last executing test programs: 4.828549615s ago: executing program 4 (id=12991): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYBLOB="bc010000190001000000000001000000fe880000000000000000000000000101ac141438000000000000000000002000fffc00004e2100000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800004000000000000000000000000000000000000000000000000000000000000000000000100000000040105000a010102000000000000000000000000000000003300000002000000ffffffff0000000000000000000000000000000000000000000000000000000040000000fe8000000000000000000000000000bb0000000033"], 0x1bc}, 0x1, 0x0, 0x0, 0x1}, 0x800) 4.716221555s ago: executing program 4 (id=12994): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000cc0), 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000a80)=[{{&(0x7f0000000340)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000000740)=[{&(0x7f0000000440)=""/99, 0x63}, {&(0x7f0000000540)=""/164, 0xa4}, {&(0x7f00000006c0)=""/124, 0x7c}, {&(0x7f0000000840)=""/160, 0xa0}, {&(0x7f0000000140)=""/52, 0x34}, {&(0x7f0000000900)=""/242, 0xf2}], 0x10000000000000f3, &(0x7f00000003c0)=""/50, 0x32}, 0xe}], 0x1, 0x100, &(0x7f0000000ac0)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a3, &(0x7f0000000200)='bridge0\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "2d9421fe8a4c9563", "cf6ff9ff337ed301000100c747fbbfc1", "dbdc27ff", "16de86d67a8426bd"}, 0x28) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) recvfrom(r1, &(0x7f0000002800)=""/4071, 0xfffffffffffffdab, 0x17, 0x0, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1) recvmmsg(r1, &(0x7f0000008bc0)=[{{0x0, 0x0, 0x0}, 0x3}, {{0x0, 0x0, &(0x7f0000002500)=[{&(0x7f0000002400)=""/73, 0x49}], 0x1}, 0x7fffffff}], 0x2, 0x10002, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f00000000c0)=0x8, 0x4) r3 = socket$inet6_udp(0xa, 0x2, 0x0) r4 = syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x5, 0xb, &(0x7f0000000240)=ANY=[@ANYRES16=r5, @ANYRESOCT, @ANYRESHEX=r2, @ANYRES64=r3, @ANYRES32=0x0, @ANYRESDEC=r4], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f00000004c0), r5) sendmsg$DEVLINK_CMD_TRAP_GET(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x20048041}, 0xa000) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) unshare(0x6a040000) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000006c0)=ANY=[], 0x14}}, 0x8841) socket$netlink(0x10, 0x3, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 3.454497778s ago: executing program 2 (id=13007): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4040}, 0x0) writev(0xffffffffffffffff, &(0x7f0000001540)=[{&(0x7f00000001c0)="da", 0x1}], 0x1) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000480500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000004400000000b0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d10300002c0000000e0a010200000000000000000a0000000900010073797a310000000009000200"], 0xd8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 3.338795334s ago: executing program 2 (id=13008): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x3, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x8}}, @NFT_MSG_NEWFLOWTABLE={0x30, 0x16, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0x6}, [@NFTA_FLOWTABLE_HOOK={0x4}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x8c}}, 0x4000000) 3.24531303s ago: executing program 0 (id=13010): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r1, &(0x7f0000000440), &(0x7f0000000040)=@udp=r0}, 0x20) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x21) r2 = socket$unix(0x1, 0x1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1900000004000100040000000500000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70800000000e7057b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x3, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0xfffffffffffffe8b, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x1e) bind$unix(r2, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r2, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) connect$unix(r5, &(0x7f0000000640)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r6, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r7], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe08}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r8, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20}, 0x50) syz_emit_ethernet(0xbe, &(0x7f0000001800)=ANY=[@ANYBLOB="aaaaaaaaaa23aaaaaaaaaa0c0800450000b00000000000119078000000000000000000004e20009c907801000000000000007b4b142b7461fd777bfd012bd14efb9f49fcdb8f080c26a04883ad5c8c82a9732009f1ad16bf05cb285275b8af584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c04594282423424d00000000000000000000000000bcfd56f1375461caaa2f19935e6996c7096ffeeb03000000000000649a3bfbc1f39cb307b3472eb9cdb042d2643fcbb2c50f000000544af6e8dafe09"], 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r9, r10, 0x100000af5, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x2003}, 0x94) r11 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000200)='syzkaller\x00', 0x9}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r11, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) recvmmsg(r0, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000800)=""/4092, 0xffc}], 0x1}, 0xb}], 0x1, 0x10043, 0x0) 3.062022702s ago: executing program 2 (id=13013): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000340)={r0, 0x8, 0x4, 0x687df61a}) sendmsg$NFT_BATCH(r0, &(0x7f0000001b40)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r0], 0x70}, 0x1, 0x0, 0x0, 0x24000805}, 0xc0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x0, @local}, 0x10) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, &(0x7f0000000440), 0x10) r4 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r4, 0x65, 0x2, &(0x7f0000000400)=0x2, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r6 = socket(0x2d, 0x2, 0x1) socket$inet_tcp(0x2, 0x1, 0x0) connect$qrtr(r6, &(0x7f0000000140)={0x2d, 0x0, 0x4001}, 0xc) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000001c0)={'bridge_slave_0\x00', 0x0}) bind$xdp(r6, &(0x7f0000000080)={0x2d, 0x0, r8, 0x3e}, 0x10) bind$can_raw(r4, &(0x7f0000000480)={0x1d, r5}, 0x10) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r11 = openat$cgroup_ro(r10, &(0x7f0000000280)='cpuset.effective_mems\x00', 0x275a, 0x0) write(r11, &(0x7f00000002c0)="4cf7", 0x2) splice(r11, &(0x7f0000000040), r10, 0x0, 0x6, 0x0) readv(r9, &(0x7f0000001900)=[{0x0}, {0x0}, {0x0}, {0x0, 0x1}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9) close(r4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0xb}}}, 0x24}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="2c0000006800010003001000fdffff7f00000000000000000c0002000100000015000000080010"], 0x2c}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) r12 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r12, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01080000000000000000070000000900010073797a300000ff0054000000090a0104000000000000247d0c20b8a74d00000700000008000a40000004efa887020073797a31000076050000000000007a30e7ffffff070000000008080007400000001d0800064000000000440000000c0a01010000000000000000070000020073797a31000000000900010073797a3000000000180003801400008008000340000000020800028004000280140000001000010000000001a90000000084000a7071dc4553ec9a9aa43d4a24a141112a41dc87b913a7e666803efc82472eec9583fe4a2065eeaf7875b4bfa87502b759e9f513e1c5f59bb31827df72e23cf4f28ada5d818b6d95a06464a14ffdb960ce00c8c7bc19e93765accae9c9a1c9c209b426c5f6d3a52821e3000000"], 0xe0}}, 0x4000000) 2.356518422s ago: executing program 0 (id=13014): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040), 0x10) listen(r0, 0x0) accept4(r0, &(0x7f0000000400)=@isdn, &(0x7f0000000180)=0x80, 0x180000) socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="0500000008e6ff000000003fe9e686a5c4100040", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r2 = socket$kcm(0x2, 0x5, 0x84) sendmsg$inet(r2, &(0x7f00000007c0)={&(0x7f0000000140)={0x2, 0x0, @private=0xa010101}, 0x10, &(0x7f0000000900)=[{&(0x7f0000000b80)="92", 0x1}], 0x1, &(0x7f0000000640)=ANY=[@ANYBLOB="2400000000000000840000000700000044140823e000000200000002e00000010000100000000000dc00000000000000000000000700000094040000863900000001000cb2ffb69602013567ffcb060f19367d2b99bdc0f59e428bc33a050a3660f2bb77c7045b050a31efe0215e235d56060495ae0144243471ac14142700000006ac1414bb00000001ac1414bb0000ffff0a01010200000009009404010000866000000000000c253d78b48f9458beb62d0102000d3bf9f2dbdddfea00b260f00503db010436b20603c70109e35e3ab5244a640709675e60e1799f870512e123b12c8654130f6a1f80f526064d12061127d9c9821b1bfe4b42fcb33e2e2d2594040000000000001400000000000000000000000200000022a20000000000001400000000000000000000000200000005000000000000001c"], 0x158}, 0x40) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0x8, &(0x7f00000001c0)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r1}}]}, &(0x7f00000003c0)='syzkaller\x00', 0x4, 0x1005, &(0x7f0000002500)=""/4101, 0x0, 0xc}, 0x94) syz_genetlink_get_family_id$nl80211(&(0x7f0000000600), r0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="09000000040000000c0000000b"], 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0xb, 0x5, 0x400, 0x9, 0x1}, 0x50) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000f4751f2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r4}, 0xc) setsockopt$X25_QBITINCL(r0, 0x106, 0x1, &(0x7f0000000480)=0x1, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x14, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x7}}, 0x14}}, 0x0) r6 = socket(0x2d, 0x2, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000001c0)={'bridge_slave_0\x00', 0x0}) bind$xdp(r6, &(0x7f0000000080)={0x2d, 0x0, r8, 0x3e}, 0x10) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r6, 0x89fb, &(0x7f0000000040)={'sit0\x00', 0x0}) 2.207698676s ago: executing program 0 (id=13017): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xb, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000ff030000000000000000000085000000c200000085000000a000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.205262013s ago: executing program 2 (id=13018): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4040}, 0x0) writev(0xffffffffffffffff, &(0x7f0000001540)=[{&(0x7f00000001c0)="da", 0x1}], 0x1) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000600500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000004400000000b0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d10300002c0000000e0a010200000000000000000a0000000900010073797a310000000009000200"], 0xd8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.093235181s ago: executing program 0 (id=13020): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4ea3, 0x10, @mcast2, 0x3}, 0x1c) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001e0021002bbd70000000000007004000"], 0x24}, 0x1, 0x0, 0x0, 0x2008800}, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r2, 0x29, 0x13, 0x0, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, &(0x7f0000000180)={r0, &(0x7f0000000300)='\x00\x00\x00\x00\x00\x00\x00\x92\xe9S\xf5\x85\x806&\xa8\x02\xfc\xb5\x82n\xcbJ\x0ek\xe6\xab\xa18r\xf6dl\x90\xc3\xac%\xc0(\x17\x98V(\xc3Z\x13,\x886A\xb9M\x90\r\x00\xca\xa3\a\x86@\x7f(\xeaa\xad\xeb\x04,\xf0\xf0}j\x898%\x00\x0e\xb1\xc3\x00\xday\xc0\xf8\xd4_\xbfP\xce\xfdL\x8a\xba\x91\xd1\xaaB\x1cB\xa0\xa10\x06\xbaAW\\\x1cw\x02\tT\xe3\xc9\xeb\xb6\xaa\xc8\xa0F\xfb\xab\xa2\x1c\x17\x10\x99w\x13\x18\xee\rE\xa8%1\x8b\x88i\xab<\xbe\xd9\x97|]7\xdd\x0f~\xb5y\xb1\x16\x81\x05<\xa4\x91g\xd2\x19\xde=\xda\xa3w\xda\xb0wA\xc8\xbbeE@\xf0\xe5\xf2L\x9c\')\xb5\xc6&x\xd4!\xffE\xd4\x0f\x99\xf2ZxFr1\x95\xceyF\xa4\xd2)\xedN\xd1#\xe1\xc2\xd1\xab\xa5E\xac\x12\xb4\"\n\xa2h\xf9R\xe2y\x06\xf1\x9d6\xa1S\xaeB\xde\xdfEG\xfc\xad\xd7iF\xd2mB\xc8\xf4yP!\x13\x92\xd8\x98\x1d\x84yd/\xc7l\x93\x89', 0x383003, &(0x7f00000000c0)={@_ha_fsid={[0xa200, 0x3]}, {0x1ffe, 0x2, 0x4, 0x1}}, 0xebe, &(0x7f0000000080), &(0x7f0000000140)=0x69d}) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0xa, 0x6, 0x8, 0x8, 0x40}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=@base={0xe, 0x4, 0x8, 0x8001, 0x4}, 0x48) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000600000004000000000000010400000000040000000000000000000d040000000000000000000010040000000400000000000008030000000000000061"], 0x0, 0x52}, 0x28) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000480850000002d00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r5}, 0xc) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=@ipv4_newroute={0x38, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0xfd, 0x0, 0x0, 0x5}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x2}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, @LWTUNNEL_IP_OPT_GENEVE_TYPE={0x5, 0x2, 0x7}}}}]}, 0x38}}, 0x0) ioctl$sock_inet_SIOCSARP(r3, 0x8955, &(0x7f0000000280)={{0x2, 0x4e21, @empty}, {0x306, @multicast}, 0x4, {0x2, 0x4e23, @remote}, 'pim6reg1\x00'}) 2.029672203s ago: executing program 4 (id=13022): r0 = socket(0x11, 0x3, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8955, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0600000004000000060000000800000000000000", @ANYRES32, @ANYBLOB="9e00a4eb0f0082eef2b325d2c26500"/27, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xd, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7dfb}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r1}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x15}}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000340)='syzkaller\x00', 0x5, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0xe, 0xfeff, &(0x7f0000000100)="e0857f9f582f0300000000000000", 0x0, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000800)="240000001e005f031420654400000000000000000100000001000800080008c01300ff00", 0x24) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r4, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x4}, 0x1c) r5 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'gre0\x00', 0x0}) sendto$packet(r5, &(0x7f00000001c0)="05", 0x1, 0x240458d1, &(0x7f0000000200)={0x11, 0x88a8, r6, 0x1, 0x85, 0x6, @broadcast}, 0x14) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_netrom_SIOCDELRT(r3, 0x890c, &(0x7f0000000400)={0x0, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={'rose', 0x0}, 0x4, 'syz0\x00', @null, 0x6, 0x5, [@null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0x3}, {}, {0x8, 0x10}}}, 0x24}}, 0x10) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) ioctl$SIOCAX25DELFWD(r0, 0x89eb, &(0x7f00000003c0)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x4, 0xc0000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x3, 0x3}, {0xa, 0xe}, {0x0, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xe7e7}, @TCA_FQ_PIE_TARGET={0x8, 0x3, 0x8}]}}]}, 0x44}}, 0x20004015) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.026657157s ago: executing program 1 (id=13023): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_buf(r1, 0x6, 0x1f, &(0x7f0000000480)="32a20ea0b46908ca88512558d50eb60f4214", 0x12) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0x10000000}, 0x1c) ioctl$TUNSETLINK(r0, 0x400454cd, 0x304) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000540)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000004c0), &(0x7f0000000500)}, 0x20) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='freezer.parent_freezing\x00', 0x275a, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{}, &(0x7f00000001c0), &(0x7f00000005c0)}, 0x20) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f00000008c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x3, [@typedef={0xd, 0x0, 0x0, 0x8, 0x1}, @ptr={0xa, 0x0, 0x0, 0x2, 0x4}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x5, 0x6}}]}, {0x0, [0x5f]}}, &(0x7f0000000180)=""/8, 0x4b, 0x8}, 0x28) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000a40)={0x1b, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x2}, 0x50) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b80)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x7f, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x3, 0x2}, 0x50) r6 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r6, 0xfffffffc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r7, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000480)="aa1953d3", 0x4}], 0x1, &(0x7f00000002c0)=ANY=[@ANYBLOB="14000000000000000100000001"], 0x18}, 0xc800) setsockopt$sock_int(r8, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r8, &(0x7f0000001140), 0x700, 0x2, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r9, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r6}, 0x20) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_buf(r10, 0x1, 0x1f, 0x0, &(0x7f0000001000)=0x1e) socket$nl_generic(0x10, 0x3, 0x10) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000300)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x8, '\x00', 0x0, r4, 0x2, 0x1, 0x3}, 0x50) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000c80)={0xffffffffffffffff, 0x1, 0x10}, 0xc) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000cc0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7f, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x1}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000dc0)=@bpf_lsm={0x1d, 0x2d, &(0x7f0000000e80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x2}, {}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0xa}, @map_val={0x18, 0xa, 0x2, 0x0, r3, 0x0, 0x0, 0x0, 0x3}, @exit, @btf_id={0x18, 0x9, 0x3, 0x0, 0x4}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xa}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r5}}, @btf_id={0x18, 0x9, 0x3, 0x0, 0x5}, @printk={@u, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x2}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000007c0)='GPL\x00', 0x4, 0x8c, &(0x7f0000000800)=""/140, 0x41000, 0x10, '\x00', 0x0, 0x1b, r4, 0x8, &(0x7f00000009c0)={0x6, 0x3}, 0x8, 0x10, &(0x7f0000000a00)={0x20000001, 0x7, 0x2, 0x9}, 0x10, 0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000d40)=[r2, 0xffffffffffffffff, r11, r9, r11, r12, r5], &(0x7f0000000d80)=[{0x0, 0x3, 0x2, 0x9}, {0x4, 0x3, 0x9, 0x7}, {0x8002, 0x4, 0xc, 0x3}, {0x1, 0x5, 0x4, 0xa}]}, 0x94) socket$kcm(0x11, 0x2, 0x0) 1.937551132s ago: executing program 2 (id=13024): sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000140)="839ac5ffe5b6db6aa9f5d026297c595fe32699d24e80ac0c2a53758e2eafff5c", 0x20}], 0x1, 0x0, 0x0, 0x8041}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000080)=@nameseq={0x1e, 0x1, 0x0, {0x43, 0x4, 0x1}}, 0x10) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) recvmsg$unix(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/246, 0xf6}], 0x1}, 0x20) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) r3 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f000000d379)={&(0x7f00000002c0)=ANY=[@ANYBLOB="180000001400010300000000000000001e"], 0x18}}, 0x0) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x2, 0x1}, 0x10) syz_emit_ethernet(0x11c, &(0x7f0000000680)=ANY=[@ANYBLOB="000000000000ffffffffffff8847000000004994010a0067000000069078ac1e0001ac14142f00892bb4e0000002e00000017f000001ac14b0fcffffffffac1414aa00000000ac1414bbac1414bbac1414aa071b9f7f000001e00000017f0000010000000000000400ac14140b861100000003000444200107635b21187f4434d393ac1414aa000080010000000000000009ac14144200aa00000009ffffffff000002000000000000000007940400006424f3617f000001000010000a010102fffffffd0a01010200000006ffffffff0000ac3d441c4d90000000000000c96d000000080000000900001000000000070000000000000000000000000000000400004e2400004e23000000010000000300000000000003fbfcdbc99c23c1df4125725ac07a80e43686b1"], 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000180)=@name={0x1e, 0x2, 0x1, {{0x0, 0x2}, 0x800000}}, 0x10) r5 = socket$tipc(0x1e, 0x5, 0x0) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000240)) bind$tipc(r5, &(0x7f00000000c0)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) bind$tipc(r4, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r6 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r6, &(0x7f0000000b80)=@nameseq={0x1e, 0x1, 0x3, {0x42}}, 0x10) r7 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r7, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) socket$tipc(0x1e, 0x5, 0x0) socket(0x2a, 0x2, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000280)={0x0}, 0x1, 0x0, 0x0, 0x20040845}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x10, 0xf}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x48048}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd29, 0x3, {0x0, 0x0, 0x0, 0x0, {0xfffa}, {}, {0x1c, 0x10}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0xfff1, 0xe}}, @TCA_FLOWER_FLAGS={0x8, 0x16, 0x12}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000004}, 0x24000000) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.873666603s ago: executing program 0 (id=13025): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x100000, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000010040b7080000000000007b8af8ff00000000b7080000000000107b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002002000b705000008000000850000003100000095"], &(0x7f00000001c0)='GPL\x00', 0x8, 0x0, 0x0, 0x41000, 0xa}, 0x94) 1.725121584s ago: executing program 0 (id=13027): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg(r0, &(0x7f0000000e80)=[{{0x0, 0x0, &(0x7f0000000d80)}}], 0x1, 0x20000) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000080)={'vxcan0\x00'}) r1 = socket$packet(0x11, 0x2, 0x300) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt(r2, 0x1, 0xd, &(0x7f0000000100)="0100ddff", 0x4) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r3, &(0x7f0000000280)="c84ec461f21713a5691dec3b2b77feafd5713e423109c64091276a1eadb75ca49687d464c12c2d604b62cb5d1440f49db2fd2544c50047a9a02414a978d5a8bfab62c7477cbf831d349bef53eafd74e4a367be009f8dc73a8e764f791f02d12828c0a2af29226828e53f3dee8f7eba2dcacac26d473c0c2db4d13b32957ea22b", 0x80, 0x0, &(0x7f0000000340)={0xa, 0x4e24, 0x3, @local, 0x3}, 0x1c) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f00000007c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x50, r5, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0x1c, 0xa9, @random="c3dc9cb3c5d9d648046b446f6b47cf56cd53ea75c6a6ad00"}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x84}, 0x40080) bpf$MAP_CREATE(0x0, 0x0, 0x50) close(0x4) unshare(0x6a040000) socket$inet6(0xa, 0x3, 0x7) r6 = socket$netlink(0x10, 0x3, 0x4) socket$inet6(0xa, 0x3, 0x7) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="580000001400192340834b80040d8c560aff820fffff5bab60070000002058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100030c100000000000224e0000", 0x58}], 0x1) sendmsg$RDMA_NLDEV_CMD_SET(r6, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0xa84}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, 0x1402, 0x622, 0x70bd29, 0x25dfdbfc, "", [@RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_DIM={0x5}, @RDMA_NLDEV_ATTR_DEV_NAME={0x9, 0x2, 'syz1\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x3}, @RDMA_NLDEV_NET_NS_FD={0x8, 0x44, r1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x48084}, 0x20000000) r7 = socket$netlink(0x10, 0x3, 0x12) sendmsg$nl_route(r7, 0x0, 0x20000004) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) 1.721313327s ago: executing program 4 (id=13028): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f00000001c0)='g', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}, 0x2}, 0x1c) shutdown(r0, 