last executing test programs: 4.707925771s ago: executing program 1 (id=3970): ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000001c0)={'ip6gre0\x00', &(0x7f0000000240)={'ip6tnl0\x00', 0x0, 0x4, 0x3, 0xff, 0x8, 0x0, @private1, @private0, 0x7, 0x8000, 0x81, 0xeb29}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000380)={'syztnl2\x00', &(0x7f0000000300)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x1, 0x1, 0x20, @private0, @local, 0x20, 0x7, 0x7, 0x401}}) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x4) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xd, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r3, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {0x10}, {}, {0x2, 0x1}}, [@qdisc_kind_options=@q_cbq={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40098}, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001bc0)=@newtfilter={0x30, 0x2c, 0xd2b, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x1, 0x4}, {}, {0xe, 0x1}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x893}, 0x20040084) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1c, &(0x7f0000000480)={@dev, 0x0}, &(0x7f00000004c0)=0x14) sendmsg$ETHTOOL_MSG_FEATURES_GET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)={0xe0, 0x0, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r0}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6tnl0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gretap0\x00'}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x805}, 0x840) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000002060101000000000000000000000000010000000a000000090002008d001f106f194eb3050001"], 0x30}}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001d0001000000000004086aa42d"], 0x30}}, 0x0) r11 = socket(0x400000000010, 0x3, 0x0) r12 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006880)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r13, {0x4, 0xa}, {}, {0x3, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8848}, 0x80) sendmsg$nl_route_sched(r11, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r13, {0xc, 0xc}, {0x0, 0xfff1}, {0x0, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) ioctl$SIOCGETMIFCNT_IN6(r11, 0x89e0, &(0x7f0000000040)) 4.393227002s ago: executing program 2 (id=3976): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03", 0x3}], 0x1}, 0x0) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf2502ffc10008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="5001"], 0x14) write$nci(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="500238"], 0x3b) 4.141612925s ago: executing program 2 (id=3979): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000009c0000000b"], 0x50) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$netrom_NETROM_T1(r2, 0x103, 0x1, &(0x7f0000000080)=0x1, 0x4) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000400004803c0001800b00010065787468647200002c00028008000740000000000500020000000000080003400000004a08000640000000010800044000000002140000001100010000000000000000000000000a72dcd551611c08c6cd48a0bc2492e5f2de"], 0x94}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 4.136676529s ago: executing program 1 (id=3980): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 32) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) (rerun: 32) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xa, &(0x7f0000000140)=0x9d, 0x4) (async) recvmmsg(r2, &(0x7f0000001300)=[{{0x0, 0x0, 0x0}}], 0x1, 0x41, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="e2e75e7ed191000300e99a18000000000000000000000001"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x2}, 0x94) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="5c0300002e00090027bd70000000000004000000480311802ef98b", @ANYRES8], 0x35c}, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) 4.026621505s ago: executing program 3 (id=3981): r0 = socket$can_raw(0x1d, 0x3, 0x1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r2) sendmsg$NLBL_CALIPSO_C_REMOVE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x14, r3, 0x1, 0x70bd2c, 0x0, {0x3}}, 0x14}}, 0x0) setsockopt$CAN_RAW_LOOPBACK(r0, 0x65, 0x3, &(0x7f0000000200), 0x4) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x6, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2d}, 0x90) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f00000004c0)={'syzkaller1\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000200)={r4, r6, 0x25, 0x4, @void}, 0x10) sendmsg$can_raw(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x1d, r6}, 0x10, &(0x7f0000000100)={&(0x7f0000000240)=@canfd={{0x2, 0x1}, 0x19, 0x1, 0x0, 0x0, "b80dcefd11eced04bbdf577b9c00faafca617eebbf5489ebd4c3196c6780afdc1dc6f86a4bcf8321ca182e1442cbfd665d6e7d0d0322ec095174a668f738a75e"}, 0x48}}, 0x40) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000140)={'vxcan0\x00', 0x0}) sendmsg$can_raw(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x1d, r7}, 0x10, &(0x7f0000000300)={&(0x7f00000001c0)=@can={{0x4, 0x0, 0x0, 0x1}, 0x4, 0x0, 0x0, 0x0, "43b9dfb720598c2f"}, 0x10}, 0x1, 0x0, 0x0, 0x48001}, 0x4000085) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$netlink(0x10, 0x3, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r11, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={0x0, 0xf4}, 0x1, 0x0, 0x0, 0xc001}, 0x4000000) r12 = socket(0x2d, 0x2, 0x0) connect$qrtr(r12, &(0x7f0000000440)={0x2d, 0x0, 0x1}, 0xc) bind$xdp(r12, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) r13 = socket(0x2d, 0x2, 0x0) connect$qrtr(r13, &(0x7f0000000440)={0x2d, 0x0, 0x1}, 0xc) bind$xdp(r13, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r14, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x54, 0x10, 0xffffff1f, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x34080}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}, @IFLA_GRE_ENCAP_FLAGS={0x6, 0xf, 0x7}, @IFLA_GRE_REMOTE={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x28}}]}}}, @IFLA_MASTER={0x8, 0xa, r14}]}, 0x54}}, 0x0) getsockopt$llc_int(r8, 0x10c, 0x4, &(0x7f0000000040), &(0x7f0000000080)=0x4) 3.598600663s ago: executing program 2 (id=3982): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r1, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) r3 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000200)=ANY=[@ANYBLOB="140100002f00010000000000fcdbdf250101f2800c00180008ac0f0000000000140001"], 0x114}], 0x1, 0x0, 0x0, 0x1}, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000200)=0x1, 0x4) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000080)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x66, &(0x7f0000000500)={r7, 0x3}, &(0x7f0000000540)=0x8) r8 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r8) setsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000080)={r7, 0x2}, 0x8) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0xa, r9}, 0x10) bind$xdp(r1, &(0x7f0000000180)={0x2c, 0x1, r9, 0x0, r2}, 0x10) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3cf621", @ANYRES32=0x0, @ANYBLOB="cb840400000000001c00128009000100626f6e64000000000c00028008000f00ff7f0000"], 0x3c}}, 0x0) 3.142173268s ago: executing program 3 (id=3986): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x28, 0x20, 0x301, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a}, [@FRA_TUN_ID={0xc, 0xc, 0x1, 0x0, 0x3}]}, 0x28}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @target={{0xb}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0xa, 0x1, 'AUDIT\x00'}]}}}]}], {0x14, 0x10}}, 0xa4}}, 0x0) 3.138128562s ago: executing program 1 (id=3988): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x4, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x14, 0x2, [@TCA_CODEL_TARGET={0x4}, @TCA_CODEL_CE_THRESHOLD={0xffffffffffffff79}]}}]}, 0x44}}, 0x0) r5 = socket(0x40000000015, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000008c0), 0x4) sendmsg$rds(r5, &(0x7f0000000a00)={&(0x7f0000000080)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/56, 0x38}, {&(0x7f0000000100)=""/31, 0x1f}, {&(0x7f0000000240)=""/167, 0xa7}, {&(0x7f0000000140)=""/88, 0x58}], 0x4, &(0x7f0000001cc0)=[@rdma_dest={0x18, 0x114, 0x2, {0x7f, 0x7fffffff}}, @zcopy_cookie={0x18, 0x114, 0xc, 0x7}, @cswp={0x58, 0x114, 0x7, {{0x1, 0x4}, &(0x7f00000003c0)=0xf39, &(0x7f0000000400), 0xfffffffffffffffd, 0x8, 0x3, 0x3, 0x41, 0x8}}, @fadd={0x58, 0x114, 0x6, {{0x9}, &(0x7f0000000440)=0x8, &(0x7f0000000480)=0xabbc, 0x3, 0xfffffffffffffffe, 0xd, 0x4, 0x9, 0x6}}, @mask_cswp={0x58, 0x114, 0x9, {{0x8000, 0x5}, &(0x7f00000004c0)=0x7fffffff, &(0x7f0000000500)=0x1, 0x100000000, 0x0, 0x6, 0xb153, 0x0, 0x80}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000000540)=""/220, 0xdc}, &(0x7f0000000640), 0x8}}, @cswp={0x58, 0x114, 0x7, {{0x5, 0xe}, &(0x7f0000000680)=0x5, &(0x7f00000006c0)=0x8, 0x8, 0x1, 0x1, 0xfffffffffffffffd, 0x3, 0xfffffffffffffbff}}, @rdma_dest={0x18, 0x114, 0x2, {0x4, 0xffff}}, @rdma_args={0x48, 0x114, 0x1, {{0x4, 0x2}, {&(0x7f0000000700)=""/9, 0x9}, &(0x7f0000000980)=[{&(0x7f0000000cc0)=""/4096, 0x1000}, {&(0x7f0000000740)=""/87, 0x57}, {&(0x7f00000007c0)=""/53, 0x35}, {&(0x7f0000000800)=""/154, 0x9a}, {&(0x7f0000000900)=""/88, 0x58}], 0x5, 0x5c, 0x2}}], 0x220, 0x84}, 0x4000) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYBLOB="140000001000010000000000000000000700000a91010000060a0b0400000000000000000200000064010480600101800a0001006d617463680000005001028008000240000000000b000100706f6c696379000038010300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6070000004e8278ad51f6d123a616cf3eb44b275fe6bc6bf402a3f9335458bb7a92f23fc0aa88f2495ff70157ea6b29f7fab11ec362920cab3350208c749f342b38e0df9334cea6fe1e331d76beb7094102d5d409992dcd236e3fd7a8785f97ae9d01b0822c161a491bef0501f8e81ddd66d1b676e8c9f0b2159c2cc0b069669b5af555f644c39bedd627181d27d9c185aae5d910550f08822c6fec60302779b9e812403a2ff826781b4c761bd14eb7515ae224260c9534891afdd05d18b2ffe91f52766a0b9fe3955bfb1866142e7c1caceb88de7d6e8a5c08ce052bb461f0c7ee914ca5c98c19442d0262a6d04a8e3e29360a9b5871812e08542d54775f5843d70b15871bc247e30d66b83560c014f5000000000900010073797a30000000000900020073797a32"], 0x1b8}, 0x1, 0x0, 0x0, 0x8010}, 0x4000800) ioctl$XFS_IOC_START_COMMIT(r0, 0x80585882, &(0x7f0000000a40)={0xffffffffffffffff}) sendmsg$NFT_BATCH(r6, &(0x7f0000002280)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000002240)={&(0x7f0000001f00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_DELRULE={0x2dc, 0x8, 0xa, 0x100, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFTA_RULE_EXPRESSIONS={0x88, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @range={{0xa}, @void}}, {0x10, 0x1, 0x0, 0x1, @tproxy={{0xb}, @void}}, {0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}, {0xc, 0x1, 0x0, 0x1, @ct={{0x7}, @void}}, {0x48, 0x1, 0x0, 0x1, @objref={{0xb}, @val={0x38, 0x2, 0x0, 0x1, [@NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0xe}, @NFTA_OBJREF_SET_NAME={0x9, 0x4, 'syz2\x00'}, @NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJREF_SET_SREG={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_OBJREF_IMM_NAME={0x9, 0x2, 'syz2\x00'}]}}}]}, @NFTA_RULE_USERDATA={0xba, 0x7, 0x1, 0x0, "a545c955bb7892db40d5260dd05b56da6e38b3237719455952370848cb8587fe76bdfaa75ce6a02d0e03a7b3b0b571b38ffc5b4219dd0fa69343ecbef7e0f1fd4ff1c88a9d0c77205effad3180829cf4d5fd12b3d959de55d1f69722407ce216d519660adba170c8bb0efae829234181c1a87fdd1552a7a918ad12e089f2899be7c65dfc4256daa1da756305da2bb4d75ef36d5af2ef8fd82a438c754b30a97b1c770beb4365d8f3c7d26d9de29f9dc6373b3fb4ca29"}, @NFTA_RULE_EXPRESSIONS={0x164, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_SOCKET_LEVEL={0x8, 0x3, 0x68}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x11}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x3}]}}}, {0x20, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc}]}}}, {0x14, 0x1, 0x0, 0x1, @synproxy={{0xd}, @void}}, {0x10, 0x1, 0x0, 0x1, @reject={{0xb}, @void}}, {0x54, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x43}, @NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_MASQ_REG_PROTO_MIN={0x8, 0x2, 0x1, 0x0, 0x13}, @NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x4b}, @NFTA_MASQ_FLAGS={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x17}]}}}, {0x20, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x10, 0x2, 0x0, 0x1, [@NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0x35}]}}}, {0x44, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5, 0x3, 0x1}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0xf}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x17}, @NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_XFRM_DIR={0x5, 0x3, 0x2}, @NFTA_XFRM_DIR={0x5, 0x3, 0x2}]}}}, {0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_SREG={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_CT_DIRECTION={0x5}, @NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x15}]}}}]}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x304}}, 0x800) 3.013471263s ago: executing program 0 (id=3990): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) (async, rerun: 64) sendmsg$netlink(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000840)=ANY=[@ANYBLOB="1c00000022000106770000000000000005000000000001"], 0x1c}], 0x1}, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=@newtaction={0x14, 0x30, 0x800, 0x70bd26, 0x22000}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x48195) (async) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000003e0007010000000000000000017c00000400fc800c0001800600060065580000080002"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) (async) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) (async, rerun: 32) r3 = socket$inet_tcp(0x2, 0x1, 0x0) (rerun: 32) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) (async) listen(r2, 0x0) (async, rerun: 64) r4 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r5 = socket(0x28, 0x1, 0x0) r6 = accept$packet(r5, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000540)=0x14) getsockname$packet(r6, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000005c0)=0x14) sendmsg$nl_route_sched(r4, &(0x7f0000002580)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000002440)=@delchain={0x2c, 0x2e, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0xe, 0x3}, {0xfff2, 0xffff}, {0xc, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x8, 0x8}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000085}, 0x0) (async) r8 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r8, &(0x7f0000000040), 0x10) (async, rerun: 64) listen(r8, 0x0) (async, rerun: 64) r9 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r9, &(0x7f0000000080), 0x10) (async) setsockopt$sock_linger(r9, 0x1, 0x3c, &(0x7f0000000180)={0x1, 0x5}, 0x8) (async) sendmmsg(r9, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x1, 0x24008094) (async, rerun: 64) setsockopt$sock_int(r9, 0x1, 0x29, &(0x7f0000000280)=0x7, 0x4) (async, rerun: 64) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r9, &(0x7f00000004c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000480)={&(0x7f0000000680)=ANY=[@ANYBLOB="58000000040801020000000000000000050000020500030021000000050003002100000006000240888e00000c00048008000140000000080600024090000000050003003a0000000600024088e3000005000300210000000bc3440c99b76bc95007e704fea89714e8e12aecb75cc81a9b1dbb0c73f874da24f72f8946865397dcfe20f9ff41a0e73b73620da6d83658df7b0072fd4dc7aa47741ddd5eeb88b2cbcaa0ef28b4cbbb1e72211ab08dadd0dfc547167c1f140f8418f21b577f72376e4994fe64b00d1cab02023d04e127"], 0x58}, 0x1, 0x0, 0x0, 0x44841}, 0x40020) (async) r10 = accept4$unix(r8, 0x0, 0x0, 0x0) recvfrom$unix(r10, &(0x7f0000000140)=""/263, 0x107, 0x0, 0x0, 0x0) (async) recvfrom$unix(r9, 0x0, 0x0, 0x2002, 0x0, 0x0) (async) ioctl$sock_inet6_SIOCDIFADDR(r2, 0x8936, &(0x7f0000000040)={@private0={0xfc, 0x0, '\x00', 0x1}, 0x50, r7}) (async) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2, 0x13, r3, 0xa3618000) 3.012349469s ago: executing program 3 (id=3991): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f0000000000)=0x0) bind$nfc_llcp(r0, &(0x7f0000001040)={0x27, r2, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)={0x9c, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @ipv4={'\x00', '\xff\xff', @multicast1}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x44, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @local}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}]}, @CTA_TIMEOUT={0x8}]}, 0x9c}, 0x1, 0x0, 0x0, 0x80}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x2, [@restrict, @func_proto={0x0, 0x1, 0x0, 0xd, 0x0, [{0xfffffffc, 0x2}]}]}}, 0x0, 0x3a}, 0x20) listen(r0, 0xf5f) accept(r0, 0x0, 0x0) close(r1) 2.8570712s ago: executing program 1 (id=3992): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0xa8442, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}, @TCA_RATE={0x6, 0x5, {0x9, 0x1}}]}, 0x40}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000022c0)=@newtfilter={0x94, 0x2c, 0xd27, 0x170bd2b, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {}, {0x8, 0x4}}, [@filter_kind_options=@f_flow={{0x9}, {0x64, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1e3a9}, @TCA_FLOW_ACT={0x50, 0x9, 0x0, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x3d1, 0x3, 0x20000000, 0x6, 0x6}, 0x63}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0xc804}, 