 0x558, 0x558, 0x5, 0x0, {[{{@uncond, 0x0, 0xa8, 0xf0}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x0, @ipv4=@empty, @ipv6=@remote}}}, {{@ipv6={@dev, @loopback, [], [], 'batadv0\x00', 'veth1_vlan\x00'}, 0x0, 0xa8, 0xf0}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv4=@loopback, @ipv6=@private0, @icmp_id, @icmp_id}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x0, @ipv6=@dev={0xfe, 0x80, '\x00', 0x1b}, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @gre_key, @gre_key}}}, {{@ipv6={@remote, @mcast1, [0x0, 0xff000000], [], 'ipvlan0\x00', 'pim6reg\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE1={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4d0) r2 = socket$rxrpc(0x21, 0x2, 0xa) shutdown(r2, 0x0) (async) shutdown(r2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REQ_SET_REG(r3, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000ec0)={0x24, r0, 0x1, 0x0, 0x0, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x1}, @NL80211_ATTR_REG_ALPHA2={0x6, 0x21, 'b\x00'}]}, 0x24}}, 0x0) 48.74985512s ago: executing program 2 (id=3192): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0xf4}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x34080}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r2}, @IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x28}}]}}}]}, 0x44}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8008}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x28, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}, @NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x17}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}, 0x1, 0x0, 0x0, 0x850}, 0x4040080) 48.022873161s ago: executing program 2 (id=3194): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x1e, 0x4, &(0x7f0000000580)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x1a}]}, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$FIONCLEX(r4, 0x5450) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000040000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000530000008500000005000000bca90000000000003509000000d44a6be5000d0000000000b702000000000000739af0ff00000000c509040004100000c3aaf0fff1000000bf8600000000000007080000f8ffffffbfa400000000000007060000f0ffffffb70200000800000018220000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7050000080000004608f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xb, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r5, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r7, &(0x7f0000000000), 0x10) setsockopt$CAN_RAW_FILTER(r7, 0x65, 0x1, 0x0, 0x0) close(r7) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r6, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x28012, r0, 0x0) 47.50236221s ago: executing program 2 (id=3197): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x8080, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x2, 0x0, 0x1}}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000780)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000900)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=@newqdisc={0x200, 0x24, 0x41f, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x1d0, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104, 0x2, "0000000000000000000000000000000000000000000000000000000000000000000000000f00"}]}}]}, 0x200}}, 0x0) 44.455623281s ago: executing program 4 (id=3213): socketpair(0x1, 0x6, 0x4, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000300)}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) (async) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xe, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0) (async) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000880)={0x1, 0x0}, 0x8) r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000008c0)=r5, 0x4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000900)=@bpf_lsm={0x1d, 0x28, &(0x7f00000009c0)=ANY=[], &(0x7f0000000a00)='syzkaller\x00', 0xb, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x1b, r6, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r5, 0x0, 0x1, 0x0, &(0x7f0000000a40)=[{0x0, 0x2, 0x20d, 0x4}], 0x10, 0xfffffffb}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000c80)={0x18, 0x15, &(0x7f0000000a80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x7fff}, {}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @exit], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000b40)='GPL\x00', 0xa, 0x58, &(0x7f0000000b80)=""/88, 0x41000, 0x3f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000c00)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000c40)=[{0x2, 0x5, 0x3, 0x7}, {0x2, 0x3, 0xa, 0x8}, {0x4, 0x4, 0x5}, {0x3, 0x3, 0xa, 0xa}], 0x10, 0x5}, 0x94) (async) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000c80)={0x18, 0x15, &(0x7f0000000a80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x7fff}, {}, {}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @exit], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000b40)='GPL\x00', 0xa, 0x58, &(0x7f0000000b80)=""/88, 0x41000, 0x3f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000c00)={0x7, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000c40)=[{0x2, 0x5, 0x3, 0x7}, {0x2, 0x3, 0xa, 0x8}, {0x4, 0x4, 0x5}, {0x3, 0x3, 0xa, 0xa}], 0x10, 0x5}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000010c0)={r7, 0xe0, &(0x7f0000000fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000009c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, &(0x7f0000000e40)=[0x0], &(0x7f0000000e80)=[0x0], 0x0, 0x2e, &(0x7f0000000ec0)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000f00), &(0x7f0000000f40), 0x8, 0x36, 0x8, 0x8, &(0x7f0000000f80)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000001100)={0x13, 0x1b, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x2}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @cb_func={0x18, 0x4, 0x4, 0x0, 0x6}, @cb_func={0x18, 0x9, 0x4, 0x0, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000700)='syzkaller\x00', 0x9, 0xa2, &(0x7f0000000740)=""/162, 0x40f00, 0x28, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x1, 0xa, 0xb, 0x76e6}, 0x10, r5, r7, 0x3, 0x0, &(0x7f0000000d40)=[{0x5, 0x5, 0x0, 0x4}, {0x4, 0x4, 0x1, 0xa}, {0x1000005, 0x5, 0x1, 0x1}], 0x10, 0xb2}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000001100)={0x13, 0x1b, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}}, @map_idx_val={0x18, 0x2, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x9}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x2}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @cb_func={0x18, 0x4, 0x4, 0x0, 0x6}, @cb_func={0x18, 0x9, 0x4, 0x0, 0x2}, @func={0x85, 0x0, 0x1, 0x0, 0xffffffffffffffff}]}, &(0x7f0000000700)='syzkaller\x00', 0x9, 0xa2, &(0x7f0000000740)=""/162, 0x40f00, 0x28, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x8, &(0x7f0000000800)={0x7, 0x5}, 0x8, 0x10, &(0x7f0000000840)={0x1, 0xa, 0xb, 0x76e6}, 0x10, r5, r7, 0x3, 0x0, &(0x7f0000000d40)=[{0x5, 0x5, 0x0, 0x4}, {0x4, 0x4, 0x1, 0xa}, {0x1000005, 0x5, 0x1, 0x1}], 0x10, 0xb2}, 0x94) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f0000000100)="ef535d55cb5db69181f4aeafcf1e78d3facd9c3214ce8f760f64bfe31f60cacf2ec9aa327285887994b0a8e9ff3567219d319d85939b05b4aa5e51dfbdfd6c005144118796011749deaab5bf53d1a3e9be4f580deae25e51418c3479c8246998aa9678beef94395bd20500b883cb7015f81e41cddeea3687640a3306ac25a1f0f08dfa82f8e7cf3b03eebae42894f89eeae495041f22d621130d2c316112c2116442dcfb53d8ebedb303b5a2d1c72ead340cebc02dc0117a98e289e6cdb4b5a7c8b8b9db62f23d9c3f0f5de19e7f5fa127e65a91a33805280e86546aa842e5757e13a797aed8a21f9d50c8caff8bebe8f1d32a05f74cc540bad15fd9") r8 = socket$nl_route(0x10, 0x3, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)) syz_emit_ethernet(0x48, &(0x7f0000000200)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000210", 0x1, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, [{0x18}]}}}}}}, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0x1, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x421a2}, [@IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}, @IFLA_VFINFO_LIST={0x1c, 0x16, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, [@IFLA_VF_IB_PORT_GUID={0x14, 0xb, {0x0, 0x8}}]}]}]}, 0x50}}, 0x0) 43.981988775s ago: executing program 4 (id=3215): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000180)=ANY=[@ANYRES8=r0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000000006c000000fe8000000000000000000000000000bb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000020003000000000000000000480003006465666c61746500"/240], 0x138}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f0000000040)=0x60000, 0x4) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r5, 0x29, 0x37, &(0x7f0000000400)={0x2}, 0x8) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f00000003c0)={'syzkaller0\x00', 0x7101}) syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r1) 37.609936213s ago: executing program 4 (id=3237): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000071120a000002000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 37.541509704s ago: executing program 4 (id=3238): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x8080, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x2, 0x0, 0x1}}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000780)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000900)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=@newqdisc={0x200, 0x24, 0x41f, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x1d0, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104, 0x2, "000000000000000000000000000000000000000000000000000000000000000000000000000000001000"}]}}]}, 0x200}}, 0x0) 35.306598381s ago: executing program 1 (id=3247): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000019800)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0xfd10, 0x0, 0x25, &(0x7f0000000900), 0x100}, 0x4000a043) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x7b, 0x11, 0x30}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x76}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x7, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) 35.149896132s ago: executing program 1 (id=3248): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="3000000011140100000000000000000008004a0001000000080003000100000008a9ea936609c0ca0800010000000000"], 0x30}, 0x1, 0x0, 0x0, 0x4000800}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="23000000b200000002000000ffff000005"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r2}, &(0x7f0000000080), &(0x7f00000000c0)}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r2}, &(0x7f0000000080), &(0x7f00000000c0)}, 0x20) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r2, &(0x7f0000000140), &(0x7f0000000180)=""/72}, 0x20) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="280000006a00831300000000000000ffa60000000000000008000e0000000000080005"], 0x28}, 0x1, 0x0, 0x0, 0x400d050}, 0x240c881c) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000540)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) socket(0x10, 0x803, 0x0) (async) r5 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000580)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x10001, 0x1, 0x3, 0x8, 0xffffffc0}, 0x4, 0x1, 0x8, 0x0, 0x3, 0x0, 0x16, 0x13, 0x3, 0xca, {0x0, 0x8, 0x3, 0x5, 0x84, 0x8}}}}]}, 0x78}}, 0x0) (async) sendmsg$nl_route_sched(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000640)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x10001, 0x1, 0x3, 0x8, 0xffffffc0}, 0x4, 0x1, 0x8, 0x0, 0x3, 0x0, 0x16, 0x13, 0x3, 0xca, {0x0, 0x8, 0x3, 0x5, 0x84, 0x8}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000740)=@newtfilter={0x70, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r6, {0xf000, 0xc}, {}, {0xc}}, [@filter_kind_options=@f_flow={{0x9}, {0x40, 0x2, [@TCA_FLOW_EMATCHES={0x3c, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_LIST={0x30, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0x6, 0x1, 0x1}, {0x6000, 0x0, 0x4, 0x2, 0x1, 0x1, 0x1}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{0x5, 0x7, 0x6}, {{0x1, 0x1, 0x1}, {0x1fffffff}}}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x2}}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x80}, 0x20000800) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8982, &(0x7f0000000280)={0x7, 'team_slave_0\x00', {0x8}, 0xa730}) (async) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r0, 0x8982, &(0x7f0000000280)={0x7, 'team_slave_0\x00', {0x8}, 0xa730}) sendmmsg(r7, &(0x7f0000000280), 0x40000000000009f, 0x0) (async) sendmmsg(r7, &(0x7f0000000280), 0x40000000000009f, 0x0) r8 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000380), 0x4) bpf$ITER_CREATE(0x21, &(0x7f00000003c0)={r8}, 0x8) (async) bpf$ITER_CREATE(0x21, &(0x7f00000003c0)={r8}, 0x8) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f00000007c0)={0x0, 0x10, &(0x7f0000000800)=[@in={0x2, 0x4e34, @local}]}, &(0x7f0000000840)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000880)={0x0, 0x10, &(0x7f0000000a80)=[@in={0x2, 0x4e20, @private=0xa010103}]}, &(0x7f0000000ac0)=0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000880)={0x0, 0x10, &(0x7f0000000a80)=[@in={0x2, 0x4e20, @private=0xa010103}]}, &(0x7f0000000ac0)=0x10) setsockopt(r10, 0x84, 0x7f, &(0x7f0000000b80)="010000000980ffff", 0x8) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f0000000bc0)={0x2, [0x0, 0x0]}, &(0x7f0000000c00)=0xc) (async) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r10, 0x84, 0x1d, &(0x7f0000000bc0)={0x2, [0x0, 0x0]}, &(0x7f0000000c00)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r10, 0x84, 0x66, &(0x7f0000000c40)={r11, 0x1}, &(0x7f0000000c80)=0x8) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r10, 0x84, 0x66, &(0x7f0000000c40)={r11, 0x1}, &(0x7f0000000c80)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r9, 0x84, 0x9, &(0x7f0000000cc0)={r11, @in6={{0xa, 0x4e21, 0x200, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x1}}, 0x6, 0xc, 0x202, 0xa, 0x4, 0x0, 0xc6}, 0x9c) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r12, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x70, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_SEQ_ADJ_REPLY={0xc, 0x5, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0xfffffffffffffd41}]}]}, 0x70}}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_NEW(r12, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)={0x70, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_SEQ_ADJ_REPLY={0xc, 0x5, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0xfffffffffffffd41}]}]}, 0x70}}, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000b00)=@nat={'nat\x00', 0x19, 0x1, 0x198, [0x2000000008c0, 0x0, 0x0, 0x2000000008f0, 0x200000000920], 0x0, 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff04000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000feffffff01000000090000000000000022eb677265746170300000000000000000006d6163766c616e30000000000000000067656e657665310000000000000000006d616373656330000000000000000000665b4563cf6fffffff000000bbbbbbbbbbbb00ffff5b00000000d0000000d00000000801000061727000000000000000000000000000000000000000000000000000000000203800000000000000001700160004000000000000807fff00e0000001000000ff0180c200000effffff0000ffaaaaaaaaaabb00ffffffff0054c3000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000ffffffff00000000"]}, 0x210) 34.915233427s ago: executing program 3 (id=3249): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000780), r0) recvmmsg(r0, &(0x7f00000007c0)=[{{0x0, 0x0, &(0x7f0000000800)=[{&(0x7f0000000880)=""/145, 0x91}, {&(0x7f0000000940)=""/226, 0xe2}, {&(0x7f0000000a40)=""/24, 0x18}, {&(0x7f0000000a80)=""/246, 0xf6}, {&(0x7f0000000b80)=""/41, 0x29}, {&(0x7f0000000bc0)=""/4096, 0x1000}, {&(0x7f0000001bc0)=""/158, 0x9e}, {&(0x7f0000001c80)=""/87, 0x57}], 0x8}, 0x5}], 0x1, 0x120a0, 0x0) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000001d00)={0x0, 0x0, &(0x7f0000001d40)={&(0x7f0000001dc0)=ANY=[@ANYBLOB="18000000", @ANYRES16=r1, @ANYBLOB="030704707900000000000100040004000180", @ANYRES8=r0, @ANYRESOCT=r0, @ANYRES16=r1], 0x18}}, 0x44000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = socket$l2tp6(0xa, 0x2, 0x73) getsockopt$inet6_mreq(r4, 0x29, 0x46, 0x0, &(0x7f0000000240)) sendmsg$nl_xfrm(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="580100001000130426bd700040000000ac1414bb000000000000000000000000ac1e01010000000000000000000000004e2000074e1f00000a00202067000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac141422000000000000000000000000000004d43200000000000000000000000000ffffe000000100080000000000007d0100000000000000000000000000000400000000004000ffffffffffffffff06000000000000007f0000000000000002000000000000000000000000000000fd2100000000000004000000000000000400000000000000f6004000040000000800000000000000ff340000020001be330000000000000067001200726663343330392863636d2861657329290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d800000040"], 0x158}, 0x1, 0x0, 0x0, 0x4000}, 0x4000804) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb01001800000000000000340000003400000006000000d7d5b9fb1661330c040000000000000e040000ff0f000000000000000000000d04000000040000000000000700000000000000000000000a0300"], 0x0, 0x52}, 0x20) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYRES16=r3, @ANYBLOB="ec9158af419b1783443365744dae03f0d5358fea1c7d", @ANYRESOCT=r5, @ANYRES32=r5, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc00080005000a000000140004"], 0x58}}, 0x911) r6 = socket$alg(0x26, 0x5, 0x0) r7 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r7, 0x29, 0x4d, &(0x7f0000001d80)=0x7, 0x4) recvmmsg(r7, &(0x7f0000001e00)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x0, 0x0) bind$alg(r7, &(0x7f0000000280)={0x26, 'aead\x00', 0x0, 0x0, 'morus640-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000480)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r8 = accept4$alg(r6, 0x0, 0x0, 0x0) sendmmsg$alg(r8, &(0x7f00000004c0)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000580)="a92e81d0991808e33c2330164cf023df", 0xfffffc81}], 0x1, &(0x7f00000005c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) recvmsg(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000680)=""/216, 0xd8}], 0x1}, 0x2000) close(r2) 34.191109125s ago: executing program 0 (id=3253): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c00000010001fff109e00008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000440012800b00010067656e6576650000340002800500030003000000060005004e20000005000400ab000000050009000100000005000a0001000000050009000100000008000a00", @ANYRES32=r3], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 34.054861179s ago: executing program 0 (id=3254): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="b00100004000070127bd7000fedbdf25037c00000400c2808801018084011080800107808c003d800c00550000f8ffffffffffff77007a80fb51b6508af3b78e17b3a5bac96b475f4dba0225007b54a6a923d8274620b16c1cdde8cc4f1ea57a6b0a7791f32804decfa0307289632af2974ee469467cd4574a3ee8cc24c623ed84d36bf49e7021c72143f78efd321fa67018f2bd615b0b7f30951a8c1653a8e98b28ace7d7a89c1b5a7ce60004003380f772cb8be168bd1aba2c4dee89546d8785023ed530aa873eada93fcc6a5aaf1a2e1d9031246c4583d97fc2e94cdb0b88fd70a1f199732ac8c2793c8b8e5c187c474e2f60ff2f5bb3fa9f54e972e7d4eec645770492bcc9b0c3055a3bfb680000000000000000871f029508009f00", @ANYRES32, @ANYBLOB="080071000a0101010600c500329e00000800ab00", @ANYRES32, @ANYBLOB="31ca10fe88ea0799c2f042bd6f145a4c06d7c8abe4d24f8689c476a19e0fa27834e05a69ebade9d71dde6c1dec7e59325715627abf0f8ef43818946f4ddedd5fc7caf59319462d9ca7036425028cfeed479fe2d9a5d8b8abe4f0db50a8fc9316ef43bcbc5d88040008000c"], 0x1b0}, 0x1, 0x0, 0x0, 0x4c090}, 0xc000) r1 = socket$inet6(0xa, 0x2, 0x3a) sendmmsg$inet6(r1, &(0x7f0000001900)=[{{&(0x7f0000001980)={0xa, 0x0, 0x0, @mcast2={0xff, 0x5, '\x00', 0x0}, 0x20000}, 0x1c, &(0x7f00000019c0)=[{&(0x7f0000001a00)="a0002883781ecc0e", 0x8}], 0x1}}, {{0x0, 0x0, &(0x7f0000001a40)}}], 0x2, 0x40) 33.941930408s ago: executing program 0 (id=3255): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x3c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@device_b}, @NL80211_ATTR_BG_SCAN_PERIOD={0x6, 0x98, 0xffff}]}, 0x3c}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x1a, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x15}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x3494a}]}, &(0x7f0000000180)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x6b, '\x00', 0x0, 0x3d}, 0x94) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF_FLAGS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={0x2, 0xffffffffffffffff, 0x80000}, &(0x7f0000000380)=0xc) (async) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF_FLAGS(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={0x2, 0xffffffffffffffff, 0x80000}, &(0x7f0000000380)=0xc) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f00000003c0)=[@in6={0xa, 0x4e24, 0x18000000, @loopback, 0x2}, @in={0x2, 0x4e23, @rand_addr=0x64010102}, @in={0x2, 0x4e24, @broadcast}, @in={0x2, 0x4e24, @multicast2}], 0x4c) 33.930500151s ago: executing program 3 (id=3256): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="bc010000130001010000000000000000ac141415000000000000000000000000fe8000000000000000000000000000bb4e20000d040000090a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0200000000000000000000000000000000000002000000000000000000000000060000000000000003000000000000000500000000000000080000000000000000000000000000000100000000000000000000000000000000010000000000000800000000000000000000000000000004010500"], 