0x1) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000000)=ANY=[@ANYBLOB="c4000000190001000000000000000000fc0200000000000000000000000000012001000000000000000000000000000000000008000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000a900000000000000000000000000000005000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a00000000000000000000008040000200000000000008000000000003000000010200000000000c0008008a"], 0xc4}}, 0x0) setsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000440)={0x0, 0x9}, 0x8) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r2) ioctl$SIOCSIFHWADDR(r2, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1c, 0xe, &(0x7f0000000c00)=ANY=[@ANYRESDEC], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2000}, 0x94) 1.515382985s ago: executing program 2 (id=13030): socket$inet_icmp_raw(0x2, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4c00000021000d0028bd7002fddbdf250a101407040000151000000014000100fe880000000000000000000000000001140002002001000000000006000000000000000218000400c4000000"], 0x4c}}, 0x0) ioctl$XFS_IOC_COMMIT_RANGE(r0, 0x40585883, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB], 0x0, 0x5a}, 0x28) unshare(0x6a040000) ioctl$F2FS_IOC_ABORT_ATOMIC_WRITE(0xffffffffffffffff, 0xf505, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$NL80211_CMD_UPDATE_FT_IES(r2, &(0x7f0000000540)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000440)={0x98, r4, 0x2, 0x70bd2a, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_IE={0x25, 0x2a, [@prep={0x83, 0x1f, {{}, 0xa, 0xf, @device_a, 0xb8, @void, 0xdd9, 0x7, @device_a, 0x1}}]}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x3}, @NL80211_ATTR_MDID={0x6, 0xb1, 0x8afc}, @NL80211_ATTR_IE={0x49, 0x2a, [@measure_req={0x26, 0x1a, {0xb2, 0x2, 0x5, "502344bb4a3c092458fc460ed7052ee85aeefb112d7482"}}, @ssid={0x0, 0x1a, @random="88a9843852982115a058c9bf6cf7e42c63052a41350dd94e6911"}, @ext_channel_switch={0x3c, 0x4, {0x1, 0xff, 0xb9, 0x34}}, @ssid={0x0, 0x5, @random="f6948163a0"}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x800}, 0x20008080) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01002dbd7000000000003900000008000300", @ANYRES32=r6, @ANYBLOB="1c005a80180001000300090006000500"], 0x38}, 0x1, 0x0, 0x0, 0x40}, 0x4000040) sendmsg$NL80211_CMD_GET_SURVEY(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="001eda0500000000000000e7d2c8fd531b87aef332f53cfb2fd50f83debd3cfc9ed922aa88a7c4", @ANYRES32=r6, @ANYBLOB="0c0099000900000062000000"], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x40088d0) r7 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r7, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r7, 0x29, 0x2, &(0x7f0000004240)=0xc3, 0x4) recvmmsg(r7, &(0x7f0000002300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=""/31, 0x1f}, 0x4}], 0x1, 0x2, 0x0) setsockopt$inet6_int(r7, 0x29, 0x8, &(0x7f0000000000)=0x7f, 0x4) sendto$inet6(r7, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) r8 = socket(0x8, 0x3, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r8, 0x8934, &(0x7f0000000040)={'dummy0\x00', 0x1ff}) ioctl$sock_netrom_SIOCADDRT(r8, 0x6180, 0x0) close(0x4) r9 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x1}, 0x10) 1.479531543s ago: executing program 4 (id=13031): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r3, 0x0, 0xf3a, 0x0) close(r2) write(r0, 0x0, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) setsockopt$bt_BT_SECURITY(r4, 0x112, 0x4, 0x0, 0x0) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x100000d, 0x6031, 0xffffffffffffffff, 0xa1b92000) r5 = socket$rds(0x15, 0x5, 0x0) bind$rds(r5, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sendmsg$rds(r5, &(0x7f0000000080)={&(0x7f0000000040)={0x2, 0x4, @local}, 0x10, 0x0, 0x0, &(0x7f0000000240)=[@rdma_args={0x48, 0x114, 0x1, {{0x5, 0x8}, {0x0}, &(0x7f0000000440)=[{&(0x7f0000000880)=""/4096, 0x1000}], 0x1}}], 0x48}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0xc0b0) 1.467054373s ago: executing program 1 (id=13032): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x78}, 0x1, 0x0, 0x0, 0x840}, 0x0) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x9c, 0x2, 0x6, 0x101, 0x0, 0x0, {0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0x54, 0x7, 0x0, 0x1, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x5}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1}, @IPSET_ATTR_CADT_FLAGS={0x8}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x4}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_MARK={0x8}, @IPSET_ATTR_CIDR={0x5, 0x3, 0xa0}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x9c}, 0x1, 0x0, 0x0, 0x44048040}, 0x0) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000280)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x300, 0x14}, @ipv4=@tcp={{0x6, 0x4, 0x0, 0x3c, 0x2c, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @broadcast, {[@timestamp={0x44, 0x4, 0xf4, 0x0, 0x1}]}}, {{0xa200, 0x22eb, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}, 0x3a) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x78}, 0x1, 0x0, 0x0, 0x840}, 0x0) (async) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000000c0)={0x9c, 0x2, 0x6, 0x101, 0x0, 0x0, {0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0x54, 0x7, 0x0, 0x1, [@IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x5}, @IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x1, 0x0, 0x1}, @IPSET_ATTR_CADT_FLAGS={0x8}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x4}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e21}, @IPSET_ATTR_MARK={0x8}, @IPSET_ATTR_CIDR={0x5, 0x3, 0xa0}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x9c}, 0x1, 0x0, 0x0, 0x44048040}, 0x0) (async) socket$kcm(0x2, 0x3, 0x2) (async) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) (async) write$tun(r0, &(0x7f0000000280)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x300, 0x14}, @ipv4=@tcp={{0x6, 0x4, 0x0, 0x3c, 0x2c, 0x0, 0x0, 0x0, 0x2f, 0x0, @empty, @broadcast, {[@timestamp={0x44, 0x4, 0xf4, 0x0, 0x1}]}}, {{0xa200, 0x22eb, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}, 0x3a) (async) 1.061507883s ago: executing program 1 (id=13034): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4040}, 0x0) writev(0xffffffffffffffff, &(0x7f0000001540)=[{&(0x7f00000001c0)="da", 0x1}], 0x1) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000511000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0800034000000004400000000b0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d10300002c0000000e0a010200000000000000000a0000000900010073797a310000000009000200"], 0xd8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 931.913256ms ago: executing program 1 (id=13035): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket(0x10, 0x803, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000240)={'ip6gre0\x00', &(0x7f00000001c0)={'ip6_vti0\x00', 0x0, 0x2f, 0x4, 0xff, 0x10001, 0x4, @mcast1, @private1, 0x700, 0x38, 0x5, 0x80000000}}) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@newchain={0x34, 0x64, 0x20, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x6, 0x7}, {0x7, 0x9}, {0xfff1, 0xd}}, [@TCA_CHAIN={0x8, 0xb, 0x3}, @TCA_CHAIN={0x8, 0xb, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x20008000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) listen(r4, 0xfff) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r5, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, 0x1405, 0x1, 0x70bd29, 0x25dfdbfb, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x0) accept4(r4, 0x0, 0x0, 0x800) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1, 0xfffffffd}, 0x28) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r7 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000040)={0x10000802, 0x80, 0x0, 0x40000}, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000005200010004000000000000001c0000001400", @ANYRES16=r6], 0x28}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x24, 0x2c, 0x1, 0x70bd23, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x6, 0x4}, {0x0, 0xf}, {0xf, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async) socket(0x10, 0x803, 0x0) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000240)={'ip6gre0\x00', &(0x7f00000001c0)={'ip6_vti0\x00', 0x0, 0x2f, 0x4, 0xff, 0x10001, 0x4, @mcast1, @private1, 0x700, 0x38, 0x5, 0x80000000}}) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@newchain={0x34, 0x64, 0x20, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x6, 0x7}, {0x7, 0x9}, {0xfff1, 0xd}}, [@TCA_CHAIN={0x8, 0xb, 0x3}, @TCA_CHAIN={0x8, 0xb, 0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x20008000) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) socket$inet6_sctp(0xa, 0x5, 0x84) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) listen(r4, 0xfff) (async) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r5, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x20, 0x1405, 0x1, 0x70bd29, 0x25dfdbfb, "", [{{0x8, 0x1, 0x1}, {0x8, 0x3, 0x3}}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) accept4(r4, 0x0, 0x0, 0x800) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f00000005c0)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x1, 0xfffffffd}, 0x28) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) (async) socket(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000040)={0x10000802, 0x80, 0x0, 0x40000}, 0x10) (async) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000005200010004000000000000001c0000001400", @ANYRES16=r6], 0x28}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x24, 0x2c, 0x1, 0x70bd23, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x6, 0x4}, {0x0, 0xf}, {0xf, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) (async) 811.971012ms ago: executing program 4 (id=13036): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-blowfish-asm\x00'}, 0x58) accept$alg(r0, 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) socket$inet_icmp_raw(0x2, 0x3, 0x1) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') unshare(0x6a040000) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x400000000010, 0x3, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x2c, &(0x7f0000001080)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in6={0xa, 0x4e24, 0x0, @empty, 0x4}]}, &(0x7f0000000080)=0x10) socket$alg(0x26, 0x5, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x800, 0x0) close(r4) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) sendto$packet(r2, &(0x7f00000002c0)="05031400d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r7, 0x1, 0x0, 0x6, @multicast}, 0x14) 749.009439ms ago: executing program 3 (id=13037): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000300)="8b", 0x1, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1={0xfc, 0x1, '\x00', 0x4}}, 0x1c) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="12000000070000000400000002"], 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r2, &(0x7f00000000c0)="a931", &(0x7f0000000100)=@tcp6=r1, 0x1}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r2}, &(0x7f0000000040), &(0x7f0000000140)=r1}, 0x20) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002080)=@newtaction={0xe68, 0x30, 0x25, 0x0, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0xb, 0x95a8, 0x5, 0x101, 0x2}, 0x0, 0x1}, [{0x7, 0x6, 0x18, 0x8, 0x80000001, 0x4}, {0x35, 0xbd6, 0x7, 0x7, 0xc294, 0x9}, {0x800, 0x6, 0x8001, 0x1, 0x0, 0x4}, {0x5, 0x1, 0xe00, 0xd32, 0xfff}, {0x2, 0x200, 0x7, 0xd64, 0x5, 0xc}, {0x3, 0x7ff, 0xfff, 0xb, 0xfff, 0x5}, {0x2, 0x4, 0x0, 0x3, 0x3, 0x10001}, {0xfff, 0x5, 0x7f, 0x2, 0x0, 0x8}, {0x111fdbe2, 0x3, 0x8, 0x5, 0x2000000, 0x4}, {0x9, 0x7, 0x5, 0x466, 0xfffffc01, 0x2}, {0x1000, 0x5, 0xed87, 0xd2a, 0x0, 0x1}, {0x8, 0x5, 0x8000, 0x10, 0x6, 0x7c2}, {0x2, 0x7, 0x6, 0x7, 0xc, 0x8}, {0x2, 0x240, 0x7, 0xc, 0xfffffffd, 0x7}, {0x9, 0x6, 0x4, 0x101, 0xffff8001, 0x200}, {0x1d2cbf69, 0xfffffbff, 0x2, 0x2, 0xf, 0x3}, {0x2ce, 0x7, 0x1, 0x3e18, 0x8, 0x4}, {0xfc5, 0xae7, 0x80000000, 0x1ff, 0x8b, 0xfffffffd}, {0x3, 0x8, 0x2, 0xfffffff8, 0x3, 0xf2e}, {0x5, 0x5, 0xffffffff, 0x7, 0x1, 0x3}, {0x3, 0x7d6, 0xe4, 0x5, 0x2, 0x10001}, {0x9fa3, 0x1fc, 0x0, 0x9, 0x0, 0xc29}, {0x7, 0x5, 0x6, 0x80000001, 0x0, 0x1}, {0x8, 0x0, 0xfe000000, 0xa, 0x3, 0x161}, {0x9, 0x8, 0x4, 0x3, 0x10001, 0x25075c96}, {0x101, 0x8000, 0xe7, 0x200, 0xf, 0x3}, {0x15000000, 0x2d41, 0x6, 0x8, 0x6, 0x2e}, {0x6, 0x401, 0x1, 0x28a, 0xf5c, 0xe2a}, {0x0, 0x3ff, 0x0, 0x5ce, 0x42, 0x3}, {0x0, 0x4, 0x6cce, 0x2}, {0x3, 0x1, 0x3, 0x0, 0xa1, 0x2}, {0x7, 0x9, 0x8, 0x3045, 0x2, 0x1}, {0x7, 0x4, 0x6, 0x510cc509, 0x6, 0x6}, {0x89f9, 0xe5ff, 0x1, 0x9, 0x2f37}, {0x9c, 0x10000, 0x8, 0x9717, 0x9, 0x8001}, {0xfffffffe, 0xfff, 0x5, 0x8001, 0x5, 0x3}, {0x80, 0x3, 0x80000001, 0x80000001, 0x8, 0x81}, {0x6, 0x9, 0x4, 0x7, 0x0, 0x1}, {0x58d47774, 0x5dba, 0x1, 0x2, 0x3, 0x9}, {0x1, 0x3ff, 0xd, 0x7, 0x80000000, 0x3d}, {0x9, 0x0, 0x200, 0xaeb, 0x1, 0x28ec}, {0x7fff, 0x4, 0x6, 0x80, 0x8, 0x5}, {0x100, 0x3, 0x9, 0x0, 0x6, 0xc639}, {0xc, 0x9, 0x6, 0x100, 0x400, 0x1ff}, {0x3, 0x9, 0x1, 0x3, 0x9, 0x6}, {0x17, 0x200, 0x5, 0x1, 0x4, 0x9}, {0x5, 0x8, 0x7, 0xca, 0x3, 0xfff}, {0x0, 0xfffffff8, 0x9, 0x9, 0x6, 0x80}, {0x10100000, 0x0, 0x7, 0x80000000, 0x5, 0x51}, {0x6, 0x5, 0x8, 0x3ea7, 0x4, 0x9e4}, {0x7fffffff, 0xc, 0x3, 0x7, 0x7f, 0x7}, {0x5, 0x5b07f77b, 0x7, 0xd4, 0xd96, 0x4b3}, {0x1, 0x0, 0xda9b, 0x9, 0x4, 0x2e1}, {0x4, 0x1, 0x9, 0x7, 0xd, 0x9}, {0x8, 0x8, 0x4, 0x6726953b, 0x34, 0x8}, {0xc45, 0x3, 0x401, 0x7fff, 0x2}, {0x40000, 0x0, 0x80, 0xd7b, 0x7, 0x100000}, {0x6, 0x6, 0x4, 0xf, 0xfffffffa, 0x3}, {0xc, 0x8, 0x7ff, 0x1, 0x5, 0xfffffff8}, {0x5, 0x68f, 0x2, 0x5, 0x400, 0x100}, {0x1, 0xa, 0xc, 0x5, 0x0, 0x7fff}, {0xfffffff5, 0x1, 0x5, 0x0, 0x4000, 0x602b}, {0x8, 0x1, 0x1000, 0xf4, 0xffffff01, 0x2}, {0x8, 0x1ff, 0x81, 0x4, 0x6, 0x8000}, {0x6, 0x80000001, 0x3, 0x240, 0x6, 0x8}, {0x7, 0x3, 0x9, 0x4, 0x4, 0xcf88}, {0x6c7, 0x4, 0x9c, 0x18, 0x0, 0xc}, {0x2, 0x9, 0x200, 0x7, 0x4, 0x7}, {0x800, 0xaf7b, 0x5, 0x80, 0x3, 0x2}, {0x5, 0xfffffbff, 0x9, 0x4, 0x5, 0x80000001}, {0x7, 0x9, 0x81, 0x2fd, 0x40, 0x2}, {0x30, 0x8, 0x81, 0x80000001, 0xa, 0xcc8}, {0x8, 0xa, 0x4, 0x2, 0x9d5, 0x7}, {0x539, 0x2, 0xb673, 0x4, 0x80000000, 0x1000}, {0x2, 0x3, 0x8000, 0x6, 0x7, 0x7}, {0x2, 0x9, 0x6, 0x7, 0x187, 0x800}, {0x200, 0xad1, 0x0, 0x8a, 0x5, 0xffff}, {0x4, 0xf, 0x8, 0x9, 0x5, 0x6}, {0x8, 0x10, 0x9, 0x1, 0x3, 0x4}, {0xfffff800, 0xffffff7e, 0x1, 0x10001, 0x8, 0x7}, {0x7ff, 0x9, 0x0, 0xd, 0x7, 0xfffff54c}, {0x6087, 0x2, 0x1, 0x0, 0x2, 0x1}, {0x9, 0x8, 0x7d, 0x6970bd98, 0x63c1, 0x1}, {0x9, 0x13e39b74, 0x8, 0x7, 0x400}, {0x40, 0x6, 0x81, 0x93, 0x6, 0x3}, {0x9, 0x7, 0xffff622e, 0x87, 0x1000, 0xfffffffb}, {0x8, 0x8e8, 0x7, 0xffff0001, 0x101, 0x3}, {0x7f, 0x2, 0x5, 0x3, 0x5, 0x6}, {0xfffffffd, 0x3, 0x3, 0xff, 0x3, 0xffff}, {0xffff, 0x1, 0x1, 0x7, 0x5, 0x5}, {0x4, 0x4, 0x0, 0x2, 0x0, 0xa}, {0x9, 0x2, 0x1, 0x81, 0x2, 0x3}, {0x654c5d3b, 0xffffffff, 0xef, 0x4, 0xdaf6, 0xc}, {0x8, 0x5, 0x2, 0x7ff, 0xffffff51, 0x3}, {0x7, 0x200, 0xa34, 0x1, 0x6, 0xffffff03}, {0x1, 0x0, 0x9, 0x5, 0x5, 0xb08}, {0x6, 0x890, 0x588d, 0x7, 0x1, 0x8}, {0xf, 0x9, 0x8, 0x2, 0x2, 0xf}, {0x4, 0x7, 0x7, 0x5, 0x4, 0x1}, {0x8, 0x44a, 0x7, 0x80, 0x6, 0x10001}, {0x800, 0xd2, 0x8, 0x0, 0x4, 0x5}, {0x6, 0x9, 0x23f, 0x9, 0x94, 0xffff}, {0xfffffffb, 0x1dd, 0x0, 0x6, 0xb5e, 0x800}, {0xb, 0xd851, 0xfff, 0xc9, 0xec, 0x5}, {0x7a4316df, 0x3ff, 0x3, 0x20c4, 0x0, 0x1000}, {0x8, 0x464, 0x7fff, 0x8, 0x1, 0x9}, {0x10, 0xa, 0x9, 0x6, 0x57ca, 0xfffff000}, {0x8, 0xee, 0x7, 0xffffff0d, 0x4, 0x3}, {0x4c0, 0x7, 0x2, 0x0, 0x8, 0x100}, {0x1, 0x6, 0x0, 0x6, 0x80000000, 0x4}, {0x0, 0x8e80, 0x65, 0x6, 0xffffffff, 0x6}, {0x3, 0x1, 0x1, 0x0, 0x8, 0xa}, {0x8001, 0x100, 0x1, 0x1, 0x6, 0x3b}, {0xfffff7e5, 0xff, 0x10, 0x0, 0xa, 0x6}, {0x9, 0x75, 0x9, 0xef, 0xff, 0x89}, {0x4, 0x8, 0x7, 0x5, 0x8, 0x3f}, {0xf083, 0x74406f13, 0x80000001, 0x1ff, 0x9, 0x9}, {0xfffffffb, 0x10001, 0x1, 0xfffffffe, 0x1000}, {0x8001, 0x4c6a, 0x8, 0x25e9, 0x90b, 0x5}, {0x7, 0xa, 0x4, 0x1000, 0xfff, 0x7}, {0x7fb, 0xd, 0x8, 0x78, 0x7, 0x9}, {0x1, 0xfffffffe, 0x800, 0x1, 0x1, 0x4}, {0x80000000, 0x3, 0xa31f6f1f, 0x1, 0x5, 0x8000}, {0x7, 0x7, 0x4, 0x8, 0x10001}, {0xfffffff7, 0x0, 0x40, 0x6, 0x5, 0x5}, {0x5, 0xfff, 0xe7da, 0x2, 0x9, 0x7}, {0x6, 0x0, 0x80000001, 0x5, 0x4, 0x4}, {0xfffffffb, 0x1c000000, 0x0, 0x8001, 0x8, 0x9}], [{0x5}, {}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x1}, {0x1}, {0x2}, {0x1}, {0x0, 0x1}, {0x2}, {0x0, 0x1}, {0x5, 0x1}, {}, {0x5}, {0x3, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x2, 0x1}, {0x2}, {0x2, 0x1}, {}, {0x1, 0x1}, {0x5aba00c555baa7ef, 0x1}, {0x1, 0x2}, {0x5}, {0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x4}, {0x1, 0x1}, {0x0, 0x1}, {0xd}, {0x5, 0x1}, {0x1}, {0x3}, {0x5}, {0x1, 0x1}, {0x4, 0x1}, {0x2}, {0x4, 0x1}, {0x5}, {0x2}, {}, {0x0, 0x1}, {0x1, 0x1}, {0x7, 0x1}, {0x3, 0x1}, {0x2}, {0x3, 0x1}, {0x1}, {0x5, 0x1}, {0x5, 0x1}, {0x1}, {0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x3, 0x1}, {}, {0x0, 0x1}, {0x4, 0x1}, {0x4}, {0x5}, {0x3, 0x1}, {0x1}, {0x1}, {0x3, 0x1}, {}, {0x7}, {0x3, 0x1}, {0x2, 0x1}, {0x1}, {0x5, 0x1}, {0x2}, {0x5, 0x1}, {0x4}, {0x1}, {0x4}, {0x5, 0x1}, {0x1, 0x181885f84a3b5ba1}, {0x3, 0x1}, {0x1}, {0x1}, {}, {}, {0x5, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x5}, {0x3, 0x1}, {0x3}, {0x5}, {0x1b187e6351498f25}, {0x0, 0x1}, {0x4, 0x1}, {0x970f042e95146b82, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x3}, {0x2}, {0x3, 0x1}, {0x1}, {0x3}, {0x5, 0x1}, {0x5}, {0x2, 0x1}, {0x5}, {0x3}, {0x2}, {0x5}, {0x0, 0x1}, {0x1}, {0x2, 0x1}, {0x4}, {0x1}, {0x7}, {0x1, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000780)=ANY=[@ANYBLOB="3a1000000000000004010704691dc44b38077005d7453449d3e9461d443b5640feffd9ea098eae045c44627e5ed0056eb8d89cd50e5781ef497c51609d70362e0e57f259f36967a84c8851e87b3775a9a4f28d7ac376aaf380dc5a9e98067d93ccd7f38bbcc22c9f4145c00fb4c1040103c910fc0200002a04000000000000000000000062a1808af9c2e1488b43fd6b4af987ebf43ae0cc424cde87385c6c00"/171], 0x90) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x81, &(0x7f00000020c0)=""/4130, &(0x7f0000000000)=0x1022) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="30000000100001"], 0x30}, 0x1, 0x0, 0x0, 0x46801}, 0x4000000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x5}, 0x10) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000001a0001ff80000000000000000a"], 0x38}}, 0x0) sendmsg$DEVLINK_CMD_PORT_GET(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000640)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01000010000000000000490000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008007300000000000e0001006e657464657673696d0000000f0002006e65746d657673696d3000000800030002000010713947231f334d1b6f1c083fabadb614befda2964038768d56c278fb166ec0d3f40757165d007e80b9f2f7976cc7e15595455e072be9a6f15888783e1d1347b172049b29100c12c79029e17122588f2383d84bfe8b1103aad7186ef799acf920386c350c149d6694a7834ea2540a63b820c0f8046d83441621098c1f5e9aae49577076df6947bae6ced4c566baa1f798ae8298e44c03264020a5608f104d3c379e23970b466b9f115294c73f3f424e60e27978571c3f556772db2b6110e108067a01d57d5c94b8d13e138a"], 0x64}}, 0x0) r7 = socket$can_raw(0x1d, 0x3, 0x1) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r11 = getuid() setsockopt$inet_IP_IPSEC_POLICY(r8, 0x0, 0x10, &(0x7f0000000340)={{{@in=@dev={0xac, 0x14, 0x14, 0x24}, @in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x4e23, 0x80, 0x4e22, 0xe, 0xa, 0x30, 0x20, 0x3b, r10, r11}, {0x5c, 0x1ff, 0x1, 0x1, 0xa, 0x4, 0xff, 0x3}, {0xffffffffffffffff, 0x2, 0x101, 0x9}, 0x0, 0x6e6bb3, 0x2, 0x0, 0x0, 0x3}, {{@in6=@loopback, 0x4d6, 0x6c}, 0xa, @in=@private=0xa010101, 0x3507, 0x4, 0x1, 0x9, 0x3, 0x1, 0x3}}, 0xe8) bind$can_raw(r7, &(0x7f0000000040)={0x1d, r9}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1f, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="180000fcffffffffffffff000827000018110004", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000030000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000300000085000000a60000009500000000000000"], &(0x7f00000005c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x7b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 513.684066ms ago: executing program 1 (id=13038): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x100000, '\x00', 0x0, 0x0}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000010040b7080000000000007b8af8ff00000000b7080000000000107b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002003000b705000008000000850000003100000095"], &(0x7f00000001c0)='GPL\x00', 0x8, 0x0, 0x0, 0x41000, 0xa}, 0x94) 513.090169ms ago: executing program 3 (id=13039): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) pread64(r2, 0x0, 0x0, 0x1b) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newlink={0x44, 0x10, 0x401, 0x0, 0xfffffffe, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_AD_SELECT={0x5}, @IFLA_BOND_AD_ACTOR_SYS_PRIO={0x6, 0x18, 0x696}]}}}]}, 0x44}}, 0x40000c0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x5c, 0x10, 0x19, 0x70bd2c, 0x255fdbfa, {0x0, 0x0, 0x0, 0x0, 0x40d87, 0x79269}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_DPORT={0x6, 0x11, 0x4e1c}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x5}]}}}, @IFLA_IFNAME={0x14, 0x3, 'ip6gretap0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0xcc93f1266b77d0bf}, 0x8040) 424.535436ms ago: executing program 1 (id=13040): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) sendto$packet(r0, 0x0, 0x0, 0x40, &(0x7f00000000c0)={0x11, 0x18, 0x0, 0x1, 0x9, 0x6, @broadcast}, 0x14) r1 = socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x50, 0xffffffffffffffff, 0x217eb000) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000000540)=0x1, 0x4) connect$inet(r2, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r3, &(0x7f0000007340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/61, 0x3d}, 0xfffffffe}], 0x1, 0x0, 0x0) r4 = openat$ppp(0xffffffffffffff9c, 0x0, 0x705000, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000001c0)) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(0x0, r6) setsockopt$inet_mreqsrc(r6, 0x0, 0x27, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000080)=0x8, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)=ANY=[@ANYBLOB="1c0000000306010200000000000000000700000a0500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40814) sendmsg$IPCTNL_MSG_CT_GET_CTRZERO(0xffffffffffffffff, &(0x7f0000005f80)={0x0, 0x0, &(0x7f0000005f40)={&(0x7f0000000380)=ANY=[@ANYRES64=r1, @ANYRES64=r4, @ANYRESDEC=0x0, @ANYRES16=r5], 0x60}, 0x1, 0x0, 0x0, 0x8000}, 0x20000040) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000001c0)=0xffffffffffffffff, 0x4) sendmmsg$inet(r2, &(0x7f00000060c0)=[{{0x0, 0x0, &(0x7f0000000a40)=[{&(0x7f0000000140)='@', 0x1}, {&(0x7f00000007c0)='y', 0x1}, {&(0x7f0000000340)="b9", 0x1}, {&(0x7f0000000940)="99", 0x1}, {&(0x7f00000008c0)='z', 0x1}, {&(0x7f00000009c0)='~', 0x1}, {&(0x7f0000000a00)='x', 0x1}, {&(0x7f0000000440)="06", 0x1}, {&(0x7f0000000580)='k', 0xffffffc6}, {&(0x7f00000006c0)="1d", 0x1}, {&(0x7f0000000800)='a', 0x1}, {&(0x7f0000000280)='$', 0x1}], 0xc}}, {{0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f0000001040)="fc"}, {&(0x7f0000001080)="c9", 0x1}, {&(0x7f0000002180)='-', 0x1}, {&(0x7f0000002240)='R', 0x1}, {&(0x7f00000033c0)="c4", 0x1}], 0x5}}], 0x2, 0x4000000) setsockopt$sock_int(r2, 0x1, 0x20, &(0x7f0000000000)=0x7fffffff, 0x4) close(0x4) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="09000000040000000400000002"], 0x50) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r9}, 0xc) accept$alg(0xffffffffffffffff, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000000000000000000000000000000000000000000613480c673ddb066dce4fb053fb523272a189745efebbebf117e90eafc13f4ec3a075a9b03411acee32b71ff646e3164234c619d8d36e848714bd18686754186cbcc5bdd5ecb1e853a960105c9cf060000000000000042d6140c2ed5428948cba471d1313c024f8e10516a4db697f1a116de185880ad18e09316e3bb1a393ef89fd871f67153c8394a547a0d7938908c66c0210051006f6a9e623a5612308b1c4b307d0dbb0d6af550da2a862453b1d229f3eb8e64da61e7e12a0202f4818a5d0c7c58de3d47079a567bcbc7b4dd47b7f2d251cca49ddb6a8f5f1b"], 