0x2) close(r2) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e24, 0x20000000, @rand_addr=' \x01\x00'}}, 0x0, 0x0, 0x3, 0x0, "ddfd3b7ed7c6a1c172a987ae5ce3cafd64c9a736831a5912d606798fb75c9981c4b3ac0e06891ff18bc5543ed57215a3c45f9154dfa319e52a15a2b9acf80c07fb1a854dad742eef6187f2304844c296"}, 0xd8) close(r5) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'veth0_to_bridge\x00', 0x0}) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r1, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r6, 0x42}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000200)="27030200000314000e00003c000300000000000100000000000000000000000000000000000085dc9d9839dc1336", 0x2e}], 0x1}, 0x4005) socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000009a40)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xfffe}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x68}}, 0x0) 2.854541333s ago: executing program 0 (id=3993): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x29, &(0x7f0000001500)=[{&(0x7f0000001580)="d80000001a0081044e81f782db4cb904021d08007b490d4f1e81f8d815001000ff05142603600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e", 0xd8}], 0x1}, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000040), &(0x7f0000000080)=0xc) 2.612258406s ago: executing program 0 (id=3995): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)={0x40, r2, 0x1, 0x0, 0x1, {}, [@ETHTOOL_A_DEBUG_MSGMASK={0x14, 0x2, 0x0, 0x1, [@ETHTOOL_A_BITSET_NOMASK={0x4}, @ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8}]}, @ETHTOOL_A_DEBUG_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan1\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000054}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="f68b0000", @ANYRES16=r3, @ANYBLOB="050000000000200000000600000008000300", @ANYRES32=r4, @ANYBLOB="0800050008000000"], 0x24}}, 0x48000) 2.59836594s ago: executing program 2 (id=3996): bind$isdn(0xffffffffffffffff, &(0x7f00000001c0)={0x22, 0x1a, 0x9, 0x6, 0x8}, 0x6) r0 = socket$inet(0xa, 0x801, 0x84) r1 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff, 0xa, 0x0, @val=@tcx={@void, @value=r0}}, 0x1c) ioctl$BTRFS_IOC_SEND(r0, 0x40489426, &(0x7f00000002c0)={{r1}, 0x3, &(0x7f0000000280)=[0x8000000000000000, 0xffffffff, 0xfffffffffffffffa], 0x0, 0x8}) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r2 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000680)={0x0, 0x9}, 0x8) r3 = socket$nl_rdma(0x10, 0x3, 0x14) getsockopt$netlink(r3, 0x10e, 0x0, 0x0, &(0x7f0000000000)) recvmmsg(r0, &(0x7f00000001c0), 0x0, 0x2022, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=@newlink={0x40, 0x10, 0x401, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bond={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x9}, @IFLA_BOND_ARP_IP_TARGET={0x4}]}}}]}, 0x40}}, 0x8004) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="b800e2ff18000100000000000000000000000000000000000000ac1414bb00"/57, @ANYRES32=0x0, @ANYRES32], 0xb8}}, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r5) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r5, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000000c0)={'tunl0\x00', &(0x7f00000006c0)={'sit0\x00', 0x0, 0x20, 0x3800, 0x5e6, 0x5, {{0x2e, 0x4, 0x2, 0x7, 0xb8, 0x65, 0x0, 0x1, 0x2f, 0x0, @private=0xa010101, @rand_addr=0x64010102, {[@end, @noop, @cipso={0x86, 0x62, 0xffffffffffffffff, [{0x0, 0x12, "7f171dac6fe392dc5986941cf26458f7"}, {0x0, 0xd, "5e75d4f998d3e24ee252ca"}, {0x1, 0x7, "feb8a08f97"}, {0x0, 0xb, "f63c8c12582ba99600"}, {0x2, 0x12, "a9f0ce81d6d5da2caf7e7abad8d56f0a"}, {0x5, 0x12, "e2a14f63d690495d40da67c6195fe63d"}, {0x5, 0x7, "c91207c442"}]}, @timestamp_prespec={0x44, 0x4, 0xae, 0x3, 0x4}, @rr={0x7, 0x17, 0xc, [@multicast2, @rand_addr=0x64010101, @broadcast, @private=0xa010101, @multicast2]}, @timestamp_prespec={0x44, 0xc, 0x16, 0x3, 0x8, [{@remote, 0x7}]}, @rr={0x7, 0x17, 0x40, [@remote, @dev={0xac, 0x14, 0x14, 0x15}, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x31}, @empty]}]}}}}}) ioctl$sock_inet6_SIOCDIFADDR(r2, 0x8936, &(0x7f0000000100)={@private2, 0x44, r6}) ioctl$sock_SIOCGIFCONF(r2, 0x8912, &(0x7f0000000180)=@req={0x28, &(0x7f0000000140)={'xfrm0\x00', @ifru_map={0x3, 0xff, 0xf, 0x2, 0x7, 0xb}}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0x3, &(0x7f0000000000)=@framed={{0x72, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0x5f}}, &(0x7f0000000380)='GPL\x00'}, 0x90) 2.506639468s ago: executing program 0 (id=3997): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000003000000030000000050000000000000001000004080000000000000003000000100000000000000000000002000000000300000000000011"], 0x0, 0x4d}, 0x20) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r0, 0x4058587a, &(0x7f00000003c0)={{r0, &(0x7f0000000140)=']%\x00', 0x10801, &(0x7f0000000180)={@align=0x80, {0x5, 0x0, 0xf94b, 0x25}}, 0x7f, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000200)=0x7}, {[0x33ae, 0x7, 0x2, 0x4]}, 0x1ff, 0xc3, &(0x7f00000002c0)=""/195}) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000500)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000240), &(0x7f00000004c0)}, 0x20) r3 = socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x10, 0x3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x0, 0x3, 0x0, 0x1}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x51}, 0x0) (async) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.idle_time\x00', 0x26e1, 0x0) (async) r7 = socket$kcm(0x2, 0x3, 0x2) setsockopt$sock_attach_bpf(r7, 0x1, 0x3e, &(0x7f00000002c0)=r6, 0x4) (async) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000780)={0x1, 0xffffffffffffffff}, 0x4) (async) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0x21, 0x7, 0xfffeffff, 0x4, 0x2, 0xffffffffffffffff, 0x1, '\x00', 0x0, r0, 0x0, 0x4, 0x1}, 0x50) (async) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000840)={0x1b, 0x0, 0x0, 0x4, 0x0, 0x1, 0x200, '\x00', 0x0, r0, 0x0, 0x0, 0x4}, 0x50) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000008c0)={0x1b, 0x0, 0x0, 0x8, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, r0, 0x5, 0x2, 0x1}, 0x50) r12 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000940)={0x1b, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, 0x7, '\x00', 0x0, r0, 0x0, 0x1, 0x2}, 0x50) (async) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000009c0)={r0, 0xffffffff, 0x800, 0x8}) (async) r14 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000a00)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x10, '\x00', 0x0, r0, 0x4, 0x4, 0x3}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x1c, &(0x7f00000005c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0xffffffff}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@generic={0xaf, 0xc, 0x8, 0x8, 0x9}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x89}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @btf_id={0x18, 0x1, 0x3, 0x0, 0x4}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000540)='syzkaller\x00', 0x8001, 0x1, &(0x7f00000006c0)=""/1, 0x41000, 0x40, '\x00', r5, 0x0, r6, 0x8, &(0x7f0000000700)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000740)={0x5, 0x6, 0x8, 0x5}, 0x10, 0x0, 0x0, 0x7, &(0x7f0000000a80)=[r8, r9, r10, r11, r12, r13, r14], &(0x7f0000000ac0)=[{0x4, 0x5, 0xd}, {0x5, 0x4, 0x9, 0x5}, {0x5, 0x1, 0xd, 0x1}, {0x5, 0x4, 0x2, 0xc}, {0x4, 0x5, 0x5, 0x5}, {0x5, 0x2, 0x3, 0x3}, {0x3, 0x1, 0x5, 0x2}], 0x10, 0x3}, 0x94) (async) r15 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r15, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c00000010000304000000000000000000000300", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e00000004000280080040"], 0x3c}}, 0x0) (async) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="c6d0982b513fdf581c9dd1580eca362592c7929a742d34eac560f4f844529e7f15170bb6bad647363c52bad644fd7d89c8a826560c81c898aec9fb79c1e632c40621316ca7061b189db32ba6f3531bee1425854a83cc9be3e896b6abe3bea79bbdc7475f9f07ee0d00fe3a2a38608a891f322579b6dde3e0a97161c727ff59cd36906dd780c61d780fb7322df5fc0979426c3a95a8edcbe5c8a7dc68ff05034c4002fe3160496cd15b6826a424819c5788043300886fa0bae6c24d06091a192c69a4ee385e", 0xc5, 0x20000080, &(0x7f0000000100)={0xa, 0x4e20, 0x1, @loopback, 0x8000}, 0x1c) 2.353010524s ago: executing program 4 (id=3999): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_SECURITY(r0, 0x11, 0x4, 0x0, 0x1000000000000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000900)=@updpolicy={0x13c, 0x19, 0x1, 0x70bd29, 0x25dfdbfb, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0xfffffffffffffffd}, {0x0, 0x5, 0x200000000000}, 0x0, 0x0, 0x1, 0x0, 0x2, 0x2}, [@tmpl={0x84, 0x5, [{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d6, 0x3c}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @empty}, 0x3507, 0x0, 0x3, 0x10, 0x9, 0x0, 0x10001}, {{@in6=@mcast1, 0x4d4, 0x2b}, 0x2, @in6=@empty, 0x0, 0x2, 0x1, 0x6a, 0x7ff, 0x8, 0x5}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) socket$kcm(0x2, 0x3, 0x2) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000a40)={0x0, 0x4, 0x2, 0x1}) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000280)={'veth0\x00', &(0x7f0000000700)=@ethtool_channels={0x3d, 0x7fff, 0x0, 0x1, 0x408, 0x1, 0x9, 0x2, 0x33}}) syz_emit_ethernet(0x32, &(0x7f0000000340)={@local, @dev, @void, {@ipv4={0x800, @generic={{0x9, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x8, 0x0, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x3b}, {[@ssrr={0x89, 0x7, 0xef, [@broadcast]}, @cipso={0x86, 0x6}]}}}}}}, 0x0) 2.264068079s ago: executing program 4 (id=4000): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.swap.current\x00', 0x26e1, 0x0) close(r3) ioctl$SIOCSIFHWADDR(r3, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="0100"}) write$nci(r3, &(0x7f0000000000)=@NCI_OP_RF_DISCOVER_RSP={0x1, 0x0, 0x2, 0x3, 0x6}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f00000022c0)=ANY=[@ANYBLOB="b702000000000090bfa300000000000007030000f0ffffff7a0af0ff0200000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b70500000d0000006a0af2fe000000008500000009000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989425f5d0b79f6584d0416d7c4bb9f547b328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f01000000010000006e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7f9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b98d2de10c21d3ea02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d000000200008000000000000001abc11c800000000000000000000000928ee53595a779d243a48cea769470424d20a04c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2c4af38ffb7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da202274f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec7ffff35e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0eb3280e09758bd445ab91d20baca005472b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92fe8bad99ca332af00f191b66b6a6f732a91f0e2e9190e4b448da7de018c58e950767f9b320be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c52573d9308a13d115b43f8b1894c8fa8a14dc4810f61ae96bf704526a8919bc700002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381ccc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f78fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb3c035fc6846abe389b25c988f0bbb889560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a9b7d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73cfd1e76982f3d899f71e495f0ba8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e4a48dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b54d2d3d50e2815268fc1a6ec566981bc8ca2a4583f3d40e817433d0f4f25cfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f00000021f8547d393dabe616fbbde21c90be00b5a22671395c7a69c6dd4d022ffc97ddb6aa025131652d409da1d8cfc3d219d4b1c1b7b8170d7c33d91db2b73f7ae02485a209a2474b5d0790d05c01bec623056e4d3f4d3149373a28b26a15a1fcce73d57e6eaf7e6f315fe275ebc9ef7aeca277dde01dde724f419803a2172a7833ceab38d21ca4f1dea5e1f4d8824167b21dd289dd4e6ecfba9e163bdbc48e1e758ecde05c10809c9edfa6d77c652fd742e6dad13d2a397bebe3ea8bc087d3720e2202f36c7719ae34f042e19dc08a3323a3d94098a7ec171469352bab1662c3e4d4803c565cfcce32dad628fade43a4844abb230ce608726fd87e93c405a96cf638c41510f26e9da5f316"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r4, 0x0, 0x62, 0xfe, &(0x7f0000000140)="cb74445b7d4c0b24676c6c71ae37efcedaf40242309766deb4e793f90000000000000000dbc856cbc664650634231454ca2d8034c4ca29e0d99c3b6615e91835a600c08f989af45438a54981be310aad92ae545b1c961e5f3762a51fe4c736edec6f", &(0x7f0000000440)=""/254, 0x2f00, 0x0, 0xff, 0x194, &(0x7f0000000980)="ffc4438e5c3081d0e133e812196ec0ed923733aa8b5aba32c8650e7a66d6136853773dfbc6226be13039e230d511f1ac50cc7811aac0400e4c833fedf842ae2918e6fddb550729246fcf4c0a01bc64989ea3985fb362751a83991bd56e761379caa64f6148893ff25f38d5cd6dd695bbf9ca709a9960e0e6b054d5e2239bcb7c0fb2ac66dc4c8f534e439ff20ccaf0d48a98c19c92a3b437a699350f49606d21a403f8c112c46fea5486bf367a854b0f6c1e563b656e4794f6793a08bb3656c391643f6df71d0255054368a938d38503d064da82d5dbf395ad47ed3932669168d324ed0f6de8360d499042ddc7d02b6c0772128257702bfe6d0971f00fea85da062cdc", &(0x7f00000007c0)="4c87fe555ceb79157b1e507ff4d3cc053321e42ae89f596427188b4877ab8f1776c0685784f1174c6401ecc1dd6e2a77bc79238f87ad9215a92ff203a30099e77c543e702b4a4438d358616381745f24f74e585498af129c4b173b242f445b08135f7fa40eb7ba78160ff4f0c80e1b324d0c234cb7f43a3ff9e9535dc16000c797113a039f4508a09144090000009f38a90a24f173b3e68377e4272950a80cfcd3aa6850e917bc7e57370060f5e6db941d67fc98a1e98103830b821657438325578d2af822dd4fc13ea7a7eef8d9be4e715aec8fd6cadc41c8da5ce9da2b9e1559d92a1936fc2b3a00000000000000000072200e10ba6269b634f10f7098c65ba67ba65c0e2687637e131fb8d5ba6c12c09c8356853c434a44ff0878e496dcf9a4f5ca02c293279948f37ebb28843f92c87c057a3b410e04418557d5deda7ddd3bd1d384d64ec980187e8b64a0696571a49e847db79349c9b3c3fab5f1f977bde4d802d9026ae0c11744eb1525c5195fd215d7a432497f35c2f2cfcd2b6336b26dfef0cb968c910ea2af5cdd4d58cc08535d5514", 0x2, 0x0, 0x10000}, 0x24) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r6], 0x1c}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) write$nci(r1, &(0x7f0000000040)=@NCI_OP_RF_DEACTIVATE_NTF={0x1, 0x0, 0x3, 0x6, 0x1, {0x6, 0x1}}, 0x5) write$nci(r1, 0x0, 0x7) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000940)=@framed={{0x18, 0x9}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xa000000}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r0, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)=r7}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x6, 0x14, &(0x7f0000001740)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r8}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1ab92b}, {0x85, 0x0, 0x0, 0x8}, {0x4}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x1, 0x2000}}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r9}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x9}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockopt$IP_SET_OP_GET_BYNAME(r3, 0x1, 0x53, &(0x7f0000000080)={0x6, 0x7, 'syz2\x00'}, &(0x7f0000000200)=0x28) 2.025446389s ago: executing program 4 (id=4001): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xc, 0x8031, 0xffffffffffffffff, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000180)={0x0, 0x0, 0x6, 0x700, 0x7, 0x0, 0xffffffffffffffff}, &(0x7f0000000240)={0x0, 0x3938700}, &(0x7f00000002c0)={&(0x7f0000000280)={[0xffffffffffffffff]}, 0x8}) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x3a, 0x0, &(0x7f00000000c0)) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x14, r1, 0x28543634fae43ad}, 0x14}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000700)={@broadcast, @multicast, @val={@void, {0x8100, 0x0, 0x0, 0x1}}, {@ipv6={0x86dd, @dccp_packet={0x2, 0x6, "4bc7fb", 0x10, 0x21, 0x0, @empty, @ipv4={'\x00', '\xff\xff', @empty}, {[], {{0x4e20, 0x4e22, 0x4, 0x1, 0x3, 0x0, 0x0, 0x6, 0x1, "c8fd14", 0x7, "0ebb69"}}}}}}}, 0x0) ioctl$SIOCGSTAMPNS(0xffffffffffffffff, 0x8907, &(0x7f00000001c0)) pipe(&(0x7f0000000040)={0xffffffffffffffff}) readv(r2, &(0x7f0000000680)=[{&(0x7f0000000240)=""/127, 0x7f}], 0x1) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000d80)={r2, 0x20, &(0x7f0000000d40)={&(0x7f0000000cc0)=""/66, 0x42, 0x0, &(0x7f0000000040)=""/19, 0x13}}, 0x10) r3 = socket(0x1e, 0x1, 0x0) accept$inet6(r3, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xa, 0x4, &(0x7f0000000c80)=ANY=[@ANYBLOB="b400000000000000dd110000000022007301faffffffffff9400000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x7, 0xbb, &(0x7f000000cf3d)=""/187, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r4 = accept4$bt_l2cap(r3, 0x0, &(0x7f0000000080), 