0x1bc}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) 33.825013525s ago: executing program 3 (id=3257): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0xffffffff) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000003c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000440)="c7", 0x1}], 0x1, 0x0, 0x0, 0x8054}}], 0x1, 0x4000045) sendmsg$netlink(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000600)={0x10, 0x2a, 0x800, 0x70bd27, 0x25dfdbfc}, 0x10}], 0x1, 0x0, 0x0, 0x2000c040}, 0x20000000) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000640)={0x3}, 0x10) sendto$inet(r1, &(0x7f0000000680)="b3", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000006c0)={0x0, 0x1}, 0x8) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f0000000280)=@abs={0x1, 0x0, 0x4e24}, 0x6e) bind$unix(r3, &(0x7f0000000340)=@file={0x1, './file0\x00'}, 0x6e) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8b20, &(0x7f0000000180)={'wlan1\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}) setsockopt$CAN_RAW_ERR_FILTER(r4, 0x65, 0x2, &(0x7f0000000100)=0x4, 0x4) getsockopt$sock_buf(r4, 0x1, 0x3b, &(0x7f0000000080)=""/127, &(0x7f0000000140)=0x7f) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x839, 0x70bd25, 0x3ffff, {0x0, 0x0, 0x0, r5, {0x0, 0x1}, {0xfff2, 0xffff}, {0xa}}}, 0x24}}, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r7, 0x89f0, &(0x7f0000000480)={'gre0\x00', &(0x7f00000004c0)={'ip_vti0\x00', r5, 0x7800, 0x10, 0xed0, 0x0, {{0x27, 0x4, 0x1, 0x7, 0x9c, 0x67, 0x0, 0x73, 0x4, 0x0, @empty, @multicast2, {[@timestamp_prespec={0x44, 0x14, 0xad, 0x3, 0x3, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0xfbd}, {@broadcast, 0x5}]}, @end, @ssrr={0x89, 0x7, 0xae, [@initdev={0xac, 0x1e, 0x1, 0x0}]}, @cipso={0x86, 0x6b, 0x1, [{0x2, 0x12, "3f545ce433673fafeb9892c83f23af89"}, {0x7, 0x5, "9f7c98"}, {0x2, 0xf, "9febaa20c7c7846d41eb8420e2"}, {0x7, 0xe, "ca99590f5ef8bdddb46423df"}, {0x2, 0x8, "e1b876623406"}, {0x6, 0xe, "9e19657ddacf045e17b887d9"}, {0x1, 0xf, "2ab0986d9c9890d6d47036398e"}, {0x2, 0xc, "4926b88f961035d0e0c3"}]}]}}}}}) 33.816657159s ago: executing program 0 (id=3258): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000880)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x9}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x8, 0x2, 0x7, 0x0, 0x1, 0xfffd}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0xd, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000f00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x3f, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000240), &(0x7f0000000280)=r2}, 0x20) bpf$PROG_BIND_MAP(0xa, &(0x7f00000002c0)={r2, r1}, 0xc) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x11, 0x10, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x41}}, [@jmp={0x5, 0x1, 0x8, 0x0, 0xdad1124f55525050}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000ac0)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x67}, 0x94) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000880)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x9}, 0x50) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x1, 0x8, 0x2, 0x7, 0x0, 0x1, 0xfffd}, 0x50) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0xd, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000003000000000000000040000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000f00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x3f, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r1}, &(0x7f0000000240), &(0x7f0000000280)=r2}, 0x20) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f00000002c0)={r2, r1}, 0xc) (async) close(0x3) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=@base={0x2, 0x4, 0x4, 0x8, 0x1014}, 0x48) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x11, 0x10, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x700}, {0x85, 0x0, 0x0, 0x86}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x41}}, [@jmp={0x5, 0x1, 0x8, 0x0, 0xdad1124f55525050}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000ac0)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x67}, 0x94) (async) 33.605661771s ago: executing program 0 (id=3259): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4080000400000006110540000000000a6000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x0, 0x10, &(0x7f0000000080), 0xffffffffffffffb2}, 0x48) r1 = socket(0x10, 0x803, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000240), r2) sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)={0x48, r3, 0x1, 0x70bd2c, 0x1000, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x2}, @NBD_ATTR_SOCKETS={0x1c, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}]}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x128}]}, 0x48}, 0x1, 0x700}, 0x4) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000400)=r0, 0x4) sendmsg$nl_generic(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="1c0000005200010000000000000000080a00000008000100", @ANYRES64], 0x1c}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_CQM(r4, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="c0000000", @ANYRES16=r5, @ANYBLOB="02002dbd7000fddbdf25a40d1cc408e102006603ca157d6106000000ff0e00313670cacbf5afecb5f19a830424ffb52d4192dcb93eef4b858126841ced2dfa2370d4ebceb441f144596f732ff0baa4147a7a0cbdb4374456ceaf", @ANYRES32=r6, @ANYBLOB="0c009900ff0000000800000054005e800800090066090000080009002a0000000800030001000080080009000600000008000700a0060000080007003901000008000500330000000800060008000000080002000000000008000200303c000044005e800800050058000000080007004f000000080009000000000008000200ff000000080007006503000010000100ffffff7f03000000000000000800030002000000"], 0xc0}, 0x1, 0x0, 0x0, 0x4004000}, 0x4000) 33.385376965s ago: executing program 4 (id=3260): r0 = socket$nl_route(0x10, 0x3, 0x0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$smc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$SMC_PNETID_GET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x20, r2, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x80) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) (async) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) r5 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000200)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000340)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000380)=@assoc_value={0x0}, &(0x7f00000003c0)=0x8) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r4, 0x84, 0x74, &(0x7f0000000400)={r6, 0x0, 0x10, 0x20000000006, 0xb1aa}, &(0x7f0000000440)=0x18) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="21000000000000002000128008000100687372001400028008000100", @ANYRES32=r3, @ANYBLOB="08000200", @ANYRES32=0x0, @ANYBLOB="3e7bcf526f3b18710778439d20263f80fa3ab49d3d522318d00297f8faba34bab62ce98cff969b1a0b09f2d4df8199bfcf737e754e7e14eb1b4256084e9343c38371691c6c040000000000000053f95ee48aa9578408098fdb94806981469c48b2a738350666bd6010d92351386a283ff2e5cb9483b4ace48f61f7b76e6c7300000000"], 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) 31.927636319s ago: executing program 1 (id=3261): setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000000)={0x209d, 0x0, 0x4, 0x1f}, 0x10) write(0xffffffffffffffff, &(0x7f0000000040)="1800000016005f0214fffffffffffff80700000001000000", 0x18) syz_emit_ethernet(0x66, &(0x7f00000001c0)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "fc414a", 0x30, 0x3c, 0x0, @private0, @local, {[@srh={0x2f, 0x4, 0x4, 0x2, 0xe5, 0x70, 0x8, [@private1, @private0]}], {0x0, 0x0, 0x8}}}}}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x98, 0x98, 0x4, [@const={0x0, 0x0, 0x0, 0xa, 0x2}, @union={0x9, 0x3, 0x0, 0x5, 0x0, 0x2, [{0x8, 0x4, 0xb45}, {0x4, 0x2, 0x2}, {0x9, 0x5, 0x9}]}, @func_proto={0x2, 0xa, 0x0, 0xc, 0x2, [{0xc, 0x4}, {0x2, 0xfffffffe}, {0x3, 0x5}, {0xb, 0x3}, {0xe, 0x2}, {0x2}, {0xb, 0x5}, {0x7, 0x5}, {0x3, 0x4}, {0x8, 0x4}]}]}, {0x0, [0x0, 0x61]}}, 0x0, 0xb4}, 0x28) 31.877971898s ago: executing program 3 (id=3262): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r0) sendmsg$NLBL_MGMT_C_VERSION(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)={0x14, r1, 0x1}, 0x14}}, 0x0) 31.7982803s ago: executing program 1 (id=3263): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000540)=ANY=[@ANYBLOB="6c00000010001fff109e00008000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000003f0000440012800b00010067656e6576650000340002800500030003000000060005004e20000005000400ab000000050009000100000005000a0001000000050009000100000008000a00", @ANYRES32=r3], 0x6c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 31.579193219s ago: executing program 1 (id=3264): r0 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0), 0xffffffffffffffff) syz_emit_ethernet(0x4e, &(0x7f0000000b80)=ANY=[@ANYBLOB="269fe000183afffe000000000000000000000000000101ff4b30997235026d00000000000040000000000001d503385d43fd88009078030000002081000000809d31040966c769995c710a554988b07b5161e2a35048e05a325d24ef9a847dc9ecd91fca84ce3a826849f68a61e2c816922e98ec477d55bbf63108af59e14b114d6722569d4e65497945a8b4b3b402eea3fe98b59f835d775ef1a851d64ba4f41bd1e3cd5bde23bb44c5ced38e3470870a896a2efc08a661d645555fd62327c5328752b93ebd887814b6b71f80f8ce94ae33ee0bd0af10955898d1b97c36045e2f701d7b5b7fb458f1eef3bed459f454b9f415cd57bea8d11b3e52d422085e5b0191d5a3c3dff6d62b154b1c0886d229e23421979169de54d5a32a0845ac6568dc93ff2b5a36d286c1f43b07c054ad4abf453fbec8ab99a2e84234479a14f135afe1042c651fd60e1e2d2295929bb47c9514328afa48a414c77851f0d4481be1395ad5b8feca48cccd000000005ebb39575d586b176be83e4691d52db2c28c745295fdf8b4e2b5430e94fd67d70d3133e364e212b3"], 0x0) r1 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$SIOCPNGETOBJECT(r1, 0x89e0, &(0x7f0000000380)=0x7) r2 = socket$kcm(0x10, 0x2, 0x4) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000008c0)='./cgroup/syz1\x00', 0x1ff) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000900), 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f0000000940)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f0000000200), 0x12) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000009c0)='./cgroup.cpu/syz1\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000a00), 0x200002, 0x0) unshare(0x6020400) r6 = openat$cgroup_procs(r5, &(0x7f0000000a40)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r6, &(0x7f0000000a80), 0x12) r7 = socket$igmp(0x2, 0x3, 0x2) sendmsg$kcm(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000400)="4c000000150097f87059ae08060c040002ff0f0200000000000001870182fa73a69d35a2cca84708f7abca1bac1414aabd7c493872f750375ed08a560400000003c48f93b82a03000000461e", 0x4c}], 0x1}, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nfc(&(0x7f00000001c0), r9) sendmsg$NFC_CMD_LLC_SET_PARAMS(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000880)={0x24, r10, 0x1, 0x70bd25, 0x25dfdbfe, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_LLC_PARAM_MIUX={0x6, 0x11, 0x121}]}, 0x24}, 0x1, 0x0, 0x0, 0x850}, 0x20040880) sendmsg$nl_route(r8, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)=ANY=[], 0x4c}}, 0x8000) bpf$ITER_CREATE(0x21, &(0x7f0000000900)={r7}, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="1700000000000000080000000100000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000fbffffff0000000000000000a04dee0653c6f39200000000"], 0x50) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r11, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB="14f60ecb", @ANYRES16=r12, @ANYBLOB="0100000000000000000001000000000000000b0000000005001473797a3000000000"], 0x28}}, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_CMD_SHOW_LINK_STATS(r13, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x30, r0, 0x100, 0x70bd27, 0x25dfdbff, {{}, {}, {0x14, 0x14, 'broadcast-link\x00'}}}, 0x30}}, 0x80) sendmsg$NL80211_CMD_SET_QOS_MAP(r13, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000127bd7000fddbdf25680000001600c70067000000000502040f0191b86b090e6e5bb600002c00c7000601cc030c0309000900000506030000020006020207060603023204a2068107baa969254390c1893600c7006c0408030701a9051406ff0400040802800004020706d4061001080300070504050605020a068501fb0759a427cfcc2b97c70000"], 0x90}, 0x1, 0x0, 0x0, 0x40000}, 0x40000084) 28.601581466s ago: executing program 4 (id=3265): syz_emit_ethernet(0xffffffffffffff20, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd600a8435001406fffe8000000000000000000000000000bbfe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000040000000000"], 0x0) syz_emit_ethernet(0x4a, &(0x7f00000004c0)={@local, @random="6cf6566994c6", @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x2d, 0x38, 0x0, 0x0, 0xa3, 0x6, 0x0, @remote, @local, {[@rr={0x7, 0xf, 0x9, [@multicast2, @loopback, @empty]}]}}, {{0x4e22, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r0, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f00000000c0)={0x248, 0x2, 0x2, 0x201, 0x0, 0x0, {0x3, 0x0, 0x1}, [@CTA_EXPECT_ID={0x8, 0x5, 0x1, 0x0, 0x41}, @CTA_EXPECT_TUPLE={0x38, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x40}}, {0x8, 0x2, @broadcast}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_EXPECT_MASK={0x84, 0x3, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_FN={0x13, 0xb, 'callforwarding\x00'}, @CTA_EXPECT_NAT={0xf0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x64, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @dev={0xfe, 0x80, '\x00', 0x1b}}, {0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x68, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @remote}, {0x8, 0x2, @multicast2}}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_FN={0xa, 0xb, 'Q.931\x00'}, @CTA_EXPECT_MASTER={0x58, 0x1, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @remote}}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0xfd3d29b154b3c88a}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x7}]}, 0x248}, 0x1, 0x0, 0x0, 0x4008000}, 0x20004001) 28.600925456s ago: executing program 0 (id=3266): socket(0x1e, 0x4, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000180)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000200)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000240)) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280)) socket$tipc(0x1e, 0x5, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000002c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000300)) socket$tipc(0x1e, 0x2, 0x0) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r0, &(0x7f0000000340)="580000001500010300000000000000001e000000ffffffff00"/88, 0x58) 28.597410568s ago: executing program 3 (id=3267): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x16, &(0x7f00000006c0)=ANY=[@ANYBLOB="61126500000000006113770000000000bf2000000000000015000500511b48013d030100000000009500000000000000bc26000000000000bf67000000000000070300000fff07006702000003000000360600000ee600f0bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a83683d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf5fe7030586162c17600674290ca9d8d6413b8199e34f67ceaaa78710f9f8aba4765c91382f497585ca39c595b21afa6bce62b5ab0d44e9c32ad6f0349d92962a58d39494a19a9183362382792ac85578d3de07b7e155cf4ee5e3dd51212d2831bd8e2655b2fbd88791e4c66c832a774919b28b8a62711f0f156e636804e1d3f44a5ff3d63a3a51f0c7ec0c8c25e072194ddd83aa155a537e15c0d91f502deef03f83e826718705c9aef9613ac4a325a428d147c1749196e94226671fd9573ab0d079d44b13b56f793e98ab571c58e98e022f18a3be3f318e0690fff93f44f22473dc8004fc758218349bd3f0516a72a7ea913bfa7603063ed3118b2d680cbc"], &(0x7f00000008c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x1a, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x15}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x34ec5}]}, &(0x7f0000000180)='GPL\x00', 0x9, 0x0, 0x0, 0x41000, 0x6b, '\x00', 0x0, 0x3d, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) (async) r1 = socket$kcm(0x1e, 0x4, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x1000001, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) (async) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000900), 0x43) (async) r2 = socket$kcm(0x1e, 0x4, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001cc0)={&(0x7f0000001d00)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x4, [@var={0x2, 0x0, 0x0, 0x11}]}, {0x0, [0x0, 0x61]}}, 0x0, 0x2c}, 0x20) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000009c0)={r1, 0x8001, 0x100000000, 0x8}) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000001ac0)="ddfbaddde9a7a0d9dda2a5f6fb91744fea991b11ccdfb2661ae7ce99376604bbfb7035a64f699a93bc1ba9e10e811f850938c4976f", 0x35) (async) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001c00), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r4, 0xc004743e, &(0x7f0000001c40)=0x3) (async) ioctl$PPPIOCSMAXCID(r4, 0x40047451, &(0x7f0000001c80)=0xfffefffe) (async) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f0000000940), 0x43) r5 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r5, 0x10f, 0x87, &(0x7f0000000980), 0x43) (async) write$cgroup_subtree(r5, &(0x7f00000009c0)=ANY=[], 0xfdef) (async) close(r5) (async, rerun: 32) recvmsg(r2, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000a80)=""/4101, 0x1005}], 0x1}, 0x2101) (async, rerun: 32) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000000)={0x1b, 0x0, 0x0, 0x194, 0x0, 0x1, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x3}, 0x50) (async) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000003c0)={@local, @broadcast, 0x0}, &(0x7f0000000400)=0xc) r8 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440)=0xffffffffffffffff, 0x4) (async) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) recvmsg(r9, &(0x7f0000001d40)={0x0, 0x0, 0x0}, 0x2000) (async) r10 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r10, 0x4000000000000, 0x40, &(0x7f0000001e40)=@raw={'raw\x00', 0x4001, 0x3, 0x488, 0x330, 0xb, 0x148, 0x330, 0x148, 0x3f0, 0x230, 0x242, 0x3f0, 0x215, 0x3, 0x0, {[{{@ip={@local, @remote, 0x0, 0xffffffff, 'veth0\x00', 'macvtap0\x00'}, 0x0, 0x2d0, 0x330, 0x0, {0xff0f000000000000}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x0, 0x0, 0x8}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0xe, 0x0, 0x6, './file0\x00', {0x1000000000000}}}]}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@loopback, [0xffffff00, 0xff000000, 0xff, 0xffffff00], 0x4e20, 0x4e22, 0x4e22, 0x4e22, 0x0, 0x101, 0x0, 0x40c, 0x4}}}, {{@uncond, 0xec010000, 0xa0, 0xc0, 0x0, {}, [@common=@ah={{0x30}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x4e8) sendmsg$netlink(r9, &(0x7f0000001d80)={0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000001e00)=ANY=[@ANYBLOB="140000001300015b993dde440113e90006"], 0x14}], 0x1}, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$team(&(0x7f0000001b00), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_GET(r11, &(0x7f0000001b40)={0x0, 0x0, &(0x7f0000001b80)={&(0x7f0000001bc0)={0x14, r12, 0x1, 0x70bd25, 0x25dfdbff}, 0x14}}, 0x4008004) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000540)=@bpf_lsm={0x1d, 0x13, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000004000000000000000000000051fa1700b0767eeb6bea0000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000003007000008000000186700000c00000000000000b6ffffff1908571010000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000280)='GPL\x00', 0xfffffff9, 0xc2, &(0x7f00000002c0)=""/194, 0x41000, 0x0, '\x00', r7, 0x1b, r8, 0x8, &(0x7f0000000480)={0x0, 0x5}, 0x8, 0x10, &(0x7f00000004c0)={0x1, 0x5, 0x5, 0x81}, 0x10, 0xffffffffffffffff, 0x0, 0x1, 0x0, &(0x7f0000000500)=[{0x1, 0x2, 0x7}], 0x10, 0x7}, 0x94) 28.580659221s ago: executing program 1 (id=3268): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=@newsa={0x138, 0x1a, 0x713, 0x0, 0x0, {{@in6=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x2}, {@in=@local, 0x0, 0x33}, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, {0x0, 0x0, 0x0, 0x0, 0xb4, 0x0, 0x0, 0x20000000}, {0x0, 0x0, 0xffffffffffffffff}, {}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x60}, [@algo_auth={0x48, 0x1, {{'rmd320-generic\x00'}}}]}, 0x138}}, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newlink={0x58, 0x10, 0x401, 0x70bd28, 0x8848, {0x0, 0x0, 0x0, 0x0, 0x8405}, [@IFLA_IFNAME={0x14, 0x3, 'bridge_slave_0\x00'}, @IFLA_MAP={0x24, 0xe, {0x2, 0x4, 0x9e, 0xe52, 0x10, 0xfe}}]}, 0x58}}, 0x40) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'macsec0\x00', &(0x7f0000000040)=@ethtool_link_settings={0x0, 0x694, 0x81, 0xfc, 0xb9, 0x0, 0x7, 0xf9, 0x10, 0x5, [0x40, 0x2, 0x7, 0x5, 0x3, 0x9d, 0x1, 0x8], [0x5, 0x4, 0x9, 0x6, 0x6]}}) 19.04608867s ago: executing program 3 (id=3269): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x8080, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x2, 0x0, 0x1}}]}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000780)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000900)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000009c0)=@newqdisc={0x200, 0x24, 0x41f, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x1d0, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x1000, 0xa, 0x64, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104, 0x2, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00'}]}}]}, 0x200}}, 0x0) 0s ago: executing program 32 (id=3266): socket(0x1e, 0x4, 0x0) socket$tipc(0x1e, 0x2, 