0x48) 289.067252ms ago: executing program 3 (id=13041): r0 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000180)={0x28, 0x0, 0xffff96cd, @my=0x1}, 0x10, 0x80800) r1 = socket$inet(0x2, 0x2, 0x1) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f0000000200)={"f99df1e93487eb511de8c01cc567375d", 0x0, 0x0, {0x7fff, 0x81}, {0x5, 0xff}, 0x3, [0xa, 0x2, 0x0, 0x8, 0x7da1, 0xfffffffffffffffe, 0x3, 0x1, 0x6, 0x1, 0x100000001, 0xfffffffffffffff4, 0x7, 0x1, 0x7, 0x100000001]}) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r0, 0x5000943f, &(0x7f0000000300)={{r1}, r2, 0x2, @unused=[0x8000, 0x10001, 0x5, 0x5cd8ec91], @subvolid=0xfffffffffffffffb}) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)={0x118, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x106, 0xf2, 0x0, 0x1, [@typed={0xc, 0x18, 0x0, 0x0, @u64=0xfac08}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@ipv4={'\x00', '\xff\xff', @multicast2}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29", @typed={0x8, 0xe9, 0x0, 0x0, @ipv4=@remote}]}]}, 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) 133.423271ms ago: executing program 3 (id=13042): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=@newlink={0x44, 0x10, 0x401, 0xfffffffc, 0x259fdbfc, {0x0, 0x0, 0x0, 0x0, 0x1533}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r1}]}, 0x44}, 0x1, 0x0, 0x0, 0x24000891}, 0x0) 36.596494ms ago: executing program 3 (id=13043): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@empty, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x2, 0xc, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@multicast1, 0xfffffffc, 0x3c}, 0x2, @in=@local, 0x6, 0x4, 0x3, 0x0, 0x401}]}]}, 0xfc}}, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0x1, 0x0, 0x0) r2 = socket$inet6(0xa, 0x800000000000002, 0x0) sendmmsg$inet6(r2, &(0x7f0000001340)=[{{&(0x7f0000000140)={0xa, 0x4e21, 0x4, @dev={0xfe, 0x80, '\x00', 0x29}}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}}], 0x1, 0x0) 0s ago: executing program 3 (id=13044): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) (async, rerun: 64) r1 = socket$kcm(0x10, 0x2, 0x0) (rerun: 64) sendmsg$kcm(r1, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe55a10a0015400600142603600e1208000b0000000401a8001600a400014009000200036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x2}, 0x50) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000010400)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast6-avx\x00'}, 0x58) (async, rerun: 64) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.swap.current\x00', 0x275a, 0x0) (rerun: 64) write$cgroup_int(r4, &(0x7f0000000080)=0x7fffffffffffffff, 0x12) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4000003, 0x13, r4, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r5 = accept4(r3, 0x0, 0x0, 0x80800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}], 0x1}, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000000)={'sit0\x00', &(0x7f0000000300)={'gre0\x00', 0x0, 0x40, 0x80, 0x5, 0x2, {{0x2b, 0x4, 0x1, 0x3d, 0xac, 0x68, 0x0, 0xca, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@generic={0x94, 0xa, "db7cd48eb1e6a78b"}, @lsrr={0x83, 0x23, 0x40, [@remote, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote, @loopback, @broadcast, @multicast1, @remote]}, @cipso={0x86, 0x27, 0x2, [{0x2, 0x4, "11a0"}, {0x2, 0x8, "8c3abbd4abbe"}, {0x2, 0xc, "a647aa6276edabb89a11"}, {0x6, 0x6, "1da1a40a"}, {0x0, 0x3, "f3"}]}, @end, @ssrr={0x89, 0xf, 0xc9, [@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @remote]}, @timestamp_addr={0x44, 0x2c, 0x4d, 0x1, 0x5, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x200}, {@rand_addr=0x64010102, 0x8}, {@private=0xa010101, 0xcd2}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x7}, {@multicast2, 0x9}]}, @generic={0x44, 0x6, "ad032efd"}]}}}}}) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$MRT_DEL_VIF(r5, 0x0, 0xcb, &(0x7f0000000400)={0xffffffffffffffff, 0x1, 0x9, 0x8, @vifc_lcl_addr=@loopback, @multicast2}, 0x10) (async) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x90, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x64, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x4f}, @NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x38}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x1}]}}}, {0x2c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x29}, @NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0xe}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xb8}, 0x1, 0x0, 0x0, 0x40}, 0x24000800) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000040)={0x2, 0x4, 0x8, 0x1, 0x80, r2, 0x3, '\x00', r7, 0xffffffffffffffff, 0x2, 0x0, 0x3}, 0x50) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r6, 0x0, 0xf89, 0x0, &(0x7f0000000540)="39bdeac368e4c4e87a7bfd439b9f4793bcb64f217eb9435d6b4e435770512f9a534ba988586c565c33b12ddb4c357728b463ae54ffa88f65c5bc96051eb279632efcc45cc6c9e2dc521020f9357b64ce3879ce30e3", 0x0, 0x0, 0x0, 0x0, 0x62, 0x0, 0x0, 0x6, 0x9, 0xffffffff}, 0x28) kernel console output (not intermixed with test programs): m2 netdevsim2: renamed from eth2 [ 1217.666606][T14174] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1217.768842][T14334] wg1 speed is unknown, defaulting to 1000 [ 1217.919673][T14349] dvmrp1: entered allmulticast mode [ 1217.974643][ T5836] Bluetooth: hci1: command tx timeout [ 1218.066194][T14174] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1218.127914][T14355] netlink: 8 bytes leftover after parsing attributes in process `syz.1.11780'. [ 1218.193261][T14359] xt_SECMARK: mode already set to 1 cannot mix with rules for mode 3 [ 1218.251586][T14174] 8021q: adding VLAN 0 to HW filter on device team0 [ 1218.268548][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 1218.275767][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1218.345934][T14366] netlink: 'syz.3.11781': attribute type 1 has an invalid length. [ 1218.372615][T14366] 8021q: adding VLAN 0 to HW filter on device bond6 [ 1218.391555][T23725] bridge0: port 2(bridge_slave_1) entered blocking state [ 1218.398709][T23725] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1218.435237][T14365] syzkaller0: entered promiscuous mode [ 1218.446085][T14365] syzkaller0: entered allmulticast mode [ 1218.469623][T14365] netlink: 16 bytes leftover after parsing attributes in process `syz.4.11783'. [ 1218.479499][T14365] netlink: 40 bytes leftover after parsing attributes in process `syz.4.11783'. [ 1218.565070][T14372] netlink: ct family unspecified [ 1218.570195][T14372] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1218.787915][T14361] bond6: (slave veth11): Enslaving as an active interface with a down link [ 1218.807880][T14366] lo: Caught tx_queue_len zero misconfig [ 1218.868646][T14371] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1218.876336][T14371] bond6: (slave batadv1): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 1218.905774][T14377] netlink: 'syz.3.11781': attribute type 6 has an invalid length. [ 1219.581185][T14401] lo speed is unknown, defaulting to 1000 [ 1219.597600][T14174] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1219.607490][T14401] wg1 speed is unknown, defaulting to 1000 [ 1219.731663][T14174] veth0_vlan: entered promiscuous mode [ 1219.771914][T14174] veth1_vlan: entered promiscuous mode [ 1219.842107][T14174] veth0_macvtap: entered promiscuous mode [ 1219.870903][T14174] veth1_macvtap: entered promiscuous mode [ 1220.000323][T14174] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1220.012489][T14174] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1220.054226][ T5836] Bluetooth: hci1: command tx timeout [ 1220.079126][ T319] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1220.102691][ T319] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1220.144741][T14424] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.11798'. [ 1220.154804][T14424] openvswitch: netlink: Key type 769 is out of range max 32 [ 1220.181827][ T319] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1220.192290][ T319] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1220.218451][T14428] netlink: 12 bytes leftover after parsing attributes in process `syz.4.11799'. [ 1220.219782][T14426] wg1: Master is either lo or non-ether device [ 1220.558348][T23724] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1220.578628][T23724] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1220.667711][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1220.680984][T14442] netlink: 'syz.4.11804': attribute type 1 has an invalid length. [ 1220.723168][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1220.811082][T14445] bond7: (slave vxcan1): The slave device specified does not support setting the MAC address [ 1220.852539][T14445] bond7: (slave vxcan1): Error -95 calling set_mac_address [ 1220.989552][T14442] bond7: (slave gretap2): making interface the new active one [ 1221.010668][T14442] bond7: (slave gretap2): Enslaving as an active interface with an up link [ 1221.024417][T14458] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11806'. [ 1221.047605][T14460] macvlan2: entered promiscuous mode [ 1221.053130][T14460] macvlan2: entered allmulticast mode [ 1221.063419][T14460] bond7: entered promiscuous mode [ 1221.069743][T14460] gretap2: entered promiscuous mode [ 1221.077449][T14460] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1221.090199][T14460] bond7: (slave macvlan2): the slave hw address is in use by the bond; giving it the hw address of gretap2 [ 1221.108729][T14460] bond7: left promiscuous mode [ 1221.116219][T14460] gretap2: left promiscuous mode [ 1221.294007][T14476] syzkaller1: entered promiscuous mode [ 1221.299611][T14476] syzkaller1: entered allmulticast mode [ 1221.312696][T14479] netlink: 24 bytes leftover after parsing attributes in process `syz.4.11813'. [ 1221.536523][T14490] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1221.582482][T14490] tipc: Enabling of bearer rejected, already enabled [ 1221.617446][T14492] netlink: 104 bytes leftover after parsing attributes in process `syz.4.11818'. [ 1221.814511][T14485] netlink: 176 bytes leftover after parsing attributes in process `syz.0.11816'. [ 1221.827551][T14492] syzkaller0: entered promiscuous mode [ 1222.014792][T14509] netlink: 'syz.2.11822': attribute type 1 has an invalid length. [ 1222.143580][ T5836] Bluetooth: hci1: command tx timeout [ 1222.167750][T14513] netlink: 20 bytes leftover after parsing attributes in process `syz.1.11824'. [ 1222.342087][T14527] tipc: Started in network mode [ 1222.357070][T14527] tipc: Node identity ac14140f, cluster identity 4711 [ 1222.381626][T14527] tipc: New replicast peer: 255.255.255.255 [ 1222.396816][T14527] tipc: Enabled bearer , priority 6 [ 1222.566857][T14550] netlink: 40 bytes leftover after parsing attributes in process `syz.0.11830'. [ 1222.607382][T14533] netlink: 'syz.1.11829': attribute type 13 has an invalid length. [ 1222.985712][T14573] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11836'. [ 1223.051910][T14573] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11836'. [ 1223.079501][T14578] syzkaller0: entered promiscuous mode [ 1223.087084][T14578] syzkaller0: entered allmulticast mode [ 1223.108359][T14578] veth0_to_bridge: Caught tx_queue_len zero misconfig [ 1223.130291][T14578] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11837'. [ 1223.239103][T14586] netlink: 8 bytes leftover after parsing attributes in process `syz.3.11833'. [ 1223.249381][T14585] tipc: Enabled bearer , priority 0 [ 1223.274481][T14576] tipc: Resetting bearer [ 1223.347290][T14576] tipc: Disabling bearer [ 1223.415465][T14184] udevd[14184]: inotify_add_watch(7, /dev/nbd7, 10) failed: No such file or directory [ 1223.537948][T18083] tipc: Node number set to 2886997007 [ 1224.144933][T14635] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11844'. [ 1224.195833][T14639] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1224.254081][T14640] netlink: 'syz.3.11849': attribute type 10 has an invalid length. [ 1224.292896][T14637] netlink: 'syz.3.11849': attribute type 10 has an invalid length. [ 1224.516404][T14654] sch_tbf: burst 88 is lower than device veth13 mtu (1514) ! [ 1224.573079][T14655] syzkaller1: entered promiscuous mode [ 1224.589937][T14655] syzkaller1: entered allmulticast mode [ 1225.137004][T14689] syzkaller0: entered allmulticast mode [ 1225.156388][T14689] syzkaller0 (unregistering): left allmulticast mode [ 1225.352691][T14707] netlink: 'syz.1.11869': attribute type 1 has an invalid length. [ 1225.440434][T14696] netlink: 'syz.2.11867': attribute type 25 has an invalid length. [ 1225.458432][T14696] netlink: 'syz.2.11867': attribute type 29 has an invalid length. [ 1225.560016][T14713] netlink: 'syz.0.11872': attribute type 2 has an invalid length. [ 1225.601876][T14713] !: entered promiscuous mode [ 1225.614802][T14713] netlink: 'syz.0.11872': attribute type 2 has an invalid length. [ 1225.753335][T14730] netlink: 'syz.1.11876': attribute type 4 has an invalid length. [ 1225.781535][T14730] netlink: 'syz.1.11876': attribute type 4 has an invalid length. [ 1226.168766][T14744] bond0: (slave bridge0): Releasing backup interface [ 1226.180440][T14744] bridge0: left promiscuous mode [ 1226.208967][T14744] bond0: (slave dummy0): Releasing backup interface [ 1226.217542][T14744] dummy0: left promiscuous mode [ 1226.236282][T14744] ¾x9ÿ: left allmulticast mode [ 1226.241105][T14744] ¾x9ÿ: left promiscuous mode [ 1226.248778][T14744] bridge0: port 1(1¾x9ÿ) entered disabled state [ 1226.259226][T14744] bridge_slave_1: left allmulticast mode [ 1226.265779][T14744] bridge_slave_1: left promiscuous mode [ 1226.272386][T14744] bridge0: port 2(bridge_slave_1) entered disabled state [ 1226.287669][T14744] bond0: (slave bond_slave_0): Releasing backup interface [ 1226.299127][T14744] bond_slave_0: left promiscuous mode [ 1226.309876][T14744] bond0: (slave bond_slave_1): Releasing backup interface [ 1226.322698][T14744] bond_slave_1: left promiscuous mode [ 1226.335555][T14744] team0: Port device team_slave_0 removed [ 1226.346001][T14744] team0: Port device team_slave_1 removed [ 1226.352830][T14744] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1228.547819][T14713] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1228.742434][T14769] dvmrp12: entered allmulticast mode [ 1228.763078][T14768] dvmrp12: left allmulticast mode [ 1228.848859][T14779] netlink: 'syz.3.11887': attribute type 32 has an invalid length. [ 1229.108585][T14789] openvswitch: netlink: VXLAN extension 1 has unexpected len 6 expected 4 [ 1229.113418][T14791] __nla_validate_parse: 5 callbacks suppressed [ 1229.113437][T14791] netlink: 24 bytes leftover after parsing attributes in process `syz.1.11894'. [ 1229.191425][T14796] IPVS: rr: FWM 3 0x00000003 - no destination available [ 1229.225771][T14799] FAULT_INJECTION: forcing a failure. [ 1229.225771][T14799] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1229.243444][T14799] CPU: 1 UID: 0 PID: 14799 Comm: syz.0.11896 Not tainted syzkaller #0 PREEMPT(full) [ 1229.243473][T14799] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1229.243483][T14799] Call Trace: [ 1229.243490][T14799] [ 1229.243497][T14799] dump_stack_lvl+0xe8/0x150 [ 1229.243525][T14799] should_fail_ex+0x412/0x560 [ 1229.243554][T14799] _copy_from_user+0x2d/0xb0 [ 1229.243583][T14799] ___sys_sendmsg+0x1c6/0x360 [ 1229.243609][T14799] ? __pfx____sys_sendmsg+0x10/0x10 [ 1229.243672][T14799] ? __fget_files+0x2a/0x420 [ 1229.243697][T14799] ? __fget_files+0x3a0/0x420 [ 1229.243733][T14799] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1229.243755][T14799] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1229.243784][T14799] ? __pfx_ksys_write+0x10/0x10 [ 1229.243816][T14799] do_syscall_64+0x14d/0xf80 [ 1229.243842][T14799] ? trace_irq_disable+0x3b/0x150 [ 1229.243867][T14799] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1229.243885][T14799] ? clear_bhb_loop+0x40/0x90 [ 1229.243908][T14799] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1229.243927][T14799] RIP: 0033:0x7f7fdfb9c799 [ 1229.243945][T14799] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1229.243962][T14799] RSP: 002b:00007f7fe0b13028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1229.243982][T14799] RAX: ffffffffffffffda RBX: 00007f7fdfe16090 RCX: 00007f7fdfb9c799 [ 1229.243996][T14799] RDX: 0000000000000000 RSI: 00002000000029c0 RDI: 000000000000000a [ 1229.244008][T14799] RBP: 00007f7fe0b13090 R08: 0000000000000000 R09: 0000000000000000 [ 1229.244019][T14799] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1229.244031][T14799] R13: 00007f7fdfe16128 R14: 00007f7fdfe16090 R15: 00007ffdad972058 [ 1229.244061][T14799] [ 1229.607348][T14812] netlink: 'syz.3.11900': attribute type 3 has an invalid length. [ 1230.192211][T14840] netlink: 16 bytes leftover after parsing attributes in process `syz.1.11908'. [ 1230.236597][T14839] team_slave_0: entered promiscuous mode [ 1230.242322][T14839] team_slave_1: entered promiscuous mode [ 1230.311147][T14839] macsec1: entered promiscuous mode [ 1230.381079][T14839] team0: entered promiscuous mode [ 1230.428191][T14859] netlink: 4 bytes leftover after parsing attributes in process `syz.3.11910'. [ 1230.429647][T14839] team0: Device macsec1 is already an upper device of the team interface [ 1230.551807][T14839] team0: left promiscuous mode [ 1230.569618][T14839] team_slave_0: left promiscuous mode [ 1230.575110][T14839] team_slave_1: left promiscuous mode [ 1230.627059][T14866] netlink: 32 bytes leftover after parsing attributes in process `syz.1.11913'. [ 1230.667354][T14866] netlink: 40 bytes leftover after parsing attributes in process `syz.1.11913'. [ 1230.668857][T14870] netlink: 'syz.0.11914': attribute type 3 has an invalid length. [ 1231.309621][T14904] tipc: Resetting bearer [ 1231.599699][T14925] netlink: 'syz.3.11927': attribute type 3 has an invalid length. [ 1231.690009][T14933] netlink: 4 bytes leftover after parsing attributes in process `syz.4.11926'. [ 1231.841512][T14939] ipvlan2: entered promiscuous mode [ 1231.890233][T14941] netlink: 12 bytes leftover after parsing attributes in process `syz.0.11930'. [ 1231.985254][T14941] netlink: 4 bytes leftover after parsing attributes in process `syz.0.11930'. [ 1232.009992][T14941] openvswitch: netlink: Unknown nsh attribute 0 [ 1232.026684][T14950] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11932'. [ 1232.070701][T14950] netlink: 28 bytes leftover after parsing attributes in process `syz.3.11932'. [ 1232.267197][T14958] netlink: 'syz.2.11934': attribute type 25 has an invalid length. [ 1232.281963][T14958] netlink: 'syz.2.11934': attribute type 29 has an invalid length. [ 1232.324959][T14963] netlink: 'syz.4.11936': attribute type 4 has an invalid length. [ 1232.379383][T14972] IPVS: rr: FWM 3 0x00000003 - no destination available [ 1232.571712][T14985] netlink: 'syz.1.11940': attribute type 13 has an invalid length. [ 1232.580953][T14985] netlink: 'syz.1.11940': attribute type 17 has an invalid length. [ 1232.601047][T14985] netlink: 'syz.1.11940': attribute type 27 has an invalid length. [ 1232.727191][T14992] netlink: 'syz.2.11944': attribute type 1 has an invalid length. [ 1235.310291][T14963] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1235.334456][T14995] netlink: 'syz.0.11945': attribute type 1 has an invalid length. [ 1235.353224][T14995] __nla_validate_parse: 5 callbacks suppressed [ 1235.353242][T14995] netlink: 224 bytes leftover after parsing attributes in process `syz.0.11945'. [ 1235.684086][T15024] netlink: 'syz.0.11954': attribute type 1 has an invalid length. [ 1235.781547][T15036] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11953'. [ 1235.836921][T15031] gretap3: entered allmulticast mode [ 1235.849117][T15031] bond8: (slave gretap3): making interface the new active one [ 1235.858392][T15031] bond8: (slave gretap3): Enslaving as an active interface with an up link [ 1236.015744][T15045] netlink: 212108 bytes leftover after parsing attributes in process `syz.3.11956'. [ 1236.048311][T15037] syzkaller0: entered promiscuous mode [ 1236.059393][T15037] syzkaller0: entered allmulticast mode [ 1236.256962][T15054] netlink: 36 bytes leftover after parsing attributes in process `syz.0.11960'. [ 1236.361938][T15057] netlink: 'syz.4.11961': attribute type 9 has an invalid length. [ 1236.370501][T15057] netlink: 'syz.4.11961': attribute type 11 has an invalid length. [ 1236.380424][T15057] netlink: 'syz.4.11961': attribute type 12 has an invalid length. [ 1236.389136][T15057] netlink: 210020 bytes leftover after parsing attributes in process `syz.4.11961'. [ 1238.123905][T15057] macsec1: entered promiscuous mode [ 1238.150758][T15057] bridge0: entered promiscuous mode [ 1238.266555][T15061] netlink: 24 bytes leftover after parsing attributes in process `syz.2.11962'. [ 1238.386194][T15067] bridge6: trying to set multicast startup query interval above maximum, setting to 8640000 (86400000ms) [ 1238.412773][T15072] netlink: 4 bytes leftover after parsing attributes in process `syz.1.11967'. [ 1238.446314][T15072] netlink: 12 bytes leftover after parsing attributes in process `syz.1.11967'. [ 1238.621723][ T1298] lec:lec_start_xmit: lec0:No lecd attached [ 1238.644500][ T5824] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1238.662091][ T5824] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1238.674053][ T5824] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1238.682336][ T5824] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1238.692572][ T5824] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1238.761776][T15078] lo speed is unknown, defaulting to 1000 [ 1238.945189][T15078] wg1 speed is unknown, defaulting to 1000 [ 1239.057912][T15093] syzkaller0: entered promiscuous mode [ 1239.074053][T15093] syzkaller0: entered allmulticast mode [ 1239.112428][T15109] netlink: 4 bytes leftover after parsing attributes in process `syz.2.11973'. [ 1239.147219][T15106] mac80211_hwsim hwsim112 syzkaller0: entered promiscuous mode [ 1239.178821][T15106] mac80211_hwsim hwsim112 syzkaller0: entered allmulticast mode [ 1239.218713][T15106] netlink: 28 bytes leftover after parsing attributes in process `syz.1.11975'. [ 1239.844996][T15141] bridge13: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 1240.031155][T15150] netlink: 'syz.1.11989': attribute type 10 has an invalid length. [ 1240.061410][T15078] chnl_net:caif_netlink_parms(): no params data found [ 1240.440347][T15078] bridge0: port 1(bridge_slave_0) entered blocking state [ 1240.480596][T15078] bridge0: port 1(bridge_slave_0) entered disabled state [ 1240.499389][T15078] bridge_slave_0: entered allmulticast mode [ 1240.523893][T15078] bridge_slave_0: entered promiscuous mode [ 1240.556592][T15078] bridge0: port 2(bridge_slave_1) entered blocking state [ 1240.584197][T15078] bridge0: port 2(bridge_slave_1) entered disabled state [ 1240.592667][T15078] bridge_slave_1: entered allmulticast mode [ 1240.611250][T15078] bridge_slave_1: entered promiscuous mode [ 1240.760338][T15078] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1240.774835][ T5836] Bluetooth: hci0: command tx timeout [ 1240.816218][T15078] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1241.202443][T15078] team0: Port device team_slave_0 