0x80800) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000081780000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071103b00000000001d400500000000004704000001ed00000f030000000000001d440000000000006b0a00fe000000007203000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fe51bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afc0513466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea01d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a07f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a126a1bdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0d5d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f10bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00e10000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d490cba8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e16e1461173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d00b07862c4fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52c094016406cdd32abf77fea373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e80dc18cde98d662eee077515dca8811922929e08538fab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c00000000000000f59dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ed1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67cf0216e2d81e6127bd9d7fab28800eaab2355992f8ce4cd38add4b272c0bee4076ca4847ffa691cf78fb7ec212bad3bef29f57cbc05cd897f40693ec427ea71578130cde48de3b4dda0c7b615b57ccd4f8ac729a80f891d91a89d967948b9d95b1f22480ab48969e86b854a8c17f3e264ce11f9f63552364e759eec94572f2f7b0e2f293573d0b80709815f4344f908c00"/2646], &(0x7f0000001780)='syzkaller\x00', 0x400, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x4}, 0x10}, 0x94) setsockopt(r4, 0x0, 0xe, &(0x7f00000000c0)="951ffbbcec5a27984aeb0594c2b7a62a0f9e83694c7d4dc296bf59270969a2b03b6c26e767dbd546fac8a5aee750a13980dbfbe14c57a0051429df216a205041f7e0f5d4a50032426d842b57228091166b80b38a80b5c9a7677ec3e2af546e54abc57bb53610a8ce4cf6cf82828923fae5dd5e61236c99428f5dd7e19e7e57fdf31b5c7145aabcbddb1075cdab78ec44daa2c882ec97646a0d15b05a87839470f1010a", 0xa3) 2.023313374s ago: executing program 3 (id=4002): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = socket$igmp6(0xa, 0x3, 0x2) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYBLOB="020400000c00000000000000000000000500060000000000443eb600000000fc020000000000000000000000000000000000000000000002000100000000000000000000000000030005000000000002000000e0000002000000000000000038147e37a875df059afdd90959b7ae41abf243be572ec7848fe3fb383a3d1d9f1e55dd801e7f1050d396ccbb4d59ab13832b1f71cfb8b40507c3d40ed767c5e7311cbbcab73bf6c955b2eaaeca2c99dabc444b846eb516c2ecf1f56efcdc4f8edc2a02fe8245"], 0x60}, 0x1, 0x7}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000000079107b00000000000500000000000000950000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r3 = accept4(r1, 0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000100)={'ip6_vti0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x29, 0xf9, 0x8d, 0x4, 0x46, @mcast1, @empty, 0x7800, 0x80, 0x9f9, 0x48}}) sendmsg$nl_route_sched_retired(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000005c0)=@delqdisc={0x1ec, 0x25, 0x20, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, r4, {0x8, 0x2}, {0x8, 0x2}, {0xfff1, 0x2}}, [@q_dsmark={{0xb}, {0x1c, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x9}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x10}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x8}]}}, @q_dsmark={{0xb}, {0x28, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x40}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x6}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x20}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}]}}, @q_dsmark={{0xb}, {0x20, 0x2, [@TCA_DSMARK_INDICES={0x6, 0x1, 0x8}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x9}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x8}]}}, @q_dsmark={{0xb}, {0x28, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0xf801}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x11}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x5}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_INDICES={0x6, 0x1, 0xa}]}}, @q_dsmark={{0xb}, {0x8, 0x2, [@TCA_DSMARK_SET_TC_INDEX={0x4}]}}, @q_dsmark={{0xb}, {0x30, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x9}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x1}, @TCA_DSMARK_INDICES={0x6, 0x1, 0xa}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x12}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x7}, @TCA_DSMARK_SET_TC_INDEX={0x4}]}}, @q_dsmark={{0xb}, {0x50, 0x2, [@TCA_DSMARK_INDICES={0x6, 0x1, 0x20}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x33}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x2d}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x8}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x3}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x8f6}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x3}, @TCA_DSMARK_INDICES={0x6}]}}, @q_dsmark={{0xb}, {0x24, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0xf11}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x7d45}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}]}}, @q_dsmark={{0xb}, {0x24, 0x2, [@TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x8}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x8}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x3}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x1}]}}]}, 0x1ec}}, 0x4000000) recvmmsg$unix(r3, &(0x7f00000029c0)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000002a00)=""/4100, 0x1004}], 0x1}}], 0x1, 0x10000, 0x0) close(0x4) 1.906099546s ago: executing program 3 (id=4003): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) (async) r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) getsockopt$WPAN_WANTACK(r2, 0x0, 0x300, 0x0, &(0x7f0000000080)) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) (async) write$tun(r1, &(0x7f0000003500)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x0, 0x0, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x2b, 0x20, 0x68, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, {[@ra={0x94, 0x4}]}}, "11f3305280f125e6"}}, 0x2e) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001840)=@newtaction={0xe68, 0x30, 0x25, 0x0, 0x0, {}, [{0xe54, 0x1, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x3}, [{}, {}, {0x0, 0x8000}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x9, 0xfffffffc, 0x0, 0x0, 0x9}, {}, {0x0, 0x1}, {0x0, 0x0, 0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0x0, 0xffffffff}, {}, {0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3cf}, {0x0, 0x7}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x3}, {}, {}, {}, {0x0, 0x0, 0x4000}, {}, {0xfffffffd}, {}, {}, {}, {0x0, 0x5}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x200}, {}, {0x8, 0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x7f, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x3}, {}, {0x0, 0x0, 0xfffffffd}, {0x0, 0xffffff01}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, {0x0, 0x0, 0xdf}, {0x0, 0xfffffff2}, {}, {}, {}, {}, {}, {0x0, 0xfffffffe}, {}, {0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0x0, 0x2, 0xf}, {}, {}, {}, {0x0, 0x0, 0x10}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40000}, {}, {0x0, 0x0, 0x100}, {}, {0xfffffffc, 0x3}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x4, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {0x0, 0x2, 0x0, 0x0, 0x4000000}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3}, {0x0, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe68}}, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x0) (async) syz_init_net_socket$rose(0xb, 0x5, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) bind$bt_l2cap(r7, &(0x7f0000000140)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x6}, 0xe) getsockopt$bt_BT_CHANNEL_POLICY(r7, 0x112, 0x4, 0x0, &(0x7f00000000c0)) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x29, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x1, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x1021, 0x3}, [@IFLA_GROUP={0x8}, @IFLA_MTU={0x8, 0x4, 0x8001}]}, 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) (async) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@gettaction={0x28, 0x32, 0x6dd711a25f4cb68b, 0x0, 0x0, {}, [@action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}]}]}, 0x28}}, 0x0) (async) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r5) (async) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) (async) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{}, "cf556c33235019ca", "b21eaca21cd0da29761ca41ca77830b7", "2833fbce", "8893ffe76209f4c5"}, 0x28) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000feffffff71f60300000000009500000000000000"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) getsockopt(r5, 0xf, 0x7, &(0x7f0000000180)=""/42, &(0x7f00000001c0)=0x2a) 1.338129365s ago: executing program 4 (id=4004): ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x7, 0x7, 0x4, 0x7fffffff, {{0x32, 0x4, 0x3, 0x6, 0xc8, 0x67, 0x0, 0x17, 0x2f, 0x0, @broadcast, @remote, {[@rr={0x7, 0x17, 0x16, [@local, @multicast1, @dev={0xac, 0x14, 0x14, 0x33}, @remote, @dev={0xac, 0x14, 0x14, 0x12}]}, @timestamp_addr={0x44, 0x34, 0x81, 0x1, 0x3, [{@local, 0x80000001}, {@multicast1, 0x7fff}, {@multicast1, 0x7}, {@broadcast, 0xe}, {@dev={0xac, 0x14, 0x14, 0xf}, 0x5}, {@multicast1, 0x2}]}, @cipso={0x86, 0x45, 0x3, [{0x2, 0x11, "830b141c927addb7f1b941993e3b14"}, {0x7, 0x3, "de"}, {0x0, 0x9, "242e6175448774"}, {0x5, 0x3, "f4"}, {0x5, 0xd, "ee9b54fcfc000cd086e93a"}, {0x5, 0x9, "951ee87c563f5f"}, {0x2, 0x9, "ac53f452144cb0"}]}, @timestamp_prespec={0x44, 0xc, 0xfe, 0x3, 0x4, [{@empty, 0x10000}]}, @ra={0x94, 0x4}, @rr={0x7, 0x13, 0x9a, [@remote, @rand_addr=0x64010100, @rand_addr=0x64010101, @multicast1]}]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000180)=0x7f, 0x4) connect$inet6(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x0, 0x0, 0x0) shutdown(r3, 0x1) getsockopt$inet6_int(r2, 0x29, 0x3c, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000000000000000fc000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000002c0003802800008008000340000000021c00028018000280080001"], 0xec}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000240)={'syztnl0\x00', 0x0, 0x7, 0x7, 0x4, 0x7fffffff, {{0x32, 0x4, 0x3, 0x6, 0xc8, 0x67, 0x0, 0x17, 0x2f, 0x0, @broadcast, @remote, {[@rr={0x7, 0x17, 0x16, [@local, @multicast1, @dev={0xac, 0x14, 0x14, 0x33}, @remote, @dev={0xac, 0x14, 0x14, 0x12}]}, @timestamp_addr={0x44, 0x34, 0x81, 0x1, 0x3, [{@local, 0x80000001}, {@multicast1, 0x7fff}, {@multicast1, 0x7}, {@broadcast, 0xe}, {@dev={0xac, 0x14, 0x14, 0xf}, 0x5}, {@multicast1, 0x2}]}, @cipso={0x86, 0x45, 0x3, [{0x2, 0x11, "830b141c927addb7f1b941993e3b14"}, {0x7, 0x3, "de"}, {0x0, 0x9, "242e6175448774"}, {0x5, 0x3, "f4"}, {0x5, 0xd, "ee9b54fcfc000cd086e93a"}, {0x5, 0x9, "951ee87c563f5f"}, {0x2, 0x9, "ac53f452144cb0"}]}, @timestamp_prespec={0x44, 0xc, 0xfe, 0x3, 0x4, [{@empty, 0x10000}]}, @ra={0x94, 0x4}, @rr={0x7, 0x13, 0x9a, [@remote, @rand_addr=0x64010100, @rand_addr=0x64010101, @multicast1]}]}}}}}) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x67, &(0x7f0000000180)=0x7f, 0x4) (async) connect$inet6(0xffffffffffffffff, 0x0, 0x0) (async) socket$packet(0x11, 0x3, 0x300) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) socket$inet6_sctp(0xa, 0x801, 0x84) (async) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8924, 0x0) (async) sendto$inet6(r3, 0x0, 0x0, 0x0, 0x0, 0x0) (async) shutdown(r3, 0x1) (async) getsockopt$inet6_int(r2, 0x29, 0x3c, 0x0, 0x0) (async) bind$inet(0xffffffffffffffff, 0x0, 0x0) (async) connect$inet(0xffffffffffffffff, 0x0, 0x0) (async) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) (async) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4001, 0x1, @dev={0xfe, 0x80, '\x00', 0x39}, 0x3e}, 0x1c) (async) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000000000000000fc000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028580000000c0a01010000000000000000070000000900020073797a31000000000900010073797a30000000002c0003802800008008000340000000021c00028018000280080001"], 0xec}}, 0x0) (async) 1.173997324s ago: executing program 4 (id=4005): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r1, {0x0, 0x2}, {0xffff, 0xffff}, {0xc, 0xfff3}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_DQ_RATE_ESTIMATOR={0x8, 0xc, 0x1}]}}]}, 0x3c}}, 0x20008010) 276.508307ms ago: executing program 2 (id=4006): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x0, 0x0}, 0x4000000) r1 = socket(0x15, 0x5, 0x0) getsockopt(r1, 0x200000000114, 0x2721, 0x0, &(0x7f0000000040)) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, 0x0) (async) sendmsg$netlink(0xffffffffffffffff, 0x0, 0x4) (async) r2 = socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) socket$nl_netfilter(0x10, 0x3, 0xc) (async) ioctl$sock_proto_private(r2, 0x8b15, &(0x7f0000000080)) (async) unshare(0x20000600) (async) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) (async) syz_emit_ethernet(0x6a, &(0x7f00000001c0)={@local, @link_local, @void, {@ipv4={0x800, @gre={{0x6, 0x4, 0x3, 0x0, 0x5c, 0x64, 0x0, 0xda, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x18}, @multicast2, {[@rr={0x7, 0x3, 0xbc}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x1, 0x0, 0x1}, {0x0, 0x0, 0x1}, {0x8, 0x88be, 0x1, {{0x9, 0x1, 0x0, 0x3, 0x0, 0x2, 0x4, 0x4}, 0x1, {0xfffffffd}}}, {0x8, 0x22eb, 0x1, {{0x1, 0x2, 0x1, 0x1, 0x0, 0x1, 0x3, 0x5}, 0x2, {0x6, 0x1000, 0x2, 0x1c, 0x0, 0x0, 0x1}}}}}}}}, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.stat\x00', 0x275a, 0x0) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r4) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x38, r6, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x18, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x6, 0x81, 0x9, 0x2, 0x11, 0x3, 0x9]}}]}]}]}, 0x38}}, 0x0) (async) read(r3, 0x0, 0x0) (async) socketpair(0xb, 0x80000, 0xff, &(0x7f00000001c0)) 269.500831ms ago: executing program 0 (id=4007): sendmsg$key(0xffffffffffffffff, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="023ba0b97d5889c0a200080d00000a000000000000000000000005000500000000000a000000000000000000000000000000000000fe0000020100000000000000000300060000f30000020000000000000000000000fbf50000"], 0x50}}, 0x0) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) bind$802154_raw(r0, &(0x7f0000000000)={0x24, @long={0x3, 0x1, {0xaaaaaaaaaaaa0102}}}, 0x14) r1 = socket(0x1d, 0x3, 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) bind$alg(r1, &(0x7f00000003c0)={0x26, 'aead\x00', 0x0, 0x0, 'rfc7539(cbc-aes-ce,crc32c-generic)\x00'}, 0x58) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x30, r3, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_TX_RATES={0x14, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x10, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_HT={0x6, 0x2, [{}, {0x0, 0x5}]}]}]}]}, 0x30}}, 0x0) getsockopt$nfc_llcp(r1, 0x65, 0x2, 0x0, 0x20000028) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000280)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x80, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x0, 0x3}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000380)={r5, 0xffffffffffffffff, &(0x7f0000000300)=""/36}, 0x20) pread64(r0, &(0x7f0000000180)=""/90, 0x5a, 0x2) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3000005, 0x40010, r5, 0x6e6ab000) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0x6, &(0x7f0000000000)=ANY=[@ANYRESOCT=r0], &(0x7f0000000040)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x8000}, 0x94) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r6) sendmsg$NLBL_CIPSOV4_C_ADD(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)=ANY=[@ANYBLOB="84010000", @ANYRES16=r7, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054"], 0x184}}, 0x0) 206.070823ms ago: executing program 1 (id=4008): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="780000001000830404000000fedbdf2500007400", @ANYRES32=r2, @ANYBLOB="0008000007500500580012800b0001006272696467650000480002800500190002000000050017"], 0x78}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)=@gettclass={0x24, 0x2a, 0x1, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0x7, 0x5e8703d7f8e8059c}, {0xc, 0x8}, {0x7, 0xa}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000000) 174.946583ms ago: executing program 4 (id=4009): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) (async) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)={0x114, 0x25, 0x1, 0x0, 0x0, "", [@nested={0x101, 0x0, 0x0, 0x1, [@typed={0xc, 0x1, 0x0, 0x0, @u64=0x2}, @typed={0x14, 0x3, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00'}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe8101000000010000008b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd"]}]}, 0x114}], 0x1}, 0x0) (async) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$kcm(0x29, 0x2, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r3, 0x119, 0x1, 0x0, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x201, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xd8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r2, 0x110, 0x5, &(0x7f0000000040)=[0x2, 0x1], 0x2) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002b80)={0x6, 0x4, &(0x7f0000001a00)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}, [@alu={0x7, 0x0, 0x9, 0x0, 0x0, 0x1, 0xffffffffffffffff}]}, &(0x7f0000001a40)='GPL\x00', 0x7}, 0x94) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xfff3, 0xffe0}, {}, {0x5, 0x8}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x0, 0xffff}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8848}, 0x4000010) (async, rerun: 64) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004}, 0xc000) 79.753741ms ago: executing program 3 (id=4010): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_SECURITY(r0, 0x11, 0x4, 0x0, 