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000080)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000000c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000180)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000001c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000200)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000240)) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000280)) socket$tipc(0x1e, 0x5, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000002c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000300)) socket$tipc(0x1e, 0x2, 0x0) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r0, &(0x7f0000000340)="580000001500010300000000000000001e000000ffffffff00"/88, 0x58) kernel console output (not intermixed with test programs): process `syz.2.1792'. [ 220.039996][T12265] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1792'. [ 220.418482][T12288] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1800'. [ 220.642529][T12309] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 222.244923][T12409] 8021q: adding VLAN 0 to HW filter on device bond11 [ 222.267379][T12409] bond10: (slave team0): Removing an active aggregator [ 222.268043][T12409] bond10: (slave team0): Releasing backup interface [ 222.278952][T12409] 8021q: adding VLAN 0 to HW filter on device team0 [ 222.285061][T12409] bond11: (slave team0): Enslaving as a backup interface with an up link [ 222.391374][T12420] 8021q: adding VLAN 0 to HW filter on device bond12 [ 222.659839][T12438] ip_tables: iptables: counters copy to user failed while replacing table [ 222.902817][T12454] 8021q: adding VLAN 0 to HW filter on device bond13 [ 222.940577][T12454] bond11: (slave team0): Removing an active aggregator [ 222.942743][T12454] bond11: (slave team0): Releasing backup interface [ 222.967314][T12454] 8021q: adding VLAN 0 to HW filter on device team0 [ 222.970016][T12454] bond13: (slave team0): Enslaving as a backup interface with an up link [ 222.973308][T12460] bond15: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 223.042363][T12460] bond15: (slave lo): Enslaving as an active interface with an up link [ 223.042640][T12460] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 223.310148][T12481] validate_nla: 67 callbacks suppressed [ 223.310173][T12481] netlink: 'syz.3.1860': attribute type 32 has an invalid length. [ 223.574328][T12497] netlink: 'syz.1.1865': attribute type 1 has an invalid length. [ 223.721057][T12497] 8021q: adding VLAN 0 to HW filter on device bond11 [ 223.771516][T12507] bond10: (slave team0): Removing an active aggregator [ 223.773454][T12507] bond10: (slave team0): Releasing backup interface [ 223.803307][T12507] 8021q: adding VLAN 0 to HW filter on device team0 [ 223.809259][T12507] bond11: (slave team0): Enslaving as a backup interface with an up link [ 224.019167][T12520] netlink: 'syz.3.1872': attribute type 39 has an invalid length. [ 224.208672][T12522] __nla_validate_parse: 12 callbacks suppressed [ 224.208696][T12522] netlink: 52 bytes leftover after parsing attributes in process `syz.1.1876'. [ 224.402430][T12550] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1878'. [ 224.534249][T12558] netlink: 'syz.4.1881': attribute type 1 has an invalid length. [ 224.561110][T12561] netlink: 'syz.0.1882': attribute type 1 has an invalid length. [ 224.587549][T12558] 8021q: adding VLAN 0 to HW filter on device bond12 [ 224.591323][T12558] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1881'. [ 224.634478][T12567] netlink: 'syz.0.1882': attribute type 1 has an invalid length. [ 224.643879][T12561] 8021q: adding VLAN 0 to HW filter on device bond14 [ 224.765364][T12582] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1885'. [ 225.091604][T12604] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1893'. [ 225.093892][T12605] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1893'. [ 225.150444][T12615] netlink: 'syz.2.1894': attribute type 2 has an invalid length. [ 225.150459][T12615] netlink: 'syz.2.1894': attribute type 2 has an invalid length. [ 225.165283][T12615] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1894'. [ 225.165304][T12615] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1894'. [ 225.204504][T12618] netlink: 'syz.1.1895': attribute type 1 has an invalid length. [ 225.245304][T12618] 8021q: adding VLAN 0 to HW filter on device bond12 [ 225.262369][T12618] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1895'. [ 225.278373][T12618] bond11: (slave team0): Removing an active aggregator [ 225.278985][T12618] bond11: (slave team0): Releasing backup interface [ 225.283463][T12618] 8021q: adding VLAN 0 to HW filter on device team0 [ 225.294791][T12618] bond12: (slave team0): Enslaving as a backup interface with an up link [ 225.453363][T12629] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1898'. [ 225.574913][T12639] xt_REDIRECT: bad MAP_IPS. [ 225.851790][T12654] netlink: 'syz.1.1907': attribute type 1 has an invalid length. [ 225.934829][T12654] 8021q: adding VLAN 0 to HW filter on device bond13 [ 225.963557][T12657] bond12: (slave team0): Removing an active aggregator [ 225.964285][T12657] bond12: (slave team0): Releasing backup interface [ 225.995022][T12657] 8021q: adding VLAN 0 to HW filter on device team0 [ 226.000507][T12657] bond13: (slave team0): Enslaving as a backup interface with an up link [ 227.120087][T12694] Bluetooth: MGMT ver 1.23 [ 227.343716][T12706] 8021q: adding VLAN 0 to HW filter on device bond13 [ 227.354706][T12714] veth1_macvtap: left promiscuous mode [ 227.354735][T12714] macsec0: entered promiscuous mode [ 227.415014][T12714] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 227.668791][T12727] tipc: Enabling of bearer rejected, failed to enable media [ 227.720226][T12734] bond0: Caught tx_queue_len zero misconfig [ 227.858850][T12750] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 227.860918][T12747] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 227.860934][T12747] IPv6: NLM_F_CREATE should be set when creating new route [ 227.860973][T12747] IPv6: NLM_F_CREATE should be set when creating new route [ 227.860998][T12747] IPv6: NLM_F_CREATE should be set when creating new route [ 227.917939][T12751] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 228.095779][T12762] xt_hashlimit: size too large, truncated to 1048576 [ 228.319323][ T24] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 228.336688][ T24] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 228.466894][ T24] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 228.554675][T12781] Cannot find add_set index 0 as target [ 228.663329][T12787] validate_nla: 7 callbacks suppressed [ 228.663351][T12787] netlink: 'syz.1.1939': attribute type 1 has an invalid length. [ 228.876408][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 228.974045][T12798] bond9: option arp_all_targets: invalid value (18446744073709551613) [ 228.993354][T12798] bond9 (unregistering): Released all slaves [ 229.175414][T12816] syzkaller0: entered promiscuous mode [ 229.175438][T12816] syzkaller0: entered allmulticast mode [ 229.372525][T12823] __nla_validate_parse: 16 callbacks suppressed [ 229.372548][T12823] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1949'. [ 229.480618][T12823] netlink: 256 bytes leftover after parsing attributes in process `syz.0.1949'. [ 229.512504][T12828] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1950'. [ 229.661651][T12836] netlink: 'syz.4.1952': attribute type 1 has an invalid length. [ 229.751140][T12841] tunl0: Caught tx_queue_len zero misconfig [ 229.919112][T12852] netlink: 'syz.4.1955': attribute type 2 has an invalid length. [ 229.934440][T12854] veth0_macvtap: Caught tx_queue_len zero misconfig [ 229.945401][T12856] netlink: 'syz.4.1955': attribute type 2 has an invalid length. [ 230.083568][T12862] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 230.213293][T12874] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1961'. [ 230.258896][T12875] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1961'. [ 230.376035][T12870] TC_ACT_REPEAT abuse ? [ 230.717820][T12906] netlink: 'syz.1.1970': attribute type 1 has an invalid length. [ 230.749646][T12906] 8021q: adding VLAN 0 to HW filter on device bond15 [ 230.750843][T12906] netlink: 'syz.1.1970': attribute type 1 has an invalid length. [ 230.751079][T12906] netlink: 'syz.1.1970': attribute type 1 has an invalid length. [ 230.751273][T12906] netlink: 'syz.1.1970': attribute type 1 has an invalid length. [ 230.751449][T12906] netlink: 'syz.1.1970': attribute type 1 has an invalid length. [ 230.751622][T12906] netlink: 'syz.1.1970': attribute type 1 has an invalid length. [ 230.860240][T12904] h: entered promiscuous mode [ 230.889263][T12917] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 231.078910][T12925] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1975'. [ 231.243325][T12941] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1975'. [ 231.312564][T12944] IPVS: set_ctl: invalid protocol: 22 0.0.0.0:20002 [ 231.609994][T12956] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 231.799248][T12971] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1987'. [ 231.823423][T12959] netlink: 244 bytes leftover after parsing attributes in process `syz.0.1986'. [ 231.838136][T12972] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1990'. [ 231.849878][T12965] 8021q: adding VLAN 0 to HW filter on device bond9 [ 231.869071][T12971] bond7: (slave team0): Removing an active aggregator [ 231.873819][T12971] bond7: (slave team0): Releasing backup interface [ 231.893623][T12971] 8021q: adding VLAN 0 to HW filter on device team0 [ 231.902227][T12971] bond9: (slave team0): Enslaving as a backup interface with an up link [ 232.823880][T13028] 8021q: adding VLAN 0 to HW filter on device bond15 [ 233.387630][T13057] syzkaller0: entered promiscuous mode [ 233.387653][T13057] syzkaller0: entered allmulticast mode [ 233.602134][T13081] ip_tables: iptables: counters copy to user failed while replacing table [ 233.746322][T13085] syz.1.2019 (13085) used obsolete PPPIOCDETACH ioctl [ 233.975725][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 234.484398][T13132] __nla_validate_parse: 9 callbacks suppressed [ 234.484420][T13132] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2025'. [ 234.529948][T13135] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2028'. [ 234.542702][T13131] tipc: Enabled bearer , priority 10 [ 234.870136][T13159] validate_nla: 65 callbacks suppressed [ 234.870162][T13159] netlink: 'syz.2.2034': attribute type 1 has an invalid length. [ 234.925615][T13163] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2034'. [ 234.928606][T13159] 8021q: adding VLAN 0 to HW filter on device bond11 [ 234.963293][T13163] bond9: (slave team0): Removing an active aggregator [ 234.965256][T13163] bond9: (slave team0): Releasing backup interface [ 234.999310][T13163] 8021q: adding VLAN 0 to HW filter on device team0 [ 235.002267][T13163] bond11: (slave team0): Enslaving as a backup interface with an up link [ 235.191585][T13173] openvswitch: netlink: Duplicate or invalid key (type 0). [ 235.191620][T13173] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 235.293102][T13181] IPVS: set_ctl: invalid protocol: 58 255.255.255.255:20003 [ 235.293328][T13179] netlink: 'syz.2.2042': attribute type 1 has an invalid length. [ 235.301662][T13180] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2042'. [ 235.301702][T13180] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2042'. [ 235.653087][T13203] netlink: 'syz.1.2048': attribute type 1 has an invalid length. [ 235.678004][T13203] 8021q: adding VLAN 0 to HW filter on device bond16 [ 235.681656][T13203] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2048'. [ 235.764516][T13203] bond13: (slave team0): Removing an active aggregator [ 235.774676][T13203] bond13: (slave team0): Releasing backup interface [ 235.801415][T13203] 8021q: adding VLAN 0 to HW filter on device team0 [ 235.814681][T13203] bond16: (slave team0): Enslaving as a backup interface with an up link [ 236.142023][T13228] netlink: 'syz.0.2058': attribute type 32 has an invalid length. [ 236.142045][T13228] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2058'. [ 236.212880][T13235] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2062'. [ 236.263353][T13228] bond16: Setting coupled_control to off (0) [ 236.428295][T13251] netlink: 'syz.4.2065': attribute type 1 has an invalid length. [ 236.487568][T13256] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2065'. [ 236.546302][T13251] 8021q: adding VLAN 0 to HW filter on device bond16 [ 236.625334][T13259] netlink: 'syz.3.2067': attribute type 4 has an invalid length. [ 236.868575][T13281] netlink: 232 bytes leftover after parsing attributes in process `syz.0.2074'. [ 236.986726][T13286] xt_nat: multiple ranges no longer supported [ 237.163145][T13297] netlink: 'syz.3.2079': attribute type 1 has an invalid length. [ 237.192722][T13297] 8021q: adding VLAN 0 to HW filter on device bond16 [ 237.369296][T13305] macvlan0: entered promiscuous mode [ 237.937468][T13331] netlink: 'syz.2.2092': attribute type 1 has an invalid length. [ 238.007645][T13331] 8021q: adding VLAN 0 to HW filter on device bond12 [ 238.040856][T13335] bond11: (slave team0): Removing an active aggregator [ 238.041762][T13335] bond11: (slave team0): Releasing backup interface [ 238.086189][T13335] 8021q: adding VLAN 0 to HW filter on device team0 [ 238.088376][T13335] bond12: (slave team0): Enslaving as a backup interface with an up link [ 238.467112][T13350] sctp: [Deprecated]: syz.0.2096 (pid 13350) Use of struct sctp_assoc_value in delayed_ack socket option. [ 238.467112][T13350] Use struct sctp_sack_info instead [ 238.910056][T13389] FAULT_INJECTION: forcing a failure. [ 238.910056][T13389] name failslab, interval 1, probability 0, space 0, times 0 [ 238.910087][T13389] CPU: 0 UID: 0 PID: 13389 Comm: syz.2.2106 Not tainted syzkaller #0 PREEMPT(full) [ 238.910108][T13389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 238.910135][T13389] Call Trace: [ 238.910143][T13389] [ 238.910151][T13389] dump_stack_lvl+0xe8/0x150 [ 238.910188][T13389] should_fail_ex+0x3eb/0x540 [ 238.910222][T13389] should_failslab+0xa8/0x100 [ 238.910249][T13389] ? radix_tree_node_alloc+0x82/0x3a0 [ 238.910274][T13389] kmem_cache_alloc_noprof+0x9c/0x600 [ 238.910298][T13389] ? kernel_text_address+0xa5/0xe0 [ 238.910325][T13389] ? radix_tree_node_alloc+0x82/0x3a0 [ 238.910358][T13389] radix_tree_node_alloc+0x82/0x3a0 [ 238.910390][T13389] idr_get_free+0x28f/0xa10 [ 238.910428][T13389] idr_alloc_u32+0x18a/0x330 [ 238.910458][T13389] ? __pfx_idr_alloc_u32+0x10/0x10 [ 238.910485][T13389] ? net_generic+0x1e/0x240 [ 238.910512][T13389] ? l2tp_tunnel_register+0x140/0x1570 [ 238.910542][T13389] l2tp_tunnel_register+0x15a/0x1570 [ 238.910582][T13389] ? __pfx_l2tp_tunnel_register+0x10/0x10 [ 238.910608][T13389] ? do_raw_spin_lock+0x12b/0x2f0 [ 238.910633][T13389] ? pcpu_alloc+0x10/0x310 [ 238.910688][T13389] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 238.910712][T13389] ? l2tp_tunnel_create+0x249/0x3e0 [ 238.910733][T13389] ? l2tp_tunnel_create+0x2d3/0x3e0 [ 238.910763][T13389] l2tp_nl_cmd_tunnel_create+0x342/0x840 [ 238.910784][T13389] ? trace_kmalloc+0x2a/0xf0 [ 238.910810][T13389] ? __pfx_l2tp_nl_cmd_tunnel_create+0x10/0x10 [ 238.910836][T13389] ? __nla_parse+0x40/0x60 [ 238.910868][T13389] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 238.910891][T13389] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 238.910923][T13389] genl_family_rcv_msg_doit+0x233/0x340 [ 238.910955][T13389] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 238.910994][T13389] ? bpf_lsm_capable+0x9/0x20 [ 238.911011][T13389] ? security_capable+0x7e/0x2c0 [ 238.911047][T13389] genl_rcv_msg+0x614/0x7a0 [ 238.911077][T13389] ? __pfx_genl_rcv_msg+0x10/0x10 [ 238.911098][T13389] ? __pfx_l2tp_nl_cmd_tunnel_create+0x10/0x10 [ 238.911134][T13389] netlink_rcv_skb+0x226/0x4a0 [ 238.911160][T13389] ? __pfx_genl_rcv_msg+0x10/0x10 [ 238.911183][T13389] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 238.911227][T13389] ? down_read+0x2b9/0x320 [ 238.911258][T13389] genl_rcv+0x28/0x40 [ 238.911277][T13389] netlink_unicast+0x8ef/0xa80 [ 238.911322][T13389] netlink_sendmsg+0x7f0/0xb20 [ 238.911357][T13389] ? __pfx_netlink_sendmsg+0x10/0x10 [ 238.911388][T13389] ? aa_sock_msg_perm+0x144/0x210 [ 238.911412][T13389] ? apparmor_socket_sendmsg+0x98/0x360 [ 238.911442][T13389] ? __pfx_netlink_sendmsg+0x10/0x10 [ 238.911469][T13389] sock_sendmsg_nosec+0x14e/0x190 [ 238.911497][T13389] ____sys_sendmsg+0x54e/0x850 [ 238.911524][T13389] ? __pfx_____sys_sendmsg+0x10/0x10 [ 238.911554][T13389] ? import_iovec+0x73/0xa0 [ 238.911582][T13389] ___sys_sendmsg+0x2a5/0x360 [ 238.911600][T13389] ? __lock_acquire+0x747/0x2de0 [ 238.911630][T13389] ? __pfx____sys_sendmsg+0x10/0x10 [ 238.911701][T13389] ? __fget_files+0x3a2/0x420 [ 238.911722][T13389] ? __fget_files+0x2a/0x420 [ 238.911755][T13389] __x64_sys_sendmsg+0x1b1/0x290 [ 238.911780][T13389] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 238.911824][T13389] do_syscall_64+0x166/0x520 [ 238.911846][T13389] ? trace_irq_disable+0x3b/0x140 [ 238.911871][T13389] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.911890][T13389] ? clear_bhb_loop+0x70/0xc0 [ 238.911914][T13389] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 238.911933][T13389] RIP: 0033:0x7f70dbd9fb19 [ 238.911952][T13389] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 238.911967][T13389] RSP: 002b:00007f70dcd50028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 238.911987][T13389] RAX: ffffffffffffffda RBX: 00007f70dc025fa0 RCX: 00007f70dbd9fb19 [ 238.912001][T13389] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 238.912013][T13389] RBP: 00007f70dcd50090 R08: 0000000000000000 R09: 0000000000000000 [ 238.912024][T13389] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 238.912034][T13389] R13: 00007f70dc026038 R14: 00007f70dc025fa0 R15: 00007ffe105791b8 [ 238.912065][T13389] [ 239.547653][T13406] __nla_validate_parse: 48 callbacks suppressed [ 239.547675][T13406] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2110'. [ 239.547882][T13406] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2110'. [ 239.548057][T13406] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2110'. [ 239.548232][T13406] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2110'. [ 239.548408][T13406] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2110'. [ 239.548587][T13406] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2110'. [ 239.548774][T13406] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2110'. [ 239.548949][T13406] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2110'. [ 239.549125][T13406] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2110'. [ 239.549299][T13406] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2110'. [ 239.723845][T13414] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 240.003695][T13438] FAULT_INJECTION: forcing a failure. [ 240.003695][T13438] name failslab, interval 1, probability 0, space 0, times 0 [ 240.003725][T13438] CPU: 0 UID: 0 PID: 13438 Comm: syz.2.2118 Not tainted syzkaller #0 PREEMPT(full) [ 240.003747][T13438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 240.003759][T13438] Call Trace: [ 240.003766][T13438] [ 240.003775][T13438] dump_stack_lvl+0xe8/0x150 [ 240.003812][T13438] should_fail_ex+0x3eb/0x540 [ 240.003842][T13438] should_failslab+0xa8/0x100 [ 240.003871][T13438] ? security_inode_alloc+0x39/0x310 [ 240.003893][T13438] kmem_cache_alloc_noprof+0x9c/0x600 [ 240.003915][T13438] ? make_kgid+0x1d1/0x6a0 [ 240.003939][T13438] ? rcu_is_watching+0x16/0xb0 [ 240.003969][T13438] ? security_inode_alloc+0x39/0x310 [ 240.003998][T13438] security_inode_alloc+0x39/0x310 [ 240.004022][T13438] inode_init_always_gfp+0x97e/0xd30 [ 240.004052][T13438] ? __pfx_sock_alloc_inode+0x10/0x10 [ 240.004077][T13438] alloc_inode+0x82/0x1b0 [ 240.004102][T13438] __sock_create+0x127/0xac0 [ 240.004141][T13438] l2tp_tunnel_register+0x396/0x1570 [ 240.004188][T13438] ? __pfx_l2tp_tunnel_register+0x10/0x10 [ 240.004217][T13438] ? do_raw_spin_lock+0x12b/0x2f0 [ 240.004243][T13438] ? pcpu_alloc+0x10/0x310 [ 240.004291][T13438] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 240.004319][T13438] ? l2tp_tunnel_create+0x249/0x3e0 [ 240.004343][T13438] ? l2tp_tunnel_create+0x2d3/0x3e0 [ 240.004375][T13438] l2tp_nl_cmd_tunnel_create+0x342/0x840 [ 240.004398][T13438] ? trace_kmalloc+0x2a/0xf0 [ 240.004424][T13438] ? __pfx_l2tp_nl_cmd_tunnel_create+0x10/0x10 [ 240.004449][T13438] ? __nla_parse+0x40/0x60 [ 240.004481][T13438] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 240.004504][T13438] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 240.004536][T13438] genl_family_rcv_msg_doit+0x233/0x340 [ 240.004576][T13438] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 240.004615][T13438] ? bpf_lsm_capable+0x9/0x20 [ 240.004633][T13438] ? security_capable+0x7e/0x2c0 [ 240.004670][T13438] genl_rcv_msg+0x614/0x7a0 [ 240.004700][T13438] ? __pfx_genl_rcv_msg+0x10/0x10 [ 240.004721][T13438] ? __pfx_l2tp_nl_cmd_tunnel_create+0x10/0x10 [ 240.004759][T13438] netlink_rcv_skb+0x226/0x4a0 [ 240.004788][T13438] ? __pfx_genl_rcv_msg+0x10/0x10 [ 240.004813][T13438] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 240.004858][T13438] ? down_read+0x2b9/0x320 [ 240.004890][T13438] genl_rcv+0x28/0x40 [ 240.004910][T13438] netlink_unicast+0x8ef/0xa80 [ 240.004958][T13438] netlink_sendmsg+0x7f0/0xb20 [ 240.004994][T13438] ? __pfx_netlink_sendmsg+0x10/0x10 [ 240.005028][T13438] ? aa_sock_msg_perm+0x144/0x210 [ 240.005055][T13438] ? apparmor_socket_sendmsg+0x98/0x360 [ 240.005085][T13438] ? __pfx_netlink_sendmsg+0x10/0x10 [ 240.005114][T13438] sock_sendmsg_nosec+0x14e/0x190 [ 240.005144][T13438] ____sys_sendmsg+0x54e/0x850 [ 240.005174][T13438] ? __pfx_____sys_sendmsg+0x10/0x10 [ 240.005207][T13438] ? import_iovec+0x73/0xa0 [ 240.005238][T13438] ___sys_sendmsg+0x2a5/0x360 [ 240.005257][T13438] ? __lock_acquire+0x747/0x2de0 [ 240.005288][T13438] ? __pfx____sys_sendmsg+0x10/0x10 [ 240.005354][T13438] ? __fget_files+0x3a2/0x420 [ 240.005375][T13438] ? __fget_files+0x2a/0x420 [ 240.005409][T13438] __x64_sys_sendmsg+0x1b1/0x290 [ 240.005434][T13438] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 240.005477][T13438] do_syscall_64+0x166/0x520 [ 240.005499][T13438] ? trace_irq_disable+0x3b/0x140 [ 240.005523][T13438] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.005543][T13438] ? clear_bhb_loop+0x70/0xc0 [ 240.005574][T13438] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 240.005599][T13438] RIP: 0033:0x7f70dbd9fb19 [ 240.005619][T13438] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 240.005635][T13438] RSP: 002b:00007f70dcd50028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 240.005656][T13438] RAX: ffffffffffffffda RBX: 00007f70dc025fa0 RCX: 00007f70dbd9fb19 [ 240.005672][T13438] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 240.005685][T13438] RBP: 00007f70dcd50090 R08: 0000000000000000 R09: 0000000000000000 [ 240.005697][T13438] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 240.005709][T13438] R13: 00007f70dc026038 R14: 00007f70dc025fa0 R15: 00007ffe105791b8 [ 240.005745][T13438] [ 240.122461][T13438] socket: no more sockets [ 240.658376][T13468] netlink: 'syz.0.2126': attribute type 10 has an invalid length. [ 240.726694][T13468] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 240.987252][T13483] Bluetooth: MGMT ver 1.23 [ 241.055243][T13490] FAULT_INJECTION: forcing a failure. [ 241.055243][T13490] name failslab, interval 1, probability 0, space 0, times 0 [ 241.055274][T13490] CPU: 0 UID: 0 PID: 13490 Comm: syz.3.2132 Not tainted syzkaller #0 PREEMPT(full) [ 241.055296][T13490] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 241.055307][T13490] Call Trace: [ 241.055314][T13490] [ 241.055322][T13490] dump_stack_lvl+0xe8/0x150 [ 241.055360][T13490] should_fail_ex+0x3eb/0x540 [ 241.055391][T13490] should_failslab+0xa8/0x100 [ 241.055420][T13490] ? security_inode_alloc+0x39/0x310 [ 241.055440][T13490] kmem_cache_alloc_noprof+0x9c/0x600 [ 241.055461][T13490] ? make_kgid+0x1d1/0x6a0 [ 241.055485][T13490] ? rcu_is_watching+0x16/0xb0 [ 241.055512][T13490] ? security_inode_alloc+0x39/0x310 [ 241.055538][T13490] security_inode_alloc+0x39/0x310 [ 241.055562][T13490] inode_init_always_gfp+0x97e/0xd30 [ 241.055591][T13490] ? __pfx_sock_alloc_inode+0x10/0x10 [ 241.055616][T13490] alloc_inode+0x82/0x1b0 [ 241.055638][T13490] __sock_create+0x127/0xac0 [ 241.055675][T13490] l2tp_tunnel_register+0x396/0x1570 [ 241.055718][T13490] ? __pfx_l2tp_tunnel_register+0x10/0x10 [ 241.055745][T13490] ? do_raw_spin_lock+0x12b/0x2f0 [ 241.055770][T13490] ? pcpu_alloc+0x10/0x310 [ 241.055819][T13490] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 241.055847][T13490] ? l2tp_tunnel_create+0x249/0x3e0 [ 241.055871][T13490] ? l2tp_tunnel_create+0x2d3/0x3e0 [ 241.055903][T13490] l2tp_nl_cmd_tunnel_create+0x342/0x840 [ 241.055926][T13490] ? trace_kmalloc+0x2a/0xf0 [ 241.055961][T13490] ? __pfx_l2tp_nl_cmd_tunnel_create+0x10/0x10 [ 241.055987][T13490] ? __nla_parse+0x40/0x60 [ 241.056018][T13490] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 241.056040][T13490] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 241.056070][T13490] genl_family_rcv_msg_doit+0x233/0x340 [ 241.056099][T13490] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 241.056132][T13490] ? bpf_lsm_capable+0x9/0x20 [ 241.056148][T13490] ? security_capable+0x7e/0x2c0 [ 241.056182][T13490] genl_rcv_msg+0x614/0x7a0 [ 241.056208][T13490] ? __pfx_genl_rcv_msg+0x10/0x10 [ 241.056228][T13490] ? __pfx_l2tp_nl_cmd_tunnel_create+0x10/0x10 [ 241.056268][T13490] netlink_rcv_skb+0x226/0x4a0 [ 241.056296][T13490] ? __pfx_genl_rcv_msg+0x10/0x10 [ 241.056319][T13490] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 241.056363][T13490] ? down_read+0x2b9/0x320 [ 241.056394][T13490] genl_rcv+0x28/0x40 [ 241.056414][T13490] netlink_unicast+0x8ef/0xa80 [ 241.056460][T13490] netlink_sendmsg+0x7f0/0xb20 [ 241.056495][T13490] ? __pfx_netlink_sendmsg+0x10/0x10 [ 241.056528][T13490] ? aa_sock_msg_perm+0x144/0x210 [ 241.056554][T13490] ? apparmor_socket_sendmsg+0x98/0x360 [ 241.056584][T13490] ? __pfx_netlink_sendmsg+0x10/0x10 [ 241.056611][T13490] sock_sendmsg_nosec+0x14e/0x190 [ 241.056640][T13490] ____sys_sendmsg+0x54e/0x850 [ 241.056667][T13490] ? __pfx_____sys_sendmsg+0x10/0x10 [ 241.056699][T13490] ? import_iovec+0x73/0xa0 [ 241.056726][T13490] ___sys_sendmsg+0x2a5/0x360 [ 241.056744][T13490] ? __lock_acquire+0x747/0x2de0 [ 241.056774][T13490] ? __pfx____sys_sendmsg+0x10/0x10 [ 241.056835][T13490] ? __fget_files+0x3a2/0x420 [ 241.056856][T13490] ? __fget_files+0x2a/0x420 [ 241.056890][T13490] __x64_sys_sendmsg+0x1b1/0x290 [ 241.056916][T13490] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 241.056971][T13490] do_syscall_64+0x166/0x520 [ 241.056994][T13490] ? trace_irq_disable+0x3b/0x140 [ 241.057019][T13490] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 241.057039][T13490] ? clear_bhb_loop+0x70/0xc0 [ 241.057064][T13490] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 241.057084][T13490] RIP: 0033:0x7f8e6bf9fb19 [ 241.057102][T13490] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 241.057118][T13490] RSP: 002b:00007f8e6cdf0028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 241.057139][T13490] RAX: ffffffffffffffda RBX: 00007f8e6c225fa0 RCX: 00007f8e6bf9fb19 [ 241.057153][T13490] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000003 [ 241.057164][T13490] RBP: 00007f8e6cdf0090 R08: 0000000000000000 R09: 0000000000000000 [ 241.057176][T13490] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 241.057186][T13490] R13: 00007f8e6c226038 R14: 00007f8e6c225fa0 R15: 00007ffd86dc4e08 [ 241.057222][T13490] [ 241.257276][T13490] socket: no more sockets [ 241.537947][T13496] xt_hashlimit: size too large, truncated to 1048576 [ 241.538191][T13496] xt_hashlimit: max too large, truncated to 1048576 [ 241.539325][T13496] xt_hashlimit: invalid rate [ 241.900405][ T1113] IPVS: starting estimator thread 0... [ 241.902737][T13519] IPVS: ip_vs_edit_dest(): server weight less than zero [ 241.997630][T13522] IPVS: using max 28 ests per chain, 67200 per kthread [ 242.362279][T13546] netlink: 'syz.3.2146': attribute type 1 has an invalid length. [ 242.409747][T13546] 8021q: adding VLAN 0 to HW filter on device bond17 [ 242.428379][T13549] syz_tun: entered promiscuous mode [ 242.431265][T13549] syz_tun: left promiscuous mode [ 242.831001][T13566] xt_nat: multiple ranges no longer supported [ 242.871049][T13566] netlink: 'syz.3.2151': attribute type 1 has an invalid length. [ 243.508307][T13614] netlink: 'syz.2.2158': attribute type 1 has an invalid length. [ 243.545938][T13614] 8021q: adding VLAN 0 to HW filter on device bond13 [ 243.562700][T13614] bond12: (slave team0): Removing an active aggregator [ 243.574006][T13614] bond12: (slave team0): Releasing backup interface [ 243.589205][T13614] 8021q: adding VLAN 0 to HW filter on device team0 [ 243.591335][T13614] bond13: (slave team0): Enslaving as a backup interface with an up link [ 243.700758][T13626] netlink: 'syz.3.2162': attribute type 10 has an invalid length. [ 243.813609][T13638] IPVS: ip_vs_edit_dest(): server weight less than zero [ 243.904938][T13641] netlink: 'syz.3.2168': attribute type 22 has an invalid length. [ 243.987767][T13642] netlink: 'syz.3.2168': attribute type 22 has an invalid length. [ 244.006774][T13641] netlink: 'syz.3.2168': attribute type 22 has an invalid length. [ 244.064930][T13658] netlink: 'syz.1.2173': attribute type 1 has an invalid length. [ 244.077906][T13659] netlink: 'syz.0.2172': attribute type 10 has an invalid length. [ 244.197791][T13658] 8021q: adding VLAN 0 to HW filter on device bond17 [ 244.264589][T13659] team0: Device wg2 is of different type [ 244.369191][T13668] bond16: (slave team0): Removing an active aggregator [ 244.371927][T13668] bond16: (slave team0): Releasing backup interface [ 244.390632][T13668] 8021q: adding VLAN 0 to HW filter on device team0 [ 244.401059][T13668] bond17: (slave team0): Enslaving as a backup interface with an up link [ 244.659810][T13696] __nla_validate_parse: 111 callbacks suppressed [ 244.659834][T13696] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2182'. [ 244.660343][T13696] IPVS: ip_vs_edit_dest(): server weight less than zero [ 244.778501][T13705] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2181'. [ 244.849144][T13704] bond20 (unregistering): Released all slaves [ 245.114370][T13704] bond20 (unregistering): Released all slaves [ 245.289736][T13704] bond20 (unregistering): Released all slaves [ 245.466731][T13735] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2189'. [ 245.577419][T13704] bond20 (unregistering): Released all slaves [ 245.781776][T13755] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2193'. [ 245.782324][T13755] IPVS: ip_vs_edit_dest(): server weight less than zero [ 245.788568][T13755] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2193'. [ 245.788602][T13755] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2193'. [ 245.794605][T13755] ip6gretap0: entered promiscuous mode [ 245.799751][T13755] syz_tun: entered promiscuous mode [ 245.799897][T13755] syz_tun: left promiscuous mode [ 245.842910][T13755] ip6gretap0: left promiscuous mode [ 245.898075][T13761] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2194'. [ 246.250652][T13784] validate_nla: 62 callbacks suppressed [ 246.250675][T13784] netlink: 'syz.1.2202': attribute type 1 has an invalid length. [ 246.290702][T13788] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2203'. [ 246.309446][T13792] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2202'. [ 246.317417][T13784] 8021q: adding VLAN 0 to HW filter on device bond18 [ 246.415993][T13788] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 246.474676][T13788] batman_adv: batadv0: Removing interface: ipvlan2 [ 246.543721][T13792] bond17: (slave team0): Removing an active aggregator [ 246.544390][T13792] bond17: (slave team0): Releasing backup interface [ 246.574432][T13792] 8021q: adding VLAN 0 to HW filter on device team0 [ 246.588626][T13792] bond18: (slave team0): Enslaving as a backup interface with an up link [ 246.984124][T13807] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2207'. [ 247.456730][T13842] ip_tables: iptables: counters copy to user failed while replacing table [ 248.371717][T13894] netlink: 'syz.3.2235': attribute type 1 has an invalid length. [ 248.446258][T13894] 8021q: adding VLAN 0 to HW filter on device bond20 [ 248.504934][T13899] bond20: (slave veth0_to_bond): making interface the new active one [ 248.550223][T13899] bond20: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 248.651671][T13894] macvlan2: entered promiscuous mode [ 248.651692][T13894] macvlan2: entered allmulticast mode [ 248.652176][T13894] bond20: entered promiscuous mode [ 248.652194][T13894] veth0_to_bond: entered promiscuous mode [ 248.662923][T13894] bond20: entered allmulticast mode [ 248.662945][T13894] veth0_to_bond: entered allmulticast mode [ 248.670248][T13894] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 248.672062][T13894] bond20: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 248.675446][T13894] bond20: left allmulticast mode [ 248.676163][T13894] veth0_to_bond: left allmulticast mode [ 248.676213][T13894] bond20: left promiscuous mode [ 248.676225][T13894] veth0_to_bond: left promiscuous mode [ 248.803966][T13914] bond17: (slave gretap0): Device is not bonding slave [ 248.803989][T13914] bond17: option active_slave: invalid value (gretap0) [ 248.823417][T13914] bond17 (unregistering): Released all slaves [ 249.226037][T13933] vxcan0: tx drop: invalid da for name 0x0000000000000003 [ 249.334557][T13936] netlink: 'syz.1.2249': attribute type 1 has an invalid length. [ 249.387832][T13936] 8021q: adding VLAN 0 to HW filter on device bond19 [ 249.412589][T13936] bond19: (slave geneve3): making interface the new active one [ 249.417050][T13936] bond19: (slave geneve3): Enslaving as an active interface with an up link [ 249.419932][T13936] tap0: tun_chr_ioctl cmd 1074025676 [ 249.419954][T13936] tap0: owner set to 0 [ 249.628204][T13949] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 249.694963][T13954] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 249.699161][T13954] __nla_validate_parse: 13 callbacks suppressed [ 249.699181][T13954] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2253'. [ 249.701418][T13954] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2253'. [ 249.770916][T13958] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 249.952256][T13967] tipc: Started in network mode [ 249.952289][T13967] tipc: Node identity ac14142e, cluster identity 4711 [ 249.952781][T13967] tipc: Enabling of bearer rejected, failed to enable media [ 250.259308][T13990] ip_tables: iptables: counters copy to user failed while replacing table [ 250.548807][T14005] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2265'. [ 250.590643][T14010] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2267'. [ 250.607504][T14010] 8021q: VLANs not supported on ip_vti0 [ 250.630814][T14005] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2265'. [ 250.763930][T14017] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2268'. [ 250.778544][T14021] syzkaller1: entered promiscuous mode [ 250.778565][T14021] syzkaller1: entered allmulticast mode [ 250.832614][T14026] x_tables: duplicate underflow at hook 1 [ 250.888112][T14028] netlink: 'syz.3.2271': attribute type 1 has an invalid length. [ 250.974184][T14032] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2272'. [ 253.791208][T14062] netlink: 'syz.3.2279': attribute type 1 has an invalid length. [ 253.793654][T14061] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2280'. [ 253.793992][T14061] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2280'. [ 253.894575][T14065] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2282'. [ 253.930089][T14068] netlink: 'syz.2.2283': attribute type 1 has an invalid length. [ 254.124340][T14081] netlink: 'syz.0.2287': attribute type 1 has an invalid length. [ 254.180905][T14081] 8021q: adding VLAN 0 to HW filter on device bond17 [ 254.274972][T14081] bond17: (slave geneve4): making interface the new active one [ 254.283567][T14081] bond17: (slave geneve4): Enslaving as an active interface with an up link [ 254.323219][T14094] bridge7: entered promiscuous mode [ 254.323242][T14094] bridge7: entered allmulticast mode [ 254.433203][T14109] vxcan0: tx address claim with dlc 1 [ 254.671085][T14121] netlink: 'syz.2.2298': attribute type 1 has an invalid length. [ 254.722888][T14127] __nla_validate_parse: 3 callbacks suppressed [ 254.722908][T14127] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2298'. [ 254.843913][T14127] bond15: (slave geneve3): making interface the new active one [ 254.844557][T14127] bond15: (slave geneve3): Enslaving as an active interface with an up link [ 255.130263][T14112] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 255.338130][T14145] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2304'. [ 255.498269][T14156] netlink: 'syz.2.2306': attribute type 1 has an invalid length. [ 255.498293][T14156] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2306'. [ 255.652913][T14161] netlink: 'syz.2.2308': attribute type 1 has an invalid length. [ 255.652937][T14161] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2308'. [ 255.718401][T14166] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2310'. [ 255.738185][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.740182][T14167] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2309'. [ 255.848975][T14173] netlink: 144 bytes leftover after parsing attributes in process `syz.3.2313'. [ 256.183537][T14195] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2319'. [ 256.204611][T14197] xt_l2tp: v2 sid > 0xffff: 4294967294 [ 256.219042][T14195] netlink: 'syz.0.2319': attribute type 9 has an invalid length. [ 256.219063][T14195] netlink: 'syz.0.2319': attribute type 4 has an invalid length. [ 256.600570][T14210] Bluetooth: ISO socket layer initialized [ 256.718158][T14215] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2326'. [ 256.718197][T14215] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2326'. [ 256.849092][T14230] netlink: 'syz.4.2329': attribute type 5 has an invalid length. [ 256.859022][T14230] geneve4: entered promiscuous mode [ 256.859044][T14230] geneve4: entered allmulticast mode [ 256.878615][ T7469] netdevsim netdevsim4 netdevsim3: set [1, 2] type 2 family 0 port 256 - 0 [ 256.879239][ T7469] netdevsim netdevsim4 netdevsim2: set [1, 2] type 2 family 0 port 256 - 0 [ 256.879276][ T7469] netdevsim netdevsim4 netdevsim1: set [1, 2] type 2 family 0 port 256 - 0 [ 256.879305][ T7469] netdevsim netdevsim4 netdevsim0: set [1, 2] type 2 family 0 port 256 - 0 [ 257.125173][T14242] netlink: 'syz.2.2332': attribute type 4 has an invalid length. [ 257.142297][T14247] FAULT_INJECTION: forcing a failure. [ 257.142297][T14247] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 257.142328][T14247] CPU: 0 UID: 0 PID: 14247 Comm: syz.4.2334 Not tainted syzkaller #0 PREEMPT(full) [ 257.142350][T14247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 257.142362][T14247] Call Trace: [ 257.142369][T14247] [ 257.142378][T14247] dump_stack_lvl+0xe8/0x150 [ 257.142414][T14247] should_fail_ex+0x3eb/0x540 [ 257.142444][T14247] _copy_from_user+0x2d/0xb0 [ 257.142470][T14247] ___sys_sendmsg+0x1c6/0x360 [ 257.142491][T14247] ? __lock_acquire+0x747/0x2de0 [ 257.142528][T14247] ? __pfx____sys_sendmsg+0x10/0x10 [ 257.142590][T14247] ? __fget_files+0x3a2/0x420 [ 257.142612][T14247] ? __fget_files+0x2a/0x420 [ 257.142640][T14247] __x64_sys_sendmsg+0x1b1/0x290 [ 257.142661][T14247] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 257.142702][T14247] do_syscall_64+0x166/0x520 [ 257.142723][T14247] ? trace_irq_disable+0x3b/0x140 [ 257.142746][T14247] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.142766][T14247] ? clear_bhb_loop+0x70/0xc0 [ 257.142789][T14247] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 257.142808][T14247] RIP: 0033:0x7fbc1739fb19 [ 257.142826][T14247] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 257.142841][T14247] RSP: 002b:00007fbc181f9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 257.142859][T14247] RAX: ffffffffffffffda RBX: 00007fbc17625fa0 RCX: 00007fbc1739fb19 [ 257.142872][T14247] RDX: 0000000000000000 RSI: 0000200000000480 RDI: 0000000000000003 [ 257.142883][T14247] RBP: 00007fbc181f9090 R08: 0000000000000000 R09: 0000000000000000 [ 257.142894][T14247] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 257.142905][T14247] R13: 00007fbc17626038 R14: 00007fbc17625fa0 R15: 00007ffd80b646f8 [ 257.142936][T14247] [ 257.445392][T14259] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 257.445417][T14259] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 257.455194][T14259] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 257.455218][T14259] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 257.663041][T14274] bond13: (slave team0): Removing an active aggregator [ 257.665306][T14274] bond13: (slave team0): Releasing backup interface [ 257.700228][T14274] bridge_slave_0: left allmulticast mode [ 257.700255][T14274] bridge_slave_0: left promiscuous mode [ 257.700493][T14274] bridge0: port 1(bridge_slave_0) entered disabled state [ 257.730959][T14274] bridge_slave_1: left allmulticast mode [ 257.730984][T14274] bridge_slave_1: left promiscuous mode [ 257.731294][T14274] bridge0: port 2(bridge_slave_1) entered disabled state [ 257.767888][T14274] bond0: (slave bond_slave_0): Releasing backup interface [ 257.774598][T14274] bond_slave_0: left promiscuous mode [ 257.797714][T14274] bond0: (slave bond_slave_1): Releasing backup interface [ 257.799527][T14274] bond_slave_1: left promiscuous mode [ 257.838185][T14274] team0: Port device team_slave_0 removed [ 257.851245][T14274] team0: Port device team_slave_1 removed [ 257.871370][T14274] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 257.893420][T14275] team0: Device xfrm0 is of different type [ 257.900919][T14276] tipc: Enabled bearer , priority 0 [ 258.009884][T14287] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 258.012513][T14285] bond22: (slave geneve4): making interface the new active one [ 258.013197][T14285] bond22: (slave geneve4): Enslaving as an active interface with an up link [ 258.559551][T14322] bond20: (slave geneve4): making interface the new active one [ 258.560116][T14322] bond20: (slave geneve4): Enslaving as an active interface with an up link [ 258.577647][ T12] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20033 - 0 [ 258.579810][ T6822] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20033 - 0 [ 258.579891][ T6822] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20033 - 0 [ 258.579924][ T6822] netdevsim netdevsim1 : set [1, 1] type 2 family 0 port 20033 - 0 [ 258.659270][T14336] ip_tables: iptables: counters copy to user failed while replacing table [ 258.738180][T14339] xt_ipcomp: unknown flags 1D [ 259.670211][T14363] Unknown metaid 8705 dlen 4 [ 259.720271][T14371] validate_nla: 4 callbacks suppressed [ 259.720292][T14371] netlink: 'syz.1.2373': attribute type 1 has an invalid length. [ 259.829807][T14377] bond21: (slave geneve5): making interface the new active one [ 259.830389][T14377] bond21: (slave geneve5): Enslaving as an active interface with an up link [ 259.852975][ T6822] netdevsim netdevsim1 netdevsim3: set [1, 2] type 2 family 0 port 20000 - 0 [ 259.853204][ T6822] netdevsim netdevsim1 netdevsim2: set [1, 2] type 2 family 0 port 20000 - 0 [ 259.853250][ T6822] netdevsim netdevsim1 netdevsim1: set [1, 2] type 2 family 0 port 20000 - 0 [ 259.853282][ T6822] netdevsim netdevsim1 : set [1, 2] type 2 family 0 port 20000 - 0 [ 259.872340][T14379] __nla_validate_parse: 10 callbacks suppressed [ 259.872359][T14379] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2374'. [ 260.103271][T14391] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2377'. [ 260.541188][T14420] IPVS: set_ctl: invalid protocol: 60 127.0.0.1:20002 [ 260.556713][T14423] FAULT_INJECTION: forcing a failure. [ 260.556713][T14423] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 260.556743][T14423] CPU: 1 UID: 0 PID: 14423 Comm: syz.0.2383 Not tainted syzkaller #0 PREEMPT(full) [ 260.556774][T14423] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 260.556785][T14423] Call Trace: [ 260.556793][T14423] [ 260.556800][T14423] dump_stack_lvl+0xe8/0x150 [ 260.556836][T14423] should_fail_ex+0x3eb/0x540 [ 260.556863][T14423] _copy_from_iter+0x1d3/0x1680 [ 260.556887][T14423] ? __alloc_skb+0x27a/0x7a0 [ 260.556916][T14423] ? __alloc_skb+0x27a/0x7a0 [ 260.556943][T14423] ? __alloc_skb+0x27a/0x7a0 [ 260.556971][T14423] ? __pfx__copy_from_iter+0x10/0x10 [ 260.556991][T14423] ? kmem_cache_alloc_node_noprof+0x1f4/0x600 [ 260.557014][T14423] ? __alloc_skb+0x27a/0x7a0 [ 260.557040][T14423] ? __alloc_skb+0x27a/0x7a0 [ 260.557074][T14423] ? netlink_sendmsg+0x64f/0xb20 [ 260.557101][T14423] ? skb_put+0x112/0x210 [ 260.557122][T14423] netlink_sendmsg+0x6bb/0xb20 [ 260.557156][T14423] ? __pfx_netlink_sendmsg+0x10/0x10 [ 260.557186][T14423] ? aa_sock_msg_perm+0x144/0x210 [ 260.557211][T14423] ? apparmor_socket_sendmsg+0x98/0x360 [ 260.557241][T14423] ? __pfx_netlink_sendmsg+0x10/0x10 [ 260.557268][T14423] sock_sendmsg_nosec+0x14e/0x190 [ 260.557297][T14423] ____sys_sendmsg+0x54e/0x850 [ 260.557325][T14423] ? __pfx_____sys_sendmsg+0x10/0x10 [ 260.557356][T14423] ? import_iovec+0x73/0xa0 [ 260.557402][T14423] ___sys_sendmsg+0x2a5/0x360 [ 260.557421][T14423] ? __lock_acquire+0x747/0x2de0 [ 260.557450][T14423] ? __pfx____sys_sendmsg+0x10/0x10 [ 260.557504][T14423] ? __fget_files+0x3a2/0x420 [ 260.557526][T14423] ? __fget_files+0x2a/0x420 [ 260.557557][T14423] __x64_sys_sendmsg+0x1b1/0x290 [ 260.557582][T14423] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 260.557626][T14423] do_syscall_64+0x166/0x520 [ 260.557649][T14423] ? trace_irq_disable+0x3b/0x140 [ 260.557684][T14423] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.557704][T14423] ? clear_bhb_loop+0x70/0xc0 [ 260.557730][T14423] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 260.557749][T14423] RIP: 0033:0x7f0024d9fb19 [ 260.557768][T14423] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 260.557784][T14423] RSP: 002b:00007f0025cd3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 260.557805][T14423] RAX: ffffffffffffffda RBX: 00007f0025025fa0 RCX: 00007f0024d9fb19 [ 260.557820][T14423] RDX: 0000000000000000 RSI: 0000200000000480 RDI: 0000000000000003 [ 260.557833][T14423] RBP: 00007f0025cd3090 R08: 0000000000000000 R09: 0000000000000000 [ 260.557845][T14423] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 260.557857][T14423] R13: 00007f0025026038 R14: 00007f0025025fa0 R15: 00007ffed1915fd8 [ 260.557890][T14423] [ 260.871436][T14428] ieee802154 phy0 wpan0: encryption failed: -22 [ 260.872171][T14428] ipvlan1: Caught tx_queue_len zero misconfig [ 260.967956][T14433] netlink: 'syz.0.2386': attribute type 1 has an invalid length. [ 261.165414][T14445] netlink: 56 bytes leftover after parsing attributes in process `syz.3.2390'. [ 261.272002][T14450] veth1_virt_wifi: tun_chr_ioctl cmd 1074025678 [ 261.272027][T14450] veth1_virt_wifi: group set to 0 [ 261.488081][T14458] netlink: 112 bytes leftover after parsing attributes in process `syz.1.2397'. [ 261.666686][T14484] bond17: entered allmulticast mode [ 261.667104][T14484] 8021q: adding VLAN 0 to HW filter on device bond17 [ 261.673846][T14484] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2403'. [ 261.883470][T14497] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2406'. [ 261.989454][T14503] TC_ACT_REPEAT abuse ? [ 262.019651][T14495] syzkaller0: entered promiscuous mode [ 262.019679][T14495] syzkaller0: entered allmulticast mode [ 264.223950][T14524] bridge0: port 1(bridge_slave_0) entered disabled state [ 264.429234][T14541] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2417'. [ 264.552799][T14545] netlink: 'syz.2.2420': attribute type 1 has an invalid length. [ 264.552823][T14545] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2420'. [ 264.552851][T14545] nbd: couldn't find device at index 767 [ 264.654988][T14552] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2422'. [ 264.655025][T14552] netlink: 'syz.4.2422': attribute type 8 has an invalid length. [ 264.655038][T14552] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2422'. [ 265.097147][T14573] openvswitch: netlink: IPv6 tunnel dst address is zero [ 265.197879][T14575] netlink: 'syz.4.2429': attribute type 12 has an invalid length. [ 265.198746][T14575] netlink: 'syz.4.2429': attribute type 12 has an invalid length. [ 265.214672][T14579] syzkaller1: entered promiscuous mode [ 265.214694][T14579] syzkaller1: entered allmulticast mode [ 265.306561][T14583] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2431'. [ 265.338455][T14583] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2431'. [ 265.469335][T14592] netlink: 'syz.2.2434': attribute type 1 has an invalid length. [ 265.471062][T14594] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 265.473787][T14594] ip_tables: iptables: counters copy to user failed while replacing table [ 265.522015][T14598] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2434'. [ 265.827263][T14613] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2440'. [ 265.827286][T14613] netlink: 14 bytes leftover after parsing attributes in process `syz.4.2440'. [ 266.021388][T14621] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2443'. [ 266.107946][T14623] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2444'. [ 266.266509][T14634] netlink: 'syz.1.2448': attribute type 1 has an invalid length. [ 267.235880][T14683] netlink: 'syz.4.2463': attribute type 1 has an invalid length. [ 267.603126][T14703] tunl0: Caught tx_queue_len zero misconfig [ 267.859782][T14718] bond_slave_0: Caught tx_queue_len zero misconfig [ 267.942253][T14727] xt_l2tp: v2 doesn't support IP mode [ 268.120486][T14733] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2473'. [ 268.284448][T14743] netlink: 196 bytes leftover after parsing attributes in process `syz.2.2476'. [ 268.407247][T14753] ip_tables: iptables: counters copy to user failed while replacing table [ 268.483881][T14755] tunl0: entered promiscuous mode [ 268.490035][T14755] netlink: 'syz.1.2481': attribute type 3 has an invalid length. [ 268.490056][T14755] netlink: 9 bytes leftover after parsing attributes in process `syz.1.2481'. [ 268.529290][T14761] netlink: 'syz.1.2481': attribute type 3 has an invalid length. [ 268.822679][T14777] xt_TCPMSS: Only works on TCP SYN packets [ 269.348188][T14806] 8021q: adding VLAN 0 to HW filter on device bond17 [ 269.350312][T14799] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 269.404970][T14799] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 269.842554][T14830] openvswitch: netlink: Missing key (keys=40, expected=80) [ 269.942643][T14831] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 270.577597][T14869] openvswitch: netlink: Missing key (keys=40, expected=100) [ 270.981017][T14895] __nla_validate_parse: 8 callbacks suppressed [ 270.981038][T14895] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2515'. [ 271.517927][T14924] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2523'. [ 271.517951][T14924] tipc: Invalid UDP bearer configuration [ 271.517995][T14924] tipc: Enabling of bearer rejected, failed to enable media [ 271.863841][T14936] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2529'. [ 271.884355][T14936] ip6tnl0: entered promiscuous mode [ 271.909552][T14936] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2529'. [ 272.180912][T14963] netlink: 'syz.2.2534': attribute type 3 has an invalid length. [ 272.180945][T14963] netlink: 244 bytes leftover after parsing attributes in process `syz.2.2534'. [ 272.300807][T14971] bridge4: entered allmulticast mode [ 272.535437][T14985] 8021q: adding VLAN 0 to HW filter on device bond23 [ 273.092532][T15004] sctp: [Deprecated]: syz.3.2541 (pid 15004) Use of struct sctp_assoc_value in delayed_ack socket option. [ 273.092532][T15004] Use struct sctp_sack_info instead [ 273.120119][T15007] FAULT_INJECTION: forcing a failure. [ 273.120119][T15007] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 273.120150][T15007] CPU: 0 UID: 0 PID: 15007 Comm: syz.4.2543 Not tainted syzkaller #0 PREEMPT(full) [ 273.120196][T15007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 273.120220][T15007] Call Trace: [ 273.120236][T15007] [ 273.120252][T15007] dump_stack_lvl+0xe8/0x150 [ 273.120320][T15007] should_fail_ex+0x3eb/0x540 [ 273.120380][T15007] _copy_from_user+0x2d/0xb0 [ 273.120430][T15007] __sys_bind+0x1c6/0x410 [ 273.120483][T15007] ? __pfx___sys_bind+0x10/0x10 [ 273.120566][T15007] ? __pfx_ksys_write+0x10/0x10 [ 273.120615][T15007] __x64_sys_bind+0x7a/0x90 [ 273.120644][T15007] do_syscall_64+0x166/0x520 [ 273.120666][T15007] ? trace_irq_disable+0x3b/0x140 [ 273.120691][T15007] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.120710][T15007] ? clear_bhb_loop+0x70/0xc0 [ 273.120733][T15007] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 273.120752][T15007] RIP: 0033:0x7fbc1739fb19 [ 273.120769][T15007] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 273.120788][T15007] RSP: 002b:00007fbc181f9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000031 [ 273.120808][T15007] RAX: ffffffffffffffda RBX: 00007fbc17625fa0 RCX: 00007fbc1739fb19 [ 273.120821][T15007] RDX: 0000000000000080 RSI: 0000200000000300 RDI: 0000000000000004 [ 273.120833][T15007] RBP: 00007fbc181f9090 R08: 0000000000000000 R09: 0000000000000000 [ 273.120844][T15007] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 273.120854][T15007] R13: 00007fbc17626038 R14: 00007fbc17625fa0 R15: 00007ffd80b646f8 [ 273.120885][T15007] [ 273.481755][T15032] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2546'. [ 273.525215][T15037] geneve5: entered promiscuous mode [ 273.549206][T15037] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2549'. [ 273.549238][T15037] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2549'. [ 273.701346][T15049] wg2: Caught tx_queue_len zero misconfig [ 273.834219][T15056] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2554'. [ 273.941119][T15063] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2557'. [ 273.941634][T15063] IPVS: ip_vs_edit_dest(): server weight less than zero [ 274.048343][T15067] FAULT_INJECTION: forcing a failure. [ 274.048343][T15067] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 274.048373][T15067] CPU: 1 UID: 0 PID: 15067 Comm: syz.2.2558 Not tainted syzkaller #0 PREEMPT(full) [ 274.048396][T15067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 274.048407][T15067] Call Trace: [ 274.048415][T15067] [ 274.048423][T15067] dump_stack_lvl+0xe8/0x150 [ 274.048460][T15067] should_fail_ex+0x3eb/0x540 [ 274.048489][T15067] _copy_to_user+0x31/0xb0 [ 274.048523][T15067] simple_read_from_buffer+0xe1/0x170 [ 274.048553][T15067] proc_fail_nth_read+0x1bb/0x230 [ 274.048591][T15067] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 274.048630][T15067] ? rw_verify_area+0x24a/0x4c0 [ 274.048656][T15067] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 274.048686][T15067] vfs_read+0x213/0xa80 [ 274.048718][T15067] ? __pfx___mutex_lock+0x10/0x10 [ 274.048745][T15067] ? __pfx_vfs_read+0x10/0x10 [ 274.048770][T15067] ? __fget_files+0x2a/0x420 [ 274.048791][T15067] ? __fget_files+0x3a2/0x420 [ 274.048812][T15067] ? __fget_files+0x2a/0x420 [ 274.048840][T15067] ? fdget+0x1ac/0x250 [ 274.048870][T15067] ksys_read+0x150/0x270 [ 274.048898][T15067] ? __pfx_ksys_read+0x10/0x10 [ 274.048935][T15067] do_syscall_64+0x166/0x520 [ 274.048958][T15067] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.048979][T15067] ? clear_bhb_loop+0x70/0xc0 [ 274.049002][T15067] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.049021][T15067] RIP: 0033:0x7f70dbd6034e [ 274.049039][T15067] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 274.049056][T15067] RSP: 002b:00007f70dcd4ffe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 274.049077][T15067] RAX: ffffffffffffffda RBX: 00007f70dcd506c0 RCX: 00007f70dbd6034e [ 274.049091][T15067] RDX: 000000000000000f RSI: 00007f70dcd500a0 RDI: 0000000000000003 [ 274.049104][T15067] RBP: 00007f70dcd50090 R08: 0000000000000000 R09: 0000000000000000 [ 274.049116][T15067] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 274.049128][T15067] R13: 00007f70dc026038 R14: 00007f70dc025fa0 R15: 00007ffe105791b8 [ 274.049161][T15067] [ 274.273165][T15074] netlink: 'syz.4.2562': attribute type 32 has an invalid length. [ 274.315208][T15069] bond24 (unregistering): Released all slaves [ 274.431961][T15074] bond19: Setting coupled_control to off (0) [ 274.482524][T15076] gretap0: entered promiscuous mode [ 274.482548][T15076] gretap0: entered allmulticast mode [ 274.529112][T15084] bond23: entered allmulticast mode [ 274.529519][T15084] 8021q: adding VLAN 0 to HW filter on device bond23 [ 274.718569][T15107] IPVS: ip_vs_edit_dest(): server weight less than zero [ 274.742835][T15107] ip6gretap0: entered promiscuous mode [ 274.756758][T15107] syz_tun: entered promiscuous mode [ 274.760117][T15107] syz_tun: left promiscuous mode [ 274.773212][T15107] ip6gretap0: left promiscuous mode [ 274.811434][T15111] netlink: 'syz.3.2572': attribute type 1 has an invalid length. [ 274.876012][T15116] veth0_to_bond: entered allmulticast mode [ 274.970384][ T6822] bond20: (slave veth0_to_bond): link status definitely down, disabling slave [ 274.973821][ T6822] bond20: now running without any active interface! [ 275.229691][T15132] netlink: 'syz.4.2577': attribute type 1 has an invalid length. [ 275.295431][T15132] 8021q: adding VLAN 0 to HW filter on device bond20 [ 275.539165][T15160] IPVS: ip_vs_edit_dest(): server weight less than zero [ 275.848591][T15176] netlink: 'syz.0.2592': attribute type 1 has an invalid length. [ 275.884060][T15176] 8021q: adding VLAN 0 to HW filter on device bond19 [ 275.898495][T15176] bond13: (slave team0): Removing an active aggregator [ 275.899650][T15176] bond13: (slave team0): Releasing backup interface [ 275.913223][T15176] 8021q: adding VLAN 0 to HW filter on device team0 [ 275.919418][T15176] bond19: (slave team0): Enslaving as a backup interface with an up link [ 276.049002][T15191] netlink: 'syz.3.2593': attribute type 1 has an invalid length. [ 276.183615][T15204] Bluetooth: hci0: Opcode 0x0401 failed: -22 [ 276.391828][T15209] ip_tables: iptables: counters copy to user failed while replacing table [ 276.564631][T15220] tipc: Enabled bearer , priority 0 [ 276.608657][T15219] tipc: Disabling bearer [ 276.646576][T15217] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 276.646613][T15217] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 276.646653][T15217] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 276.984115][T15231] rxe_eth0 speed is unknown, defaulting to 1000 [ 277.163513][T15248] gre0: Caught tx_queue_len zero misconfig [ 277.360094][T15231] virt_wifi0 speed is unknown, defaulting to 1000 [ 277.423427][ T6822] smbdirect: ib_dev[syz2] removed [ 277.523469][T15265] __nla_validate_parse: 85 callbacks suppressed [ 277.523491][T15265] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2621'. [ 277.544111][T15265] tipc: Enabling of bearer rejected, no device for the media [ 277.602925][T15267] netlink: 'syz.4.2620': attribute type 5 has an invalid length. [ 277.689612][T15275] netlink: 'syz.2.2624': attribute type 10 has an invalid length. [ 277.797706][T15275] team0: Device vxcan0 is CAN, IEEE 802.15.4 or 6LoWPAN. These device types can't be added as a team port [ 277.895420][T15284] netlink: 'syz.0.2627': attribute type 13 has an invalid length. [ 277.895441][T15284] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2627'. [ 277.915670][T15284] netlink: 'syz.0.2627': attribute type 13 has an invalid length. [ 277.915691][T15284] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2627'. [ 278.086424][T15290] netlink: 'syz.3.2630': attribute type 33 has an invalid length. [ 278.434863][T15305] openvswitch: netlink: Key type 31 is not supported [ 278.575415][T15309] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2636'. [ 278.575445][T15309] netlink: 'syz.1.2636': attribute type 3 has an invalid length. [ 278.640641][T15311] ip_tables: iptables: counters copy to user failed while replacing table [ 278.719271][T15313] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2637'. [ 278.841235][T15316] C: renamed from lo [ 278.852387][T15316] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 278.933479][T15321] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2640'. [ 278.933503][T15321] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2640'. [ 278.933522][T15321] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2640'. [ 278.999414][T15318] bond24: entered promiscuous mode [ 278.999488][T15318] bond24: entered allmulticast mode [ 279.001815][T15318] 8021q: adding VLAN 0 to HW filter on device bond24 [ 279.018856][T15323] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2641'. [ 279.022140][T15324] netlink: 104 bytes leftover after parsing attributes in process `syz.2.2641'. [ 279.285870][T15337] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 280.040187][ T6822] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 280.040426][ T6822] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 280.082198][ T5638] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 280.099873][T15368] netlink: 'syz.2.2654': attribute type 1 has an invalid length. [ 280.223679][T15372] veth0: entered promiscuous mode [ 280.303592][T15371] veth0: left promiscuous mode [ 280.776187][ T5638] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 281.097063][ T5638] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 281.293968][T15412] netlink: 'syz.0.2668': attribute type 1 has an invalid length. [ 282.175942][T15456] netlink: 'syz.4.2683': attribute type 1 has an invalid length. [ 282.351370][T15462] syzkaller0: entered promiscuous mode [ 282.351391][T15462] syzkaller0: entered allmulticast mode [ 282.776715][T15490] bond22: option active_slave: mode dependency failed, not supported in mode balance-rr(0) [ 282.804814][T15490] bond22 (unregistering): Released all slaves [ 282.831863][T15497] __nla_validate_parse: 10 callbacks suppressed [ 282.831884][T15497] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2694'. [ 282.886917][T15494] lo: entered allmulticast mode [ 282.922074][T15497] vlan0: entered promiscuous mode [ 282.922109][T15497] bond0: entered promiscuous mode [ 282.922123][T15497] bond_slave_1: entered promiscuous mode [ 283.351132][T15523] netlink: 'syz.2.2700': attribute type 1 has an invalid length. [ 283.525147][T15532] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2703'. [ 283.810665][T15546] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2709'. [ 283.812809][T15546] IPVS: ip_vs_edit_dest(): server weight less than zero [ 283.846881][T15546] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2709'. [ 283.846918][T15546] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2709'. [ 283.859585][T15547] netlink: 'syz.4.2710': attribute type 1 has an invalid length. [ 283.877628][T15546] ip6gretap0: entered promiscuous mode [ 283.883910][T15546] syz_tun: entered promiscuous mode [ 283.884074][T15546] syz_tun: left promiscuous mode [ 283.893473][T15546] ip6gretap0: left promiscuous mode [ 284.194798][T15547] bond22: entered promiscuous mode [ 284.204877][T15547] 8021q: adding VLAN 0 to HW filter on device bond22 [ 284.375744][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 284.443649][T15576] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2718'. [ 284.464829][T15574] netlink: 'syz.2.2717': attribute type 1 has an invalid length. [ 284.928620][T15593] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2725'. [ 284.929091][T15593] IPVS: ip_vs_edit_dest(): server weight less than zero [ 284.950056][T15593] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2725'. [ 284.950094][T15593] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2725'. [ 285.165162][T15604] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2729'. [ 285.318157][T15610] netlink: 'syz.1.2731': attribute type 1 has an invalid length. [ 285.444258][T15617] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 285.444258][T15617] Please contact the netfilter-devel mailing list or update your nftables rules. [ 286.143046][T15646] netlink: 'syz.1.2746': attribute type 21 has an invalid length. [ 286.187120][T15646] netlink: 'syz.1.2746': attribute type 21 has an invalid length. [ 286.792542][T15671] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 286.851988][T15676] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 287.856723][T15728] __nla_validate_parse: 13 callbacks suppressed [ 287.856745][T15728] netlink: 48 bytes leftover after parsing attributes in process `syz.3.2767'. [ 287.894453][T15728] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2767'. [ 287.994580][T15644] NFSD: Failed to start, no listeners configured. [ 288.014331][T15737] ip_tunnel: non-ECT from 172.30.1.2 with TOS=0x3 [ 288.112438][T15744] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 288.112475][T15744] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 288.112513][T15744] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 288.426073][T15758] tipc: Enabled bearer , priority 0 [ 288.580512][T15767] netlink: 'syz.1.2781': attribute type 15 has an invalid length. [ 288.580535][T15767] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2781'. [ 288.769631][T15781] netlink: 'syz.4.2784': attribute type 1 has an invalid length. [ 289.180225][T15799] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2788'. [ 290.028855][ T5640] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 290.048172][ T5640] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 290.057385][ T5640] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 290.067043][ T5640] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 290.067670][ T5640] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 290.103182][T15836] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 290.161658][ T5634] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 290.165337][T15840] syzkaller1: entered promiscuous mode [ 290.165357][T15840] syzkaller1: entered allmulticast mode [ 290.167434][ T5634] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 290.167753][ T5634] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 290.171787][ T5634] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 290.172387][ T5634] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 290.516264][ T5628] tipc: Resetting bearer [ 290.643855][ T5628] tipc: Disabling bearer [ 290.690225][T15862] netlink: 304 bytes leftover after parsing attributes in process `syz.0.2805'. [ 290.874527][T15874] netlink: 304 bytes leftover after parsing attributes in process `syz.0.2805'. [ 291.182353][T15890] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2809'. [ 291.268847][T15890] netlink: 'syz.2.2809': attribute type 8 has an invalid length. [ 291.269097][T15890] sch_fq: defrate 0 ignored. [ 291.558336][T15830] rxe_eth0 speed is unknown, defaulting to 1000 [ 291.721209][T15915] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2816'. [ 291.770375][T15919] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2817'. [ 291.956167][T15931] erspan0: entered promiscuous mode [ 291.956192][T15931] erspan0: entered allmulticast mode [ 292.090098][T15830] virt_wifi0 speed is unknown, defaulting to 1000 [ 292.217859][ T5634] Bluetooth: hci5: command tx timeout [ 292.244730][T15934] syzkaller0: entered promiscuous mode [ 292.244754][T15934] syzkaller0: entered allmulticast mode [ 292.450672][T15947] xt_CT: You must specify a L4 protocol and not use inversions on it [ 292.778615][T15955] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2825'. [ 292.891030][T15968] __nla_validate_parse: 1 callbacks suppressed [ 292.891050][T15968] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2826'. [ 293.173942][T15988] sctp: [Deprecated]: syz.2.2828 (pid 15988) Use of int in maxseg socket option. [ 293.173942][T15988] Use struct sctp_assoc_value instead [ 293.357575][T15830] bridge0: port 1(bridge_slave_0) entered blocking state [ 293.357680][T15830] bridge0: port 1(bridge_slave_0) entered disabled state [ 293.358309][T15830] bridge_slave_0: entered allmulticast mode [ 293.364052][T15830] bridge_slave_0: entered promiscuous mode [ 293.399482][T15830] bridge0: port 2(bridge_slave_1) entered blocking state [ 293.399591][T15830] bridge0: port 2(bridge_slave_1) entered disabled state [ 293.400570][T15830] bridge_slave_1: entered allmulticast mode [ 293.402655][T15830] bridge_slave_1: entered promiscuous mode [ 293.482630][T15830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 293.495737][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 293.510287][T15830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 293.563800][T15830] team0: Port device team_slave_0 added [ 293.573380][T15830] team0: Port device team_slave_1 added [ 293.650832][T15830] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 293.650850][T15830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 293.650875][T15830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 293.654586][T15830] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 293.654603][T15830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 293.654629][T15830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 293.841599][T15830] hsr_slave_0: entered promiscuous mode [ 293.843062][T15830] hsr_slave_1: entered promiscuous mode [ 293.843788][T15830] debugfs: 'hsr0' already exists in 'hsr' [ 293.843808][T15830] Cannot create hsr debugfs directory [ 294.051843][T15830] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 294.051882][T15830] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 294.051908][T15830] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 294.165321][T15830] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 294.165373][T15830] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 294.165400][T15830] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 294.250532][T15830] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 294.250571][T15830] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 294.250597][T15830] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 294.296559][ T5634] Bluetooth: hci5: command tx timeout [ 294.322966][T15830] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 294.322988][T15830] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 294.323002][T15830] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 295.592290][T15954] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 295.613858][T15999] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2830'. [ 295.613886][T15999] nbd: must specify at least one socket [ 295.739043][T15830] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 295.750868][T15830] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 295.751886][T15830] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 295.792395][T15830] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 295.800944][T15830] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 295.824788][T15830] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 295.834602][T15830] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 295.871091][T15830] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 295.967047][T16022] netlink: 'syz.0.2834': attribute type 1 has an invalid length. [ 296.034218][T16022] 8021q: adding VLAN 0 to HW filter on device bond21 [ 296.045087][T16029] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2837'. [ 296.176707][T16026] netlink: 96 bytes leftover after parsing attributes in process `syz.2.2836'. [ 296.274808][T16041] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2839'. [ 296.318201][T15830] 8021q: adding VLAN 0 to HW filter on device bond0 [ 296.355260][T15830] 8021q: adding VLAN 0 to HW filter on device team0 [ 296.377238][ T5634] Bluetooth: hci5: command tx timeout [ 296.383526][ T1113] bridge0: port 1(bridge_slave_0) entered blocking state [ 296.383640][ T1113] bridge0: port 1(bridge_slave_0) entered forwarding state [ 296.428237][ T1113] bridge0: port 2(bridge_slave_1) entered blocking state [ 296.428343][ T1113] bridge0: port 2(bridge_slave_1) entered forwarding state [ 296.514639][T16046] netlink: 'syz.2.2841': attribute type 7 has an invalid length. [ 296.514659][T16046] netlink: 'syz.2.2841': attribute type 8 has an invalid length. [ 296.574552][T16050] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2843'. [ 296.586973][T16051] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2843'. [ 296.752062][T16063] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2847'. [ 296.909572][T16066] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2849'. [ 296.983773][T16069] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2850'. [ 297.041626][T16080] IPVS: ip_vs_edit_dest(): server weight less than zero [ 297.065200][T16069] bond26: Invalid ad_actor_system MAC address. [ 297.065223][T16069] bond26: option ad_actor_system: invalid value (1) [ 297.070866][T16069] bond26 (unregistering): Released all slaves [ 297.780958][T16128] netlink: 'syz.1.2862': attribute type 16 has an invalid length. [ 297.780983][T16128] netlink: 'syz.1.2862': attribute type 3 has an invalid length. [ 297.795183][T15830] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 298.113893][T16147] __nla_validate_parse: 4 callbacks suppressed [ 298.113915][T16147] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2867'. [ 298.193080][T15830] veth0_vlan: entered promiscuous mode [ 298.218966][T15830] veth1_vlan: entered promiscuous mode [ 298.279912][T15830] veth0_macvtap: entered promiscuous mode [ 298.295104][T15830] veth1_macvtap: entered promiscuous mode [ 298.298897][T16154] netlink: 'syz.0.2870': attribute type 1 has an invalid length. [ 298.370487][T16158] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2871'. [ 298.370909][T16158] IPVS: ip_vs_edit_dest(): server weight less than zero [ 298.375335][T16158] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2871'. [ 298.375372][T16158] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2871'. [ 298.383986][T15830] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 298.443927][T15830] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 298.466488][ T5634] Bluetooth: hci5: command tx timeout [ 298.500207][T16165] netlink: 'syz.3.2873': attribute type 1 has an invalid length. [ 298.545767][T16165] 8021q: adding VLAN 0 to HW filter on device bond24 [ 298.550723][T16165] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2873'. [ 298.596165][ T6822] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 298.597315][ T1113] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 298.597367][ T1113] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 298.597402][ T1113] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 298.726589][T16173] bridge0: port 1(30{X功) entered disabled state [ 298.727308][T16173] bridge0: port 2(bridge_slave_1) entered disabled state [ 298.740448][T16174] bridge0: port 1(30{X功) entered blocking state [ 298.740637][T16174] bridge0: port 1(30{X功) entered forwarding state [ 298.740981][T16174] bridge0: port 2(bridge_slave_1) entered blocking state [ 298.741104][T16174] bridge0: port 2(bridge_slave_1) entered forwarding state [ 298.930567][T16178] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2875'. [ 298.998904][T16185] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2875'. [ 299.021819][ T7469] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 299.021843][ T7469] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 299.084010][ T7469] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 299.084032][ T7469] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 299.183255][T16188] netlink: 144 bytes leftover after parsing attributes in process `syz.0.2877'. [ 299.254459][T16194] netlink: 'syz.1.2878': attribute type 2 has an invalid length. [ 299.319128][T16199] netlink: 'syz.3.2881': attribute type 1 has an invalid length. [ 299.412256][T16206] netlink: 45349 bytes leftover after parsing attributes in process `syz.2.2882'. [ 299.412390][T16206] 0猉功D龌: renamed from 30{X功 (while UP) [ 299.513164][T16211] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2884'. [ 299.517990][T16209] netlink: 'syz.0.2883': attribute type 1 has an invalid length. [ 299.574548][T16209] 8021q: adding VLAN 0 to HW filter on device bond23 [ 299.608088][T16209] bond19: (slave team0): Removing an active aggregator [ 299.608912][T16209] bond19: (slave team0): Releasing backup interface [ 299.639931][T16209] 8021q: adding VLAN 0 to HW filter on device team0 [ 299.643292][T16209] bond23: (slave team0): Enslaving as a backup interface with an up link [ 299.950271][T16232] team0: Cannot enslave team device to itself [ 300.453064][T16265] IPVS: ip_vs_edit_dest(): server weight less than zero [ 300.980835][T16293] validate_nla: 22 callbacks suppressed [ 300.980858][T16293] netlink: 'syz.2.2909': attribute type 1 has an invalid length. [ 300.986099][T16293] netlink: 'syz.2.2909': attribute type 1 has an invalid length. [ 301.002918][T16293] netlink: 'syz.2.2909': attribute type 1 has an invalid length. [ 301.022548][T16293] netlink: 'syz.2.2909': attribute type 1 has an invalid length. [ 301.024665][T16293] netlink: 'syz.2.2909': attribute type 1 has an invalid length. [ 301.048241][T16293] netlink: 'syz.2.2909': attribute type 1 has an invalid length. [ 301.054205][T16293] netlink: 'syz.2.2909': attribute type 1 has an invalid length. [ 301.055351][T16293] netlink: 'syz.2.2909': attribute type 1 has an invalid length. [ 301.081189][T16293] netlink: 'syz.2.2909': attribute type 1 has an invalid length. [ 301.081835][T16293] netlink: 'syz.2.2909': attribute type 1 has an invalid length. [ 301.413669][T16306] 8021q: adding VLAN 0 to HW filter on device bond26 [ 301.690174][T16324] ip_tables: iptables: counters copy to user failed while replacing table [ 301.707932][T16321] ip_tables: iptables: counters copy to user failed while replacing table [ 301.757109][T16321] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 301.757435][T16321] syzkaller1: linktype set to 823 [ 301.825811][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 301.947922][T16333] tipc: Enabling of bearer rejected, no device for the media [ 301.995003][T16331] bond25: entered promiscuous mode [ 302.003490][T16331] 8021q: adding VLAN 0 to HW filter on device bond25 [ 302.008476][T16334] tipc: Enabling of bearer rejected, no device for the media [ 302.037574][T16337] vlan1: entered allmulticast mode [ 302.037599][T16337] bond25: entered allmulticast mode [ 302.095282][T16331] bond25: (slave bridge6): making interface the new active one [ 302.095311][T16331] bridge6: entered promiscuous mode [ 302.097066][T16331] bridge6: entered allmulticast mode [ 302.112709][T16331] bond25: (slave bridge6): Enslaving as an active interface with an up link [ 302.228123][T16349] IPVS: ip_vs_edit_dest(): server weight less than zero [ 302.996029][T16399] IPVS: ip_vs_edit_dest(): server weight less than zero [ 303.129882][T16407] netlink: 'syz.3.2946': attribute type 11 has an invalid length. [ 303.148225][T16408] tipc: Started in network mode [ 303.156239][T16408] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 303.156914][T16408] tipc: New replicast peer: 2001:0000:0000:0000:0000:0000:0000:0000 [ 303.157165][T16408] tipc: Enabled bearer , priority 10 [ 303.451183][T16423] __nla_validate_parse: 22 callbacks suppressed [ 303.451205][T16423] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2949'. [ 303.482634][T16418] 8021q: adding VLAN 0 to HW filter on device bond21 [ 303.523206][T16423] tipc: Resetting bearer [ 303.530560][T16423] 8021q: adding VLAN 0 to HW filter on device team0 [ 303.553315][T16431] ip_tunnel: non-ECT from 172.30.1.5 with TOS=0x3 [ 303.554909][T16423] bond21: (slave team0): Enslaving as a backup interface with an up link [ 303.586946][ T6821] bond21: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 303.705953][ T6821] bond21: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 304.119462][T16455] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2959'. [ 304.119955][T16455] IPVS: ip_vs_edit_dest(): server weight less than zero [ 304.124442][T16455] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2959'. [ 304.124475][T16455] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2959'. [ 304.240704][T16465] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2962'. [ 304.302443][ T5750] tipc: Node number set to 1 [ 304.673436][T16491] netlink: 'syz.3.2971': attribute type 11 has an invalid length. [ 304.725054][T16494] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2972'. [ 304.757537][T16494] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2972'. [ 304.794208][T16494] Cannot find add_set index 65532 as target [ 304.831665][T16498] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2974'. [ 304.832051][T16498] IPVS: ip_vs_edit_dest(): server weight less than zero [ 304.853667][T16498] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2974'. [ 304.853706][T16498] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2974'. [ 304.974814][T16504] tipc: Enabling of bearer rejected, failed to enable media [ 305.162908][T16512] 8021q: adding VLAN 0 to HW filter on device bond26 [ 305.271041][T16514] bond18: (slave team0): Removing an active aggregator [ 305.273426][T16514] bond18: (slave team0): Releasing backup interface [ 305.302790][T16514] 8021q: adding VLAN 0 to HW filter on device team0 [ 305.315386][T16514] bond26: (slave team0): Enslaving as a backup interface with an up link [ 305.624477][T16539] IPVS: ip_vs_edit_dest(): server weight less than zero [ 305.760416][ T5640] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 305.763807][ T5640] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 305.774406][ T5640] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 305.789573][ T5640] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 305.791218][ T5640] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 305.880215][T16545] can: request_module (can-proto-0) failed. [ 306.201756][ T5632] tipc: Resetting bearer [ 306.327503][ T5632] bond6: (slave syz_tun): Removing an active aggregator [ 306.327985][ T5632] bond6: (slave syz_tun): Releasing backup interface [ 306.371197][ T5632] tipc: Resetting bearer [ 306.371456][ T5632] tipc: Disabling bearer [ 306.565442][T16586] validate_nla: 14 callbacks suppressed [ 306.574734][T16586] netlink: 'syz.3.2998': attribute type 1 has an invalid length. [ 306.680253][T16591] IPVS: ip_vs_edit_dest(): server weight less than zero [ 306.897175][T16604] tc_dump_action: action bad kind [ 306.929423][T16549] rxe_eth0 speed is unknown, defaulting to 1000 [ 307.167674][T16549] virt_wifi0 speed is unknown, defaulting to 1000 [ 307.351974][T16618] erspan0: entered promiscuous mode [ 307.370071][T16618] erspan0: left promiscuous mode [ 307.476715][T16627] netlink: 'syz.3.3010': attribute type 1 has an invalid length. [ 307.540032][T16543] NFSD: Failed to start, no listeners configured. [ 307.872494][T16549] bridge0: port 1(bridge_slave_0) entered blocking state [ 307.876252][T16549] bridge0: port 1(bridge_slave_0) entered disabled state [ 307.876420][T16549] bridge_slave_0: entered allmulticast mode [ 307.881669][T16549] bridge_slave_0: entered promiscuous mode [ 307.897827][ T5634] Bluetooth: hci0: command tx timeout [ 307.923822][T16549] bridge0: port 2(bridge_slave_1) entered blocking state [ 307.924004][T16549] bridge0: port 2(bridge_slave_1) entered disabled state [ 307.924155][T16549] bridge_slave_1: entered allmulticast mode [ 307.950673][T16549] bridge_slave_1: entered promiscuous mode [ 307.994027][T16549] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 308.010106][T16549] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 308.063226][T16549] team0: Port device team_slave_0 added [ 308.072334][T16549] team0: Port device team_slave_1 added [ 308.133678][T16549] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 308.133696][T16549] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 308.133720][T16549] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 308.139229][T16549] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 308.139244][T16549] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 308.139270][T16549] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 308.274526][T16549] hsr_slave_0: entered promiscuous mode [ 308.282245][T16549] hsr_slave_1: entered promiscuous mode [ 308.283015][T16549] debugfs: 'hsr0' already exists in 'hsr' [ 308.283035][T16549] Cannot create hsr debugfs directory [ 308.529078][T16651] __nla_validate_parse: 18 callbacks suppressed [ 308.529100][T16651] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3018'. [ 308.542993][T16654] vxcan0: tx address claim with dest, not broadcast [ 308.615180][T16549] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 308.615217][T16549] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.615267][T16549] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20033 - 0 [ 308.615292][T16549] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 308.667711][T16651] 0{X功: left promiscuous mode [ 308.667877][T16651] bridge0: port 1(30{X功) entered disabled state [ 308.670101][T16651] bridge_slave_1: left allmulticast mode [ 308.670117][T16651] bridge_slave_1: left promiscuous mode [ 308.670246][T16651] bridge0: port 2(bridge_slave_1) entered disabled state [ 308.715236][T16658] ip_tables: iptables: counters copy to user failed while replacing table [ 308.747940][T16657] xt_CT: You must specify a L4 protocol and not use inversions on it [ 308.798843][T16549] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 308.798879][T16549] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 308.798903][T16549] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20033 - 0 [ 308.798928][T16549] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 308.834984][T16658] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3019'. [ 309.001655][T16549] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 309.001692][T16549] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.001718][T16549] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20033 - 0 [ 309.001747][T16549] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 309.162663][T16549] netdevsim netdevsim1  (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 309.162699][T16549] netdevsim netdevsim1  (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 309.162725][T16549] netdevsim netdevsim1  (unregistering): unset [1, 1] type 2 family 0 port 20033 - 0 [ 309.162749][T16549] netdevsim netdevsim1  (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 309.227193][T16666] tipc: Enabled bearer , priority 0 [ 309.281220][T16664] tipc: Disabling bearer [ 309.307924][T16679] netlink: 144 bytes leftover after parsing attributes in process `syz.4.3026'. [ 309.340883][T16684] ip_tables: iptables: counters copy to user failed while replacing table [ 309.342825][T16684] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3029'. [ 309.604272][T16549] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 309.619250][T16549] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 309.621718][T16549] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 309.644928][T16549] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 309.654536][T16549] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 309.669577][T16549] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 309.673599][T16549] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 309.695814][T16549] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 309.737166][T16705] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3035'. [ 309.742457][T16705] macvlan0: left promiscuous mode [ 309.743606][T16705] netlink: 'syz.3.3035': attribute type 1 has an invalid length. [ 309.743623][T16705] netlink: 'syz.3.3035': attribute type 2 has an invalid length. [ 309.976154][ T5634] Bluetooth: hci0: command tx timeout [ 310.073717][T16549] 8021q: adding VLAN 0 to HW filter on device bond0 [ 310.075065][T16721] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3040'. [ 310.129038][T16549] 8021q: adding VLAN 0 to HW filter on device team0 [ 310.166509][ T6821] bridge0: port 1(bridge_slave_0) entered blocking state [ 310.166617][ T6821] bridge0: port 1(bridge_slave_0) entered forwarding state [ 310.202481][ T7468] bridge0: port 2(bridge_slave_1) entered blocking state [ 310.202590][ T7468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 310.433628][T16736] netlink: 144 bytes leftover after parsing attributes in process `syz.0.3041'. [ 310.785506][ C0] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 310.933047][T16764] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3050'. [ 310.969550][ T5839] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 311.128817][ T5750] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 311.302871][ T1152] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 311.594704][T16774] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 311.814694][T16783] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 312.042387][T16781] xt_CT: No such helper "snmp_trap" [ 312.068531][ T5634] Bluetooth: hci0: command tx timeout [ 312.384329][T16793] netlink: 'syz.4.3057': attribute type 1 has an invalid length. [ 312.401199][T16794] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3051'. [ 312.455626][T16796] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3057'. [ 312.512848][T16793] 8021q: adding VLAN 0 to HW filter on device bond1 [ 312.532943][T16796] 8021q: adding VLAN 0 to HW filter on device team0 [ 312.553091][T16796] bond1: (slave team0): Enslaving as a backup interface with an up link [ 312.832681][T16549] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 312.999727][T16549] veth0_vlan: entered promiscuous mode [ 313.044216][T16549] veth1_vlan: entered promiscuous mode [ 313.129024][T16549] veth0_macvtap: entered promiscuous mode [ 313.161527][T16549] veth1_macvtap: entered promiscuous mode [ 313.215806][T16549] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 313.248350][T16549] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 313.348786][ T140] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 313.365938][ T6821] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 313.367332][ T6821] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 313.367750][ T6821] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 313.836971][ T7464] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 313.836994][ T7464] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 314.086159][ T6821] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 314.086181][ T6821] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 314.092630][T16826] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 314.134843][T16826] tipc: Enabled bearer , priority 10 [ 314.136093][ T5634] Bluetooth: hci0: command tx timeout [ 314.300452][T16827] __nla_validate_parse: 4 callbacks suppressed [ 314.300475][T16827] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3065'. [ 314.642799][T16841] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3070'. [ 315.055259][T16847] syzkaller0: entered promiscuous mode [ 315.055282][T16847] syzkaller0: entered allmulticast mode [ 315.077323][T16856] netlink: 'syz.1.2986': attribute type 1 has an invalid length. [ 315.256451][T16862] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3075'. [ 315.282658][T16863] netlink: 'syz.2.3075': attribute type 2 has an invalid length. [ 315.282681][T16863] netlink: 244 bytes leftover after parsing attributes in process `syz.2.3075'. [ 315.435334][T16863] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 315.462046][T16863] netlink: 'syz.2.3075': attribute type 75 has an invalid length. [ 317.060941][T16900] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3082'. [ 317.191455][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.533508][T16907] netlink: 'syz.1.3085': attribute type 1 has an invalid length. [ 317.695515][ C0] sched: DL replenish lagged too much [ 317.738019][ T5640] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 317.742573][ T5640] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 317.744365][ T5640] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 317.785260][ T5640] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 317.797711][ T5640] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 318.277225][T16920] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3086'. [ 318.278561][T16920] ieee802154 phy0 wpan0: encryption failed: -126 [ 318.718138][T16932] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 319.132837][T16912] rxe_eth0 speed is unknown, defaulting to 1000 [ 319.678102][T16945] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 319.893137][T16912] virt_wifi0 speed is unknown, defaulting to 1000 [ 319.975801][ T5640] Bluetooth: hci3: command tx timeout [ 320.369752][T16961] netlink: 'syz.1.3096': attribute type 1 has an invalid length. [ 320.408480][T16961] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3096'. [ 320.870261][T16912] bridge0: port 1(bridge_slave_0) entered blocking state [ 320.872026][T16912] bridge0: port 1(bridge_slave_0) entered disabled state [ 320.872182][T16912] bridge_slave_0: entered allmulticast mode [ 320.890782][T16912] bridge_slave_0: entered promiscuous mode [ 320.906661][T16912] bridge0: port 2(bridge_slave_1) entered blocking state [ 320.906843][T16912] bridge0: port 2(bridge_slave_1) entered disabled state [ 320.906999][T16912] bridge_slave_1: entered allmulticast mode [ 320.908822][T16912] bridge_slave_1: entered promiscuous mode [ 320.990750][T16912] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 320.994641][T16912] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 321.047823][T16912] team0: Port device team_slave_0 added [ 321.051024][T16912] team0: Port device team_slave_1 added [ 321.109082][T16912] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 321.109100][T16912] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 321.109127][T16912] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 321.111187][T16912] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 321.111200][T16912] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 321.111226][T16912] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 321.268024][T16912] hsr_slave_0: entered promiscuous mode [ 321.269034][T16912] hsr_slave_1: entered promiscuous mode [ 321.269740][T16912] debugfs: 'hsr0' already exists in 'hsr' [ 321.269759][T16912] Cannot create hsr debugfs directory [ 321.839844][T16912] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 321.839882][T16912] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 321.839907][T16912] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 321.839932][T16912] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 322.058046][ T5640] Bluetooth: hci3: command tx timeout [ 322.141813][T16986] vcan0: tx drop: invalid sa for name 0x0000000000000003 [ 322.143774][T16986] Bluetooth: MGMT ver 1.23 [ 322.466622][T16996] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3104'. [ 322.557481][T16996] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3104'. [ 322.561180][T16996] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3104'. [ 322.588430][T16996] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3104'. [ 322.595109][T16996] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3104'. [ 322.617245][T16996] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3104'. [ 322.629305][T16996] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3104'. [ 322.647091][T16996] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3104'. [ 322.664902][T16996] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3104'. [ 323.171311][T17006] TC_ACT_REPEAT abuse ? [ 323.187644][T17006] TC_ACT_REPEAT abuse ? [ 323.637762][T17019] netlink: 'syz.4.3113': attribute type 1 has an invalid length. [ 323.680238][T17019] bond3: (slave geneve2): making interface the new active one [ 323.681325][T17019] bond3: (slave geneve2): Enslaving as an active interface with an up link [ 323.715258][ T12] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 323.731907][ T12] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 323.733754][ T12] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 323.733838][ T12] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 323.863272][T17024] IPVS: set_ctl: invalid protocol: 118 255.255.255.255:20000 [ 324.145994][ T5640] Bluetooth: hci3: command tx timeout [ 325.017796][T17052] netlink: 'syz.4.3124': attribute type 1 has an invalid length. [ 325.473605][T16912] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 325.473643][T16912] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 325.473669][T16912] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 325.473694][T16912] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 325.567226][T17068] __nla_validate_parse: 28 callbacks suppressed [ 325.567246][T17068] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3126'. [ 325.928389][T17076] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3127'. [ 326.215789][ T5640] Bluetooth: hci3: command tx timeout [ 326.675744][ T6821] IPVS: starting estimator thread 0... [ 326.800395][T17100] IPVS: using max 26 ests per chain, 62400 per kthread [ 327.292445][T17115] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3138'. [ 327.411100][T17112] xt_hashlimit: size too large, truncated to 1048576 [ 327.774720][T17123] netlink: 5 bytes leftover after parsing attributes in process `syz.4.3139'. [ 327.787543][T17123] netlink: 5 bytes leftover after parsing attributes in process `syz.4.3139'. [ 327.787787][T17123] netlink: 5 bytes leftover after parsing attributes in process `syz.4.3139'. [ 327.787977][T17123] netlink: 5 bytes leftover after parsing attributes in process `syz.4.3139'. [ 327.963060][T17123] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3139'. [ 327.998194][T17123] IPVS: length: 143 != 24 [ 328.731499][T17141] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 329.091303][T17144] syzkaller0: entered promiscuous mode [ 329.091329][T17144] syzkaller0: entered allmulticast mode [ 329.140150][T17152] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3146'. [ 329.991664][ T5634] Bluetooth: hci3: command 0x0405 tx timeout [ 332.550198][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 333.928905][ T1152] bridge_slave_1: left allmulticast mode [ 333.928957][ T1152] bridge_slave_1: left promiscuous mode [ 333.931489][ T1152] bridge0: port 2(bridge_slave_1) entered disabled state [ 333.961505][ T1152] bridge_slave_0: left allmulticast mode [ 333.961543][ T1152] bridge_slave_0: left promiscuous mode [ 333.964980][ T1152] bridge0: port 1(bridge_slave_0) entered disabled state [ 334.038752][ T1152] pimreg3: left allmulticast mode [ 334.784403][ T1152] bond21 (unregistering): (slave geneve5): Releasing active interface [ 334.837551][ T1152] bond20 (unregistering): (slave geneve4): Releasing active interface [ 334.867200][ T1152] bond19 (unregistering): (slave geneve3): Releasing active interface [ 334.946183][ T1152] bond9 (unregistering): (slave bridge2): Releasing active interface [ 335.066914][ T1152] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 335.100265][ T1152] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 335.116230][ T1152] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 335.150236][ T1152] bond0 (unregistering): Released all slaves [ 335.164379][ T1152] bond1 (unregistering): Released all slaves [ 335.185107][ T1152] bond2 (unregistering): Released all slaves [ 335.211287][ T1152] bond3 (unregistering): Released all slaves [ 335.232406][ T1152] bond4 (unregistering): Released all slaves [ 335.275948][ T1152] bond5 (unregistering): Released all slaves [ 335.302364][ T1152] bond6 (unregistering): Released all slaves [ 335.329806][ T1152] bond7 (unregistering): Released all slaves [ 335.350557][ T1152] bond8 (unregistering): Released all slaves [ 335.462771][ T1152] bond9 (unregistering): Released all slaves [ 335.484037][ T1152] bond10 (unregistering): Released all slaves [ 335.519395][ T1152] bond11 (unregistering): Released all slaves [ 335.562449][ T1152] bond12 (unregistering): Released all slaves [ 335.591679][ T1152] bond13 (unregistering): Released all slaves [ 335.621230][ T1152] bond14 (unregistering): Released all slaves [ 335.651203][ T1152] bond15 (unregistering): Released all slaves [ 335.682648][ T1152] bond16 (unregistering): Released all slaves [ 335.705075][ T1152] bond17 (unregistering): Released all slaves [ 335.736091][ T1152] bond18 (unregistering): Released all slaves [ 335.762250][ T1152] bond19 (unregistering): Released all slaves [ 335.793025][ T1152] bond20 (unregistering): Released all slaves [ 335.815140][ T1152] bond21 (unregistering): Released all slaves [ 335.880857][ T1152] bond22 (unregistering): Released all slaves [ 335.901745][ T1152] bond23 (unregistering): Released all slaves [ 335.922951][ T1152] bond24 (unregistering): Released all slaves [ 335.943037][ T1152] bond25 (unregistering): Released all slaves [ 335.983835][ T1152] bond26 (unregistering): (slave team0): Removing an active aggregator [ 335.984519][ T1152] bond26 (unregistering): (slave team0): Releasing backup interface [ 336.005141][ T1152] bond26 (unregistering): Released all slaves [ 336.233751][T16912] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 336.233787][T16912] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 336.233813][T16912] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 336.233837][T16912] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 336.518811][T17181] netlink: 'syz.0.3153': attribute type 1 has an invalid length. [ 337.242015][T17213] netlink: 'syz.4.3159': attribute type 21 has an invalid length. [ 337.242099][T17213] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3159'. [ 337.809992][T17224] netlink: 'syz.4.3160': attribute type 39 has an invalid length. [ 338.240276][T17232] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3163'. [ 338.706007][ T1152] tipc: Left network mode [ 338.792811][T17241] xt_hashlimit: size too large, truncated to 1048576 [ 339.248141][T17241] xt_hashlimit: size too large, truncated to 1048576 [ 339.519897][T17241] xt_hashlimit: size too large, truncated to 1048576 [ 340.409276][T16912] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 340.409313][T16912] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 340.409339][T16912] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 340.409365][T16912] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 2] type 2 family 0 port 20000 - 0 [ 340.548499][T17262] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 340.548763][T17262] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 342.651473][T17282] tipc: Enabled bearer , priority 10 [ 342.743244][T17287] syzkaller0: entered promiscuous mode [ 342.743268][T17287] syzkaller0: entered allmulticast mode [ 343.457841][T17289] netlink: 'syz.4.3175': attribute type 1 has an invalid length. [ 343.517527][T17292] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3175'. [ 343.551333][T17289] 8021q: adding VLAN 0 to HW filter on device bond5 [ 343.594608][T17292] bond1: (slave team0): Removing an active aggregator [ 343.595419][T17292] bond1: (slave team0): Releasing backup interface [ 343.615281][T17292] 8021q: adding VLAN 0 to HW filter on device team0 [ 343.628465][T17292] bond5: (slave team0): Enslaving as a backup interface with an up link [ 343.745173][T17296] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 343.779089][T16912] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 343.859144][T16912] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 343.862291][T16912] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 343.897485][T16912] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 343.903072][T16912] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 343.929288][T16912] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 343.931642][T16912] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 343.996987][T16912] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 344.172582][T17313] netlink: 'syz.1.3179': attribute type 2 has an invalid length. [ 344.172606][T17313] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3179'. [ 344.659513][T16912] 8021q: adding VLAN 0 to HW filter on device bond0 [ 344.772839][ T7464] IPVS: starting estimator thread 0... [ 344.825879][T17325] IPVS: ip_vs_edit_dest(): server weight less than zero [ 344.851086][T17325] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3180'. [ 344.851123][T17325] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3180'. [ 344.857465][T17321] IPVS: using max 35 ests per chain, 84000 per kthread [ 344.980835][ T30] audit: type=1107 audit(1793891393.170:5): pid=17318 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 345.033084][T17317] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3180'. [ 345.153436][T17325] ip6gretap0: entered promiscuous mode [ 345.154592][T17325] syz_tun: entered promiscuous mode [ 345.155318][T17325] debugfs: 'hsr1' already exists in 'hsr' [ 345.155337][T17325] Cannot create hsr debugfs directory [ 345.388208][T17335] netlink: 'syz.1.3184': attribute type 3 has an invalid length. [ 345.388232][T17335] netlink: 244 bytes leftover after parsing attributes in process `syz.1.3184'. [ 345.503763][T17338] netlink: 'syz.0.3186': attribute type 1 has an invalid length. [ 345.564564][T16912] 8021q: adding VLAN 0 to HW filter on device team0 [ 345.950127][T17350] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3188'. [ 346.005092][ T7464] bridge0: port 1(bridge_slave_0) entered blocking state [ 346.005202][ T7464] bridge0: port 1(bridge_slave_0) entered forwarding state [ 346.045081][ T7468] bridge0: port 2(bridge_slave_1) entered blocking state [ 346.045194][ T7468] bridge0: port 2(bridge_slave_1) entered forwarding state [ 346.243642][T17354] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 346.575789][ T5640] Bluetooth: hci0: unexpected event 0x0f length: 0 < 4 [ 346.598820][T17348] netlink: 'syz.1.3189': attribute type 10 has an invalid length. [ 346.599085][T17348] bridge0: port 2(bridge_slave_1) entered disabled state [ 