added [ 1241.227814][T15078] team0: Port device team_slave_1 added [ 1241.246587][T15218] lo speed is unknown, defaulting to 1000 [ 1241.342354][T15218] wg1 speed is unknown, defaulting to 1000 [ 1241.399905][T15078] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1241.423635][T15078] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1241.483889][T15078] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1241.563417][T15233] __nla_validate_parse: 4 callbacks suppressed [ 1241.563437][T15233] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12005'. [ 1241.835490][T15078] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1241.843032][T15078] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1241.870910][T15078] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1241.951772][T15078] hsr_slave_0: entered promiscuous mode [ 1241.960302][T15078] hsr_slave_1: entered promiscuous mode [ 1241.967952][T15078] debugfs: 'hsr0' already exists in 'hsr' [ 1241.975095][T15078] Cannot create hsr debugfs directory [ 1241.991412][T15233] macvlan5: entered promiscuous mode [ 1242.001002][T15233] macvlan5: entered allmulticast mode [ 1242.029434][T15233] veth1_to_batadv: entered allmulticast mode [ 1242.247100][T15248] syzkaller1: entered promiscuous mode [ 1242.252621][T15248] syzkaller1: entered allmulticast mode [ 1242.854586][ T5836] Bluetooth: hci0: command tx timeout [ 1242.986064][T15265] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12012'. [ 1243.001242][T15265] netlink: 'syz.1.12012': attribute type 1 has an invalid length. [ 1243.077294][T15265] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1243.116120][T15267] vlan3: entered promiscuous mode [ 1243.121187][T15267] bond5: entered promiscuous mode [ 1243.128342][T15265] netlink: 'syz.1.12012': attribute type 1 has an invalid length. [ 1243.136661][T15267] vlan3: entered allmulticast mode [ 1243.141794][T15267] bond5: entered allmulticast mode [ 1243.167132][T15265] netlink: 44 bytes leftover after parsing attributes in process `syz.1.12012'. [ 1243.187684][T15265] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 1243.206002][T15265] bond5: (slave batadv1): making interface the new active one [ 1243.217353][T15265] batadv1: entered promiscuous mode [ 1243.225725][T15265] batadv1: entered allmulticast mode [ 1243.232113][T15265] bond5: (slave batadv1): Enslaving as an active interface with an up link [ 1243.232278][T15272] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12014'. [ 1243.274933][T15272] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12014'. [ 1243.516298][T15293] netlink: 'syz.2.12020': attribute type 3 has an invalid length. [ 1243.546570][T15283] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1243.557095][T15298] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 1243.641080][T15078] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1243.702947][T15078] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1243.734503][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5110 ms [ 1243.742564][ C0] lec:lec_tx_timeout: lec0 [ 1243.772429][T15078] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1243.799705][T15078] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1244.007842][T15318] lo speed is unknown, defaulting to 1000 [ 1244.045544][T15318] wg1 speed is unknown, defaulting to 1000 [ 1244.064384][T15078] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1244.108197][T15078] 8021q: adding VLAN 0 to HW filter on device team0 [ 1244.196344][T21254] bridge0: port 1(bridge_slave_0) entered blocking state [ 1244.203550][T21254] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1244.245833][T21254] bridge0: port 2(bridge_slave_1) entered blocking state [ 1244.252998][T21254] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1244.300497][T15325] lo speed is unknown, defaulting to 1000 [ 1244.416428][T15325] wg1 speed is unknown, defaulting to 1000 [ 1244.536955][T15337] netlink: 276 bytes leftover after parsing attributes in process `syz.1.12025'. [ 1244.788306][T15333] lo speed is unknown, defaulting to 1000 [ 1244.810331][T15346] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12026'. [ 1244.933873][ T5836] Bluetooth: hci0: command tx timeout [ 1245.008319][T15346] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12026'. [ 1245.075466][T15078] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1245.241494][T15333] wg1 speed is unknown, defaulting to 1000 [ 1245.331661][T15364] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12028'. [ 1245.362445][T15364] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12028'. [ 1245.597300][T15372] macsec2: entered allmulticast mode [ 1245.602693][T15372] dummy0: entered allmulticast mode [ 1245.612065][T15372] dummy0: left allmulticast mode [ 1245.716730][T15078] veth0_vlan: entered promiscuous mode [ 1245.734818][T15078] veth1_vlan: entered promiscuous mode [ 1245.780643][T15078] veth0_macvtap: entered promiscuous mode [ 1245.830485][T15078] veth1_macvtap: entered promiscuous mode [ 1246.008058][T15078] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1246.087778][T15078] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1246.144750][T15224] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1246.205116][T15224] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1246.343704][T15224] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1246.449830][T15224] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1246.621759][T15215] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1246.653540][T15215] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1246.819601][T15217] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1246.833288][T15217] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1246.936855][T30415] block nbd6: Possible stuck request ffff888026bb0000: control (read@0,1024B). Runtime 120 seconds [ 1246.950928][T30415] block nbd6: Possible stuck request ffff888026bb0200: control (read@1024,1024B). Runtime 120 seconds [ 1246.962198][T30415] block nbd6: Possible stuck request ffff888026bb0400: control (read@2048,1024B). Runtime 120 seconds [ 1246.973868][T30415] block nbd6: Possible stuck request ffff888026bb0600: control (read@3072,1024B). Runtime 120 seconds [ 1247.013612][ T5836] Bluetooth: hci0: command tx timeout [ 1247.224487][T15401] __nla_validate_parse: 2 callbacks suppressed [ 1247.224507][T15401] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12035'. [ 1247.290558][T15408] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12037'. [ 1247.300492][T15408] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12037'. [ 1247.764769][T15423] openvswitch: netlink: Unexpected mask (mask=200044, allowed=1004c) [ 1247.802516][ T5824] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1247.813444][ T5824] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1247.822679][ T5824] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1247.831042][ T5824] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1247.842520][ T5824] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1247.928483][T15424] lo speed is unknown, defaulting to 1000 [ 1247.936580][T15424] wg1 speed is unknown, defaulting to 1000 [ 1248.524743][T15441] netlink: 'syz.0.12045': attribute type 4 has an invalid length. [ 1248.576467][T15442] lo speed is unknown, defaulting to 1000 [ 1248.586990][T15452] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12048'. [ 1248.645042][T15442] wg1 speed is unknown, defaulting to 1000 [ 1248.980993][T15424] chnl_net:caif_netlink_parms(): no params data found [ 1249.163295][T15472] netlink: 'syz.4.12051': attribute type 1 has an invalid length. [ 1249.172073][T15472] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12051'. [ 1249.230096][T15469] lo speed is unknown, defaulting to 1000 [ 1249.261048][T15472] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12051'. [ 1249.324500][T15469] wg1 speed is unknown, defaulting to 1000 [ 1249.417517][T15424] bridge0: port 1(bridge_slave_0) entered blocking state [ 1249.436639][T15424] bridge0: port 1(bridge_slave_0) entered disabled state [ 1249.445377][T15424] bridge_slave_0: entered allmulticast mode [ 1249.454326][T15424] bridge_slave_0: entered promiscuous mode [ 1249.479079][T15424] bridge0: port 2(bridge_slave_1) entered blocking state [ 1249.521180][T15424] bridge0: port 2(bridge_slave_1) entered disabled state [ 1249.531623][T15424] bridge_slave_1: entered allmulticast mode [ 1249.541965][T15424] bridge_slave_1: entered promiscuous mode [ 1249.664671][T15483] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12054'. [ 1249.671006][T15424] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1249.697618][T15424] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1249.716389][T15484] netlink: 16 bytes leftover after parsing attributes in process `syz.3.12054'. [ 1249.846269][T15488] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12056'. [ 1249.894300][ T5824] Bluetooth: hci2: command tx timeout [ 1249.927192][T15424] team0: Port device team_slave_0 added [ 1249.970328][T15424] team0: Port device team_slave_1 added [ 1250.031753][T15494] netlink: 44 bytes leftover after parsing attributes in process `syz.2.12058'. [ 1250.064776][T15424] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1250.071747][T15424] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1250.105549][T15424] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1250.118980][T15424] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1250.127731][T15424] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1250.157762][T15424] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1250.390920][T15424] hsr_slave_0: entered promiscuous mode [ 1250.428261][T15424] hsr_slave_1: entered promiscuous mode [ 1250.452776][T15424] debugfs: 'hsr0' already exists in 'hsr' [ 1250.473206][T15424] Cannot create hsr debugfs directory [ 1250.782012][T15424] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1250.819803][T15424] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1250.958652][T15424] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1250.983334][T15424] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1251.055618][T15528] netlink: 'syz.4.12069': attribute type 4 has an invalid length. [ 1251.068115][T15529] netlink: 'syz.4.12069': attribute type 4 has an invalid length. [ 1251.079526][T15424] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1251.091631][T15424] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1251.161414][T15424] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1251.172753][T15424] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 1251.186479][T15518] netlink: 'syz.3.12067': attribute type 9 has an invalid length. [ 1251.478239][T15539] bond8: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1251.491812][T15539] bond8 (unregistering): Released all slaves [ 1251.578917][T15424] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1251.634369][T15548] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 1251.678626][T15424] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1251.700031][T15224] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1251.719264][T15424] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1251.754778][T15204] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1251.805481][T15204] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1251.816906][T15204] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1251.826796][T15424] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1251.948508][T15568] Bluetooth: MGMT ver 1.23 [ 1251.970038][T15571] lo speed is unknown, defaulting to 1000 [ 1251.983772][ T5824] Bluetooth: hci2: command tx timeout [ 1252.015545][T15571] wg1 speed is unknown, defaulting to 1000 [ 1252.080941][T15424] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1252.112506][T15424] 8021q: adding VLAN 0 to HW filter on device team0 [ 1252.127511][T15224] bridge0: port 1(bridge_slave_0) entered blocking state [ 1252.134715][T15224] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1252.218085][ T319] bridge0: port 2(bridge_slave_1) entered blocking state [ 1252.225287][ T319] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1252.272363][T15594] __nla_validate_parse: 15 callbacks suppressed [ 1252.272382][T15594] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12085'. [ 1252.314337][T15594] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12085'. [ 1252.328688][T15597] xt_ecn: cannot match TCP bits for non-tcp packets [ 1252.597786][T15602] netlink: 'syz.0.12087': attribute type 13 has an invalid length. [ 1252.629272][T15605] lo speed is unknown, defaulting to 1000 [ 1252.735190][T15605] wg1 speed is unknown, defaulting to 1000 [ 1252.843991][T15424] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1252.927070][T15424] veth0_vlan: entered promiscuous mode [ 1252.956135][T15424] veth1_vlan: entered promiscuous mode [ 1253.032061][T15424] veth0_macvtap: entered promiscuous mode [ 1253.081499][T15424] veth1_macvtap: entered promiscuous mode [ 1253.126474][T15424] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1253.169683][T15424] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1253.203357][T15215] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1253.226810][T15215] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1253.240300][T15629] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12096'. [ 1253.276215][T15215] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1253.286743][T15215] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1253.297008][T15629] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12096'. [ 1253.797607][T21254] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1253.807633][T21254] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1254.053711][ T5824] Bluetooth: hci2: command tx timeout [ 1254.114439][ T319] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1254.123066][ T319] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1254.299260][T15676] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12108'. [ 1254.320925][T15676] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12108'. [ 1254.507621][T15687] bond8: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1254.556892][T15687] bond8: (slave lo): Enslaving as an active interface with an up link [ 1254.584108][T15687] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1254.677129][T15685] lo speed is unknown, defaulting to 1000 [ 1254.708111][T15685] wg1 speed is unknown, defaulting to 1000 [ 1254.846502][T15701] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12114'. [ 1255.056804][T15712] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12118'. [ 1255.094380][T15712] netlink: 261 bytes leftover after parsing attributes in process `syz.1.12118'. [ 1255.185234][T15715] netlink: 'syz.2.12120': attribute type 1 has an invalid length. [ 1255.221872][T15718] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12121'. [ 1255.248327][T15715] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 1255.348718][ T5836] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1255.367839][ T5836] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1255.381988][ T5836] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1255.392127][ T5836] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1255.405650][ T5836] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1255.621689][T15732] netlink: 'syz.1.12125': attribute type 2 has an invalid length. [ 1255.641637][T15722] lo speed is unknown, defaulting to 1000 [ 1255.702410][T15722] wg1 speed is unknown, defaulting to 1000 [ 1256.133735][ T5836] Bluetooth: hci2: command tx timeout [ 1256.441207][T15762] gre0 speed is unknown, defaulting to 1000 [ 1256.470478][T15763] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1256.594416][T15762] gre0 speed is unknown, defaulting to 1000 [ 1256.602103][T15762] gre0 speed is unknown, defaulting to 1000 [ 1256.833954][T15762] infiniband syz1: set active [ 1256.839193][T15762] infiniband syz1: added gre0 [ 1256.846819][T15762] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 1256.849039][T15762] infiniband syz1: Couldn't open port 1 [ 1256.886618][T15762] RDS/IB: syz1: added [ 1256.890699][T15762] smc: adding ib device syz1 with port count 1 [ 1256.897716][T15762] smc: ib device syz1 port 1 has no pnetid [ 1256.912141][ T5908] gre0 speed is unknown, defaulting to 1000 [ 1256.957841][ T796] gre0 speed is unknown, defaulting to 1000 [ 1256.975034][T15762] gre0 speed is unknown, defaulting to 1000 [ 1257.001167][T15722] chnl_net:caif_netlink_parms(): no params data found [ 1257.416246][T15722] bridge0: port 1(bridge_slave_0) entered blocking state [ 1257.425183][T15722] bridge0: port 1(bridge_slave_0) entered disabled state [ 1257.432512][T15722] bridge_slave_0: entered allmulticast mode [ 1257.441153][T15722] bridge_slave_0: entered promiscuous mode [ 1257.450947][T15722] bridge0: port 2(bridge_slave_1) entered blocking state [ 1257.459110][T15722] bridge0: port 2(bridge_slave_1) entered disabled state [ 1257.467360][T15722] bridge_slave_1: entered allmulticast mode [ 1257.468773][T15817] sctp: [Deprecated]: syz.0.12145 (pid 15817) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1257.468773][T15817] Use struct sctp_sack_info instead [ 1257.476703][T15722] bridge_slave_1: entered promiscuous mode [ 1257.498736][T15762] gre0 speed is unknown, defaulting to 1000 [ 1257.505384][ T5836] Bluetooth: hci4: command tx timeout [ 1257.516058][T15815] __nla_validate_parse: 4 callbacks suppressed [ 1257.516075][T15815] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12146'. [ 1257.533238][T15818] netlink: 'syz.0.12145': attribute type 3 has an invalid length. [ 1257.563047][T15815] openvswitch: netlink: Message has 2 unknown bytes. [ 1257.567673][T15722] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1257.587627][T15815] netlink: 'syz.2.12146': attribute type 11 has an invalid length. [ 1257.605292][T15722] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1257.657148][T15820] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12146'. [ 1257.707611][T15722] team0: Port device team_slave_0 added [ 1257.727954][T15722] team0: Port device team_slave_1 added [ 1257.769983][T15827] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12148'. [ 1257.803871][T15828] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12148'. [ 1257.805102][T15722] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1257.834245][T15722] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1257.884341][T15722] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1257.905327][T15827] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12148'. [ 1257.925826][T15830] kthread_run failed with err -4 [ 1257.936029][T15762] gre0 speed is unknown, defaulting to 1000 [ 1257.936873][T15722] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1257.983614][T15722] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1258.028611][T15722] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1258.089329][T15838] netlink: 148 bytes leftover after parsing attributes in process `syz.2.12150'. [ 1258.192425][T15843] netlink: 'syz.1.12152': attribute type 1 has an invalid length. [ 1258.199344][T15722] hsr_slave_0: entered promiscuous mode [ 1258.209991][T15722] hsr_slave_1: entered promiscuous mode [ 1258.219740][T15722] debugfs: 'hsr0' already exists in 'hsr' [ 1258.233047][T15722] Cannot create hsr debugfs directory [ 1258.322177][T15843] netlink: 'syz.1.12152': attribute type 21 has an invalid length. [ 1258.422872][T15848] bridge0: port 2(bridge_slave_1) entered disabled state [ 1258.430299][T15848] bridge0: port 1(bridge_slave_0) entered disabled state [ 1258.517233][T15848] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1258.532099][T15848] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1258.616826][T15843] netlink: 156 bytes leftover after parsing attributes in process `syz.1.12152'. [ 1258.628677][T15843] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12152'. [ 1258.662841][T15762] gre0 speed is unknown, defaulting to 1000 [ 1258.678045][T15217] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1258.688712][T15217] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1258.698775][T15217] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1258.710105][T15217] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1258.771308][T15217] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1258.802272][T15217] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1258.821179][T15217] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 1258.831435][T15217] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1258.984720][T15872] netlink: 68 bytes leftover after parsing attributes in process `syz.1.12159'. [ 1259.196152][T15862] lo speed is unknown, defaulting to 1000 [ 1259.201992][T15762] gre0 speed is unknown, defaulting to 1000 [ 1259.237279][T15862] wg1 speed is unknown, defaulting to 1000 [ 1259.582848][ T5836] Bluetooth: hci4: command tx timeout [ 1259.618715][T15887] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12164'. [ 1259.799031][T15762] gre0 speed is unknown, defaulting to 1000 [ 1259.813896][T15722] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1259.838072][T15722] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1259.858886][T15722] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1259.880685][T15722] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1260.001723][T15902] Bluetooth: MGMT ver 1.23 [ 1260.016867][T15722] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1260.057823][T15722] 8021q: adding VLAN 0 to HW filter on device team0 [ 1260.077432][T15215] bridge0: port 1(bridge_slave_0) entered blocking state [ 1260.084620][T15215] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1260.115406][T21246] bridge0: port 2(bridge_slave_1) entered blocking state [ 1260.122614][T21246] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1260.230839][T15862] gre0 speed is unknown, defaulting to 1000 [ 1260.317811][T15910] syzkaller0: entered promiscuous mode [ 1260.324361][T15910] syzkaller0: entered allmulticast mode [ 1260.509874][T15915] hsr0: entered promiscuous mode [ 1260.548342][T15722] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1260.566357][T15762] gre0 speed is unknown, defaulting to 1000 [ 1260.662863][T15914] hsr0: left promiscuous mode [ 1260.677014][T15722] veth0_vlan: entered promiscuous mode [ 1260.801186][T15722] veth1_vlan: entered promiscuous mode [ 1260.873288][T15922] atm:do_vcc_ioctl: ATM_SETSC is obsolete; used by syz.1.12172:15922 [ 1260.880187][T15722] veth0_macvtap: entered promiscuous mode [ 1260.907470][T15722] veth1_macvtap: entered promiscuous mode [ 1260.948372][T15722] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1260.966269][T15722] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1261.007434][T15205] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1261.040776][T15205] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1261.057751][T15205] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1261.081211][T15205] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1261.132543][T15762] gre0 speed is unknown, defaulting to 1000 [ 1261.209281][T15205] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1261.222292][T15205] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1261.288087][T15933] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1261.316551][T15205] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1261.327096][T15205] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1261.517420][T15762] gre0 