0x1000000000000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000900)=@updpolicy={0x13c, 0x19, 0x1, 0x70bd29, 0x25dfdbfb, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0xfffffffffffffffd}, {0x0, 0x5, 0x200000000000}, 0x0, 0x0, 0x1, 0x0, 0x2, 0x2}, [@tmpl={0x84, 0x5, [{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d6, 0x3c}, 0x2, @in6=@ipv4={'\x00', '\xff\xff', @empty}, 0x3507, 0x0, 0x3, 0x10, 0x9, 0x0, 0x10001}, {{@in6=@mcast1, 0x4d4, 0x2b}, 0x2, @in6=@empty, 0x0, 0x2, 0x1, 0x6a, 0x7ff, 0x8, 0x5}]}]}, 0x13c}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) socket$kcm(0x2, 0x3, 0x2) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r2, 0xc400941d, &(0x7f0000000a40)={0x0, 0x4, 0x2, 0x1}) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000280)={'veth0\x00', &(0x7f0000000700)=@ethtool_channels={0x3d, 0x7fff, 0x0, 0x1, 0x408, 0x1, 0x9, 0x2, 0x33}}) syz_emit_ethernet(0x32, &(0x7f0000000340)={@local, @dev, @void, {@ipv4={0x800, @generic={{0x9, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x8, 0x0, @private=0xa010100, @dev={0xac, 0x14, 0x14, 0x3b}, {[@ssrr={0x89, 0x7, 0xef, [@broadcast]}, @cipso={0x86, 0x6}]}}}}}}, 0x0) 49.583897ms ago: executing program 2 (id=4011): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@func_proto={0x0, 0x0, 0x0, 0xd, 0xa}, @array]}}, &(0x7f0000000f40)=""/4087, 0x3e, 0xff7, 0x1}, 0x20) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x4000051}, 0x0) 2.024916ms ago: executing program 0 (id=4012): sendmsg$ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, 0x0, 0xe7795a7bb2936510) setsockopt$TIPC_MCAST_REPLICAST(0xffffffffffffffff, 0x10f, 0x86) syz_emit_ethernet(0x323, &(0x7f00000002c0)={@multicast, @empty, @val={@val={0x88a8, 0x1, 0x0, 0x4}, {0x8100, 0x2, 0x0, 0x4}}, {@ipv6={0x86dd, @udp={0xe, 0x6, "3dcacd", 0x2e5, 0x11, 0xff, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, {[@fragment={0x88, 0x0, 0x2, 0x0, 0x0, 0x3, 0x67}, @srh={0x2e, 0xc, 0x4, 0x6, 0x3, 0x10, 0x1, [@loopback, @mcast1, @private0={0xfc, 0x0, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x1}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @loopback]}, @srh={0x67, 0x2, 0x4, 0x1, 0x9, 0x48, 0x7, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01']}, @fragment={0x3a, 0x0, 0xfb, 0x1, 0x0, 0x7, 0x68}, @dstopts={0xff, 0x3, '\x00', [@generic={0x1, 0xa, "6e0a8883da72c0cdbe91"}, @padn={0x1, 0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @enc_lim]}, @srh={0x87, 0x10, 0x4, 0x8, 0x7, 0x0, 0x8, [@private0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0={0xfc, 0x0, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}, @local, @local, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast2]}, @dstopts={0x2e, 0x0, '\x00', [@enc_lim={0x4, 0x1, 0x8}]}, @hopopts={0x2c, 0x1, '\x00', [@jumbo={0xc2, 0x4, 0xb}, @jumbo={0xc2, 0x4, 0x9}, @enc_lim={0x4, 0x1, 0x6}]}, @dstopts={0xc, 0x0, '\x00', [@pad1]}, @dstopts={0x33, 0xc, '\x00', [@calipso={0x7, 0x30, {0x1, 0xa, 0x3, 0x9, [0xfffffffffffffff6, 0x5, 0x5, 0x5, 0x7]}}, @padn={0x1, 0x1, [0x0]}, @enc_lim={0x4, 0x1, 0xfb}, @generic={0x5, 0x14, "c5202f93006d7eb37b69e88b5ece769fed788c5f"}, @jumbo={0xc2, 0x4, 0x8}, @jumbo={0xc2, 0x4, 0x9}, @ra={0x5, 0x2, 0x101}, @padn={0x1, 0x1, [0x0]}]}], {0x4e23, 0x4e24, 0xfd, 0x0, @opaque="d7279f61027a7dc1b8184556c52748eab5b4bb2992999863dcf3e096eb3e4b1b3aa706082cbda2d589a8d2d285e325ce6c48c6a7ae4e00f35325ef3e425f23a4e782fcfa6821d0e8bb475945140717ae1028ca4cc0c7b423966b55c2003aa55cacdea40a71a97fc1061ad0b0f69ffa220bbbeba0bc10ccc5ad8144dc2e91401e1edb855f5dc66f0b4a3147ef6bd19013e04b0bd92f07dd29bac42652eca35ac4fbaf5535dea79b79418c7ad1e4881dfe4592502e23c00ad53f55820b527ec5712cba1e21805f77285affe1f0b63bfa62981e818223fbf355824f93a486c2f755c5793ce555e3951208d88ba4a841657339fed5b3aa"}}}}}}, &(0x7f0000000080)={0x1, 0x3, [0x869, 0x5c5, 0x872, 0xdeb]}) syz_emit_ethernet(0x42, &(0x7f00000001c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @empty, @val={@void, {0x8100, 0x0, 0x0, 0x2}}, {@ipv6={0x86dd, @icmpv6={0x3, 0x6, "269fe0", 0x8, 0x3a, 0xff, @remote, @mcast2, {[], @echo_reply={0x81, 0x0, 0x0, 0xff, 0x7}}}}}}, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = socket$alg(0x26, 0x5, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x40800) socket$igmp6(0xa, 0x3, 0x2) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r3 = socket(0x10, 0x80002, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100)=0xf942, 0x4) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r2, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r3, @ANYRES32=r3], 0x44}}, 0x2000800) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x3a}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x94) r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000280)="2c0000001d005f80004000000000000005000000000000000000080008000100000000ff5b1844ad30c8ac46", 0x2c) 0s ago: executing program 1 (id=4013): r0 = socket$can_raw(0x1d, 0x3, 0x1) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x7c, 0x30, 0x9, 0x0, 0x0, {}, [{0x68, 0x1, [@m_mpls={0x64, 0x1, 0x0, 0x0, {{0x9}, {0x38, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x2}}, @TCA_MPLS_TTL={0x5, 0x7, 0x40}, @TCA_MPLS_LABEL={0x8}, @TCA_MPLS_TC={0x5}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x7c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000003c0)={'vcan0\x00', 0x0}) bind$can_raw(r0, &(0x7f0000000480)={0x1d, r2}, 0x10) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x2, &(0x7f0000000000), 0x4) kernel console output (not intermixed with test programs): aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 358.984300][T14890] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2394'. [ 359.151413][T14897] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2399'. [ 359.161804][T14897] bridge_slave_0: entered allmulticast mode [ 359.201377][T14901] smc: removing ib device syz0 [ 359.329614][T14912] netlink: 'syz.1.2402': attribute type 64 has an invalid length. [ 359.487862][T14918] netlink: 'syz.1.2406': attribute type 1 has an invalid length. [ 359.583760][T14920] gretap3: entered promiscuous mode [ 359.610641][T14918] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 359.724004][T14934] xt_l2tp: invalid flags combination: 0 [ 359.864423][T14929] ip6t_rpfilter: unknown options [ 359.870805][T14929] netlink: 'syz.0.2407': attribute type 5 has an invalid length. [ 360.146352][T14953] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 360.181729][T14964] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 3, id = 0 [ 360.236519][T14966] netlink: 'syz.4.2414': attribute type 4 has an invalid length. [ 360.422004][T14972] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 360.622229][T14983] xt_connbytes: Forcing CT accounting to be enabled [ 360.653083][T14981] netlink: 'syz.2.2419': attribute type 1 has an invalid length. [ 360.806137][T14988] netlink: 'syz.1.2422': attribute type 2 has an invalid length. [ 361.229200][T15012] tipc: Enabling of bearer rejected, failed to enable media [ 361.250445][T15012] xt_CT: You must specify a L4 protocol and not use inversions on it [ 361.432794][T15010] syz.2.2430 (15010) used greatest stack depth: 17472 bytes left [ 361.634798][T15033] sctp: [Deprecated]: syz.4.2436 (pid 15033) Use of int in max_burst socket option. [ 361.634798][T15033] Use struct sctp_assoc_value instead [ 362.077596][T15056] __nla_validate_parse: 7 callbacks suppressed [ 362.077618][T15056] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2442'. [ 362.151239][T15062] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2445'. [ 362.334610][T15071] netlink: 'syz.1.2447': attribute type 21 has an invalid length. [ 362.387392][T15071] netlink: 'syz.1.2447': attribute type 1 has an invalid length. [ 362.417169][T15075] netlink: 'syz.1.2447': attribute type 17 has an invalid length. [ 362.430506][T15075] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2447'. [ 362.470557][T15074] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2448'. [ 362.474077][T15075] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2447'. [ 362.484209][T15074] x_tables: duplicate underflow at hook 1 [ 362.654382][T15087] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2451'. [ 362.699314][T15093] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 363.145415][T15111] netlink: 84 bytes leftover after parsing attributes in process `syz.1.2457'. [ 363.341225][T15122] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2460'. [ 363.400064][T15122] ipt_ECN: cannot use operation on non-tcp rule [ 363.583063][T15148] bpq0: entered allmulticast mode [ 363.634186][T15146] xt_CT: You must specify a L4 protocol and not use inversions on it [ 363.788296][T15156] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.2469'. [ 364.034921][T15181] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2475'. [ 364.882571][T15218] block nbd4: not configured, cannot reconfigure [ 366.057477][T15298] validate_nla: 1 callbacks suppressed [ 366.057495][T15298] netlink: 'syz.0.2503': attribute type 1 has an invalid length. [ 366.582908][ T5488] veth0_macvtap: left promiscuous mode [ 366.671021][T15332] vcan1: entered promiscuous mode [ 366.676304][T15332] vcan1: entered allmulticast mode [ 366.837158][T15340] netem: change failed [ 366.849647][ T4584] wlan1: Trigger new scan to find an IBSS to join [ 367.030201][T15355] vlan0: entered promiscuous mode [ 367.035323][T15355] bridge0: entered promiscuous mode [ 367.059129][T15355] vlan0: entered allmulticast mode [ 367.082823][T15355] bridge0: entered allmulticast mode [ 367.244726][T15360] 8021q: adding VLAN 0 to HW filter on device bond12 [ 367.273999][T15355] __nla_validate_parse: 6 callbacks suppressed [ 367.274016][T15355] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2519'. [ 367.389091][T15355] bond0 (unregistering): left promiscuous mode [ 367.395350][T15355] bond_slave_0: left promiscuous mode [ 367.418967][T15355] bond_slave_1: left promiscuous mode [ 367.424628][T15355] mac80211_hwsim hwsim8 wlan1: left promiscuous mode [ 367.459810][T15380] openvswitch: netlink: Unknown key attributes 2 [ 367.466682][T15355] bridge_slave_1: left promiscuous mode [ 367.500532][T15355] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 367.538384][T15355] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 367.567276][T15355] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 367.610264][T15387] netlink: 'syz.0.2527': attribute type 1 has an invalid length. [ 367.636597][T15355] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 367.649911][T15355] bond0 (unregistering): Released all slaves [ 367.864848][T15398] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2531'. [ 367.876438][T15396] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2530'. [ 367.900071][T15398] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2531'. [ 368.057762][T15406] netlink: 'syz.3.2532': attribute type 39 has an invalid length. [ 368.162821][T15414] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 368.354210][T15421] bridge7: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 368.382375][T15430] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2543'. [ 368.397263][T15426] bond9: option mode: invalid value (133) [ 368.406420][T15426] bond9 (unregistering): Released all slaves [ 368.442226][T15430] netlink: 52 bytes leftover after parsing attributes in process `syz.3.2543'. [ 368.636466][T15443] tipc: Enabling of bearer rejected, already enabled [ 368.680969][T15446] netlink: 'syz.4.2547': attribute type 1 has an invalid length. [ 368.733576][T15447] syzkaller0: entered promiscuous mode [ 368.749149][T15447] syzkaller0: entered allmulticast mode [ 368.766237][T15459] netlink: 'syz.0.2548': attribute type 4 has an invalid length. [ 368.781301][T15454] geneve1: Caught tx_queue_len zero misconfig [ 368.806382][T15456] bond2: (slave vxcan1): The slave device specified does not support setting the MAC address [ 368.820879][T15456] bond2: (slave vxcan1): Setting fail_over_mac to active for active-backup mode [ 368.841142][T15456] bond2: (slave vxcan1): making interface the new active one [ 368.852298][T15456] bond2: (slave vxcan1): Enslaving as an active interface with an up link [ 369.010213][T15469] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.2552'. [ 369.030010][T15467] tipc: Enabling of bearer rejected, already enabled [ 369.101150][T15475] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2555'. [ 369.123571][T15475] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2555'. [ 369.201155][T15478] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2556'. [ 369.214492][T15478] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 369.237725][T15480] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 369.392523][T15492] netlink: 'syz.4.2561': attribute type 3 has an invalid length. [ 369.516404][T15490] syzkaller0: entered promiscuous mode [ 369.523301][T15490] syzkaller0: entered allmulticast mode [ 369.892998][ T33] wlan1: Trigger new scan to find an IBSS to join [ 371.404198][T15552] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 371.419110][T15551] sctp: [Deprecated]: syz.0.2574 (pid 15551) Use of struct sctp_assoc_value in delayed_ack socket option. [ 371.419110][T15551] Use struct sctp_sack_info instead [ 371.648179][T15570] netlink: 'syz.0.2581': attribute type 1 has an invalid length. [ 371.694026][T15569] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 371.706564][T15571] openvswitch: netlink: Unexpected mask (mask=40040, allowed=10048) [ 371.715792][T15571] netlink: 'syz.4.2582': attribute type 1 has an invalid length. [ 371.773262][T15571] bond3: (slave ip6gretap2): making interface the new active one [ 371.782308][T15571] bond3: (slave ip6gretap2): Enslaving as an active interface with an up link [ 371.840486][T15569] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 371.930638][T15569] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 371.975042][T15585] vcan1: entered promiscuous mode [ 372.002541][T15585] vcan1: entered allmulticast mode [ 372.173260][T15569] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 372.201477][T15598] tun0: tun_chr_ioctl cmd 1074025675 [ 372.213369][T15598] tun0: persist disabled [ 372.401943][ T4584] netdevsim netdevsim1 eth0: set [0, 0] type 1 family 0 port 2816 - 0 [ 372.497140][T10928] netdevsim netdevsim1 eth1: set [0, 0] type 1 family 0 port 2816 - 0 [ 372.505852][T10928] netdevsim netdevsim1 eth2: set [0, 0] type 1 family 0 port 2816 - 0 [ 372.533895][T15617] __nla_validate_parse: 7 callbacks suppressed [ 372.533913][T15617] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2595'. [ 372.550357][T15617] netlink: 'syz.4.2595': attribute type 5 has an invalid length. [ 372.558130][T15617] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2595'. [ 372.574532][ T4584] netdevsim netdevsim1 eth3: set [0, 0] type 1 family 0 port 2816 - 0 [ 372.603536][T15617] geneve5: entered promiscuous mode [ 372.619093][T15617] geneve5: entered allmulticast mode [ 372.626460][ T63] netdevsim netdevsim4 eth0: set [1, 2] type 2 family 0 port 256 - 0 [ 372.635829][ T63] netdevsim netdevsim4 eth1: set [1, 2] type 2 family 0 port 256 - 0 [ 372.678077][ T63] netdevsim netdevsim4 eth2: set [1, 2] type 2 family 0 port 256 - 0 [ 372.708798][ T63] netdevsim netdevsim4 eth3: set [1, 2] type 2 family 0 port 256 - 0 [ 372.807497][T15633] A link change request failed with some changes committed already. Interface bond_slave_1 may have been left with an inconsistent configuration, please check. [ 372.850190][ T63] wlan1: Trigger new scan to find an IBSS to join [ 372.871188][T15643] netlink: 720 bytes leftover after parsing attributes in process `syz.2.2602'. [ 373.091866][T15656] openvswitch: netlink: IP tunnel TTL not specified. [ 373.105341][T15658] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2607'. [ 373.131713][ T29] audit: type=1800 audit(1771645286.988:8): pid=15650 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2601" name="memory.events" dev="tmpfs" ino=2668 res=0 errno=0 [ 373.156732][T15663] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2607'. [ 373.319716][T15676] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2610'. [ 373.445735][T15685] netlink: 'syz.0.2614': attribute type 61 has an invalid length. [ 373.454089][T15685] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2614'. [ 373.485260][T15685] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2614'. [ 373.544006][T15689] netlink: 139 bytes leftover after parsing attributes in process `syz.3.2615'. [ 373.623657][T15695] netlink: 'syz.2.2617': attribute type 4 has an invalid length. [ 373.701241][T15696] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 373.744493][T15689] netlink: 'syz.3.2615': attribute type 1 has an invalid length. [ 373.746906][ T63] wlan1: Creating new IBSS network, BSSID 6e:53:05:e4:8d:d6 [ 373.810363][T15689] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2615'. [ 374.315569][T15742] ip_tunnel: non-ECT from 172.20.20.187 with TOS=0x2 [ 374.727499][T15771] netlink: zone id is out of range [ 374.781890][T15771] netlink: zone id is out of range [ 374.787089][T15771] netlink: zone id is out of range [ 374.819069][T15771] netlink: zone id is out of range [ 374.824399][T15771] netlink: zone id is out of