346.599951][T17348] bridge0: port 1(bridge_slave_0) entered disabled state [ 346.678058][T17348] bridge0: port 2(bridge_slave_1) entered blocking state [ 346.678192][T17348] bridge0: port 2(bridge_slave_1) entered forwarding state [ 346.678625][T17348] bridge0: port 1(bridge_slave_0) entered blocking state [ 346.678755][T17348] bridge0: port 1(bridge_slave_0) entered forwarding state [ 346.757336][T17362] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3189'. [ 346.759638][T17359] vxcan1: tx drop: invalid sa for name 0x0000000000000001 [ 346.823897][T17361] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3189'. [ 346.862519][T17348] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 346.866525][T17361] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3189'. [ 348.101893][T16912] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 348.262709][T17394] netlink: 'syz.4.3199': attribute type 1 has an invalid length. [ 348.352277][T16912] veth0_vlan: entered promiscuous mode [ 348.378355][T16912] veth1_vlan: entered promiscuous mode [ 348.634024][T16912] veth0_macvtap: entered promiscuous mode [ 348.655887][T16912] veth1_macvtap: entered promiscuous mode [ 348.724131][T16912] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 348.761445][T16912] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 348.846411][ T7468] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.847684][ T140] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.847726][ T140] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 348.847758][ T140] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 349.234542][ T6822] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 349.234564][ T6822] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 349.381182][ T7468] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 349.381203][ T7468] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 349.638747][T17418] __nla_validate_parse: 1 callbacks suppressed [ 349.638770][T17418] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3206'. [ 349.639186][T17418] IPVS: ip_vs_edit_dest(): server weight less than zero [ 349.711824][T17418] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3206'. [ 349.711861][T17418] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3206'. [ 350.361583][T17435] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3210'. [ 350.598429][T17429] sit0: entered promiscuous mode [ 350.643125][T17429] netlink: 'syz.1.3208': attribute type 1 has an invalid length. [ 350.643149][T17429] netlink: 1 bytes leftover after parsing attributes in process `syz.1.3208'. [ 350.645590][T17441] netlink: 'syz.3.3210': attribute type 9 has an invalid length. [ 351.143443][T17448] mac80211_hwsim hwsim23 wlan0: entered promiscuous mode [ 351.403976][ T13] IPVS: starting estimator thread 0... [ 351.412085][T17460] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3216'. [ 351.413774][T17460] IPVS: ip_vs_edit_dest(): server weight less than zero [ 351.480479][T17460] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3216'. [ 351.480518][T17460] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3216'. [ 351.485676][T17461] IPVS: using max 29 ests per chain, 69600 per kthread [ 351.637295][T17460] ip6gretap0: entered promiscuous mode [ 351.640706][T17460] syz_tun: entered promiscuous mode [ 351.643641][T17460] debugfs: 'hsr1' already exists in 'hsr' [ 351.643663][T17460] Cannot create hsr debugfs directory [ 352.637088][ T5643] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 352.644952][ T5643] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 352.661032][ T5643] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 352.675350][ T5643] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 352.689008][ T5643] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 354.777112][ T5643] Bluetooth: hci2: command tx timeout [ 355.804098][T17506] netlink: 6 bytes leftover after parsing attributes in process `syz.0.3228'. [ 355.905824][T17514] netlink: 132 bytes leftover after parsing attributes in process `syz.1.3229'. [ 355.907685][T17514] IPVS: ip_vs_edit_dest(): server weight less than zero [ 355.946484][T17514] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3229'. [ 355.946525][T17514] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3229'. [ 356.523588][T17487] rxe_eth0 speed is unknown, defaulting to 1000 [ 356.857719][ T5643] Bluetooth: hci2: command tx timeout [ 357.068873][T17487] virt_wifi0 speed is unknown, defaulting to 1000 [ 357.791495][T17547] netlink: 144 bytes leftover after parsing attributes in process `syz.4.3238'. [ 358.115053][T17487] bridge0: port 1(bridge_slave_0) entered blocking state [ 358.115212][T17487] bridge0: port 1(bridge_slave_0) entered disabled state [ 358.115372][T17487] bridge_slave_0: entered allmulticast mode [ 358.147082][T17487] bridge_slave_0: entered promiscuous mode [ 358.175934][T17487] bridge0: port 2(bridge_slave_1) entered blocking state [ 358.176070][T17487] bridge0: port 2(bridge_slave_1) entered disabled state [ 358.176234][T17487] bridge_slave_1: entered allmulticast mode [ 358.179740][T17487] bridge_slave_1: entered promiscuous mode [ 358.299147][T17487] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 358.302586][T17487] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 358.360668][T17487] team0: Port device team_slave_0 added [ 358.363820][T17487] team0: Port device team_slave_1 added [ 358.420668][T17487] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 358.420685][T17487] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.420718][T17487] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 358.421228][T17556] bond0: option miimon: invalid value (18446744071829782528) [ 358.421248][T17556] bond0: option miimon: allowed values 0 - 2147483647 [ 358.423522][T17487] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 358.423536][T17487] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 358.423637][T17487] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 358.607990][T17487] hsr_slave_0: entered promiscuous mode [ 358.609233][T17487] hsr_slave_1: entered promiscuous mode [ 358.610106][T17487] debugfs: 'hsr0' already exists in 'hsr' [ 358.610127][T17487] Cannot create hsr debugfs directory [ 358.938619][ T5643] Bluetooth: hci2: command tx timeout [ 359.087758][T17487] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 359.087804][T17487] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 359.087830][T17487] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 359.882061][T17570] netlink: 72 bytes leftover after parsing attributes in process `syz.0.3245'. [ 360.197640][T17576] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3248'. [ 360.330432][T17578] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3248'. [ 360.330769][T17579] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3248'. [ 361.027869][ T5643] Bluetooth: hci2: command tx timeout [ 361.128492][T17597] netlink: 'syz.0.3253': attribute type 1 has an invalid length. [ 361.566930][T17610] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3257'. [ 362.051262][T17487] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 362.051299][T17487] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 362.051324][T17487] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 363.520079][T17634] netlink: 'syz.1.3263': attribute type 1 has an invalid length. [ 363.589933][T17634] bond1: (slave geneve2): making interface the new active one [ 363.594097][T17634] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 363.603676][ T6822] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 363.603733][ T6822] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 363.603782][ T6822] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 363.603814][ T6822] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 364.873969][T17487] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 364.874008][T17487] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 364.874034][T17487] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20000 - 0 [ 366.457453][ T1152] hsr_slave_0: left promiscuous mode [ 366.474229][ T1152] hsr_slave_1: left promiscuous mode [ 366.483489][ T1152] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 366.483559][ T1152] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 366.555337][ T1152] veth1_macvtap: left promiscuous mode [ 366.557664][ T1152] veth1_vlan: left promiscuous mode [ 366.557758][ T1152] veth0_vlan: left promiscuous mode [ 378.819485][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 420.388932][ T5634] Bluetooth: hci5: command 0x0406 tx timeout [ 434.950179][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 440.192260][ T1319] ieee802154 phy0 wpan0: encryption failed: -22 [ 486.625509][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 486.632584][ C1] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P17646/1:b..l.. [ 486.641872][ C1] rcu: (detected by 1, t=10503 jiffies, g=73245, q=758902 ncpus=2) [ 486.649886][ C1] task:syz-executor state:R running task stack:26920 pid:17646 tgid:17646 ppid:16549 task_flags:0x40044c flags:0x00080002 [ 486.663422][ C1] Call Trace: [ 486.666714][ C1] [ 486.669657][ C1] __schedule+0x17dd/0x5830 [ 486.674192][ C1] ? stack_trace_save+0xa9/0x100 [ 486.679183][ C1] ? __lock_acquire+0x747/0x2de0 [ 486.684145][ C1] ? __pfx___schedule+0x10/0x10 [ 486.689032][ C1] preempt_schedule_irq+0x4b/0x90 [ 486.694077][ C1] irqentry_exit+0x14f/0x9b0 [ 486.698684][ C1] ? trace_irq_disable+0x3b/0x140 [ 486.703735][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 486.709747][ C1] RIP: 0010:unwind_next_frame+0x9b3/0x2550 [ 486.715583][ C1] Code: 48 85 ff 0f 84 db 0d 00 00 48 83 c7 50 e9 2d 01 00 00 48 8b 44 24 38 42 80 3c 20 00 74 0c 48 89 ef e8 71 70 c7 00 49 8d 55 04 <4c> 8b 45 00 49 8d 5d 01 4c 89 e8 48 c1 e8 03 42 0f b6 04 20 84 c0 [ 486.735203][ C1] RSP: 0018:ffffc900038772a0 EFLAGS: 00000246 [ 486.741300][ C1] RAX: 1ffff9200070ee70 RBX: 0000000000000003 RCX: ffffffff91b9b090 [ 486.749292][ C1] RDX: ffffffff923af27c RSI: ffffffff923af278 RDI: ffffffff8c8e8c20 [ 486.757287][ C1] RBP: ffffc90003877380 R08: 0000000000000001 R09: 0000000000000000 [ 486.765274][ C1] R10: ffffc90003877398 R11: ffffffff81b3a880 R12: dffffc0000000000 [ 486.773440][ C1] R13: ffffffff923af278 R14: ffffc90003877348 R15: 1ffff9200070ee69 [ 486.781433][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 486.787634][ C1] ? exit_to_user_mode_loop+0x10e/0x770 [ 486.793206][ C1] ? unwind_next_frame+0x8f/0x2550 [ 486.798344][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 486.804522][ C1] arch_stack_walk+0x11b/0x150 [ 486.809314][ C1] ? exit_to_user_mode_loop+0x10e/0x770 [ 486.814888][ C1] stack_trace_save+0xa9/0x100 [ 486.819680][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 486.825087][ C1] kasan_save_track+0x3e/0x80 [ 486.829782][ C1] ? kasan_save_track+0x3e/0x80 [ 486.834650][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 486.839433][ C1] ? __kmalloc_cache_noprof+0x31c/0x600 [ 486.844994][ C1] ? kmem_cache_free+0x156/0x650 [ 486.849938][ C1] ? tear_down_vmas+0x31f/0x530 [ 486.854797][ C1] ? exit_mmap+0x4ca/0xa40 [ 486.859218][ C1] ? __mmput+0x118/0x420 [ 486.863473][ C1] ? exit_mm+0x18e/0x240 [ 486.867723][ C1] ? do_exit+0x6a8/0x2360 [ 486.872067][ C1] ? do_group_exit+0x22d/0x2f0 [ 486.876839][ C1] ? get_signal+0x1216/0x12c0 [ 486.881530][ C1] ? arch_do_signal_or_restart+0xbb/0x860 [ 486.887260][ C1] ? exit_to_user_mode_loop+0x10e/0x770 [ 486.892872][ C1] ? rcu_is_watching+0x16/0xb0 [ 486.897665][ C1] __kasan_kmalloc+0x93/0xb0 [ 486.902278][ C1] __kmalloc_cache_noprof+0x31c/0x600 [ 486.907677][ C1] ? __kmalloc_cache_noprof+0x148/0x600 [ 486.913238][ C1] ? kmem_cache_free+0x156/0x650 [ 486.918188][ C1] ? kmem_cache_free+0x156/0x650 [ 486.923148][ C1] ? tear_down_vmas+0x31f/0x530 [ 486.928009][ C1] kmem_cache_free+0x156/0x650 [ 486.932797][ C1] tear_down_vmas+0x31f/0x530 [ 486.937492][ C1] exit_mmap+0x4ca/0xa40 [ 486.942185][ C1] ? __pfx_exit_mmap+0x10/0x10 [ 486.946996][ C1] ? __pfx_exit_aio+0x10/0x10 [ 486.951712][ C1] ? uprobe_clear_state+0x2a4/0x3d0 [ 486.956933][ C1] __mmput+0x118/0x420 [ 486.961026][ C1] exit_mm+0x18e/0x240 [ 486.965111][ C1] do_exit+0x6a8/0x2360 [ 486.969286][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 486.974674][ C1] ? __pfx_do_exit+0x10/0x10 [ 486.979277][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 486.984321][ C1] do_group_exit+0x22d/0x2f0 [ 486.988922][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 486.994135][ C1] get_signal+0x1216/0x12c0 [ 486.998682][ C1] arch_do_signal_or_restart+0xbb/0x860 [ 487.004246][ C1] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 487.010437][ C1] exit_to_user_mode_loop+0x10e/0x770 [ 487.015825][ C1] ? rcu_is_watching+0x16/0xb0 [ 487.020616][ C1] do_syscall_64+0x328/0x520 [ 487.025219][ C1] ? trace_irq_disable+0x3b/0x140 [ 487.030259][ C1] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.036345][ C1] ? clear_bhb_loop+0x70/0xc0 [ 487.041043][ C1] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.046951][ C1] RIP: 0033:0x7fc3fef9ebd7 [ 487.051385][ C1] RSP: 002b:00007fff20ded298 EFLAGS: 00000202 ORIG_RAX: 000000000000010a [ 487.059807][ C1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007fc3fef9ebd7 [ 487.067787][ C1] RDX: 00007fc3ff038b37 RSI: 00000000ffffff9c RDI: 00007fff20ded330 [ 487.075776][ C1] RBP: 00007fff20ded2dc R08: 0000000000000001 R09: 00000000ffffffff [ 487.083767][ C1] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000037 [ 487.091759][ C1] R13: 00000000000927c0 R14: 0000000000058fed R15: 00007fff20ded330 [ 487.099769][ C1] [ 487.102799][ C1] rcu: rcu_preempt kthread starved for 8969 jiffies! g73245 f0x2 RCU_GP_WAIT_FQS(5) ->state=R ->cpu=1 [ 487.113748][ C1] rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. [ 487.123724][ C1] rcu: RCU grace-period kthread stack dump: [ 487.129616][ C1] task:rcu_preempt state:R running task stack:27496 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000 [ 487.143138][ C1] Call Trace: [ 487.146426][ C1] [ 487.149379][ C1] __schedule+0x17dd/0x5830 [ 487.153902][ C1] ? __lock_acquire+0x747/0x2de0 [ 487.158886][ C1] ? do_raw_spin_unlock+0xf5/0x200 [ 487.164031][ C1] ? __pfx___schedule+0x10/0x10 [ 487.168899][ C1] ? lock_acquire+0x115/0x350 [ 487.173621][ C1] ? schedule+0x90/0x2b0 [ 487.177901][ C1] schedule+0x164/0x2b0 [ 487.182082][ C1] schedule_timeout+0x152/0x2c0 [ 487.186960][ C1] ? __pfx_schedule_timeout+0x10/0x10 [ 487.192358][ C1] ? __pfx_process_timeout+0x10/0x10 [ 487.197671][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 487.203496][ C1] ? prepare_to_swait_event+0x220/0x3e0 [ 487.209066][ C1] ? prepare_to_swait_event+0x35e/0x3e0 [ 487.214649][ C1] rcu_gp_fqs_loop+0x30c/0x1230 [ 487.219534][ C1] ? __pfx_rcu_watching_snap_recheck+0x10/0x10 [ 487.225752][ C1] ? __pfx_rcu_gp_fqs_loop+0x10/0x10 [ 487.231107][ C1] ? _raw_spin_unlock_irq+0x2e/0x50 [ 487.236423][ C1] rcu_gp_kthread+0x9c/0x340 [ 487.241040][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 487.246295][ C1] ? __kthread_parkme+0x71/0x1f0 [ 487.251247][ C1] ? __kthread_parkme+0x199/0x1f0 [ 487.256384][ C1] kthread+0x38b/0x480 [ 487.260473][ C1] ? __pfx_rcu_gp_kthread+0x10/0x10 [ 487.265697][ C1] ? __pfx_kthread+0x10/0x10 [ 487.270306][ C1] ret_from_fork+0x514/0xb70 [ 487.274914][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 487.280058][ C1] ? __switch_to+0xc78/0x1410 [ 487.284766][ C1] ? __pfx_kthread+0x10/0x10 [ 487.289373][ C1] ret_from_fork_asm+0x1a/0x30 [ 487.294173][ C1] [ 487.297204][ C1] rcu: Stack dump where RCU GP kthread last ran: [ 487.303549][ C1] CPU: 1 UID: 0 PID: 11594 Comm: kworker/R-bond7 Not tainted syzkaller #0 PREEMPT(full) [ 487.313383][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 487.323454][ C1] Workqueue: bond7 bond_3ad_state_machine_handler [ 487.329911][ C1] RIP: 0010:unwind_next_frame+0xb8a/0x2550 [ 487.335745][ C1] Code: 80 3c 04 00 74 09 e8 b5 6e c7 00 4c 8b 04 24 49 8d 50 f8 4d 8b 6e 10 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 10 0f b6 04 01 <84> c0 0f 85 3b 14 00 00 41 83 3e 00 0f 95 c0 49 39 d7 0f 96 c1 20 [ 487.355375][ C1] RSP: 0018:ffffc90000a07f80 EFLAGS: 00000246 [ 487.361642][ C1] RAX: 0000000000000000 RBX: 1ffff92000141006 RCX: 1ffff92000141005 [ 487.369634][ C1] RDX: ffffc900046df900 RSI: 0000000000000002 RDI: ffffc90000a08038 [ 487.377623][ C1] RBP: 1ffffffff246e53f R08: ffffc900046df908 R09: 0000000000000000 [ 487.385610][ C1] R10: ffffc90000a08078 R11: ffffffff81b3a880 R12: 1ffff92000141007 [ 487.393630][ C1] R13: ffffc90000a09000 R14: ffffc90000a08028 R15: ffffc90000a01000 [ 487.401615][ C1] FS: 0000000000000000(0000) GS:ffff88812371c000(0000) knlGS:0000000000000000 [ 487.410562][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 487.417162][ C1] CR2: 00007ffd2bc10ee0 CR3: 00000000377a2000 CR4: 00000000003526f0 [ 487.425147][ C1] Call Trace: [ 487.428433][ C1] [ 487.431291][ C1] ? do_softirq+0x77/0xd0 [ 487.435730][ C1] ? unwind_next_frame+0x8f/0x2550 [ 487.440899][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 487.447071][ C1] arch_stack_walk+0x11b/0x150 [ 487.451872][ C1] ? do_softirq+0x77/0xd0 [ 487.456225][ C1] stack_trace_save+0xa9/0x100 [ 487.461021][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 487.466420][ C1] ? __lock_acquire+0x747/0x2de0 [ 487.471384][ C1] kasan_save_track+0x3e/0x80 [ 487.476084][ C1] ? kasan_save_track+0x3e/0x80 [ 487.480955][ C1] ? kasan_save_free_info+0x40/0x50 [ 487.486168][ C1] ? __kasan_slab_free+0x5c/0x80 [ 487.491119][ C1] ? kfree+0x1c5/0x650 [ 487.495197][ C1] ? __kfree_skb+0x5d/0x210 [ 487.499705][ C1] ? nft_synproxy_eval_v4+0x36a/0x4e0 [ 487.505096][ C1] ? nft_synproxy_do_eval+0x389/0x5d0 [ 487.510489][ C1] ? nft_do_chain+0x48d/0x1b10 [ 487.515271][ C1] ? nft_do_chain_ipv4+0x195/0x290 [ 487.520398][ C1] ? nf_hook_slow+0xc5/0x220 [ 487.524999][ C1] ? NF_HOOK+0x21f/0x3c0 [ 487.529256][ C1] ? NF_HOOK+0x336/0x3c0 [ 487.533514][ C1] ? process_backlog+0xa6b/0x18b0 [ 487.538558][ C1] ? __napi_poll+0xaa/0x330 [ 487.543081][ C1] ? net_rx_action+0x61d/0xf50 [ 487.547863][ C1] ? handle_softirqs+0x265/0x8d0 [ 487.552815][ C1] ? do_softirq+0x77/0xd0 [ 487.557257][ C1] kasan_save_free_info+0x40/0x50 [ 487.562297][ C1] __kasan_slab_free+0x5c/0x80 [ 487.567083][ C1] kfree+0x1c5/0x650 [ 487.570990][ C1] ? __kfree_skb+0x5d/0x210 [ 487.575505][ C1] __kfree_skb+0x5d/0x210 [ 487.579854][ C1] nft_synproxy_eval_v4+0x36a/0x4e0 [ 487.585165][ C1] ? __pfx_nft_synproxy_eval_v4+0x10/0x10 [ 487.590907][ C1] ? nf_ip_checksum+0x13c/0x510 [ 487.595786][ C1] nft_synproxy_do_eval+0x389/0x5d0 [ 487.601032][ C1] ? __pfx_nft_synproxy_do_eval+0x10/0x10 [ 487.606794][ C1] nft_do_chain+0x48d/0x1b10 [ 487.611750][ C1] ? __pfx_nft_do_chain+0x10/0x10 [ 487.617176][ C1] ? __local_bh_enable_ip+0xd6/0x140 [ 487.622494][ C1] ? lockdep_hardirqs_on+0x7b/0x110 [ 487.627841][ C1] nft_do_chain_ipv4+0x195/0x290 [ 487.632811][ C1] ? ipt_do_table+0x2b9/0x15d0 [ 487.637598][ C1] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 487.643083][ C1] ? iptable_mangle_hook+0x18a/0x4c0 [ 487.648394][ C1] ? __pfx_nft_do_chain_ipv4+0x10/0x10 [ 487.653877][ C1] nf_hook_slow+0xc5/0x220 [ 487.658314][ C1] NF_HOOK+0x21f/0x3c0 [ 487.662440][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 487.668448][ C1] ? NF_HOOK+0x9e/0x3c0 [ 487.672641][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 487.677286][ C1] ? __pfx_ip_local_deliver_finish+0x10/0x10 [ 487.683293][ C1] ? ip_local_deliver+0x113/0x190 [ 487.688341][ C1] NF_HOOK+0x336/0x3c0 [ 487.692433][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 487.697566][ C1] ? NF_HOOK+0x9e/0x3c0 [ 487.701743][ C1] ? __pfx_NF_HOOK+0x10/0x10 [ 487.706363][ C1] ? __pfx_ip_rcv_finish+0x10/0x10 [ 487.711516][ C1] ? ip_rcv_core+0x88d/0xd50 [ 487.716136][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 487.720748][ C1] ? __pfx_ip_rcv+0x10/0x10 [ 487.725288][ C1] process_backlog+0xa6b/0x18b0 [ 487.730177][ C1] ? process_backlog+0x3de/0x18b0 [ 487.735240][ C1] __napi_poll+0xaa/0x330 [ 487.739596][ C1] net_rx_action+0x61d/0xf50 [ 487.744228][ C1] ? __pfx_net_rx_action+0x10/0x10 [ 487.749404][ C1] handle_softirqs+0x265/0x8d0 [ 487.754204][ C1] ? bond_3ad_state_machine_handler+0x5a7c/0x5d60 [ 487.761012][ C1] do_softirq+0x77/0xd0 [ 487.765195][ C1] [ 487.768129][ C1] [ 487.771075][ C1] __local_bh_enable_ip+0x100/0x140 [ 487.776316][ C1] bond_3ad_state_machine_handler+0x5a7c/0x5d60 [ 487.782606][ C1] ? do_raw_spin_lock+0x12b/0x2f0 [ 487.787653][ C1] ? bond_3ad_state_machine_handler+0xd0/0x5d60 [ 487.793944][ C1] ? __pfx_bond_3ad_state_machine_handler+0x10/0x10 [ 487.800584][ C1] ? rcu_is_watching+0x16/0xb0 [ 487.805389][ C1] ? process_scheduled_works+0x97a/0x1630 [ 487.811140][ C1] process_scheduled_works+0xc3d/0x1630 [ 487.816751][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 487.822765][ C1] ? assign_work+0x3af/0x5d0 [ 487.827386][ C1] rescuer_thread+0x84a/0x12a0 [ 487.832175][ C1] ? rescuer_thread+0xb8/0x12a0 [ 487.837056][ C1] kthread+0x38b/0x480 [ 487.841142][ C1] ? __pfx_rescuer_thread+0x10/0x10 [ 487.846351][ C1] ? __pfx_kthread+0x10/0x10 [ 487.850960][ C1] ret_from_fork+0x514/0xb70 [ 487.855569][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 487.860697][ C1] ? __switch_to+0xc78/0x1410 [ 487.865402][ C1] ? __pfx_kthread+0x10/0x10 [ 487.870057][ C1] ret_from_fork_asm+0x1a/0x30 [ 487.874858][ C1]