speed is unknown, defaulting to 1000 [ 1261.655733][ T5836] Bluetooth: hci4: command tx timeout [ 1261.888600][T15762] gre0 speed is unknown, defaulting to 1000 [ 1262.227004][T15762] gre0 speed is unknown, defaulting to 1000 [ 1262.527042][T15762] gre0 speed is unknown, defaulting to 1000 [ 1262.764381][T15762] gre0 speed is unknown, defaulting to 1000 [ 1262.831822][T15965] __nla_validate_parse: 4 callbacks suppressed [ 1262.831841][T15965] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12182'. [ 1262.885562][T15965] team0: Port device team_slave_0 removed [ 1262.953367][T15762] gre0 speed is unknown, defaulting to 1000 [ 1263.088354][T15926] lo speed is unknown, defaulting to 1000 [ 1263.105160][T15926] wg1 speed is unknown, defaulting to 1000 [ 1263.135790][T15969] netlink: 40 bytes leftover after parsing attributes in process `syz.4.12183'. [ 1263.366569][T15976] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12185'. [ 1263.377344][T15976] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12185'. [ 1263.431964][T15978] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12186'. [ 1263.623728][T15984] "syz.2.12188" (15984) uses obsolete ecb(arc4) skcipher [ 1263.688960][T15987] "syz.2.12188" (15987) uses obsolete ecb(arc4) skcipher [ 1263.734632][ T5836] Bluetooth: hci4: command tx timeout [ 1263.848106][T15993] netlink: 72 bytes leftover after parsing attributes in process `syz.4.12191'. [ 1263.866609][T15991] syzkaller0: entered promiscuous mode [ 1263.872858][T15991] syzkaller0: entered allmulticast mode [ 1263.898698][T15994] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12191'. [ 1264.229325][T16016] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12197'. [ 1264.261220][T16016] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12197'. [ 1264.429402][T16028] IPVS: set_ctl: invalid protocol: 98 172.20.20.24:20000 [ 1264.440295][T16028] IPVS: set_ctl: invalid protocol: 98 172.20.20.24:20000 [ 1264.491312][T16034] netlink: 'syz.3.12201': attribute type 3 has an invalid length. [ 1264.691312][T16041] netlink: 312 bytes leftover after parsing attributes in process `syz.2.12206'. [ 1265.081755][T16019] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 1265.233355][T16069] netlink: 'syz.0.12215': attribute type 1 has an invalid length. [ 1265.242546][T16070] netlink: 'syz.0.12215': attribute type 1 has an invalid length. [ 1266.020673][T16100] sch_tbf: peakrate 7836759490224633571 is lower than or equals to rate 15540063224392467819 ! [ 1266.179798][T16097] lo speed is unknown, defaulting to 1000 [ 1266.216030][T16097] wg1 speed is unknown, defaulting to 1000 [ 1266.303639][ T5836] Bluetooth: hci0: command 0x0401 tx timeout [ 1267.025722][T16097] gre0 speed is unknown, defaulting to 1000 [ 1267.207020][T16143] syzkaller0: entered promiscuous mode [ 1267.212588][T16143] syzkaller0: entered allmulticast mode [ 1268.091115][T16160] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1268.312047][T16165] vlan2: entered allmulticast mode [ 1268.327661][T16165] bond0: entered allmulticast mode [ 1268.343054][T16165] bond_slave_0: entered allmulticast mode [ 1268.354558][T16167] __nla_validate_parse: 7 callbacks suppressed [ 1268.354576][T16167] netlink: 14 bytes leftover after parsing attributes in process `syz.1.12243'. [ 1268.404393][T16165] bond_slave_1: entered allmulticast mode [ 1268.495782][T16167] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1268.505010][T16167] bond_slave_0: left allmulticast mode [ 1268.535840][T16167] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1268.566060][T16167] bond_slave_1: left allmulticast mode [ 1268.578565][T16167] bond0 (unregistering): Released all slaves [ 1268.616534][T16180] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12246'. [ 1268.731357][T16185] netlink: 'syz.0.12250': attribute type 3 has an invalid length. [ 1268.854781][T16193] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12253'. [ 1268.908435][T16194] netlink: 'syz.1.12252': attribute type 13 has an invalid length. [ 1268.918947][T16184] pim6reg: entered allmulticast mode [ 1268.932897][T16186] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1268.981711][T16186] bond1: (slave lo): Enslaving as an active interface with an up link [ 1269.018193][T16186] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 1269.034992][T16188] pim6reg: left allmulticast mode [ 1269.061417][T16193] netlink: 36 bytes leftover after parsing attributes in process `syz.0.12253'. [ 1269.143391][T16194] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1269.281222][T16201] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12255'. [ 1269.350798][T16208] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12257'. [ 1269.637649][T16228] netlink: 60 bytes leftover after parsing attributes in process `syz.4.12263'. [ 1269.811243][T16241] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12269'. [ 1269.885073][T16245] netlink: 'syz.4.12271': attribute type 1 has an invalid length. [ 1269.901074][T16245] netlink: 224 bytes leftover after parsing attributes in process `syz.4.12271'. [ 1269.918133][T16251] netlink: 'syz.4.12271': attribute type 1 has an invalid length. [ 1269.940728][T16251] netlink: 224 bytes leftover after parsing attributes in process `syz.4.12271'. [ 1270.067090][T16255] lo: Caught tx_queue_len zero misconfig [ 1270.088996][T16262] sock: sock_timestamping_bind_phc: sock not bind to device [ 1270.108282][T16255] sock: sock_timestamping_bind_phc: sock not bind to device [ 1270.290199][T16273] IPVS: set_ctl: invalid protocol: 8 172.30.1.3:20003 [ 1270.345104][T16273] IPVS: set_ctl: invalid protocol: 59 172.30.1.3:20001 [ 1270.542394][T16282] bond9: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 1270.568329][T16282] bond9 (unregistering): Released all slaves [ 1271.166361][T16256] lec:lec_start_xmit: lec0:No lecd attached [ 1272.689218][T16310] pim6reg: entered allmulticast mode [ 1272.699954][T16315] pim6reg: left allmulticast mode [ 1272.841828][T16331] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1273.356907][T16362] netlink: 'syz.2.12303': attribute type 11 has an invalid length. [ 1273.466685][T16367] __nla_validate_parse: 9 callbacks suppressed [ 1273.466704][T16367] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12305'. [ 1273.811313][T16379] bond1: peer notification delay (9) is not a multiple of miimon (100), value rounded to 0 ms [ 1274.009565][T16395] netlink: 'syz.4.12314': attribute type 3 has an invalid length. [ 1274.052418][T16397] ÿÿÿÿÿÿ: renamed from vlan1 [ 1274.885723][T16416] lo speed is unknown, defaulting to 1000 [ 1274.892553][T16416] wg1 speed is unknown, defaulting to 1000 [ 1275.015627][T16416] gre0 speed is unknown, defaulting to 1000 [ 1275.761676][T16460] delete_channel: no stack [ 1275.812750][T16469] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12332'. [ 1275.830895][T16469] openvswitch: netlink: Key type 12292 is out of range max 32 [ 1275.899931][T16474] x_tables: duplicate underflow at hook 2 [ 1276.131126][T16482] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1276.151040][T16479] netlink: 'syz.1.12335': attribute type 1 has an invalid length. [ 1276.180492][T16479] bond0: entered promiscuous mode [ 1276.197357][T16479] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1276.226320][T16486] bond0: (slave bridge2): making interface the new active one [ 1276.234915][T16486] bridge2: entered promiscuous mode [ 1276.241672][T16486] bond0: (slave bridge2): Enslaving as an active interface with an up link [ 1276.277832][T16486] bond0: (slave bridge3): Enslaving as a backup interface with an up link [ 1276.300537][T16486] bond0: (slave bridge4): Enslaving as a backup interface with an up link [ 1276.319805][T16486] bond0: (slave bridge5): Enslaving as a backup interface with an up link [ 1276.338529][T16494] macsec1: entered promiscuous mode [ 1276.344835][T16494] team0: entered promiscuous mode [ 1276.350024][T16494] team_slave_0: entered promiscuous mode [ 1276.356167][T16494] team_slave_1: entered promiscuous mode [ 1276.363316][T16494] team0: Device macsec1 is already an upper device of the team interface [ 1276.372765][T16494] team0: left promiscuous mode [ 1276.380967][T16494] team_slave_0: left promiscuous mode [ 1276.387770][T16494] team_slave_1: left promiscuous mode [ 1276.411767][T16486] bond0: (slave bridge6): Enslaving as a backup interface with an up link [ 1276.436317][T16486] bond0: (slave bridge7): Enslaving as a backup interface with an up link [ 1276.460756][T16486] bond0: (slave bridge8): Enslaving as a backup interface with an up link [ 1276.490663][T16486] bond0: (slave bridge9): Enslaving as a backup interface with an up link [ 1276.519839][T16497] nftables ruleset with unbound chain [ 1276.538662][T16486] bond0: (slave bridge10): Enslaving as a backup interface with an up link [ 1276.540553][T16499] netlink: 'syz.2.12340': attribute type 3 has an invalid length. [ 1276.561319][T16486] bond0: (slave bridge11): Enslaving as a backup interface with an up link [ 1276.598283][T16486] bond0: (slave bridge12): Enslaving as a backup interface with an up link [ 1276.620315][T16486] bond0: (slave bridge13): Enslaving as a backup interface with an up link [ 1276.644896][T16486] bond0: (slave bridge14): Enslaving as a backup interface with an up link [ 1276.666876][T16486] bond0: (slave bridge15): Enslaving as a backup interface with an up link [ 1276.703203][T16486] bond0: (slave bridge16): Enslaving as a backup interface with an up link [ 1276.728738][T16486] bond0: (slave bridge17): Enslaving as a backup interface with an up link [ 1276.755080][T16486] bond0: (slave bridge18): Enslaving as a backup interface with an up link [ 1276.775271][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5610 ms [ 1276.783349][ C0] lec:lec_tx_timeout: lec0 [ 1276.936827][T16486] bond0: (slave bridge19): Enslaving as a backup interface with an up link [ 1277.028620][T30415] block nbd6: Possible stuck request ffff888026bb0000: control (read@0,1024B). Runtime 150 seconds [ 1277.040308][T30415] block nbd6: Possible stuck request ffff888026bb0200: control (read@1024,1024B). Runtime 150 seconds [ 1277.051569][T30415] block nbd6: Possible stuck request ffff888026bb0400: control (read@2048,1024B). Runtime 150 seconds [ 1277.063615][T30415] block nbd6: Possible stuck request ffff888026bb0600: control (read@3072,1024B). Runtime 150 seconds [ 1277.075872][T16513] ipt_ECN: cannot use operation on non-tcp rule [ 1277.106143][T16513] netlink: 'syz.4.12344': attribute type 1 has an invalid length. [ 1277.392081][T16511] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1277.514030][T16513] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1277.545949][T16516] bond9 (unregistering): Released all slaves [ 1277.694177][T16531] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1277.792009][T16543] netlink: 'syz.4.12347': attribute type 3 has an invalid length. [ 1277.800347][T16543] netlink: 'syz.4.12347': attribute type 2 has an invalid length. [ 1277.808870][T16543] netlink: 'syz.4.12347': attribute type 2 has an invalid length. [ 1277.879520][T16546] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12351'. [ 1278.209034][T16564] bridge0: port 3(gretap0) entered blocking state [ 1278.234267][T16564] bridge0: port 3(gretap0) entered disabled state [ 1278.241064][T16564] gretap0: entered allmulticast mode [ 1278.250444][T16564] gretap0: entered promiscuous mode [ 1278.256907][T16564] bridge0: port 3(gretap0) entered blocking state [ 1278.263552][T16564] bridge0: port 3(gretap0) entered forwarding state [ 1278.580896][T16595] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12364'. [ 1278.604668][T16596] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.12364'. [ 1278.624361][T16595] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12364'. [ 1278.633207][T16599] netlink: 44 bytes leftover after parsing attributes in process `syz.4.12365'. [ 1278.669803][T16601] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12366'. [ 1278.688902][T16601] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12366'. [ 1278.704560][T16602] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12365'. [ 1278.735073][T16602] xt_hashlimit: size too large, truncated to 1048576 [ 1279.036468][T16623] veth1_macvtap: left promiscuous mode [ 1279.042135][T16623] macsec0: entered promiscuous mode [ 1279.062880][T16623] veth1_macvtap: entered promiscuous mode [ 1279.071322][T16623] macsec0: left promiscuous mode [ 1279.151585][T16624] bond2: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1279.166924][T16624] bond2 (unregistering): Released all slaves [ 1279.435541][T16643] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12376'. [ 1279.480461][T16645] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12378'. [ 1279.524672][T16642] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12376'. [ 1279.737591][ T5824] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1279.747835][ T5824] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1279.758619][ T5824] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1279.768921][ T5824] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1279.780124][ T5824] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1279.893051][T16646] lo speed is unknown, defaulting to 1000 [ 1279.910763][T16646] wg1 speed is unknown, defaulting to 1000 [ 1280.263540][T16646] gre0 speed is unknown, defaulting to 1000 [ 1280.326384][T16670] syzkaller0: entered promiscuous mode [ 1280.332063][T16670] syzkaller0: entered allmulticast mode [ 1280.525206][T16675] ip6tnl0: Caught tx_queue_len zero misconfig [ 1280.534499][T16675] netlink: 'syz.1.12383': attribute type 39 has an invalid length. [ 1280.563230][T16646] chnl_net:caif_netlink_parms(): no params data found [ 1280.633183][T16675] bridge20: entered promiscuous mode [ 1280.638877][T16675] bridge20: entered allmulticast mode [ 1280.704830][T16646] bridge0: port 1(bridge_slave_0) entered blocking state [ 1280.711991][T16646] bridge0: port 1(bridge_slave_0) entered disabled state [ 1280.722330][T16646] bridge_slave_0: entered allmulticast mode [ 1280.730095][T16646] bridge_slave_0: entered promiscuous mode [ 1280.738517][T16646] bridge0: port 2(bridge_slave_1) entered blocking state [ 1280.746403][T16646] bridge0: port 2(bridge_slave_1) entered disabled state [ 1280.754312][T16646] bridge_slave_1: entered allmulticast mode [ 1280.761343][T16646] bridge_slave_1: entered promiscuous mode [ 1280.789913][T16646] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1280.799488][T16682] syzkaller0: entered promiscuous mode [ 1280.806568][T16682] syzkaller0: entered allmulticast mode [ 1280.817188][T16646] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1280.863832][T16646] team0: Port device team_slave_0 added [ 1280.875743][T16646] team0: Port device team_slave_1 added [ 1280.900748][T16646] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1280.908464][T16646] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1280.936590][T16646] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1280.949893][T16646] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1280.957634][T16646] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1280.984993][T16646] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1281.027127][T16646] hsr_slave_0: entered promiscuous mode [ 1281.034056][T16646] hsr_slave_1: entered promiscuous mode [ 1281.040151][T16646] debugfs: 'hsr0' already exists in 'hsr' [ 1281.046743][T16646] Cannot create hsr debugfs directory [ 1281.813910][ T5824] Bluetooth: hci5: command tx timeout [ 1282.725471][T16649] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1282.737140][T16646] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1282.806914][T16646] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1282.862766][T16646] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1282.933432][T16646] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1282.971688][T16697] netlink: 'syz.2.12389': attribute type 4 has an invalid length. [ 1282.984815][T16697] netlink: 'syz.2.12389': attribute type 1 has an invalid length. [ 1283.261637][T16646] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1283.314994][T16646] 8021q: adding VLAN 0 to HW filter on device team0 [ 1283.346075][T21254] bridge0: port 1(bridge_slave_0) entered blocking state [ 1283.353273][T21254] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1283.424959][T15215] bridge0: port 2(bridge_slave_1) entered blocking state [ 1283.432126][T15215] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1283.851030][T16731] pim6reg1: tun_chr_ioctl cmd 1074025677 [ 1283.864900][T16731] pim6reg1: linktype set to 270 [ 1283.894564][ T5824] Bluetooth: hci5: command tx timeout [ 1284.063348][T16646] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1284.099115][T16742] ip6erspan0: entered allmulticast mode [ 1284.644364][T16646] veth0_vlan: entered promiscuous mode [ 1284.696497][T16646] veth1_vlan: entered promiscuous mode [ 1284.787839][T16646] veth0_macvtap: entered promiscuous mode [ 1284.808626][T16780] __nla_validate_parse: 6 callbacks suppressed [ 1284.808646][T16780] netlink: 32 bytes leftover after parsing attributes in process `syz.1.12409'. [ 1284.810614][T16646] veth1_macvtap: entered promiscuous mode [ 1284.864544][T16787] netlink: 'syz.1.12409': attribute type 4 has an invalid length. [ 1284.890700][T16646] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1284.892461][T16780] netlink: 'syz.1.12409': attribute type 4 has an invalid length. [ 1284.909045][T16646] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1284.926352][T15217] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1284.937335][T15217] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1284.959903][T16787] vlan2: entered promiscuous mode [ 1284.967238][T16787] geneve1: entered promiscuous mode [ 1284.972574][T16787] vlan2: entered allmulticast mode [ 1284.984685][T16787] geneve1: entered allmulticast mode [ 1285.017067][T15217] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1285.030852][T15217] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1285.189695][T21254] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1285.204381][T16790] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12411'. [ 1285.225457][T21254] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1285.274911][T16792] lo speed is unknown, defaulting to 1000 [ 1285.280767][T15217] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1285.294865][T16792] wg1 speed is unknown, defaulting to 1000 [ 1285.321095][T15217] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1285.479110][T16802] netlink: 'syz.2.12417': attribute type 13 has an invalid length. [ 1285.500599][T16802] netlink: 356 bytes leftover after parsing attributes in process `syz.2.12417'. [ 1285.590942][T16809] netlink: 'syz.1.12418': attribute type 4 has an invalid length. [ 1285.622123][T16809] netlink: 'syz.1.12418': attribute type 4 has an invalid length. [ 1285.829983][T16818] lo speed is unknown, defaulting to 1000 [ 1285.831618][T16792] gre0 speed is unknown, defaulting to 1000 [ 1285.847374][T16818] wg1 speed is unknown, defaulting to 1000 [ 1285.946598][T16833] netlink: 220 bytes leftover after parsing attributes in process `syz.3.12424'. [ 1285.976298][ T5836] Bluetooth: hci5: command tx timeout [ 1285.986978][T16829] netlink: 19 bytes leftover after parsing attributes in process `syz.4.12423'. [ 1285.997175][T16829] netlink: 19 bytes leftover after parsing attributes in process `syz.4.12423'. [ 1286.212390][T16840] xt_hashlimit: size too large, truncated to 1048576 [ 1286.234147][T16840] xt_hashlimit: overflow, try lower: 0/0 [ 1286.304683][T16840] syz_tun: entered allmulticast mode [ 1286.316341][T16843] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 1286.331357][T16839] syz_tun: left allmulticast mode [ 1286.491297][T16818] gre0 speed is unknown, defaulting to 1000 [ 1286.645098][T16848] bond1 (unregistering): Released all slaves [ 1286.951806][T16861] sock: sock_timestamping_bind_phc: sock not bind to device [ 1286.978401][T16856] bridge0: port 2(bridge_slave_1) entered disabled state [ 1286.986100][T16856] bridge0: port 1(bridge_slave_0) entered disabled state [ 1287.001424][T16861] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12432'. [ 1287.019318][T16863] netlink: 24 bytes leftover after parsing attributes in process `syz.3.12433'. [ 1287.019545][T16861] netlink: 40 bytes leftover after parsing attributes in process `syz.4.12432'. [ 1287.077364][T16856] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1287.111722][T16856] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1287.295528][T21254] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1287.311707][T21254] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1287.409497][T21254] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1287.496040][T21254] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1287.672705][T16868] lo speed is unknown, defaulting to 1000 [ 1287.709243][T16876] netlink: 28 bytes leftover after parsing attributes in process `syz.1.12437'. [ 1287.777465][T16868] wg1 speed is unknown, defaulting to 1000 [ 1288.065253][ T5824] Bluetooth: hci5: command tx timeout [ 1288.210204][T16890] netlink: 'syz.1.12441': attribute type 11 has an invalid length. [ 1288.236369][T16890] netlink: 'syz.1.12441': attribute type 4 has an invalid length. [ 1288.254820][T16890] netlink: 'syz.1.12441': attribute type 5 has an invalid length. [ 1288.272843][T16890] netlink: 'syz.1.12441': attribute type 6 has an invalid length. [ 1288.304747][T16896] IPVS: length: 142 != 24 [ 1288.446107][T16901] bridge1: entered promiscuous mode [ 1288.455257][T16895] sch_tbf: burst 512 is lower than device syzkaller0 mtu (1500) ! [ 1288.531009][T16868] gre0 speed is unknown, defaulting to 1000 [ 1288.761875][T16909] lo speed is unknown, defaulting to 1000 [ 1288.782715][T16909] wg1 speed is unknown, defaulting to 1000 [ 1289.207847][T16909] gre0 speed is unknown, defaulting to 1000 [ 1291.527347][T16988] __nla_validate_parse: 3 callbacks suppressed [ 1291.527366][T16988] netlink: 84 bytes leftover after parsing attributes in process `syz.2.12457'. [ 1291.567548][T16905] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1291.892014][T17005] netlink: zone id is out of range [ 1291.897537][T17005] netlink: zone id is out of range [ 1291.902666][T17005] netlink: zone id is out of range [ 1291.908774][T17005] netlink: zone id is out of range [ 1291.923292][T17005] netlink: zone id is out of range [ 1291.933288][T17005] netlink: zone id is out of range [ 1291.955519][T17005] netlink: zone id is out of range [ 1291.960666][T17005] netlink: zone id is out of range [ 1291.968963][T17006] netlink: 'syz.0.12462': attribute type 3 has an invalid length. [ 1291.980672][T17005] netlink: zone id is out of range [ 1291.989463][T17006] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12462'. [ 1291.999439][T17005] netlink: zone id is out of range [ 1293.913048][T17002] netlink: 48 bytes leftover after parsing attributes in process `syz.0.12462'. [ 1293.931271][T17002] netlink: 245 bytes leftover after parsing attributes in process `syz.0.12462'. [ 1294.097630][T17022] netlink: 'syz.3.12467': attribute type 1 has an invalid length. [ 1294.112627][T17022] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12467'. [ 