range [ 374.831346][T15771] netlink: zone id is out of range [ 374.836506][T15771] netlink: zone id is out of range [ 374.888805][T15771] netlink: set zone limit has 4 unknown bytes [ 375.151305][T15796] SET target dimension over the limit! [ 375.367745][T15802] team0: Device ip6gre2 is of different type [ 375.555315][T15814] netlink: 'syz.1.2653': attribute type 12 has an invalid length. [ 375.835540][T15834] netlink: 'syz.3.2661': attribute type 3 has an invalid length. [ 376.838115][T15894] bond9: option packets_per_slave: mode dependency failed, not supported in mode active-backup(1) [ 376.860774][T15894] bond9 (unregistering): Released all slaves [ 376.899241][T15899] syzkaller0: entered promiscuous mode [ 376.904943][T15899] syzkaller0: entered allmulticast mode [ 377.038411][T15910] nbd: must specify a size in bytes for the device [ 377.113565][T15912] netlink: 'syz.2.2686': attribute type 4 has an invalid length. [ 377.173552][T15912] netlink: 'syz.2.2686': attribute type 4 has an invalid length. [ 377.293861][T15921] ipt_ECN: cannot use operation on non-tcp rule [ 377.632550][T15950] __nla_validate_parse: 16 callbacks suppressed [ 377.632572][T15950] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2696'. [ 377.672612][T15950] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2696'. [ 377.783853][T15950] gretap3: entered promiscuous mode [ 377.795322][T15950] gretap3: entered allmulticast mode [ 377.815545][T15953] vlan0: entered promiscuous mode [ 377.839317][T15953] geneve1: entered promiscuous mode [ 377.845226][T15953] vlan0: entered allmulticast mode [ 377.852418][T15953] geneve1: entered allmulticast mode [ 377.872302][T15957] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2698'. [ 377.923017][T15779] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 377.999018][T15961] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2699'. [ 378.206288][T15972] bond10: entered allmulticast mode [ 378.215874][T15975] IPv6: sit3: Disabled Multicast RS [ 378.236233][T15972] bridge7: entered promiscuous mode [ 378.241582][T15972] bridge7: entered allmulticast mode [ 378.251673][T15972] bond10: (slave bridge7): Enslaving as an active interface with an up link [ 378.289790][T15981] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2707'. [ 378.381368][T15981] bond0: option xmit_hash_policy: invalid value (64) [ 378.402801][T15981] bond0 (unregistering): Released all slaves [ 378.609050][ T1300] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 378.952580][T16020] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2716'. [ 378.999343][T16018] syzkaller0: entered promiscuous mode [ 379.014619][T16018] syzkaller0: entered allmulticast mode [ 379.025393][T16018] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2715'. [ 379.069533][T16018] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2715'. [ 379.108341][T16018] ipvlan1: entered allmulticast mode [ 379.113812][T16018] batadv_slave_1: entered allmulticast mode [ 379.203536][T16040] netlink: 'syz.3.2722': attribute type 1 has an invalid length. [ 379.213978][T16040] netlink: 'syz.3.2722': attribute type 4 has an invalid length. [ 379.238809][T16040] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.2722'. [ 379.407170][T16047] openvswitch: netlink: Flow key attribute not present in set flow. [ 380.327012][T16098] bond0: (slave veth0_to_bond): Releasing active interface [ 380.598204][T16125] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2743'. [ 380.627318][T16125] netlink: 'syz.0.2743': attribute type 7 has an invalid length. [ 381.461424][T16174] team0: No ports can be present during mode change [ 381.562960][T16181] netlink: 'syz.4.2761': attribute type 1 has an invalid length. [ 381.681342][T16181] 8021q: adding VLAN 0 to HW filter on device bond4 [ 382.603659][T16244] netlink: 'syz.1.2777': attribute type 6 has an invalid length. [ 382.612203][T16245] syzkaller1: entered promiscuous mode [ 382.618290][T16245] syzkaller1: entered allmulticast mode [ 382.644122][T16244] netlink: 'syz.1.2777': attribute type 7 has an invalid length. [ 382.657135][T16244] netlink: 'syz.1.2777': attribute type 8 has an invalid length. [ 382.682843][T16244] netlink: 'syz.1.2777': attribute type 4 has an invalid length. [ 382.707069][T16249] __nla_validate_parse: 10 callbacks suppressed [ 382.707088][T16249] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2780'. [ 383.025359][T16270] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2787'. [ 383.055406][T16270] vcan0 (unregistering): left allmulticast mode [ 383.090531][T16275] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 383.119324][T16276] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2788'. [ 383.219073][T16275] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2787'. [ 383.347401][T16282] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2790'. [ 383.367032][T16282] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2790'. [ 383.376200][T16282] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2790'. [ 383.388451][T16282] 8021q: VLANs not supported on ip6_vti0 [ 383.483835][T16288] netlink: 'syz.4.2793': attribute type 1 has an invalid length. [ 383.543581][T16288] 8021q: adding VLAN 0 to HW filter on device bond5 [ 383.596539][T16293] netlink: 'syz.3.2795': attribute type 5 has an invalid length. [ 383.629837][T16288] bond5: (slave gretap2): making interface the new active one [ 383.639590][T16288] bond5: (slave gretap2): Enslaving as an active interface with an up link [ 383.770780][T16303] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2799'. [ 383.780098][T16303] block nbd1: Unsupported socket: should be TCP or UNIX. [ 383.933213][T16311] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2802'. [ 383.972013][T16311] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 383.981536][T16311] team0: Port device batadv3 added [ 384.016754][T16311] set match dimension is over the limit! [ 384.099563][T16332] IPVS: set_ctl: invalid protocol: 60 172.20.20.170:20001 [ 384.267128][T16335] bridge6: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 384.576121][T16362] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2815'. [ 385.157812][T16412] netlink: 'syz.1.2825': attribute type 1 has an invalid length. [ 385.412349][ T29] audit: type=1800 audit(1771645299.268:9): pid=16417 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.2826" name="memory.events" dev="tmpfs" ino=2895 res=0 errno=0 [ 385.829478][T16454] netlink: 'syz.0.2835': attribute type 1 has an invalid length. [ 385.857335][T16455] netlink: 'syz.3.2841': attribute type 10 has an invalid length. [ 385.888481][T16455] team0: Device veth0_vlan failed to register rx_handler [ 386.295541][T16486] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) [ 386.618303][T16508] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 386.838271][T16521] xt_nat: multiple ranges no longer supported [ 387.223366][T16538] netlink: 'syz.2.2865': attribute type 1 has an invalid length. [ 387.256812][T16538] bond9: entered promiscuous mode [ 387.262996][T16538] 8021q: adding VLAN 0 to HW filter on device bond9 [ 387.305318][T16538] bond9: (slave bridge7): making interface the new active one [ 387.315224][T16538] bridge7: entered promiscuous mode [ 387.321879][T16538] bond9: (slave bridge7): Enslaving as an active interface with an up link [ 387.448397][T16544] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 387.709990][T16566] openvswitch: netlink: Unexpected mask (mask=2200040, allowed=2010048) [ 387.830984][T16571] syzkaller0: entered promiscuous mode [ 387.839360][T16571] syzkaller0: entered allmulticast mode [ 388.023224][T16589] netlink: 'syz.3.2880': attribute type 15 has an invalid length. [ 388.032339][T16589] __nla_validate_parse: 16 callbacks suppressed [ 388.032361][T16589] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2880'. [ 388.217468][T16596] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2883'. [ 388.241246][T16600] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2882'. [ 388.263565][T16602] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2885'. [ 388.299030][T16601] delete_channel: no stack [ 388.422108][T16601] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2884'. [ 388.441400][T16601] tipc: Enabling of bearer rejected, already enabled [ 388.535763][T16626] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2888'. [ 388.988757][T16652] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2898'. [ 389.041242][T16656] netdevsim netdevsim2 netdevsim0: left promiscuous mode [ 389.185857][T16662] netlink: 'syz.2.2903': attribute type 12 has an invalid length. [ 389.480939][T16685] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2906'. [ 389.574363][T16690] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2910'. [ 389.610892][T16690] pim6reg: entered allmulticast mode [ 389.622444][T16690] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2910'. [ 389.660961][T16695] lo: left promiscuous mode [ 389.665586][T16695] lo: entered allmulticast mode [ 389.690756][T16695] tunl0: entered allmulticast mode [ 389.696125][T16695] gre0: entered allmulticast mode [ 389.702597][T16695] gretap0: left promiscuous mode [ 389.707596][T16695] gretap0: entered allmulticast mode [ 389.732454][T16695] erspan0: entered allmulticast mode [ 389.760236][T16695] ip_vti0: entered allmulticast mode [ 389.766608][T16695] ip6_vti0: entered allmulticast mode [ 389.777617][T16695] sit0: entered allmulticast mode [ 389.784790][T16695] ip6tnl0: entered allmulticast mode [ 389.790524][T16695] ip6gre0: entered allmulticast mode [ 389.796060][T16695] ip6gretap0: entered allmulticast mode [ 389.806856][T16695] bridge0: entered allmulticast mode [ 389.813222][T16695] vcan0: entered allmulticast mode [ 389.821548][T16695] team0: entered allmulticast mode [ 389.826845][T16695] team_slave_1: entered allmulticast mode [ 389.833794][T16695] batadv1: entered allmulticast mode [ 389.839949][T16695] batadv2: entered allmulticast mode [ 389.846060][T16695] batadv3: entered allmulticast mode [ 389.852085][T16695] dummy0: entered allmulticast mode [ 389.858181][T16695] nlmon0: entered allmulticast mode [ 389.864705][T16695] caif0: entered allmulticast mode [ 389.870746][T16695] batadv0: entered allmulticast mode [ 389.876947][T16695] vxcan0: entered allmulticast mode [ 389.884046][T16695] vxcan1: entered allmulticast mode [ 389.890210][T16695] veth0: entered allmulticast mode [ 389.895737][T16695] veth1: entered allmulticast mode [ 389.901475][T16695] wg0: entered allmulticast mode [ 389.906729][T16695] wg1: entered allmulticast mode [ 389.912481][T16695] wg2: entered allmulticast mode [ 389.918087][T16695] veth1_to_bridge: entered allmulticast mode [ 389.925597][T16695] veth0_to_bond: entered allmulticast mode [ 389.932124][T16695] bond_slave_0: entered allmulticast mode [ 389.938177][T16695] veth1_to_bond: entered allmulticast mode [ 389.945486][T16695] bond_slave_1: entered allmulticast mode [ 389.952061][T16695] veth1_to_team: entered allmulticast mode [ 389.958262][T16695] veth0_to_batadv: entered allmulticast mode [ 389.965004][T16695] batadv_slave_0: entered allmulticast mode [ 389.971556][T16695] veth1_to_batadv: entered allmulticast mode [ 389.977780][T16695] batadv_slave_1: entered allmulticast mode [ 389.984218][T16695] xfrm0: entered allmulticast mode [ 389.989710][T16695] veth0_to_hsr: entered allmulticast mode [ 389.995690][T16695] hsr_slave_0: entered allmulticast mode [ 390.002925][T16695] veth1_to_hsr: entered allmulticast mode [ 390.010048][T16695] veth1_virt_wifi: entered allmulticast mode [ 390.016242][T16695] veth0_virt_wifi: entered allmulticast mode [ 390.022614][T16695] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 390.030939][T16695] veth1_vlan: entered allmulticast mode [ 390.036769][T16695] veth0_vlan: entered allmulticast mode [ 390.043478][T16695] vlan0: entered allmulticast mode [ 390.049474][T16695] macvlan0: entered allmulticast mode [ 390.055113][T16695] macvlan1: entered allmulticast mode [ 390.060780][T16695] ipvlan0: entered allmulticast mode [ 390.066276][T16695] ipvlan1: entered allmulticast mode [ 390.072226][T16695] veth1_macvtap: entered allmulticast mode [ 390.078257][T16695] veth0_macvtap: entered allmulticast mode [ 390.084703][T16695] macvtap0: entered allmulticast mode [ 390.090741][T16695] macsec0: entered allmulticast mode [ 390.105410][T16695] geneve0: entered allmulticast mode [ 390.111133][T16695] geneve1: entered allmulticast mode [ 390.116704][T16695] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 390.124704][T16695] netdevsim netdevsim0 netdevsim1: entered allmulticast mode [ 390.132925][T16695] netdevsim netdevsim0 netdevsim2: entered allmulticast mode [ 390.140927][T16695] netdevsim netdevsim0 netdevsim3: entered allmulticast mode [ 390.149269][T16695] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode [ 390.161299][T16695] mac80211_hwsim hwsim3 wlan1: entered allmulticast mode [ 390.194313][T16695] bond1: entered allmulticast mode [ 390.206136][T16695] geneve2: entered allmulticast mode [ 390.221182][T16695] bond2: entered allmulticast mode [ 390.230723][T16695] bond3: entered allmulticast mode [ 390.240330][T16695] gretap1: entered allmulticast mode [ 390.248862][T16712] block nbd3: not configured, cannot reconfigure [ 390.262241][T16695] vlan2: entered allmulticast mode [ 390.293895][T16695] bond4: entered allmulticast mode [ 390.301776][T16695] ip6gretap1: entered allmulticast mode [ 390.312567][T16695] mac80211_hwsim hwsim16 wlan2: entered allmulticast mode [ 390.321124][T16695] macvlan2: left promiscuous mode [ 390.326585][T16695] mac80211_hwsim hwsim17 wlan3: entered allmulticast mode [ 390.344110][T16695] bridge1: entered allmulticast mode [ 390.350168][T16695] bond0: entered allmulticast mode [ 390.356907][T16695] ip6tnl1: entered allmulticast mode [ 390.363368][T16695] bridge2: entered allmulticast mode [ 390.370313][T16695] bond5: entered allmulticast mode [ 390.375678][T16695] ip6tnl2: entered allmulticast mode [ 390.383151][T16695] vlan3: left promiscuous mode [ 390.389341][T16695] hsr_slave_1: left promiscuous mode [ 390.396725][T16695] bridge3: entered allmulticast mode [ 390.413951][T16695] veth2: entered allmulticast mode [ 390.419937][T16695] veth3: entered allmulticast mode [ 390.425406][T16695] syztnl1: entered allmulticast mode [ 390.432251][T16695] ipvlan2: entered allmulticast mode [ 390.451229][T16695] bridge4: entered allmulticast mode [ 390.472461][T16695] virt_wifi0.0002: entered allmulticast mode [ 390.482130][T16695] ip6erspan0: entered allmulticast mode [ 390.487954][T16695] gretap2: entered allmulticast mode [ 390.494767][T16695] bond6: entered allmulticast mode [ 390.505147][T16695] bridge5: entered allmulticast mode [ 390.553911][T16695] ip6erspan1: entered allmulticast mode [ 390.569551][T16695] veth4: entered allmulticast mode [ 390.578166][T16695] veth5: entered allmulticast mode [ 390.585046][T16695] bond7: entered allmulticast mode [ 390.596911][T16695] bridge6: entered allmulticast mode [ 390.615670][T16695] sit1: entered allmulticast mode [ 390.633284][T16695] gre1: entered allmulticast mode [ 390.646131][T16695] bond8: entered allmulticast mode [ 390.652799][T16695] bond9: entered allmulticast mode [ 390.658219][T16695] vti0: entered allmulticast mode [ 390.666508][T16695] bridge7: left promiscuous mode [ 390.686137][T16695] gre2: entered allmulticast mode [ 391.779684][T16790] IPv6: syztnl2: Disabled Multicast RS [ 394.268763][T16756] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 394.413918][T16820] __nla_validate_parse: 116 callbacks suppressed [ 394.413938][T16820] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2945'. [ 394.485635][T16826] netlink: 'syz.0.2947': attribute type 1 has an invalid length. [ 394.494037][T16826] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2947'. [ 394.592458][T16828] A link change request failed with some changes committed already. Interface ip6gre0 may have been left with an inconsistent configuration, please check. [ 394.646316][T16836] netlink: 16215 bytes leftover after parsing attributes in process `syz.4.2952'. [ 394.664712][T16836] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2952'. [ 394.717482][T16837] netlink: 'syz.3.2951': attribute type 1 has an invalid length. [ 394.770166][T16843] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2953'. [ 394.872641][ T5842] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 394.882419][ T5842] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 394.891375][ T5842] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 394.900642][ T5842] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 394.910007][ T5842] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 394.924369][T16837] 8021q: adding VLAN 0 to HW filter on device bond7 [ 394.937745][T16845] syzkaller1: entered promiscuous mode [ 394.949768][T16845] syzkaller1: entered allmulticast mode [ 394.997428][T16846] wg1 speed is unknown, defaulting to 1000 [ 395.391235][ T5842] Bluetooth: hci4: link tx timeout [ 395.396474][ T5842] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 395.766835][T16846] chnl_net:caif_netlink_parms(): no params data