1294.132444][T17025] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12468'. [ 1294.174167][T17021] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12468'. [ 1294.575534][T17042] vlan2: entered promiscuous mode [ 1294.594132][T17042] bridge0: entered promiscuous mode [ 1294.655774][T17034] lo speed is unknown, defaulting to 1000 [ 1294.714773][T17034] wg1 speed is unknown, defaulting to 1000 [ 1294.745487][T17055] FAULT_INJECTION: forcing a failure. [ 1294.745487][T17055] name failslab, interval 1, probability 0, space 0, times 0 [ 1294.772307][T17055] CPU: 1 UID: 0 PID: 17055 Comm: syz.3.12475 Not tainted syzkaller #0 PREEMPT(full) [ 1294.772332][T17055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1294.772343][T17055] Call Trace: [ 1294.772351][T17055] [ 1294.772359][T17055] dump_stack_lvl+0xe8/0x150 [ 1294.772393][T17055] should_fail_ex+0x412/0x560 [ 1294.772434][T17055] should_failslab+0xa8/0x100 [ 1294.772461][T17055] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 1294.772483][T17055] ? __alloc_skb+0x1d0/0x7d0 [ 1294.772509][T17055] ? __local_bh_enable_ip+0xd0/0x130 [ 1294.772538][T17055] __alloc_skb+0x1d0/0x7d0 [ 1294.772562][T17055] ? cfg80211_iftype_allowed+0x159/0x300 [ 1294.772590][T17055] ? nl80211_new_interface+0x4e5/0x11f0 [ 1294.772686][T17055] nl80211_new_interface+0x6ba/0x11f0 [ 1294.772716][T17055] ? __pfx_nl80211_new_interface+0x10/0x10 [ 1294.772739][T17055] ? nl80211_pre_doit+0x4fb/0x930 [ 1294.772797][T17055] genl_family_rcv_msg_doit+0x22a/0x330 [ 1294.772827][T17055] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1294.772862][T17055] ? bpf_lsm_capable+0x9/0x20 [ 1294.772886][T17055] ? security_capable+0x7e/0x2c0 [ 1294.772916][T17055] genl_rcv_msg+0x61c/0x7a0 [ 1294.772944][T17055] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1294.772962][T17055] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 1294.772986][T17055] ? __pfx_nl80211_new_interface+0x10/0x10 [ 1294.773002][T17055] ? __pfx_nl80211_post_doit+0x10/0x10 [ 1294.773028][T17055] ? __lock_acquire+0x6b5/0x2cf0 [ 1294.773065][T17055] netlink_rcv_skb+0x232/0x4b0 [ 1294.773091][T17055] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1294.773113][T17055] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1294.773156][T17055] ? down_read+0x272/0x2e0 [ 1294.773175][T17055] ? genl_rcv+0xd/0x40 [ 1294.773196][T17055] genl_rcv+0x28/0x40 [ 1294.773214][T17055] netlink_unicast+0x80f/0x9b0 [ 1294.773247][T17055] ? __pfx_netlink_unicast+0x10/0x10 [ 1294.773272][T17055] ? netlink_sendmsg+0x650/0xb40 [ 1294.773295][T17055] ? skb_put+0x11b/0x210 [ 1294.773327][T17055] netlink_sendmsg+0x813/0xb40 [ 1294.773363][T17055] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1294.773392][T17055] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1294.773424][T17055] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1294.773448][T17055] ____sys_sendmsg+0x972/0x9f0 [ 1294.773473][T17055] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1294.773500][T17055] ? import_iovec+0x73/0xa0 [ 1294.773531][T17055] ___sys_sendmsg+0x2a5/0x360 [ 1294.773555][T17055] ? __pfx____sys_sendmsg+0x10/0x10 [ 1294.773609][T17055] ? __fget_files+0x2a/0x420 [ 1294.773634][T17055] ? __fget_files+0x3a0/0x420 [ 1294.773666][T17055] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1294.773688][T17055] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1294.773717][T17055] ? __pfx_ksys_write+0x10/0x10 [ 1294.773750][T17055] do_syscall_64+0x14d/0xf80 [ 1294.773773][T17055] ? trace_irq_disable+0x3b/0x150 [ 1294.773796][T17055] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1294.773815][T17055] ? clear_bhb_loop+0x40/0x90 [ 1294.773837][T17055] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1294.773855][T17055] RIP: 0033:0x7f8aca39c799 [ 1294.773872][T17055] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1294.773888][T17055] RSP: 002b:00007f8ac85f6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1294.773907][T17055] RAX: ffffffffffffffda RBX: 00007f8aca615fa0 RCX: 00007f8aca39c799 [ 1294.773920][T17055] RDX: 0000000024044884 RSI: 0000200000000300 RDI: 0000000000000003 [ 1294.773932][T17055] RBP: 00007f8ac85f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1294.773943][T17055] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1294.773961][T17055] R13: 00007f8aca616038 R14: 00007f8aca615fa0 R15: 00007fff385cec68 [ 1294.773992][T17055] [ 1295.220637][T17058] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12476'. [ 1295.542863][T17034] gre0 speed is unknown, defaulting to 1000 [ 1295.558941][T17057] lo speed is unknown, defaulting to 1000 [ 1295.567513][T17057] wg1 speed is unknown, defaulting to 1000 [ 1296.247385][T17093] netlink: 32 bytes leftover after parsing attributes in process `syz.0.12482'. [ 1296.523041][T17098] netlink: 28 bytes leftover after parsing attributes in process `syz.3.12483'. [ 1296.533029][T17057] gre0 speed is unknown, defaulting to 1000 [ 1296.547637][T17094] netlink: 192 bytes leftover after parsing attributes in process `syz.0.12482'. [ 1296.642919][T17101] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12484'. [ 1296.871853][T17114] netlink: 'syz.3.12485': attribute type 4 has an invalid length. [ 1296.907304][T17107] bond2: entered allmulticast mode [ 1296.931648][T17114] netlink: 17 bytes leftover after parsing attributes in process `syz.3.12485'. [ 1297.040512][T17107] bridge1: entered promiscuous mode [ 1297.046648][T17107] bridge1: entered allmulticast mode [ 1297.059754][T17107] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 1299.609076][T17101] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1299.912518][T17174] erspan1: entered promiscuous mode [ 1299.935977][T17174] erspan1: entered allmulticast mode [ 1300.043175][T17180] FAULT_INJECTION: forcing a failure. [ 1300.043175][T17180] name failslab, interval 1, probability 0, space 0, times 0 [ 1300.071268][ T1298] lec:lec_start_xmit: lec0:No lecd attached [ 1300.086280][T17180] CPU: 1 UID: 0 PID: 17180 Comm: syz.0.12498 Not tainted syzkaller #0 PREEMPT(full) [ 1300.086306][T17180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1300.086318][T17180] Call Trace: [ 1300.086325][T17180] [ 1300.086334][T17180] dump_stack_lvl+0xe8/0x150 [ 1300.086365][T17180] should_fail_ex+0x412/0x560 [ 1300.086395][T17180] should_failslab+0xa8/0x100 [ 1300.086417][T17180] ? skb_clone+0x212/0x3a0 [ 1300.086438][T17180] kmem_cache_alloc_noprof+0x87/0x650 [ 1300.086457][T17180] ? __netlink_lookup+0xc6/0x8b0 [ 1300.086490][T17180] skb_clone+0x212/0x3a0 [ 1300.086513][T17180] __netlink_deliver_tap+0x404/0x850 [ 1300.086549][T17180] ? netlink_deliver_tap+0x2e/0x1b0 [ 1300.086576][T17180] netlink_deliver_tap+0x19c/0x1b0 [ 1300.086602][T17180] netlink_unicast+0x7e3/0x9b0 [ 1300.086634][T17180] ? __pfx_netlink_unicast+0x10/0x10 [ 1300.086659][T17180] ? netlink_sendmsg+0x650/0xb40 [ 1300.086682][T17180] ? skb_put+0x11b/0x210 [ 1300.086711][T17180] netlink_sendmsg+0x813/0xb40 [ 1300.086746][T17180] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1300.086775][T17180] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1300.086800][T17180] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1300.086825][T17180] ____sys_sendmsg+0x972/0x9f0 [ 1300.086842][T17180] ? __lock_acquire+0x6b5/0x2cf0 [ 1300.086874][T17180] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1300.086903][T17180] ? import_iovec+0x73/0xa0 [ 1300.086934][T17180] ___sys_sendmsg+0x2a5/0x360 [ 1300.086958][T17180] ? __pfx____sys_sendmsg+0x10/0x10 [ 1300.086982][T17180] ? kstrtouint+0x6e/0xe0 [ 1300.087037][T17180] ? __fget_files+0x2a/0x420 [ 1300.087062][T17180] ? __fget_files+0x3a0/0x420 [ 1300.087097][T17180] __sys_sendmmsg+0x27c/0x4e0 [ 1300.087123][T17180] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1300.087140][T17180] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1300.087193][T17180] ? ksys_write+0x242/0x270 [ 1300.087216][T17180] ? __pfx_ksys_write+0x10/0x10 [ 1300.087243][T17180] __x64_sys_sendmmsg+0xa0/0xc0 [ 1300.087267][T17180] do_syscall_64+0x14d/0xf80 [ 1300.087291][T17180] ? trace_irq_disable+0x3b/0x150 [ 1300.087316][T17180] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1300.087335][T17180] ? clear_bhb_loop+0x40/0x90 [ 1300.087357][T17180] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1300.087376][T17180] RIP: 0033:0x7f2d9719c799 [ 1300.087393][T17180] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1300.087409][T17180] RSP: 002b:00007f2d98071028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1300.087428][T17180] RAX: ffffffffffffffda RBX: 00007f2d97415fa0 RCX: 00007f2d9719c799 [ 1300.087442][T17180] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000003 [ 1300.087453][T17180] RBP: 00007f2d98071090 R08: 0000000000000000 R09: 0000000000000000 [ 1300.087465][T17180] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1300.087475][T17180] R13: 00007f2d97416038 R14: 00007f2d97415fa0 R15: 00007ffcc372ef18 [ 1300.087506][T17180] [ 1300.089935][T17180] netlink: 'syz.0.12498': attribute type 25 has an invalid length. [ 1300.392478][T17180] netlink: 'syz.0.12498': attribute type 29 has an invalid length. [ 1300.794484][T17201] "syz.3.12503" (17201) uses obsolete ecb(arc4) skcipher [ 1300.867817][T17198] netlink: 28 bytes leftover after parsing attributes in process `syz.3.12503'. [ 1300.975843][T17203] netdevsim netdevsim4: Direct firmware load for /tun failed with error -2 [ 1300.987714][T17203] netdevsim netdevsim4: Falling back to sysfs fallback for: /tun [ 1301.019228][T17205] sctp: [Deprecated]: syz.1.12505 (pid 17205) Use of int in max_burst socket option deprecated. [ 1301.019228][T17205] Use struct sctp_assoc_value instead [ 1301.128234][T17210] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1500) ! [ 1301.410325][T17221] netlink: 'syz.0.12511': attribute type 13 has an invalid length. [ 1301.418372][T17219] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12510'. [ 1301.446340][T17219] team0: Port device team_slave_0 removed [ 1301.469285][T15217] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1301.472946][T17221] netlink: 'syz.0.12511': attribute type 13 has an invalid length. [ 1301.489038][T15217] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1301.527142][T15217] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1301.562848][T15217] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1301.609855][T17224] netlink: 'syz.3.12512': attribute type 2 has an invalid length. [ 1301.614851][T17226] FAULT_INJECTION: forcing a failure. [ 1301.614851][T17226] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1301.646844][T17226] CPU: 0 UID: 0 PID: 17226 Comm: syz.0.12513 Not tainted syzkaller #0 PREEMPT(full) [ 1301.646881][T17226] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1301.646892][T17226] Call Trace: [ 1301.646900][T17226] [ 1301.646908][T17226] dump_stack_lvl+0xe8/0x150 [ 1301.646937][T17226] should_fail_ex+0x412/0x560 [ 1301.646962][T17226] _copy_from_user+0x2d/0xb0 [ 1301.646990][T17226] ___sys_sendmsg+0x1c6/0x360 [ 1301.647013][T17226] ? __pfx____sys_sendmsg+0x10/0x10 [ 1301.647080][T17226] __sys_sendmmsg+0x27c/0x4e0 [ 1301.647104][T17226] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1301.647120][T17226] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 1301.647172][T17226] ? ksys_write+0x242/0x270 [ 1301.647194][T17226] ? __pfx_ksys_write+0x10/0x10 [ 1301.647220][T17226] __x64_sys_sendmmsg+0xa0/0xc0 [ 1301.647241][T17226] do_syscall_64+0x14d/0xf80 [ 1301.647265][T17226] ? trace_irq_disable+0x3b/0x150 [ 1301.647289][T17226] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1301.647307][T17226] ? clear_bhb_loop+0x40/0x90 [ 1301.647328][T17226] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1301.647346][T17226] RIP: 0033:0x7f2d9719c799 [ 1301.647362][T17226] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1301.647377][T17226] RSP: 002b:00007f2d98071028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1301.647394][T17226] RAX: ffffffffffffffda RBX: 00007f2d97415fa0 RCX: 00007f2d9719c799 [ 1301.647406][T17226] RDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000003 [ 1301.647417][T17226] RBP: 00007f2d98071090 R08: 0000000000000000 R09: 0000000000000000 [ 1301.647428][T17226] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1301.647436][T17226] R13: 00007f2d97416038 R14: 00007f2d97415fa0 R15: 00007ffcc372ef18 [ 1301.647463][T17226] [ 1302.096473][T17238] sctp: [Deprecated]: syz.1.12516 (pid 17238) Use of int in max_burst socket option deprecated. [ 1302.096473][T17238] Use struct sctp_assoc_value instead [ 1302.177603][T17244] netlink: 'syz.3.12518': attribute type 10 has an invalid length. [ 1302.437950][T17244] 8021q: adding VLAN 0 to HW filter on device team0 [ 1302.449698][T17244] bond0: (slave team0): Enslaving as an active interface with an up link [ 1302.527936][T17250] mac80211_hwsim hwsim136 syzkaller0: entered promiscuous mode [ 1302.574448][T17250] mac80211_hwsim hwsim136 syzkaller0: entered allmulticast mode [ 1302.651791][T17248] lo speed is unknown, defaulting to 1000 [ 1302.705776][T17248] wg1 speed is unknown, defaulting to 1000 [ 1302.708244][T17260] netlink: 'syz.4.12521': attribute type 2 has an invalid length. [ 1302.798032][T17261] block nbd1: reconnected socket [ 1302.804126][ T5824] block nbd1: Receive control failed (result -32) [ 1304.798415][T17248] gre0 speed is unknown, defaulting to 1000 [ 1304.989231][T17289] netlink: 'syz.2.12531': attribute type 89 has an invalid length. [ 1304.998359][T17290] netlink: 'syz.2.12531': attribute type 89 has an invalid length. [ 1305.091955][T17296] netlink: 'syz.3.12533': attribute type 1 has an invalid length. [ 1305.302841][T17307] xt_hashlimit: size too large, truncated to 1048576 [ 1305.380548][T17312] ¾x9ÿ: renamed from bridge_slave_0 [ 1305.735954][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5660 ms [ 1305.744025][ C0] lec:lec_tx_timeout: lec0 [ 1306.062134][T17314] lo speed is unknown, defaulting to 1000 [ 1306.125259][T17314] wg1 speed is unknown, defaulting to 1000 [ 1306.432291][T17314] gre0 speed is unknown, defaulting to 1000 [ 1306.559504][T17331] lo speed is unknown, defaulting to 1000 [ 1306.580629][T17331] wg1 speed is unknown, defaulting to 1000 [ 1306.580662][T17338] lo speed is unknown, defaulting to 1000 [ 1306.612607][T17337] lo speed is unknown, defaulting to 1000 [ 1306.787058][T17351] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12548'. [ 1306.909562][T17338] wg1 speed is unknown, defaulting to 1000 [ 1306.930065][T17353] netlink: 'syz.3.12549': attribute type 83 has an invalid length. [ 1306.941730][T17353] sctp: [Deprecated]: syz.3.12549 (pid 17353) Use of int in max_burst socket option. [ 1306.941730][T17353] Use struct sctp_assoc_value instead [ 1307.092597][T17355] mac80211_hwsim hwsim134 syzkaller0: entered promiscuous mode [ 1307.101327][T17355] mac80211_hwsim hwsim134 syzkaller0: entered allmulticast mode [ 1307.109769][T30415] block nbd6: Possible stuck request ffff888026bb0000: control (read@0,1024B). Runtime 180 seconds [ 1307.120723][T30415] block nbd6: Possible stuck request ffff888026bb0200: control (read@1024,1024B). Runtime 180 seconds [ 1307.131912][T30415] block nbd6: Possible stuck request ffff888026bb0400: control (read@2048,1024B). Runtime 180 seconds [ 1307.143262][T30415] block nbd6: Possible stuck request ffff888026bb0600: control (read@3072,1024B). Runtime 180 seconds [ 1307.505650][T17337] wg1 speed is unknown, defaulting to 1000 [ 1307.731773][T17337] gre0 speed is unknown, defaulting to 1000 [ 1307.799640][T17373] tipc: Started in network mode [ 1307.804966][T17373] tipc: Node identity 4200000088, cluster identity 4711 [ 1307.812216][T17373] tipc: Enabled bearer , priority 0 [ 1307.968025][T17331] gre0 speed is unknown, defaulting to 1000 [ 1308.489785][T17389] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 1308.489891][T17390] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 1308.502494][T17338] gre0 speed is unknown, defaulting to 1000 [ 1308.933614][T16000] tipc: Node number set to 3388997632 [ 1310.056023][T17432] netlink: 132 bytes leftover after parsing attributes in process `syz.3.12576'. [ 1310.068276][T17433] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12575'. [ 1310.096258][T17434] net_ratelimit: 1588 callbacks suppressed [ 1310.096280][T17434] openvswitch: netlink: Unexpected mask (mask=240040, allowed=10048) [ 1310.175908][T17434] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12577'. [ 1310.747119][T17432] lo speed is unknown, defaulting to 1000 [ 1310.844133][T17432] wg1 speed is unknown, defaulting to 1000 [ 1311.359416][T17478] netlink: 68 bytes leftover after parsing attributes in process `syz.4.12589'. [ 1311.477775][T17432] gre0 speed is unknown, defaulting to 1000 [ 1311.914828][T17503] Cannot find del_set index 1 as target [ 1311.968649][T17507] openvswitch: netlink: IP tunnel attribute has 5 unknown bytes. [ 1312.058038][T17511] netlink: 'syz.2.12600': attribute type 7 has an invalid length. [ 1312.085434][T17512] netlink: 'syz.4.12598': attribute type 15 has an invalid length. [ 1312.130792][T17512] netlink: 666 bytes leftover after parsing attributes in process `syz.4.12598'. [ 1312.277235][T17510] delete_channel: no stack [ 1312.914654][T17536] netlink: 28 bytes leftover after parsing attributes in process `syz.0.12606'. [ 1313.029701][T17541] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12608'. [ 1313.174348][T17547] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1313.189960][T17541] bridge21: port 1(veth3) entered blocking state [ 1313.198207][T17541] bridge21: port 1(veth3) entered disabled state [ 1313.204959][T17541] veth3: entered allmulticast mode [ 1313.219371][T17541] veth3: entered promiscuous mode [ 1313.246242][T17551] netlink: 5 bytes leftover after parsing attributes in process `syz.0.12609'. [ 1313.261582][T17543] bridge21: port 2(veth0_to_bond) entered blocking state [ 1313.262090][T17541] block nbd1: NBD_DISCONNECT [ 1313.269948][T17543] bridge21: port 2(veth0_to_bond) entered disabled state [ 1313.282560][T17543] veth0_to_bond: entered allmulticast mode [ 1313.294731][T17543] veth0_to_bond: entered promiscuous mode [ 1313.299247][T17541] block nbd1: Send disconnect failed -32 [ 1313.306422][T17541] block nbd1: Send disconnect failed -32 [ 1313.331564][T17541] block nbd1: Send disconnect failed -32 [ 1313.352552][T17541] block nbd1: Send disconnect failed -32 [ 1313.362625][T17541] block nbd1: shutting down sockets [ 1313.403101][T17548] bridge21: port 3(veth5) entered blocking state [ 1313.410964][T17548] bridge21: port 3(veth5) entered disabled state [ 1313.424516][T17548] veth5: entered allmulticast mode [ 1313.442090][T17548] veth5: entered promiscuous mode [ 1313.565786][T17557] lo speed is unknown, defaulting to 1000 [ 1313.573402][T17557] wg1 speed is unknown, defaulting to 1000 [ 1313.670300][T15217] bridge_slave_1: left allmulticast mode [ 1313.677139][T15217] bridge_slave_1: left promiscuous mode [ 1313.688549][T15217] bridge0: port 2(bridge_slave_1) entered disabled state [ 1313.716763][T15217] bridge_slave_0: left promiscuous mode [ 1313.734707][T15217] bridge0: port 1(bridge_slave_0) entered disabled state [ 1313.766913][T15217] veth5: left allmulticast mode [ 1313.771887][T15217] veth5: left promiscuous mode [ 1313.783688][T15217] bridge3: port 3(veth5) entered disabled state [ 1313.794834][T17565] IPVS: length: 230 != 8 [ 1313.841445][T15217] veth0_to_bond: left allmulticast mode [ 1313.849954][T15217] veth0_to_bond: left promiscuous mode [ 1313.867876][T15217] bridge3: port 2(veth0_to_bond) entered disabled state [ 1313.919162][T15217] veth3: left allmulticast mode [ 1313.934066][T15217] veth3: left promiscuous mode [ 1313.945622][T15217] bridge3: port 1(veth3) entered disabled state [ 1314.141914][T15217] bond1 (unregistering): (slave ip6gretap1): Releasing active interface [ 1314.311031][T15217] bond4 (unregistering): (slave geneve3): Releasing active interface [ 1314.320218][T15217] geneve3 (unregistering): left promiscuous mode [ 1314.327564][T15217] geneve3 (unregistering): left allmulticast mode [ 1315.288248][T15217] bond0 (unregistering): (slave bridge11): Releasing backup interface [ 1315.296849][T15217] bridge11 (unregistering): left promiscuous mode [ 1315.337415][T15217] bond3 (unregistering): (slave bridge12): Releasing backup interface [ 1315.346166][T15217] bridge12 (unregistering): left promiscuous mode [ 1315.430658][T15217] bond1 (unregistering): Released all slaves [ 1315.448543][T15217] bond0 (unregistering): Released all slaves [ 1315.461598][T15217] bond2 (unregistering): (slave veth11): Releasing backup interface [ 1315.476272][T15217] bond2 (unregistering): Released all slaves [ 1315.492773][T15217] bond3 (unregistering): Released all slaves [ 1315.508916][T15217] bond4 (unregistering): Released all slaves [ 1315.528282][T15217] bond5 (unregistering): (slave batadv1): Releasing active interface [ 1315.536479][T15217] batadv1: left promiscuous mode [ 1315.541561][T15217] batadv1: left allmulticast mode [ 1315.548201][T15217] bond5 (unregistering): Released all slaves [ 1315.559813][T17557] gre0 speed is unknown, defaulting to 1000 [ 1315.575718][T17569] vlan2: entered promiscuous mode [ 1315.763137][T15217] : left promiscuous mode [ 1315.832754][T17586] netlink: 'syz.3.12620': attribute type 3 has an invalid length. [ 1315.881709][T17586] nbd: couldn't find device at index 3 [ 1315.888908][T15217] tipc: Disabling bearer [ 1315.922570][T15217] tipc: Left network mode [ 1316.345044][T17613] netlink: 16 bytes leftover after parsing attributes in process `syz.1.12628'. [ 1316.413128][T17608] lo speed is unknown, defaulting to 1000 [ 1316.426289][T17608] wg1 speed is unknown, defaulting to 1000 [ 1316.442763][T17614] lo speed is unknown, defaulting to 1000 [ 1316.757293][T17614] wg1 speed is unknown, defaulting to 1000 [ 1316.927296][T17614] gre0 speed is unknown, defaulting to 1000 [ 1317.082219][T17608] gre0 speed is unknown, defaulting to 1000 [ 1317.088305][T17621] lo speed is unknown, defaulting to 1000 [ 1317.480197][T17621] wg1 speed is unknown, defaulting to 1000 [ 1317.875763][T17638] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12636'. [ 1317.885815][T17638] netlink: 16 bytes leftover after parsing attributes in process `syz.0.12636'. [ 1317.913341][T17621] gre0 speed is unknown, defaulting to 1000 [ 1317.917177][ T29] audit: type=1800 audit(1773848738.375:19): pid=17638 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.12636" name="memory.events" dev="tmpfs" ino=641 res=0 errno=0 [ 1318.024211][ T29] audit: type=1804 audit(1773848738.405:20): pid=17638 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.12636" name="/newroot/123/memory.events" dev="tmpfs" ino=641 res=1 errno=0 [ 1318.382121][T17657] IPv6: Can't replace route, no match found [ 1318.689316][T17668] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12643'. [ 1318.708808][T17668] netlink: 16 bytes leftover after parsing attributes in process `syz.4.12643'. [ 1318.744867][T17668] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12643'. [ 1318.765309][T17668] netlink: 36 bytes leftover after parsing attributes in process `syz.4.12643'. [ 1318.810544][T17674] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1318.819292][T17674] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1318.832207][T17674] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1318.840778][T17674] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1318.942362][T17677] netlink: 'syz.4.12646': attribute type 3 has an invalid length. [ 1318.954152][T17677] netlink: 'syz.4.12646': attribute type 1 has an invalid length. [ 1318.968627][T17677] netlink: 60387 bytes leftover after parsing attributes in process `syz.4.12646'. [ 1319.226381][T17686] netlink: 100 bytes leftover after parsing attributes in process `syz.4.12649'. [ 1319.291312][T17681] bridge0: port 3(gretap0) entered disabled state [ 1319.343893][T17688] netlink: 'syz.0.12647': attribute type 8 has an invalid length. [ 1319.389254][T17681] bridge0: port 2(bridge_slave_1) entered disabled state [ 1319.396927][T17681] bridge0: port 1(bridge_slave_0) entered disabled state [ 1319.592891][T15217] hsr_slave_0: left promiscuous mode [ 1319.618037][T15217] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1319.628783][T15217] hsr0: left allmulticast mode [ 1319.707110][T17697] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12651'. [ 1320.303635][T17715] netlink: 24 bytes leftover after parsing attributes in process `syz.4.12652'. [ 1320.756413][T17728] nbd: socks must be embedded in a SOCK_ITEM attr [ 1320.801724][T17728] nbd: nbd64 already in use [ 1321.235063][T17748] tipc: Enabling of bearer rejected, failed to enable media [ 1321.906242][T17776] gretap1: entered promiscuous mode [ 1321.925423][T17776] batman_adv: batadv0: Adding interface: gretap1 [ 1321.974247][T17776] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1322.030677][T17776] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 1322.328992][T17807] netlink: 'syz.3.12673': attribute type 4 has an invalid length. [ 1322.385950][T17809] netlink: 'syz.3.12673': attribute type 4 has an invalid length. [ 1322.498891][T17812] bond0: left promiscuous mode [ 1322.531371][T17812] bridge2: left promiscuous mode [ 1322.557473][T17812] bridge20: left promiscuous mode [ 1322.584362][T17812] bridge20: left allmulticast mode [ 1322.589678][T17812] vlan2: left promiscuous mode [ 1322.612258][T17812] geneve1: left promiscuous mode [ 1322.625843][T17812] vlan2: left allmulticast mode [ 1322.632935][T17812] geneve1: left allmulticast mode [ 1322.672426][T17812] gretap1: left promiscuous mode [ 1322.753291][T17809] lo speed is unknown, defaulting to 1000 [ 1322.858452][T17809] wg1 speed is unknown, defaulting to 1000 [ 1323.109024][T17844] lo speed is unknown, defaulting to 1000 [ 1323.433392][T17859] __nla_validate_parse: 8 callbacks suppressed [ 1323.433415][T17859] netlink: 12 bytes leftover after parsing attributes in process `syz.1.12682'. [ 1323.505850][T17859] netem: incorrect ge model size [ 1323.525726][T17859] netem: change failed [ 1323.643600][T17872] lo speed is unknown, defaulting to 1000 [ 1323.788040][T17844] wg1 speed is unknown, defaulting to 1000 [ 1323.788080][T17809] gre0 speed is unknown, defaulting to 1000 [ 1324.331308][T17905] netlink: 4 bytes leftover after parsing attributes in process `syz.4.12688'. [ 1324.391629][T17901] bond1 (unregistering): Released all slaves [ 1324.478469][T17872] wg1 speed is unknown, defaulting to 1000 [ 1324.524549][T17844] gre0 speed is unknown, defaulting to 1000 [ 1324.651346][T17915] netlink: 'syz.1.12690': attribute type 1 has an invalid length. [ 1324.927303][T17922] ip6gre1: entered promiscuous mode [ 1324.932576][T17922] ip6gre1: entered allmulticast mode [ 1325.191766][T17938] xt_hashlimit: size too large, truncated to 1048576 [ 1325.198426][T17872] gre0 speed is unknown, defaulting to 1000 [ 1326.552806][T17971] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12701'. [ 1326.632574][T17976] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1326.710613][T17978] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1326.751571][T17976] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1326.879209][T15999] IPVS: starting estimator thread 0... [ 1326.919895][T17982] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12704'. [ 1326.993585][T17988] IPVS: using max 29 ests per chain, 69600 per kthread [ 1327.344894][T18004] lo speed is unknown, defaulting to 1000 [ 1327.366497][T18004] wg1 speed is unknown, defaulting to 1000 [ 1327.431688][T18010] vlan2: entered promiscuous mode [ 1327.444337][T18010] geneve1: entered promiscuous mode [ 1327.466529][T18010] vlan2: entered allmulticast mode [ 1327.471697][T18010] geneve1: entered allmulticast mode [ 1327.635584][T18018] bridge0: port 2(bridge_slave_1) entered disabled state [ 1327.643342][T18018] bridge0: port 1(bridge_slave_0) entered disabled state [ 1327.806279][T18028] netlink: 4 bytes leftover after parsing attributes in process `syz.1.12716'. [ 1328.037657][T18018] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1328.055221][T18018] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1328.151791][T18018] bond2: left allmulticast mode [ 1328.161681][T18018] bridge1: left promiscuous mode [ 1328.167418][T18018] bridge1: left allmulticast mode [ 1328.185595][T18018] mac80211_hwsim hwsim134 syzkaller0: left promiscuous mode [ 1328.192912][T18018] mac80211_hwsim hwsim134 syzkaller0: left allmulticast mode [ 1328.201039][T18018] vlan2: left promiscuous mode [ 1328.206747][T18018] geneve1: left promiscuous mode [ 1328.211813][T18018] vlan2: left allmulticast mode [ 1328.219394][T18018] geneve1: left allmulticast mode [ 1328.230330][T18004] gre0 speed is unknown, defaulting to 1000 [ 1328.236687][T18045] netlink: 28 bytes leftover after parsing attributes in process `syz.2.12718'. [ 1328.248827][T18045] netlink: 28 bytes leftover after parsing attributes in process `syz.2.12718'. [ 1328.276513][T15215] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1328.336064][T15215] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1328.353194][T15215] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1328.383694][T15215] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1328.707750][T18007] infiniband !yz!: set active [ 1328.717066][T18012] lo speed is unknown, defaulting to 1000 [ 1328.723316][T18007] infiniband !yz!: added team_slave_0 [ 1328.756173][T18007] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 1328.759947][T18007] infiniband !yz!: Couldn't open port 1 [ 1328.856634][T18012] wg1 speed is unknown, defaulting to 1000 [ 1328.927841][T18007] RDS/IB: !yz!: added [ 1328.931921][T18007] smc: adding ib device !yz! with port count 1 [ 1328.966785][T18007] smc: ib device !yz! port 1 has no pnetid [ 1329.001190][T18099] lo speed is unknown, defaulting to 1000 [ 1329.022106][T18102] x_tables: duplicate underflow at hook 3 [ 1329.107553][T18110] netlink: 'syz.3.12729': attribute type 3 has an invalid length. [ 1329.389967][T18118] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12731'. [ 1329.409602][T18099] wg1 speed is unknown, defaulting to 1000 [ 1329.495615][T18121] netlink: 'syz.1.12732': attribute type 25 has an invalid length. [ 1329.523184][T18121] netlink: 'syz.1.12732': attribute type 29 has an invalid length. [ 1329.731890][T18123] veth1: entered allmulticast mode [ 1329.862105][T18137] netlink: 'syz.1.12735': attribute type 3 has an invalid length. [ 1329.917968][T18139] batadv_slave_0: entered promiscuous mode [ 1330.030014][T18138] batadv_slave_0: left promiscuous mode [ 1330.455558][T18123] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1331.389285][T18167] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12743'. [ 1331.486317][T15424] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 1331.564137][T15424] CPU: 1 UID: 0 PID: 15424 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 1331.564166][T15424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1331.564178][T15424] Call Trace: [ 1331.564186][T15424] [ 1331.564194][T15424] dump_stack_lvl+0xe8/0x150 [ 1331.564225][T15424] dump_header+0xd3/0x4c0 [ 1331.564282][T15424] oom_kill_process+0x3ab/0x970 [ 1331.564314][T15424] out_of_memory+0x106c/0x1410 [ 1331.564332][T15424] ? percpu_ref_put+0x19/0x180 [ 1331.564355][T15424] ? __pfx___mutex_lock+0x10/0x10 [ 1331.564389][T15424] ? __pfx_out_of_memory+0x10/0x10 [ 1331.564405][T15424] ? do_raw_spin_unlock+0xf5/0x210 [ 1331.564435][T15424] try_charge_memcg+0xc53/0x1560 [ 1331.564457][T15424] ? __lock_acquire+0x6b5/0x2cf0 [ 1331.564494][T15424] ? __pfx_try_charge_memcg+0x10/0x10 [ 1331.564512][T15424] ? xa_load+0x60/0x210 [ 1331.564614][T15424] ? mem_cgroup_swapin_charge_folio+0x36/0x4d0 [ 1331.564640][T15424] ? mem_cgroup_swapin_charge_folio+0x36/0x4d0 [ 1331.564665][T15424] mem_cgroup_swapin_charge_folio+0x2e3/0x4d0 [ 1331.564691][T15424] __swap_cache_prepare_and_add+0x52a/0x700 [ 1331.564737][T15424] swap_cache_alloc_folio+0xf1/0x240 [ 1331.564767][T15424] swap_cluster_readahead+0x369/0x690 [ 1331.564801][T15424] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 1331.564842][T15424] ? get_vma_policy+0x27b/0x3c0 [ 1331.564868][T15424] swapin_readahead+0x196/0xc50 [ 1331.564894][T15424] ? filemap_map_pages+0x185/0x2050 [ 1331.564927][T15424] ? __pfx_swapin_readahead+0x10/0x10 [ 1331.564955][T15424] ? swap_table_get+0x1e/0x260 [ 1331.564978][T15424] ? swap_table_get+0x1e/0x260 [ 1331.565000][T15424] ? swap_table_get+0x1e/0x260 [ 1331.565025][T15424] ? swap_table_get+0x216/0x260 [ 1331.565051][T15424] ? swap_cache_get_folio+0x513/0x520 [ 1331.565088][T15424] do_swap_page+0x56f/0x5a20 [ 1331.565132][T15424] ? do_swap_page+0x127/0x5a20 [ 1331.565155][T15424] ? __pfx_do_swap_page+0x10/0x10 [ 1331.565177][T15424] ? __pte_offset_map+0x1ae/0x240 [ 1331.565209][T15424] ? pte_offset_map_rw_nolock+0xea/0x160 [ 1331.565238][T15424] handle_mm_fault+0x12d2/0x3310 [ 1331.565279][T15424] ? handle_mm_fault+0xee/0x3310 [ 1331.565313][T15424] ? __pfx_handle_mm_fault+0x10/0x10 [ 1331.565336][T15424] ? lock_vma_under_rcu+0x45a/0x500 [ 1331.565383][T15424] do_user_addr_fault+0xa73/0x1340 [ 1331.565420][T15424] ? rcu_is_watching+0x15/0xb0 [ 1331.565446][T15424] ? trace_page_fault_user+0x84/0x210 [ 1331.565472][T15424] exc_page_fault+0x6a/0xc0 [ 1331.565499][T15424] asm_exc_page_fault+0x26/0x30 [ 1331.565516][T15424] RIP: 0033:0x7f705c06a7b7 [ 1331.565535][T15424] Code: 00 00 48 b8 db 34 b6 d7 82 de 1b 43 48 f7 a4 24 98 00 00 00 48 8b 05 00 b0 ed 00 48 69 8c 24 90 00 00 00 e8 03 00 00 8b 78 08 <48> 8b 44 24 18 48 c1 ea 12 4c 8b 0d f9 ae ed 00 48 01 d1 39 7c 24 [ 1331.565551][T15424] RSP: 002b:00007ffc9b36b6f0 EFLAGS: 00010202 [ 1331.565568][T15424] RAX: 0000001b2fd24000 RBX: 00000000000001f7 RCX: 0000000000144f38 [ 1331.565581][T15424] RDX: 0000000004af44ca RSI: 00007ffc9b36b780 RDI: 000000000000001c [ 1331.565593][T15424] RBP: 00007ffc9b36b72c R08: 7fffffffffffffff R09: 3fffffffffffffff [ 1331.565606][T15424] R10: 4000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 1331.565618][T15424] R13: 00000000000927c0 R14: 0000000000144d1b R15: 00007ffc9b36b780 [ 1331.565651][T15424] [ 1331.565659][T15424] memory: usage 307200kB, limit 307200kB, failcnt 730 [ 1331.640785][T18170] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12744'. [ 1331.647673][T15424] memory+swap: usage 307376kB, limit 9007199254740988kB, failcnt 0 [ 1331.647786][T15424] kmem: usage 307160kB, limit 9007199254740988kB, failcnt 0 [ 1331.647801][T15424] Memory cgroup stats for /syz1: [ 1331.648317][T15424] cache 0 [ 1331.648328][T15424] rss 4096 [ 1331.648336][T15424] rss_huge 0 [ 1331.648344][T15424] shmem 0 [ 1331.648352][T15424] mapped_file 0 [ 1331.648360][T15424] dirty 0 [ 1331.648368][T15424] writeback 0 [ 1331.648376][T15424] workingset_refault_anon 40 [ 1331.648385][T15424] workingset_refault_file 84 [ 1331.648394][T15424] swap 180224 [ 1331.648402][T15424] swapcached 221184 [ 1331.648410][T15424] pgpgin 355252 [ 1331.648418][T15424] pgpgout 355242 [ 1331.648426][T15424] pgfault 655038 [ 1331.648435][T15424] pgmajfault 19 [ 1331.648444][T15424] inactive_anon 36864 [ 1331.648451][T15424] active_anon 0 [ 1331.648460][T15424] inactive_file 0 [ 1331.648477][T15424] active_file 0 [ 1331.648486][T15424] unevictable 0 [ 1331.648494][T15424] hierarchical_memory_limit 314572800 [ 1331.648504][T15424] hierarchical_memsw_limit 9223372036854771712 [ 1331.648514][T15424] total_cache 0 [ 1331.648522][T15424] total_rss 4096 [ 1331.648530][T15424] total_rss_huge 0 [ 1331.648539][T15424] total_shmem 0 [ 1331.648547][T15424] total_mapped_file 0 [ 1331.648556][T15424] total_dirty 0 [ 1331.648564][T15424] total_writeback 0 [ 1331.648573][T15424] total_workingset_refault_anon 40 [ 1331.648582][T15424] total_workingset_refault_file 84 [ 1331.648591][T15424] total_swap 180224 [ 1331.648600][T15424] total_swapcached 221184 [ 1331.648609][T15424] total_pgpgin 355252 [ 1331.648618][T15424] total_pgpgout 355242 [ 1331.648626][T15424] total_pgfault 655056 [ 1331.648635][T15424] total_pgmajfault 19 [ 1331.648643][T15424] total_inactive_anon 36864 [ 1331.648652][T15424] total_active_anon 0 [ 1331.648660][T15424] total_inactive_file 0 [ 1331.648669][T15424] total_active_file 0 [ 1331.648677][T15424] total_unevictable 0 [ 1331.648686][T15424] anon_cost 0 [ 1331.648694][T15424] file_cost 0 [ 1331.648703][T15424] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz1,task_memcg=/syz1,task=syz.1.12738,pid=18142,uid=0 [ 1332.260502][T15424] Memory cgroup out of memory: Killed process 18142 (syz.1.12738) total-vm:108704kB, anon-rss:1340kB, file-rss:27128kB, shmem-rss:0kB, UID:0 pgtables:148kB oom_score_adj:1000 [ 1332.438662][T18174] syzkaller1: entered promiscuous mode [ 1332.463520][T18174] syzkaller1: entered allmulticast mode [ 1332.995863][T18186] netlink: 'syz.3.12751': attribute type 6 has an invalid length. [ 1333.081931][T18191] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12752'. [ 1333.547507][T18204] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12754'. [ 1333.557538][ T5194] udevd[5194]: worker [8087] /devices/virtual/block/nbd6 timeout; kill it [ 1333.575590][ T5194] udevd[5194]: seq 54856 '/devices/virtual/block/nbd6' killed [ 1334.394026][T16256] lec:lec_start_xmit: lec0:No lecd attached [ 1335.657971][T18234] netlink: 132 bytes leftover after parsing attributes in process `syz.1.12764'. [ 1335.675223][T18234] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12764'. [ 1335.712946][T18099] gre0 speed is unknown, defaulting to 1000 [ 1335.886957][T18247] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12765'. [ 1336.169287][T18256] block nbd9: Unsupported socket: should be TCP or UNIX. [ 1336.364501][T18266] macsec0: entered promiscuous mode [ 1336.395102][T18266] macsec0: left promiscuous mode [ 1336.405234][T18268] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12774'. [ 1336.415439][T18268] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12774'. [ 1336.425351][T18275] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12774'. [ 1336.464884][T18275] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12774'. [ 1336.491199][T18268] netlink: 'syz.0.12774': attribute type 1 has an invalid length. [ 1336.507184][T18012] gre0 speed is unknown, defaulting to 1000 [ 1336.587926][T18278] netlink: 'syz.3.12776': attribute type 13 has an invalid length. [ 1336.612995][T18275] bond2: (slave vxcan1): The slave device specified does not support setting the MAC address [ 1336.635519][T18275] bond2: (slave vxcan1): Error -95 calling set_mac_address [ 1336.714693][T18268] bond2: (slave bridge1): Enslaving as an active interface with a down link [ 1336.881977][T18290] veth1_macvtap: left promiscuous mode [ 1336.888910][T18290] macsec0: entered promiscuous mode [ 1336.919788][T18288] lo speed is unknown, defaulting to 1000 [ 1336.928084][T18288] wg1 speed is unknown, defaulting to 1000 [ 1337.009385][T18299] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12780'. [ 1337.174869][T30415] block nbd6: Possible stuck request ffff888026bb0000: control (read@0,1024B). Runtime 210 seconds [ 1337.185863][T30415] block nbd6: Possible stuck request ffff888026bb0200: control (read@1024,1024B). Runtime 210 seconds [ 1337.197194][T30415] block nbd6: Possible stuck request ffff888026bb0400: control (read@2048,1024B). Runtime 210 seconds [ 1337.208526][T30415] block nbd6: Possible stuck request ffff888026bb0600: control (read@3072,1024B). Runtime 210 seconds [ 1337.550237][T18288] gre0 speed is unknown, defaulting to 1000 [ 1337.722841][T18322] netlink: 28 bytes leftover after parsing attributes in process `syz.0.12786'. [ 1337.749880][T18322] vlan2: entered promiscuous mode [ 1337.755285][T18322] veth0_to_team: entered promiscuous mode [ 1337.761258][T18322] vlan2: entered allmulticast mode [ 1337.766889][T18322] veth0_to_team: entered allmulticast mode [ 1337.875691][T18324] netlink: 56 bytes leftover after parsing attributes in process `syz.0.12787'. [ 1338.216215][T18335] netlink: 'syz.3.12790': attribute type 1 has an invalid length. [ 1338.304109][T18335] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1338.320244][T18336] vlan3: entered promiscuous mode [ 1338.326091][T18336] bond3: entered promiscuous mode [ 1338.332766][T18336] vlan3: entered allmulticast mode [ 1338.339224][T18336] bond3: entered allmulticast mode [ 1339.146509][T18359] netlink: 'syz.3.12797': attribute type 4 has an invalid length. [ 1339.287930][T18364] mac80211_hwsim hwsim134 syzkaller0: Caught tx_queue_len zero misconfig [ 1339.436020][T18364] mac80211_hwsim hwsim134 syzkaller0: entered promiscuous mode [ 1339.463982][T18364] mac80211_hwsim hwsim134 syzkaller0: entered allmulticast mode [ 1339.733637][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5340 ms [ 1339.741746][ C0] lec:lec_tx_timeout: lec0 [ 1339.763036][T18382] netlink: 'syz.2.12803': attribute type 3 has an invalid length. [ 1339.842846][T18380] lo speed is unknown, defaulting to 1000 [ 1339.901305][T18380] wg1 speed is unknown, defaulting to 1000 [ 1340.442240][T18380] gre0 speed is unknown, defaulting to 1000 [ 1340.542152][T18410] sctp: [Deprecated]: syz.1.12809 (pid 18410) Use of int in maxseg socket option. [ 1340.542152][T18410] Use struct sctp_assoc_value instead [ 1340.919650][T18418] netlink: 'syz.0.12812': attribute type 10 has an invalid length. [ 1341.825629][T18440] ip6gretap1: entered promiscuous mode [ 1341.832065][T18440] ip6gretap1: entered allmulticast mode [ 1342.032590][T18448] __nla_validate_parse: 5 callbacks suppressed [ 1342.032611][T18448] netlink: 12 bytes leftover after parsing attributes in process `syz.4.12820'. [ 1342.207024][T18448] bond1: entered promiscuous mode [ 1342.214051][T18448] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1342.283304][T18460] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12822'. [ 1342.577864][T18469] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.12826'. [ 1342.729307][T18472] lo speed is unknown, defaulting to 1000 [ 1342.881718][T18472] wg1 speed is unknown, defaulting to 1000 [ 1342.996693][T18487] netlink: 4 bytes leftover after parsing attributes in process `syz.2.12831'. [ 1343.029247][T18487] netlink: 12 bytes leftover after parsing attributes in process `syz.2.12831'. [ 1343.268886][T18497] mac80211_hwsim hwsim130 syzkaller0: entered promiscuous mode [ 1343.315945][T18497] mac80211_hwsim hwsim130 syzkaller0: entered allmulticast mode [ 1343.568030][T18504] vlan0: entered promiscuous mode [ 1343.573226][T18504] dummy0: entered promiscuous mode [ 1343.649715][T18472] gre0 speed is unknown, defaulting to 1000 [ 1343.906211][T18514] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12837'. [ 1343.977898][T18514] hsr_slave_1 (unregistering): left promiscuous mode [ 1344.034545][T18519] xfrm1: entered promiscuous mode [ 1344.042088][T18518] veth0_to_bridge: Caught tx_queue_len zero misconfig [ 1344.091447][T18518] pim6reg: entered allmulticast mode [ 1344.260176][T18526] netlink: 'syz.3.12841': attribute type 2 has an invalid length. [ 1344.278906][T18526] netlink: 60 bytes leftover after parsing attributes in process `syz.3.12841'. [ 1344.509039][T18531] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12843'. [ 1344.540002][T18537] netlink: 20 bytes leftover after parsing attributes in process `syz.2.12845'. [ 1344.555479][T18531] netlink: 12 bytes leftover after parsing attributes in process `syz.3.12843'. [ 1344.688563][T18544] netlink: 'syz.2.12845': attribute type 9 has an invalid length. [ 1346.068027][T18584] nbd: socks must be embedded in a SOCK_ITEM attr [ 1346.648489][T18612] xt_nfacct: accounting object `syz0' does not exist [ 1346.731125][T18617] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1346.820729][T18622] netlink: 'syz.0.12869': attribute type 10 has an invalid length. [ 1346.837456][T18622] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1346.906571][T18629] TCP: TCP_TX_DELAY enabled [ 1347.061832][T18639] A link change request failed with some changes committed already. Interface ip6gre0 may have been left with an inconsistent configuration, please check. [ 1347.223325][T18657] __nla_validate_parse: 6 callbacks suppressed [ 1347.223367][T18657] netlink: 212 bytes leftover after parsing attributes in process `syz.2.12879'. [ 1347.379862][T18664] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1347.441613][T18668] netlink: 5 bytes leftover after parsing attributes in process `syz.2.12882'. [ 1347.559954][T18672] netlink: 'syz.4.12885': attribute type 10 has an invalid length. [ 1347.573757][T18672] team0: Failed to send options change via netlink (err -105) [ 1347.581366][T18672] team0: Port device dummy0 added [ 1347.711902][T18680] 8021q: VLANs not supported on lo [ 1347.935532][T18691] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12890'. [ 1347.979670][T18693] sctp: [Deprecated]: syz.3.12892 (pid 18693) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1347.979670][T18693] Use struct sctp_sack_info instead [ 1348.091548][T18701] netlink: 'syz.3.12893': attribute type 1 has an invalid length. [ 1348.101208][T18701] netlink: 240 bytes leftover after parsing attributes in process `syz.3.12893'. [ 1348.202776][T18701] veth0: Caught tx_queue_len zero misconfig [ 1348.250897][T18713] netlink: 24 bytes leftover after parsing attributes in process `syz.1.12897'. [ 1348.459998][T18718] netlink: 8 bytes leftover after parsing attributes in process `syz.3.12900'. [ 1348.481742][T18729] netlink: 'syz.2.12901': attribute type 10 has an invalid length. [ 1348.502852][T18729] team0: Port device dummy0 added [ 1348.686462][T18735] delete_channel: no stack [ 1348.765181][T18746] x_tables: duplicate underflow at hook 4 [ 1349.779644][T18762] netlink: 12 bytes leftover after parsing attributes in process `syz.0.12911'. [ 1349.890919][T18762] bond3: entered promiscuous mode [ 1349.922092][T18762] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1350.006834][T18781] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12913'. [ 1350.419772][T18794] netlink: 8 bytes leftover after parsing attributes in process `syz.4.12917'. [ 1351.238794][T18815] netlink: 'syz.1.12921': attribute type 3 has an invalid length. [ 1351.889082][T18827] tipc: Enabling of bearer rejected, already enabled [ 1351.902015][T18827] tipc: Resetting bearer [ 1352.102418][T18834] sctp: [Deprecated]: syz.0.12927 (pid 18834) Use of int in maxseg socket option. [ 1352.102418][T18834] Use struct sctp_assoc_value instead [ 1352.133041][T18834] netlink: 'syz.0.12927': attribute type 10 has an invalid length. [ 1352.158427][T18834] netlink: 'syz.0.12927': attribute type 3 has an invalid length. [ 1352.684284][T18840] lo speed is unknown, defaulting to 1000 [ 1352.711547][T18840] wg1 speed is unknown, defaulting to 1000 [ 1352.754792][T18841] syzkaller0: entered promiscuous mode [ 1352.777319][T18841] syzkaller0: entered allmulticast mode [ 1353.250632][T18847] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 1353.269601][T18856] netlink: 'syz.3.12934': attribute type 1 has an invalid length. [ 1353.296075][T18840] gre0 speed is unknown, defaulting to 1000 [ 1353.297182][T18850] lo speed is unknown, defaulting to 1000 [ 1353.345883][T18856] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1353.353321][T18850] wg1 speed is unknown, defaulting to 1000 [ 1353.380320][T18858] bond4: (slave geneve2): making interface the new active one [ 1353.412752][T18858] bond4: (slave geneve2): Enslaving as an active interface with an up link [ 1353.435031][T15221] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1353.491405][T15221] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1353.540586][T15221] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1353.820302][T18875] netlink: 'syz.0.12937': attribute type 1 has an invalid length. [ 1353.829200][T18874] netlink: 'syz.0.12937': attribute type 1 has an invalid length. [ 1353.846351][T15221] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1353.906266][T18875] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1354.024605][T18850] gre0 speed is unknown, defaulting to 1000 [ 1354.361942][T18894] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1354.808909][T18905] bond3: option downdelay: invalid value (18446744073709547007) [ 1354.817804][T18905] bond3: option downdelay: allowed values 0 - 2147483647 [ 1354.838085][T18905] bond3 (unregistering): Released all slaves [ 1355.195757][T18928] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 1355.487461][T18938] netlink: 20 bytes leftover after parsing attributes in process `syz.2.12953'. [ 1355.696259][T18943] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12954'. [ 1355.706396][T18943] netlink: 8 bytes leftover after parsing attributes in process `syz.0.12954'. [ 1355.831961][T18948] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12954'. [ 1355.884204][T18943] netlink: 'syz.0.12954': attribute type 1 has an invalid length. [ 1355.910600][T18943] netlink: 96 bytes leftover after parsing attributes in process `syz.0.12954'. [ 1355.943950][T18943] netlink: 658 bytes leftover after parsing attributes in process `syz.0.12954'. [ 1355.953106][T18943] netlink: 1 bytes leftover after parsing attributes in process `syz.0.12954'. [ 1356.027334][T18935] lo speed is unknown, defaulting to 1000 [ 1356.105995][T18935] wg1 speed is unknown, defaulting to 1000 [ 1356.357590][T18967] tipc: Enabling of bearer rejected, already enabled [ 1356.390127][T18967] netlink: 4 bytes leftover after parsing attributes in process `syz.0.12959'. [ 1356.419630][T18967] gretap0: left allmulticast mode [ 1356.440361][T18967] bridge0: port 3(gretap0) entered disabled state [ 1356.501812][T18967] bridge_slave_1: left allmulticast mode [ 1356.526097][T18967] bridge_slave_1: left promiscuous mode [ 1356.547724][T18967] bridge0: port 2(bridge_slave_1) entered disabled state [ 1356.585198][T18967] bridge_slave_0: left allmulticast mode [ 1356.602306][T18967] bridge_slave_0: left promiscuous mode [ 1356.633760][T18967] bridge0: port 1(bridge_slave_0) entered disabled state [ 1356.891590][T18935] gre0 speed is unknown, defaulting to 1000 [ 1356.958561][T18986] netlink: 'syz.0.12964': attribute type 3 has an invalid length. [ 1356.984758][T18988] netlink: 8 bytes leftover after parsing attributes in process `syz.2.12965'. [ 1357.073046][ T29] audit: type=1804 audit(1773848777.525:21): pid=18993 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.12966" name="/newroot/199/cgroup.controllers" dev="tmpfs" ino=1028 res=1 errno=0 [ 1357.115316][T18993] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1357.145498][ T29] audit: type=1800 audit(1773848777.525:22): pid=18993 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.12966" name="cgroup.controllers" dev="tmpfs" ino=1028 res=0 errno=0 [ 1357.214068][ T29] audit: type=1800 audit(1773848777.525:23): pid=18993 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.12966" name="cgroup.controllers" dev="tmpfs" ino=1028 res=0 errno=0 [ 1357.841142][T19026] netlink: 'syz.4.12978': attribute type 3 has an invalid length. [ 1357.900565][T19028] netlink: 8 bytes leftover after parsing attributes in process `syz.1.12977'. [ 1358.197816][T19044] IPVS: length: 124 != 24 [ 1358.827837][T19073] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 1359.282733][T19102] openvswitch: netlink: Actions may not be safe on all matching packets [ 1359.362056][T19089] lo speed is unknown, defaulting to 1000 [ 1359.432868][T19089] wg1 speed is unknown, defaulting to 1000 [ 1359.470439][T19102] bond6: (slave vcan1): refused to change device type [ 1359.855924][T19089] gre0 speed is unknown, defaulting to 1000 [ 1360.161801][T19131] netlink: 'syz.2.13007': attribute type 3 has an invalid length. [ 1360.550145][T19154] x_tables: duplicate underflow at hook 1 [ 1360.651415][T19161] __nla_validate_parse: 7 callbacks suppressed [ 1360.651434][T19161] netlink: 64 bytes leftover after parsing attributes in process `syz.2.13013'. [ 1360.718219][T19149] sctp: [Deprecated]: syz.3.13011 (pid 19149) Use of int in max_burst socket option deprecated. [ 1360.718219][T19149] Use struct sctp_assoc_value instead [ 1361.434578][T19173] netlink: 76 bytes leftover after parsing attributes in process `syz.1.13016'. [ 1361.495901][T19180] netlink: 'syz.2.13018': attribute type 3 has an invalid length. [ 1361.514556][ T1298] lec:lec_start_xmit: lec0:No lecd attached [ 1361.652388][T19185] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13022'. [ 1361.691375][T15204] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1361.703348][T19185] netlink: 4 bytes leftover after parsing attributes in process `syz.4.13022'. [ 1361.723744][T15204] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1361.753070][T15204] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1361.798307][T15204] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1361.871553][T19203] netlink: 'syz.3.13026': attribute type 2 has an invalid length. [ 1361.935788][T19203] xt_ecn: cannot match TCP bits for non-tcp packets [ 1361.942611][T19205] xt_ecn: cannot match TCP bits for non-tcp packets [ 1362.192568][T19225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.13030'. [ 1362.329802][T19229] syzkaller1: entered promiscuous mode [ 1362.344186][T19229] syzkaller1: entered allmulticast mode [ 1362.409334][T19219] netlink: 20 bytes leftover after parsing attributes in process `syz.2.13030'. [ 1362.409500][T19221] lo speed is unknown, defaulting to 1000 [ 1362.418601][T19216] netlink: 40 bytes leftover after parsing attributes in process `syz.3.13029'. [ 1362.485660][T19232] lo speed is unknown, defaulting to 1000 [ 1362.492306][T19221] wg1 speed is unknown, defaulting to 1000 [ 1362.496141][T19207] lo speed is unknown, defaulting to 1000 [ 1362.596025][T19243] netlink: 'syz.1.13034': attribute type 3 has an invalid length. [ 1362.615615][T19244] netlink: 76 bytes leftover after parsing attributes in process `syz.3.13033'. [ 1362.762022][T19221] gre0 speed is unknown, defaulting to 1000 [ 1362.768093][T19232] wg1 speed is unknown, defaulting to 1000 [ 1362.961504][T19252] netlink: 28 bytes leftover after parsing attributes in process `syz.3.13037'. [ 1363.065944][T19255] syzkaller0: entered promiscuous mode [ 1363.071458][T19255] syzkaller0: entered allmulticast mode [ 1363.087299][T19249] lo speed is unknown, defaulting to 1000 [ 1363.175466][T19260] bond5: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 1363.204768][T19260] bond5 (unregistering): Released all slaves [ 1363.240049][T19207] wg1 speed is unknown, defaulting to 1000 [ 1363.247033][T19232] gre0 speed is unknown, defaulting to 1000 [ 1363.375138][T19269] netlink: 'syz.3.13041': attribute type 1 has an invalid length. [ 1363.384480][T19269] netlink: 228 bytes leftover after parsing attributes in process `syz.3.13041'. [ 1363.471219][T19271] ipvlan2: entered promiscuous mode [ 1363.477437][T19271] bridge0: port 3(ipvlan2) entered blocking state [ 1363.487796][T19271] bridge0: port 3(ipvlan2) entered disabled state [ 1363.495010][T19271] ipvlan2: entered allmulticast mode [ 1363.500472][T19271] bridge0: entered allmulticast mode [ 1363.508825][T19271] ipvlan2: left allmulticast mode [ 1363.514372][T19271] bridge0: left allmulticast mode [ 1363.574994][T29099] Bluetooth: hci0: command 0x0401 tx timeout [ 1363.592668][ T5824] [ 1363.595027][ T5824] ====================================================== [ 1363.602038][ T5824] WARNING: possible circular locking dependency detected [ 1363.609065][ T5824] syzkaller #0 Not tainted [ 1363.613472][ T5824] ------------------------------------------------------ [ 1363.620481][ T5824] kworker/u9:3/5824 is trying to acquire lock: [ 1363.626627][ T5824] ffff88801b6dda20 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_unlink_sibling+0x71/0x180 [ 1363.637165][ T5824] [ 1363.637165][ T5824] but task is already holding lock: [ 1363.644522][ T5824] ffff88801b6dd988 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3d/0x130 [ 1363.654505][T19276] netlink: 'syz.3.13044': attribute type 21 has an invalid length. [ 1363.654784][ T5824] [ 1363.654784][ T5824] which lock already depends on the new lock. [ 1363.654784][ T5824] [ 1363.673037][ T5824] [ 1363.673037][ T5824] the existing dependency chain (in reverse order) is: [ 1363.682043][ T5824] [ 1363.682043][ T5824] -> #9 (&root->kernfs_rwsem){++++}-{4:4}: [ 1363.690028][ T5824] down_write+0x96/0x200 [ 1363.694800][ T5824] kernfs_add_one+0x41/0x5c0 [ 1363.699920][ T5824] kernfs_create_dir_ns+0xde/0x130 [ 1363.705535][ T5824] internal_create_group+0x425/0x1180 [ 1363.711414][ T5824] cpuhp_invoke_callback+0x445/0x860 [ 1363.717237][ T5824] cpuhp_issue_call+0x430/0x7a0 [ 1363.722593][ T5824] __cpuhp_setup_state_cpuslocked+0x3d9/0x6b0 [ 1363.729157][ T5824] __cpuhp_setup_state+0x3f/0x60 [ 1363.734594][ T5824] do_one_initcall+0x250/0x8d0 [ 1363.739864][ T5824] do_initcall_level+0x104/0x190 [ 1363.745424][ T5824] do_initcalls+0x59/0xa0 [ 1363.750281][ T5824] kernel_init_freeable+0x2a6/0x3e0 [ 1363.755984][ T5824] kernel_init+0x1d/0x1d0 [ 1363.760814][ T5824] ret_from_fork+0x51e/0xb90 [ 1363.765960][ T5824] ret_from_fork_asm+0x1a/0x30 [ 1363.771229][ T5824] [ 1363.771229][ T5824] -> #8 (cpuhp_state_mutex){+.+.}-{4:4}: [ 1363.779023][ T5824] [ 1363.779023][ T5824] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 1363.786731][ T5824] cpus_read_lock+0x42/0x160 [ 1363.791827][ T5824] static_key_slow_inc+0x12/0x30 [ 1363.797271][ T5824] nbd_genl_reconfigure+0x132f/0x1ea0 [ 1363.803252][ T5824] genl_family_rcv_msg_doit+0x22a/0x330 [ 1363.809299][ T5824] genl_rcv_msg+0x61c/0x7a0 [ 1363.814306][ T5824] netlink_rcv_skb+0x232/0x4b0 [ 1363.819600][ T5824] genl_rcv+0x28/0x40 [ 1363.824088][ T5824] netlink_unicast+0x80f/0x9b0 [ 1363.829358][ T5824] netlink_sendmsg+0x813/0xb40 [ 1363.834630][ T5824] ____sys_sendmsg+0x972/0x9f0 [ 1363.839894][ T5824] ___sys_sendmsg+0x2a5/0x360 [ 1363.845076][ T5824] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1363.850514][ T5824] do_syscall_64+0x14d/0xf80 [ 1363.855609][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1363.862004][ T5824] [ 1363.862004][ T5824] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 1363.869635][ T5824] __mutex_lock+0x19f/0x1300 [ 1363.874763][ T5824] nbd_queue_rq+0x37b/0x1100 [ 1363.879862][ T5824] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 1363.885992][ T5824] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 1363.892873][ T5824] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1363.899381][ T5824] blk_mq_run_hw_queue+0x348/0x4f0 [ 1363.905080][ T5824] blk_mq_dispatch_list+0xd16/0xe10 [ 1363.910785][ T5824] blk_mq_flush_plug_list+0x48d/0x570 [ 1363.916657][ T5824] __blk_flush_plug+0x3ed/0x4d0 [ 1363.922066][ T5824] __submit_bio+0x28d/0x580 [ 1363.927078][ T5824] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 1363.933231][ T5824] block_read_full_folio+0x599/0x830 [ 1363.939043][ T5824] filemap_read_folio+0x137/0x3b0 [ 1363.944572][ T5824] do_read_cache_folio+0x358/0x590 [ 1363.950192][ T5824] read_part_sector+0xb6/0x2b0 [ 1363.955515][ T5824] adfspart_check_ICS+0xa5/0xa40 [ 1363.961032][ T5824] bdev_disk_changed+0x7ba/0x1550 [ 1363.966574][ T5824] blkdev_get_whole+0x380/0x510 [ 1363.971995][ T5824] bdev_open+0x31e/0xd30 [ 1363.976743][ T5824] blkdev_open+0x470/0x610 [ 1363.981661][ T5824] do_dentry_open+0x785/0x14e0 [ 1363.986930][ T5824] vfs_open+0x3b/0x340 [ 1363.991512][ T5824] path_openat+0x2e08/0x3860 [ 1363.996610][ T5824] do_file_open+0x23e/0x4a0 [ 1364.001620][ T5824] do_sys_openat2+0x113/0x200 [ 1364.006813][ T5824] __x64_sys_openat+0x138/0x170 [ 1364.012180][ T5824] do_syscall_64+0x14d/0xf80 [ 1364.017283][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1364.023719][ T5824] [ 1364.023719][ T5824] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 1364.030914][ T5824] __mutex_lock+0x19f/0x1300 [ 1364.036023][ T5824] nbd_queue_rq+0xc6/0x1100 [ 1364.041038][ T5824] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 1364.047088][ T5824] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 1364.053922][ T5824] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 1364.060407][ T5824] blk_mq_run_hw_queue+0x348/0x4f0 [ 1364.066027][ T5824] blk_mq_dispatch_list+0xd16/0xe10 [ 1364.071729][ T5824] blk_mq_flush_plug_list+0x48d/0x570 [ 1364.077614][ T5824] __blk_flush_plug+0x3ed/0x4d0 [ 1364.082974][ T5824] __submit_bio+0x28d/0x580 [ 1364.087985][ T5824] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 1364.094132][ T5824] block_read_full_folio+0x599/0x830 [ 1364.099944][ T5824] filemap_read_folio+0x137/0x3b0 [ 1364.105496][ T5824] do_read_cache_folio+0x358/0x590 [ 1364.111122][ T5824] read_part_sector+0xb6/0x2b0 [ 1364.116388][ T5824] adfspart_check_ICS+0xa5/0xa40 [ 1364.121846][ T5824] bdev_disk_changed+0x7ba/0x1550 [ 1364.127383][ T5824] blkdev_get_whole+0x380/0x510 [ 1364.132750][ T5824] bdev_open+0x31e/0xd30 [ 1364.137491][ T5824] blkdev_open+0x470/0x610 [ 1364.142410][ T5824] do_dentry_open+0x785/0x14e0 [ 1364.147677][ T5824] vfs_open+0x3b/0x340 [ 1364.152251][ T5824] path_openat+0x2e08/0x3860 [ 1364.157341][ T5824] do_file_open+0x23e/0x4a0 [ 1364.162346][ T5824] do_sys_openat2+0x113/0x200 [ 1364.167526][ T5824] __x64_sys_openat+0x138/0x170 [ 1364.172884][ T5824] do_syscall_64+0x14d/0xf80 [ 1364.177981][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1364.184377][ T5824] [ 1364.184377][ T5824] -> #4 (set->srcu){.+.+}-{0:0}: [ 1364.191474][ T5824] __synchronize_srcu+0xca/0x3e0 [ 1364.196918][ T5824] elevator_switch+0x1e8/0x7a0 [ 1364.202198][ T5824] elevator_change+0x2cc/0x450 [ 1364.207461][ T5824] elevator_set_default+0x36c/0x430 [ 1364.213181][ T5824] blk_register_queue+0x366/0x430 [ 1364.218705][ T5824] __add_disk+0x677/0xd50 [ 1364.223537][ T5824] add_disk_fwnode+0xfb/0x480 [ 1364.228717][ T5824] nbd_dev_add+0x72c/0xb50 [ 1364.233642][ T5824] nbd_init+0x168/0x1f0 [ 1364.238410][ T5824] do_one_initcall+0x250/0x8d0 [ 1364.243684][ T5824] do_initcall_level+0x104/0x190 [ 1364.249138][ T5824] do_initcalls+0x59/0xa0 [ 1364.253972][ T5824] kernel_init_freeable+0x2a6/0x3e0 [ 1364.259670][ T5824] kernel_init+0x1d/0x1d0 [ 1364.264502][ T5824] ret_from_fork+0x51e/0xb90 [ 1364.269609][ T5824] ret_from_fork_asm+0x1a/0x30 [ 1364.274880][ T5824] [ 1364.274880][ T5824] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 1364.282674][ T5824] __mutex_lock+0x19f/0x1300 [ 1364.287773][ T5824] elevator_change+0x1b3/0x450 [ 1364.293041][ T5824] elevator_set_none+0xb5/0x140 [ 1364.298406][ T5824] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 1364.304715][ T5824] nbd_start_device+0x17f/0xb10 [ 1364.310074][ T5824] nbd_genl_connect+0x165b/0x1cf0 [ 1364.315602][ T5824] genl_family_rcv_msg_doit+0x22a/0x330 [ 1364.321647][ T5824] genl_rcv_msg+0x61c/0x7a0 [ 1364.326650][ T5824] netlink_rcv_skb+0x232/0x4b0 [ 1364.331920][ T5824] genl_rcv+0x28/0x40 [ 1364.336400][ T5824] netlink_unicast+0x80f/0x9b0 [ 1364.341664][ T5824] netlink_sendmsg+0x813/0xb40 [ 1364.347450][ T5824] ____sys_sendmsg+0x972/0x9f0 [ 1364.352717][ T5824] ___sys_sendmsg+0x2a5/0x360 [ 1364.357895][ T5824] __x64_sys_sendmsg+0x1bd/0x2a0 [ 1364.363333][ T5824] do_syscall_64+0x14d/0xf80 [ 1364.368431][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1364.374835][ T5824] [ 1364.374835][ T5824] -> #2 (&q->q_usage_counter(io)#53){++++}-{0:0}: [ 1364.383414][ T5824] blk_alloc_queue+0x546/0x680 [ 1364.388703][ T5824] __blk_mq_alloc_disk+0x197/0x390 [ 1364.394320][ T5824] nbd_dev_add+0x499/0xb50 [ 1364.399261][ T5824] nbd_init+0x168/0x1f0 [ 1364.403920][ T5824] do_one_initcall+0x250/0x8d0 [ 1364.409188][ T5824] do_initcall_level+0x104/0x190 [ 1364.414625][ T5824] do_initcalls+0x59/0xa0 [ 1364.419453][ T5824] kernel_init_freeable+0x2a6/0x3e0 [ 1364.425164][ T5824] kernel_init+0x1d/0x1d0 [ 1364.430001][ T5824] ret_from_fork+0x51e/0xb90 [ 1364.435096][ T5824] ret_from_fork_asm+0x1a/0x30 [ 1364.440361][ T5824] [ 1364.440361][ T5824] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 1364.447546][ T5824] fs_reclaim_acquire+0x71/0x100 [ 1364.452992][ T5824] kmem_cache_alloc_noprof+0x40/0x650 [ 1364.458866][ T5824] __kernfs_iattrs+0xdf/0x340 [ 1364.464047][ T5824] kernfs_iop_setattr+0xea/0x3f0 [ 1364.469499][ T5824] notify_change+0xc1a/0xf40 [ 1364.474623][ T5824] do_truncate+0x1c2/0x250 [ 1364.479549][ T5824] path_openat+0x2f89/0x3860 [ 1364.484642][ T5824] do_file_open+0x23e/0x4a0 [ 1364.489645][ T5824] do_sys_openat2+0x113/0x200 [ 1364.494836][ T5824] __x64_sys_openat+0x138/0x170 [ 1364.500213][ T5824] do_syscall_64+0x14d/0xf80 [ 1364.505308][ T5824] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1364.511701][ T5824] [ 1364.511701][ T5824] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 1364.520191][ T5824] __lock_acquire+0x15a5/0x2cf0 [ 1364.525571][ T5824] lock_acquire+0xf0/0x2e0 [ 1364.530491][ T5824] down_write+0x96/0x200 [ 1364.535244][ T5824] kernfs_unlink_sibling+0x71/0x180 [ 1364.540944][ T5824] __kernfs_remove+0x3e7/0x660 [ 1364.546217][ T5824] kernfs_remove_by_name_ns+0xaf/0x130 [ 1364.552184][ T5824] sysfs_unmerge_group+0xd4/0x140 [ 1364.557713][ T5824] dpm_sysfs_remove+0x76/0xd0 [ 1364.562989][ T5824] device_del+0x250/0x8f0 [ 1364.567844][ T5824] device_unregister+0x21/0xf0 [ 1364.573112][ T5824] hci_conn_del+0xc36/0x1230 [ 1364.578261][ T5824] hci_abort_conn_sync+0xdd0/0x1190 [ 1364.584013][ T5824] hci_cmd_sync_work+0x213/0x400 [ 1364.589491][ T5824] process_scheduled_works+0xb02/0x1830 [ 1364.595541][ T5824] worker_thread+0xa50/0xfc0 [ 1364.600633][ T5824] kthread+0x388/0x470 [ 1364.605200][ T5824] ret_from_fork+0x51e/0xb90 [ 1364.610291][ T5824] ret_from_fork_asm+0x1a/0x30 [ 1364.615556][ T5824] [ 1364.615556][ T5824] other info that might help us debug this: [ 1364.615556][ T5824] [ 1364.625759][ T5824] Chain exists of: [ 1364.625759][ T5824] &root->kernfs_iattr_rwsem --> cpuhp_state_mutex --> &root->kernfs_rwsem [ 1364.625759][ T5824] [ 1364.640179][ T5824] Possible unsafe locking scenario: [ 1364.640179][ T5824] [ 1364.647718][ T5824] CPU0 CPU1 [ 1364.653067][ T5824] ---- ---- [ 1364.658417][ T5824] lock(&root->kernfs_rwsem); [ 1364.663205][ T5824] lock(cpuhp_state_mutex); [ 1364.670297][ T5824] lock(&root->kernfs_rwsem); [ 1364.677560][ T5824] lock(&root->kernfs_iattr_rwsem); [ 1364.682827][ T5824] [ 1364.682827][ T5824] *** DEADLOCK *** [ 1364.682827][ T5824] [ 1364.690952][ T5824] 5 locks held by kworker/u9:3/5824: [ 1364.696216][ T5824] #0: ffff88807ac95948 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 [ 1364.707023][ T5824] #1: ffffc90003a57c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 [ 1364.719547][ T5824] #2: ffff8880a25b8ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 [ 1364.729358][ T5824] #3: ffff8880a25b80c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 [ 1364.739076][ T5824] #4: ffff88801b6dd988 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3d/0x130 [ 1364.749751][ T5824] [ 1364.749751][ T5824] stack backtrace: [ 1364.755626][ T5824] CPU: 0 UID: 0 PID: 5824 Comm: kworker/u9:3 Not tainted syzkaller #0 PREEMPT(full) [ 1364.755640][ T5824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1364.755648][ T5824] Workqueue: hci0 hci_cmd_sync_work [ 1364.755667][ T5824] Call Trace: [ 1364.755672][ T5824] [ 1364.755678][ T5824] dump_stack_lvl+0xe8/0x150 [ 1364.755694][ T5824] print_circular_bug+0x2e1/0x300 [ 1364.755710][ T5824] check_noncircular+0x12e/0x150 [ 1364.755726][ T5824] __lock_acquire+0x15a5/0x2cf0 [ 1364.755740][ T5824] ? __lock_acquire+0x6b5/0x2cf0 [ 1364.755754][ T5824] lock_acquire+0xf0/0x2e0 [ 1364.755766][ T5824] ? kernfs_unlink_sibling+0x71/0x180 [ 1364.755779][ T5824] down_write+0x96/0x200 [ 1364.755801][ T5824] ? kernfs_unlink_sibling+0x71/0x180 [ 1364.755818][ T5824] ? __pfx_down_write+0x10/0x10 [ 1364.755834][ T5824] ? kernfs_root+0x1c/0x230 [ 1364.755855][ T5824] ? kernfs_root+0x1c/0x230 [ 1364.755867][ T5824] ? kernfs_root+0x1c/0x230 [ 1364.755880][ T5824] ? kernfs_root+0x1ea/0x230 [ 1364.755893][ T5824] kernfs_unlink_sibling+0x71/0x180 [ 1364.755904][ T5824] __kernfs_remove+0x3e7/0x660 [ 1364.755914][ T5824] kernfs_remove_by_name_ns+0xaf/0x130 [ 1364.755925][ T5824] sysfs_unmerge_group+0xd4/0x140 [ 1364.755939][ T5824] dpm_sysfs_remove+0x76/0xd0 [ 1364.755953][ T5824] device_del+0x250/0x8f0 [ 1364.755963][ T5824] ? klist_iter_exit+0xc1/0x100 [ 1364.756068][ T5824] ? __pfx_skb_queue_purge_reason+0x10/0x10 [ 1364.756082][ T5824] ? __pfx_device_del+0x10/0x10 [ 1364.756092][ T5824] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1364.756105][ T5824] device_unregister+0x21/0xf0 [ 1364.756115][ T5824] hci_conn_del+0xc36/0x1230 [ 1364.756128][ T5824] ? hci_abort_conn_sync+0xa7b/0x1190 [ 1364.756139][ T5824] hci_abort_conn_sync+0xdd0/0x1190 [ 1364.756150][ T5824] ? __pfx_hci_abort_conn_sync+0x10/0x10 [ 1364.756161][ T5824] ? abort_conn_sync+0x26/0x210 [ 1364.756174][ T5824] ? abort_conn_sync+0x26/0x210 [ 1364.756185][ T5824] ? abort_conn_sync+0x19c/0x210 [ 1364.756196][ T5824] ? __pfx_abort_conn_sync+0x10/0x10 [ 1364.756208][ T5824] hci_cmd_sync_work+0x213/0x400 [ 1364.756222][ T5824] ? process_scheduled_works+0xa25/0x1830 [ 1364.756235][ T5824] process_scheduled_works+0xb02/0x1830 [ 1364.756253][ T5824] ? __pfx_process_scheduled_works+0x10/0x10 [ 1364.756266][ T5824] ? assign_work+0x3d5/0x5e0 [ 1364.756279][ T5824] worker_thread+0xa50/0xfc0 [ 1364.756300][ T5824] kthread+0x388/0x470 [ 1364.756309][ T5824] ? __pfx_worker_thread+0x10/0x10 [ 1364.756321][ T5824] ? __pfx_kthread+0x10/0x10 [ 1364.756330][ T5824] ret_from_fork+0x51e/0xb90 [ 1364.756343][ T5824] ? __pfx_ret_from_fork+0x10/0x10 [ 1364.756354][ T5824] ? __switch_to+0xc7d/0x1450 [ 1364.756374][ T5824] ? __pfx_kthread+0x10/0x10 [ 1364.756384][ T5824] ret_from_fork_asm+0x1a/0x30 [ 1364.756402][ T5824] [ 1365.145034][T19249] wg1 speed is unknown, defaulting to 1000 [ 1365.153186][T19207] gre0 speed is unknown, defaulting to 1000 [ 1365.346442][T19249] gre0 speed is unknown, defaulting to 1000 [ 1366.773501][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5260 ms [ 1366.781537][ C0] lec:lec_tx_timeout: lec0 [ 1367.265938][T30415] block nbd6: Possible stuck request ffff888026bb0000: control (read@0,1024B). Runtime 240 seconds [ 1367.276779][T30415] block nbd6: Possible stuck request ffff888026bb0200: control (read@1024,1024B). Runtime 240 seconds [ 1367.287765][T30415] block nbd6: Possible stuck request ffff888026bb0400: control (read@2048,1024B). Runtime 240 seconds [ 1367.298812][T30415] block nbd6: Possible stuck request ffff888026bb0600: control (read@3072,1024B). Runtime 240 seconds