found [ 396.022775][T16846] bridge0: port 1(bridge_slave_0) entered blocking state [ 396.039321][T16846] bridge0: port 1(bridge_slave_0) entered disabled state [ 396.056954][T16846] bridge_slave_0: entered allmulticast mode [ 396.070622][T16846] bridge_slave_0: entered promiscuous mode [ 396.079633][T16846] bridge0: port 2(bridge_slave_1) entered blocking state [ 396.086874][T16846] bridge0: port 2(bridge_slave_1) entered disabled state [ 396.096059][T16846] bridge_slave_1: entered allmulticast mode [ 396.104783][T16846] bridge_slave_1: entered promiscuous mode [ 396.200716][T16913] 8021q: adding VLAN 0 to HW filter on device bond6 [ 396.228672][T16846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 396.262131][T16846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 396.337709][T16846] team0: Port device team_slave_0 added [ 396.344309][T10928] batadv1: left allmulticast mode [ 396.350675][T10928] batadv1: left promiscuous mode [ 396.357343][T10928] bridge0: port 3(batadv1) entered disabled state [ 396.367405][T10928] bridge_slave_0: left allmulticast mode [ 396.374057][T10928] bridge_slave_0: left promiscuous mode [ 396.380384][T10928] bridge0: port 1(bridge_slave_0) entered disabled state [ 396.606122][T10928] bond0 (unregistering): (slave gretap1): Releasing backup interface [ 396.793520][T10928] bond0 (unregistering): (slave bridge2): Releasing backup interface [ 396.802111][T10928] bridge2 (unregistering): left promiscuous mode [ 396.999048][ T5846] Bluetooth: hci5: command tx timeout [ 397.033198][T10928] bond9 (unregistering): (slave bridge7): Releasing backup interface [ 397.041639][T10928] bridge7 (unregistering): left promiscuous mode [ 397.113454][T10928] bond1 (unregistering): Released all slaves [ 397.128382][T10928] bond2 (unregistering): Released all slaves [ 397.143918][T10928] bond3 (unregistering): Released all slaves [ 397.165707][T10928] bond0 (unregistering): Released all slaves [ 397.183737][T10928] bond4 (unregistering): Released all slaves [ 397.202938][T10928] bond5 (unregistering): Released all slaves [ 397.217509][T10928] bond6 (unregistering): Released all slaves [ 397.237021][T10928] bond7 (unregistering): Released all slaves [ 397.257901][T10928] bond8 (unregistering): Released all slaves [ 397.273111][T10928] bond9 (unregistering): Released all slaves [ 397.290434][T16846] team0: Port device team_slave_1 added [ 397.423917][T10928] tipc: Disabling bearer [ 397.449628][T16846] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 397.456865][T16846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 397.460489][T10928] tipc: Left network mode [ 397.488575][ T5846] Bluetooth: hci4: command 0x0405 tx timeout [ 397.508213][T16846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 397.585862][T10928] IPVS: stopping master sync thread 9975 ... [ 397.601839][T16846] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 397.645713][T16846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 397.681258][T16846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 397.801985][T16846] hsr_slave_0: entered promiscuous mode [ 397.818261][T16846] hsr_slave_1: entered promiscuous mode [ 397.825695][T16846] debugfs: 'hsr0' already exists in 'hsr' [ 397.833312][T16846] Cannot create hsr debugfs directory [ 397.911387][T16853] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 398.317545][T16942] nbd1: detected capacity change from 0 to 127 [ 398.459402][ T5842] block nbd1: Receive control failed (result -104) [ 398.557407][T16975] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 398.953638][T17000] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 399.029882][T17003] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2993'. [ 399.075253][T17005] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2994'. [ 399.088247][ T5842] Bluetooth: hci5: command tx timeout [ 399.158061][T17008] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2994'. [ 399.282819][T10928] team0 (unregistering): Port device team_slave_1 removed [ 399.313185][T10928] team0 (unregistering): Port device team_slave_0 removed [ 399.963623][T16846] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 400.008085][T16846] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 400.059961][T16846] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 400.072091][T16846] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 400.083055][T17036] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.2999'. [ 400.181546][T17036] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2999'. [ 400.218758][T17036] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2999'. [ 400.374987][T16846] 8021q: adding VLAN 0 to HW filter on device bond0 [ 400.431675][T16846] 8021q: adding VLAN 0 to HW filter on device team0 [ 400.482263][ T1135] bridge0: port 1(bridge_slave_0) entered blocking state [ 400.489673][ T1135] bridge0: port 1(bridge_slave_0) entered forwarding state [ 400.536501][ T1135] bridge0: port 2(bridge_slave_1) entered blocking state [ 400.543804][ T1135] bridge0: port 2(bridge_slave_1) entered forwarding state [ 400.622834][T17059] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3001'. [ 400.681684][T17059] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3001'. [ 401.085450][T16846] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 401.159548][ T5842] Bluetooth: hci5: command tx timeout [ 401.196788][T16846] veth0_vlan: entered promiscuous mode [ 401.219890][T16846] veth1_vlan: entered promiscuous mode [ 401.344098][T17082] 8021q: adding VLAN 0 to HW filter on device team0 [ 401.354961][T17087] netlink: 'syz.4.3007': attribute type 1 has an invalid length. [ 401.391642][T17082] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 401.499408][ T5945] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 401.514539][T16846] veth0_macvtap: entered promiscuous mode [ 401.556302][T16846] veth1_macvtap: entered promiscuous mode [ 401.601887][T16846] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 401.634274][T16846] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 401.691586][ T3473] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.725975][ T1135] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.757723][ T1135] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.776841][ T1135] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 401.796474][T16981] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 401.830185][T17094] syzkaller0: entered promiscuous mode [ 401.835795][T17094] syzkaller0: entered allmulticast mode [ 401.980439][T17102] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.3009'. [ 401.997048][T17098] syz_tun: entered promiscuous mode [ 402.003193][T17098] macvtap1: entered promiscuous mode [ 402.025619][T17098] syz_tun: left promiscuous mode [ 402.108454][T17102] pim6reg: entered allmulticast mode [ 402.122691][T17106] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3009'. [ 402.163762][T17106] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3009'. [ 402.309713][T10930] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 402.359586][T10668] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 402.386106][ T1135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.412102][ T1135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 402.450885][T17114] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3011'. [ 402.480004][T17117] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3010'. [ 402.524088][ T1135] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 402.565076][ T1135] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 403.229063][ T5846] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 403.238902][ T5846] Bluetooth: hci5: command tx timeout [ 403.244413][ T5846] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 403.272551][ T5846] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 403.282926][T17159] IPVS: Error connecting to the multicast addr [ 403.291691][ T5846] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 403.319392][ T5846] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 403.351113][T10928] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 403.379899][T10928] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 403.416528][T17163] netlink: 'syz.4.3022': attribute type 29 has an invalid length. [ 403.454365][T17163] netlink: 'syz.4.3022': attribute type 29 has an invalid length. [ 403.748899][T10668] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 403.882209][T17181] netlink: 'syz.0.3026': attribute type 11 has an invalid length. [ 403.891052][T17181] netlink: 'syz.0.3026': attribute type 4 has an invalid length. [ 403.904411][T17181] netlink: 'syz.0.3026': attribute type 5 has an invalid length. [ 403.912582][T17181] netlink: 'syz.0.3026': attribute type 6 has an invalid length. [ 404.113924][T17190] : renamed from bond0 [ 404.160017][T17190] netlink: 'syz.0.3028': attribute type 32 has an invalid length. [ 404.186660][T17156] chnl_net:caif_netlink_parms(): no params data found [ 404.289820][T17190] bond0: option coupled_control: invalid value (159) [ 404.303191][T17190] bond0 (unregistering): Released all slaves [ 404.364603][T17203] bpq0: left allmulticast mode [ 404.401366][T17209] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 404.426233][T17213] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 404.475866][T17198] syzkaller0: entered promiscuous mode [ 404.481754][T17198] syzkaller0: entered allmulticast mode [ 404.499972][T17201] ipvlan1: entered promiscuous mode [ 404.623734][T17223] netlink: 'syz.3.3034': attribute type 1 has an invalid length. [ 404.690888][T17223] netlink: 'syz.3.3034': attribute type 2 has an invalid length. [ 404.700515][T17226] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 404.748908][T17156] bridge0: port 1(bridge_slave_0) entered blocking state [ 404.756099][T17156] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.778208][T17156] bridge_slave_0: entered allmulticast mode [ 404.804064][T17156] bridge_slave_0: entered promiscuous mode [ 404.899386][T17156] bridge0: port 2(bridge_slave_1) entered blocking state [ 404.906709][T17156] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.964073][T17156] bridge_slave_1: entered allmulticast mode [ 404.986966][T17156] bridge_slave_1: entered promiscuous mode [ 405.117607][T17156] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 405.141639][T17156] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 405.272099][T17156] team0: Port device team_slave_0 added [ 405.290394][T17252] __nla_validate_parse: 12 callbacks suppressed [ 405.290415][T17252] netlink: 45 bytes leftover after parsing attributes in process `syz.4.3042'. [ 405.319264][T17156] team0: Port device team_slave_1 added [ 405.399004][ T5842] Bluetooth: hci0: command tx timeout [ 405.460031][T17265] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3044'. [ 405.483537][T17156] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 405.493465][T17265] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3044'. [ 405.543380][T17156] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 405.597896][T17156] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 405.642735][T17156] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 405.672719][T17156] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 405.757593][T17156] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 405.783411][T17273] netlink: 'syz.0.3047': attribute type 3 has an invalid length. [ 405.793593][T17273] netlink: 666 bytes leftover after parsing attributes in process `syz.0.3047'. [ 405.950312][T17156] hsr_slave_0: entered promiscuous mode [ 405.974857][T17156] hsr_slave_1: entered promiscuous mode [ 405.994995][T17156] debugfs: 'hsr0' already exists in 'hsr' [ 406.008664][T17156] Cannot create hsr debugfs directory [ 406.064051][T17295] bridge0: port 4(gretap0) entered blocking state [ 406.075932][T17295] bridge0: port 4(gretap0) entered disabled state [ 406.101509][T17295] gretap0: entered promiscuous mode [ 406.312377][T17309] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3054'. [ 406.347984][T17309] vxcan4: entered allmulticast mode [ 406.693341][T17156] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 406.828277][T17156] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 406.912518][T17343] netlink: 'syz.4.3061': attribute type 1 has an invalid length. [ 406.931079][T17343] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3061'. [ 407.041921][T17156] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 407.143422][T17355] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3063'. [ 407.176394][T17156] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 407.337311][T17367] netlink: 576 bytes leftover after parsing attributes in process `syz.3.3067'. [ 407.479043][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 407.487570][ T5842] Bluetooth: hci0: command tx timeout [ 407.563848][T17389] netlink: 'syz.4.3072': attribute type 1 has an invalid length. [ 407.656148][T17156] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 407.698451][T17156] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 407.712538][T17156] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 407.744592][T17156] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 407.810925][T17402] netlink: 'syz.0.3075': attribute type 16 has an invalid length. [ 407.824778][T17389] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3072'. [ 407.838286][T17402] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3075'. [ 408.130624][T17426] netlink: 'syz.4.3081': attribute type 7 has an invalid length. [ 408.147692][T17156] 8021q: adding VLAN 0 to HW filter on device bond0 [ 408.239329][T17156] 8021q: adding VLAN 0 to HW filter on device team0 [ 408.277310][T10928] bridge0: port 1(bridge_slave_0) entered blocking state [ 408.284543][T10928] bridge0: port 1(bridge_slave_0) entered forwarding state [ 408.339400][ T4584] bridge0: port 2(bridge_slave_1) entered blocking state [ 408.346581][ T4584] bridge0: port 2(bridge_slave_1) entered forwarding state [ 409.115593][T17156] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 409.245546][T17493] bond8: option lp_interval: invalid value (0) [ 409.257657][T17493] bond8: option lp_interval: allowed values 1 - 2147483647 [ 409.267944][T17498] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 409.291149][T17498] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 409.316228][T17493] bond8 (unregistering): Released all slaves [ 409.362754][ T1246] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 409.372203][T17502] TCP: TCP_TX_DELAY enabled [ 409.385572][ T1246] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 409.431716][T17156] veth0_vlan: entered promiscuous mode [ 409.561254][T17156] veth1_vlan: entered promiscuous mode [ 409.565189][ T5842] Bluetooth: hci0: command tx timeout [ 409.641587][T17508] bond9: Unable to set peer notification delay as MII monitoring is disabled [ 409.662444][T17508] bond9 (unregistering): Released all slaves [ 409.695391][T17516] veth0: entered promiscuous mode [ 409.731309][T17516] veth0: left promiscuous mode [ 409.827473][T17156] veth0_macvtap: entered promiscuous mode [ 409.861301][T17156] veth1_macvtap: entered promiscuous mode [ 409.925989][T17156] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 409.975117][T17156] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 410.039959][T10928] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.069841][T10928] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.144646][T10928] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.172438][T10928] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 410.489582][T17553] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 410.515814][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.523778][T17563] __nla_validate_parse: 7 callbacks suppressed [ 410.523795][T17563] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3111'. [ 410.523813][T17563] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3111'. [ 410.574674][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.641003][T17562] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 410.673625][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 410.683140][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 410.691075][T17567] debugfs: 'Ku crK:̥B| lS-!' already exists in 'ieee80211' [ 411.164283][T17593] netlink: 'syz.0.3120': attribute type 11 has an invalid length. [ 411.196926][T17593] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3120'. [ 411.296083][T17593] netlink: 'syz.0.3120': attribute type 11 has an invalid length. [ 411.316190][T17595] ip6_vti0: entered promiscuous mode [ 411.342374][T17595] ip6_vti0: left allmulticast mode [ 411.351127][T17593] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3120'. [ 411.361224][T17595] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3120'. [ 411.371446][T17599] netlink: 'syz.1.3121': attribute type 1 has an invalid length. [ 411.380062][ T5846] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 411.380720][ T1246] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 411.398380][ T1246] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 411.405929][ T5846] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 411.416780][ T5846] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 411.430780][ T5846] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 411.440079][ T5846] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 411.602186][ T1246] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 411.640012][ T5842] Bluetooth: hci0: command tx timeout [ 411.649018][ T1246] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 412.342245][T17600] chnl_net:caif_netlink_parms(): no params data found [ 412.741322][T17680] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3134'. [ 412.804006][T17600] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.811854][T17600] bridge0: port 1(bridge_slave_0) entered disabled state [ 412.819357][T17600] bridge_slave_0: entered allmulticast mode [ 412.827946][T17600] bridge_slave_0: entered promiscuous mode [ 412.837482][T17600] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.845225][T17600] bridge0: port 2(bridge_slave_1) entered disabled state [ 412.857659][T17600] bridge_slave_1: entered allmulticast mode [ 412.876923][T17600] bridge_slave_1: entered promiscuous mode [ 413.061028][T17600] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 413.092584][T17600] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 413.200831][T17701] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3139'. [ 413.211411][T17600] team0: Port device team_slave_0 added [ 413.220365][T17600] team0: Port device team_slave_1 added [ 413.361211][T17600] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 413.378441][T17600] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 413.461182][T17600] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 413.478703][ T5842] Bluetooth: hci4: command tx timeout [ 413.513811][T17600] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 413.521434][T17600] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 413.550491][T17600] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 413.651507][T17722] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3144'. [ 413.710607][T17600] hsr_slave_0: entered promiscuous mode [ 413.718426][T17600] hsr_slave_1: entered promiscuous mode [ 413.750875][T17600] debugfs: 'hsr0' already exists in 'hsr' [ 413.756690][T17600] Cannot create hsr debugfs directory [ 413.771995][T17724] netlink: 'syz.1.3145': attribute type 1 has an invalid length. [ 413.983477][T17745] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3146'. [ 414.026093][T17732] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.033935][T17732] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.181840][T17732] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 414.206542][T17732] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 414.479781][T17750] netlink: 'syz.1.3150': attribute type 3 has an invalid length. [ 414.546872][ T1135] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.559108][ T1135] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.638385][T17770] netlink: 'syz.2.3152': attribute type 29 has an invalid length. [ 414.662007][T17770] netlink: 'syz.2.3152': attribute type 29 has an invalid length. [ 414.682259][ T1135] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 414.746441][ T1135] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.007182][T17600] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 415.030628][T17600] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.102711][T17792] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3156'. [ 415.150378][T17600] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 415.162935][T17600] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.304451][T17796] netem: incorrect ge model size [ 415.311377][T17796] netem: change failed [ 415.338103][T17600] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 415.370730][T17600] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.461955][T17600] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 415.483920][T17600] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 415.562272][ T5842] Bluetooth: hci4: command tx timeout [ 415.587188][T17814] batman_adv: batadv0: Adding interface: dummy0 [ 415.621486][T17814] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. If you experience problems getting traffic through try increasing the MTU to 1532. [ 415.656938][T17814] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 415.679182][T17823] netlink: 5 bytes leftover after parsing attributes in process `syz.0.3162'. [ 415.709603][T17823] openvswitch: netlink: IP tunnel attribute has 1026 unknown bytes. [ 415.718747][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 415.963331][T17836] xt_hashlimit: size too large, truncated to 1048576 [ 416.117387][T17600] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 416.141929][T17600] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 416.171047][T17600] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 416.199871][T17600] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 416.482204][T17600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 416.502048][T17862] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3171'. [ 416.511559][T17862] openvswitch: netlink: Missing key (keys=40, expected=80) [ 416.566076][T17600] 8021q: adding VLAN 0 to HW filter on device team0 [ 416.595118][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 416.602324][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 416.697553][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 416.704843][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 416.848448][T17868] syzkaller0: entered allmulticast mode [ 416.903890][T17868] IPv6: NLM_F_REPLACE set, but no existing node found! [ 416.916683][T17867] syzkaller0: left allmulticast mode [ 416.971767][T17875] ipt_REJECT: TCP_RESET invalid for non-tcp [ 417.106188][T17876] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 417.223347][T17885] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3180'. [ 417.445351][T17600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 417.475482][T17896] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3182'. [ 417.567589][T17600] veth0_vlan: entered promiscuous mode [ 417.610142][T17600] veth1_vlan: entered promiscuous mode [ 417.641440][ T5846] Bluetooth: hci4: command tx timeout [ 417.671447][T17905] netlink: 'syz.1.3185': attribute type 1 has an invalid length. [ 417.732074][T17600] veth0_macvtap: entered promiscuous mode [ 417.744312][T17600] veth1_macvtap: entered promiscuous mode [ 417.793116][T17600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 417.808331][T17908] openvswitch: netlink: Multiple metadata blocks provided [ 417.821961][T17600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 417.865064][ T4584] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.877345][ T4584] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.897596][ T4584] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 417.942316][ T4584] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 418.037748][ T5846] block nbd2: Receive control failed (result -32) [ 418.062066][T17919] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3190'. [ 418.100455][T17920] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3190'. [ 418.128872][T10930] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 20002 - 0 [ 418.140108][ T4584] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 20002 - 0 [ 418.149981][ T1135] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 418.179877][ T1135] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 418.187510][T17920] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3190'. [ 418.197087][ T4584] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 20002 - 0 [ 418.213308][T17920] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3190'. [ 418.244472][T17920] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3190'. [ 418.269552][T17920] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3190'. [ 418.299282][ T4584] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 20002 - 0 [ 418.347847][ T4584] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 418.367214][T17923] syzkaller1: entered promiscuous mode [ 418.374850][ T4584] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 418.383313][T17923] syzkaller1: entered allmulticast mode [ 418.469499][T17933] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 418.910824][ T5844] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 418.920484][ T5844] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 418.929640][ T5844] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 418.937887][ T5844] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 418.946169][ T5844] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 419.266806][T17950] chnl_net:caif_netlink_parms(): no params data found [ 419.418898][T17950] bridge0: port 1(bridge_slave_0) entered blocking state [ 419.426333][T17950] bridge0: port 1(bridge_slave_0) entered disabled state [ 419.434202][T17950] bridge_slave_0: entered allmulticast mode [ 419.443444][T17950] bridge_slave_0: entered promiscuous mode [ 419.470210][T17950] bridge0: port 2(bridge_slave_1) entered blocking state [ 419.481788][T17950] bridge0: port 2(bridge_slave_1) entered disabled state [ 419.491220][T17950] bridge_slave_1: entered allmulticast mode [ 419.499753][T17950] bridge_slave_1: entered promiscuous mode [ 419.553393][T17950] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 419.567861][T17950] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 419.686255][T17950] team0: Port device team_slave_0 added [ 419.723261][ T5844] Bluetooth: hci4: command 0x0419 tx timeout [ 419.808119][T17950] team0: Port device team_slave_1 added [ 419.930597][T17997] SET target dimension over the limit! [ 420.000308][T18000] x_tables: duplicate underflow at hook 2 [ 420.067774][T18003] syzkaller1: entered promiscuous mode [ 420.083958][T18003] syzkaller1: entered allmulticast mode [ 420.097188][T17950] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 420.114933][T17950] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 420.174984][T18007] netlink: 'syz.2.3215': attribute type 178 has an invalid length. [ 420.213125][T17950] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 420.299132][T17950] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 420.306286][T17950] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 420.340478][T17950] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 420.373084][T18013] netlink: 'syz.1.3216': attribute type 1 has an invalid length. [ 420.444733][T18016] bond0: (slave ip6tnl3): The slave device specified does not support setting the MAC address [ 420.524238][T18016] bond0: (slave ip6tnl3): Error -95 calling set_mac_address [ 420.588458][T18013] tipc: Started in network mode [ 420.604402][T18013] tipc: Node identity da7f6327495f, cluster identity 4711 [ 420.626655][T18013] tipc: Enabled bearer , priority 0 [ 420.684008][ T5947] IPVS: starting estimator thread 0... [ 420.788652][T18043] IPVS: using max 31 ests per chain, 74400 per kthread [ 420.803585][T17950] hsr_slave_0: entered promiscuous mode [ 420.821569][T17950] hsr_slave_1: entered promiscuous mode [ 420.835237][T17950] debugfs: 'hsr0' already exists in 'hsr' [ 420.859820][T17950] Cannot create hsr debugfs directory [ 420.954799][T18011] tipc: Disabling bearer [ 421.009901][ T5842] Bluetooth: hci3: command tx timeout [ 421.102015][T18055] netlink: 'syz.3.3221': attribute type 4 has an invalid length. [ 421.137558][T18058] __nla_validate_parse: 65 callbacks suppressed [ 421.137578][T18058] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3222'. [ 421.328181][T18072] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3223'. [ 421.482830][T18075] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3224'. [ 421.565904][T18082] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3226'. [ 421.642893][T17950] netdevsim netdevsim4 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.665226][T17950] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 58689 - 0 [ 421.677558][T18084] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3227'. [ 421.692053][T17950] netdevsim netdevsim4 eth3 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 421.704639][T17950] netdevsim netdevsim4 eth3 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 421.800961][ T5842] Bluetooth: hci4: command 0x0419 tx timeout [ 421.811464][T17950] netdevsim netdevsim4 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.838957][T17950] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 58689 - 0 [ 421.849238][T17950] netdevsim netdevsim4 eth2 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 421.859894][T17950] netdevsim netdevsim4 eth2 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 421.887736][T18097] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3229'. [ 421.930992][T18097] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3229'. [ 421.975898][T17950] netdevsim netdevsim4 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 421.996831][T17950] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 58689 - 0 [ 422.009755][T18095] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 422.041076][T17950] netdevsim netdevsim4 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 422.064359][T17950] netdevsim netdevsim4 eth1 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 422.222420][T17950] netdevsim netdevsim4 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 422.236903][T18109] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3234'. [ 422.245766][T17950] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 58689 - 0 [ 422.245917][T17950] netdevsim netdevsim4 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 422.245953][T17950] netdevsim netdevsim4 eth0 (unregistering): unset [1, 2] type 2 family 0 port 256 - 0 [ 422.379053][T18123] syzkaller0: entered promiscuous mode [ 422.398393][T18123] syzkaller0: entered allmulticast mode [ 422.523565][T18131] netlink: 7064 bytes leftover after parsing attributes in process `syz.2.3241'. [ 422.536769][T18131] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 422.633257][T18134] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3242'. [ 422.699420][T18134] syzkaller1: entered promiscuous mode [ 422.715295][T18134] syzkaller1: entered allmulticast mode [ 422.722096][T18136] netlink: 'syz.2.3243': attribute type 3 has an invalid length. [ 422.827300][T17950] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 422.856074][T17950] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 422.876671][T17950] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 422.893606][T17950] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 423.079854][ T5842] Bluetooth: hci3: command tx timeout [ 423.213340][T17950] 8021q: adding VLAN 0 to HW filter on device bond0 [ 423.242505][T17950] 8021q: adding VLAN 0 to HW filter on device team0 [ 423.267830][ T33] bridge0: port 1(bridge_slave_0) entered blocking state [ 423.275113][ T33] bridge0: port 1(bridge_slave_0) entered forwarding state [ 423.317196][ T33] bridge0: port 2(bridge_slave_1) entered blocking state [ 423.324604][ T33] bridge0: port 2(bridge_slave_1) entered forwarding state [ 423.342932][T18173] netlink: 'syz.1.3250': attribute type 14 has an invalid length. [ 423.351102][T18173] netlink: 'syz.1.3250': attribute type 13 has an invalid length. [ 423.472885][T17950] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 423.521057][T18177] delete_channel: no stack [ 423.555924][T18182] netlink: 'syz.1.3255': attribute type 10 has an invalid length. [ 423.627468][T18182] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 424.034191][T17950] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 424.161067][T18243] x_tables: unsorted underflow at hook 2 [ 424.429773][T18256] netlink: 'syz.2.3266': attribute type 24 has an invalid length. [ 424.520221][T17950] veth0_vlan: entered promiscuous mode [ 424.574295][T17950] veth1_vlan: entered promiscuous mode [ 424.644082][T18263] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 424.676373][T17950] veth0_macvtap: entered promiscuous mode [ 424.712671][T17950] veth1_macvtap: entered promiscuous mode [ 424.779674][T17950] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 424.816181][T17950] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 424.831189][ T3473] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.859760][ T3473] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.939232][ T3473] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 424.984577][ T3473] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 425.104433][T18198] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 425.129594][T18198] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 425.159334][ T5842] Bluetooth: hci3: command tx timeout [ 425.191703][ T3473] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 425.204406][ T3473] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 425.362664][T18295] openvswitch: netlink: Flow key attr not present in new flow. [ 425.503966][ T5844] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 425.514987][ T5844] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 425.523928][ T5844] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 425.532399][ T5844] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 425.541737][ T5844] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 425.889318][T18298] chnl_net:caif_netlink_parms(): no params data found [ 426.105910][T18315] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_tx_wq": -EINTR [ 426.202646][T18330] __nla_validate_parse: 10 callbacks suppressed [ 426.202667][T18330] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3281'. [ 426.235907][T18330] netlink: 'syz.2.3281': attribute type 1 has an invalid length. [ 426.247997][T18222] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 426.272379][T18222] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 426.298104][T18330] netlink: 'syz.2.3281': attribute type 1 has an invalid length. [ 426.330435][T18312] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3281'. [ 426.356218][T18298] bridge0: port 1(bridge_slave_0) entered blocking state [ 426.378777][T18298] bridge0: port 1(bridge_slave_0) entered disabled state [ 426.386166][T18298] bridge_slave_0: entered allmulticast mode [ 426.406150][T18298] bridge_slave_0: entered promiscuous mode [ 426.436030][T18222] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 426.447092][T18222] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 426.526463][T18332] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.557525][T18298] bridge0: port 2(bridge_slave_1) entered blocking state [ 426.573731][T18298] bridge0: port 2(bridge_slave_1) entered disabled state [ 426.586772][T18298] bridge_slave_1: entered allmulticast mode [ 426.605284][T18298] bridge_slave_1: entered promiscuous mode [ 426.641859][T18351] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3288'. [ 426.664405][T18222] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 426.675523][T18222] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 426.700240][T18342] netlink: 11562 bytes leftover after parsing attributes in process `syz.1.3287'. [ 426.755948][T18222] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 426.772481][T18222] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 20002 - 0 [ 426.813911][T18332] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.881992][T18332] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 426.926016][T18298] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 426.945206][T18359] netlink: 'syz.2.3290': attribute type 17 has an invalid length. [ 426.960991][T18298] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 426.969729][T18359] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3290'. [ 426.991631][T18359] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3290'. [ 427.032294][T18332] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 427.058051][T18362] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3291'. [ 427.094680][T18298] team0: Port device team_slave_0 added [ 427.150613][T18298] team0: Port device team_slave_1 added [ 427.181085][T18365] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3292'. [ 427.238454][T18298] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 427.246173][ T5844] Bluetooth: hci3: command tx timeout [ 427.256585][T18298] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 427.303298][T18298] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 427.343897][T18298] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 427.352232][T18298] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 427.382569][T18298] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 427.425576][T18372] sch_fq: defrate 0 ignored. [ 427.450726][T18375] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3294'. [ 427.544410][T18197] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 427.579097][T18222] gretap0: left promiscuous mode [ 427.584643][T18222] bridge0: port 4(gretap0) entered disabled state [ 427.595769][T18222] veth0_to_bridge: left promiscuous mode [ 427.602751][T18222] bridge0: port 3(veth0_to_bridge) entered disabled state [ 427.611973][T18222] bridge_slave_1: left promiscuous mode [ 427.617814][T18222] bridge0: port 2(bridge_slave_1) entered disabled state [ 427.629087][T18222] bridge_slave_0: left promiscuous mode [ 427.635020][T18222] bridge0: port 1(bridge_slave_0) entered disabled state [ 427.644964][ T5844] Bluetooth: hci1: command tx timeout [ 427.657844][T18385] nbd: nbd1 already in use [ 427.745863][T18222] bond4 (unregistering): (slave ip6gretap1): Releasing active interface [ 427.954861][T18222] bond3 (unregistering): (slave gretap1): Releasing active interface [ 428.060882][T18397] Cannot find del_set index 1 as target [ 428.306613][T18222] bond10 (unregistering): (slave bridge7): Releasing backup interface [ 428.347275][T18222] bond1 (unregistering): Released all slaves [ 428.363238][T18222] bond2 (unregistering): Released all slaves [ 428.387779][T18222] bond3 (unregistering): Released all slaves [ 428.413919][T18222] bond4 (unregistering): Released all slaves [ 428.428378][T18222]  (unregistering): Released all slaves [ 428.444248][T18222] bond5 (unregistering): Released all slaves [ 428.461402][T18222] bond6 (unregistering): (slave lo): Releasing backup interface [ 428.470500][T18222] bond6 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 428.485262][T18222] bond6 (unregistering): Released all slaves [ 428.500888][T18222] bond7 (unregistering): Released all slaves [ 428.516632][T18222] bond8 (unregistering): Released all slaves [ 428.531941][ T1738] block nbd1: Possible stuck request ffff888027050000: control (read@0,1024B). Runtime 30 seconds [ 428.536960][T18222] bond9 (unregistering): Released all slaves [ 428.545037][ T1738] block nbd1: Possible stuck request ffff888027050200: control (read@1024,1024B). Runtime 30 seconds [ 428.561460][ T1738] block nbd1: Possible stuck request ffff888027050400: control (read@2048,1024B). Runtime 30 seconds [ 428.572478][ T1738] block nbd1: Possible stuck request ffff888027050600: control (read@3072,1024B). Runtime 30 seconds [ 428.586865][T18222] bond10 (unregistering): Released all slaves [ 428.613815][T18222] bond0 (unregistering): Released all slaves [ 428.726305][T18396] tipc: Enabling of bearer rejected, failed to enable media [ 428.799707][T18222] tipc: Disabling bearer [ 428.828189][T18399] delete_channel: no stack [ 428.832866][T18222] tipc: Left network mode [ 428.880762][ T3473] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 428.925209][T18298] hsr_slave_0: entered promiscuous mode [ 428.933555][T18403] netlink: 401 bytes leftover after parsing attributes in process `syz.1.3298'. [ 428.970831][T18298] hsr_slave_1: entered promiscuous mode [ 428.977560][T18298] debugfs: 'hsr0' already exists in 'hsr' [ 428.983469][T18298] Cannot create hsr debugfs directory [ 428.989327][ T3473] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.044363][T18404] pim6reg: entered allmulticast mode [ 429.201874][ T3473] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 429.719807][ T5844] Bluetooth: hci1: command tx timeout [ 429.930837][T18452] netlink: 'syz.2.3310': attribute type 11 has an invalid length. [ 430.017278][T18455] pim6reg: entered allmulticast mode [ 430.322780][T18222] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 430.334837][T18222] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 430.361344][T18222] batman_adv: batadv0: Removing interface: dummy0 [ 430.420604][T18222] pim6reg (unregistering): left allmulticast mode [ 430.489287][T18222] team0 (unregistering): Port device batadv3 removed [ 430.633821][T18222] team0 (unregistering): Port device batadv2 removed [ 430.647733][T18222] team0 (unregistering): Port device batadv1 removed [ 430.812153][T18222] team0 (unregistering): Port device team_slave_1 removed [ 431.259442][T18506] __nla_validate_parse: 10 callbacks suppressed [ 431.259462][T18506] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3324'. [ 431.695428][T18522] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.3327'. [ 431.721048][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 431.740152][T18222] IPVS: stop unused estimator thread 0... [ 431.752926][T18522] pim6reg: entered allmulticast mode [ 431.809115][ T5844] Bluetooth: hci1: command tx timeout [ 431.836312][T18522] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3327'. [ 431.868858][T18522] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3327'. [ 431.878525][T18526] netlink: 'syz.4.3328': attribute type 1 has an invalid length. [ 432.001161][T18298] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 432.078146][T18298] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 432.118374][T18298] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 432.136490][T18542] netlink: 'syz.2.3331': attribute type 2 has an invalid length. [ 432.165275][T18298] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 432.253163][T18549] netlink: 144 bytes leftover after parsing attributes in process `syz.1.3332'. [ 432.563979][T18298] 8021q: adding VLAN 0 to HW filter on device bond0 [ 432.677920][T18562] bridge0: port 1(bridge_slave_0) entered disabled state [ 432.737281][T18562] bridge0: port 2(bridge_slave_1) entered disabled state [ 432.856616][T18298] 8021q: adding VLAN 0 to HW filter on device team0 [ 432.897843][T18224] bridge0: port 1(bridge_slave_0) entered blocking state [ 432.905035][T18224] bridge0: port 1(bridge_slave_0) entered forwarding state [ 432.953884][T18224] bridge0: port 2(bridge_slave_1) entered blocking state [ 432.961101][T18224] bridge0: port 2(bridge_slave_1) entered forwarding state [ 433.051783][T18584] netem: change failed [ 433.251688][T18599] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3343'. [ 433.357192][T18602] tipc: Started in network mode [ 433.373384][T18602] tipc: Node identity 42f53d57be1c, cluster identity 4711 [ 433.394225][T18602] tipc: Enabled bearer , priority 0 [ 433.411917][T18605] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3345'. [ 433.422641][T18602] +: renamed from syzkaller0 [ 433.430725][T18602] tipc: Disabling bearer [ 433.446889][T18605] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3345'. [ 433.470003][T18610] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.3347'. [ 433.517340][T18610] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3347'. [ 433.680091][T18298] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 433.877278][T18298] veth0_vlan: entered promiscuous mode [ 433.892380][ T5844] Bluetooth: hci1: command tx timeout [ 433.914995][T18298] veth1_vlan: entered promiscuous mode [ 434.057701][ T5844] block nbd3: Receive control failed (result -107) [ 434.084645][T18647] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 434.174306][T18298] veth0_macvtap: entered promiscuous mode [ 434.255095][T18298] veth1_macvtap: entered promiscuous mode [ 434.332188][T18298] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 434.367715][T18298] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 434.401311][T18209] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.421290][T18209] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.433911][T18209] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.450477][T18209] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.514738][T18665] bond1: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 434.529966][T18665] bond1 (unregistering): Released all slaves [ 434.849517][T18206] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 434.882292][T18679] ip6t_srh: unknown srh invflags 4000 [ 434.899325][T18206] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 435.016237][ T4584] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 435.031629][ T4584] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 435.142160][T18693] netlink: 'syz.4.3371': attribute type 2 has an invalid length. [ 435.180958][T18693] 9: entered promiscuous mode [ 435.422386][T18709] xt_l2tp: missing protocol rule (udp|l2tpip) [ 435.457744][T18714] netlink: 'syz.1.3378': attribute type 13 has an invalid length. [ 436.132612][T18745] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 436.262932][T18745] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 436.299500][T18760] sctp: [Deprecated]: syz.4.3389 (pid 18760) Use of int in max_burst socket option. [ 436.299500][T18760] Use struct sctp_assoc_value instead [ 436.357067][T18760] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 436.387262][T18760] __nla_validate_parse: 13 callbacks suppressed [ 436.387283][T18760] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.3389'. [ 436.427396][T18765] netlink: 'syz.3.3390': attribute type 15 has an invalid length. [ 436.446657][T18760] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 436.457079][T18765] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3390'. [ 436.570738][T18210] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 2816 - 0 [ 436.599784][T18210] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 2816 - 0 [ 436.625789][T18210] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 2816 - 0 [ 436.643633][T18210] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 2816 - 0 [ 436.707277][T18779] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3394'. [ 436.749160][T18773] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3392'. [ 436.831731][T18786] netlink: 'syz.3.3395': attribute type 11 has an invalid length. [ 436.854525][T18786] netlink: 'syz.3.3395': attribute type 11 has an invalid length. [ 436.869762][T18786] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3395'. [ 437.002440][T18797] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.3399'. [ 437.114943][T18797] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3399'. [ 437.124270][T18797] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3399'. [ 437.131839][T18799] bridge0: port 2(bridge_slave_1) entered disabled state [ 437.141092][T18799] bridge0: port 1(bridge_slave_0) entered disabled state [ 437.197536][T18799] bridge0: entered allmulticast mode [ 437.224056][T18806] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3403'. [ 437.432702][T18816] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3407'. [ 437.602512][T18825] vlan1: Caught tx_queue_len zero misconfig [ 437.748050][T18840] netlink: 'syz.3.3411': attribute type 2 has an invalid length. [ 439.039335][T18906] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 439.231181][T18921] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 439.266124][T18925] netlink: 'syz.0.3429': attribute type 8 has an invalid length. [ 439.591139][T18939] syzkaller0: entered promiscuous mode [ 439.639886][T18939] syzkaller0: entered allmulticast mode [ 440.044541][ T1300] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 440.077872][T18979] openvswitch: netlink: Flow actions attr not present in new flow. [ 440.256263][T18986] netlink: set zone limit has 4 unknown bytes [ 440.804882][T19026] netlink: 'syz.4.3455': attribute type 39 has an invalid length. [ 441.124540][T19046] netlink: 'syz.0.3459': attribute type 1 has an invalid length. [ 441.291949][T19031] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 441.638935][T19082] tipc: Enabling of bearer rejected, failed to enable media [ 441.712144][T19087] __nla_validate_parse: 18 callbacks suppressed [ 441.712165][T19087] netlink: 1 bytes leftover after parsing attributes in process `syz.3.3468'. [ 441.988798][T19105] lo: Caught tx_queue_len zero misconfig [ 441.995314][T19107] netlink: 'syz.4.3471': attribute type 21 has an invalid length. [ 442.004092][T19107] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3471'. [ 442.275518][T19120] netlink: 'syz.3.3476': attribute type 1 has an invalid length. [ 442.379431][T19122] bond1: (slave ip6gretap1): making interface the new active one [ 442.397760][T19122] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 442.641951][T19139] tunl0: Caught tx_queue_len zero misconfig [ 442.776051][T19146] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3486'. [ 442.812451][T19148] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3485'. [ 442.842287][T19148] geneve2: entered promiscuous mode [ 443.071053][T19161] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3490'. [ 443.080991][T19161] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3490'. [ 443.098219][T19161] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 443.110413][T19161] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 443.118230][T19161] gretap1: entered promiscuous mode [ 443.124238][T19161] gretap1: entered allmulticast mode [ 443.344123][T19172] openvswitch: netlink: IP tunnel attribute has 6 unknown bytes. [ 443.526620][T19179] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 443.550631][T19179] bridge0: port 3(ipvlan2) entered blocking state [ 443.563522][T19179] bridge0: port 3(ipvlan2) entered disabled state [ 443.571596][T19179] ipvlan2: entered allmulticast mode [ 443.576943][T19179] bridge0: entered allmulticast mode [ 443.584441][T19179] ipvlan2: left allmulticast mode [ 443.589737][T19179] bridge0: left allmulticast mode [ 445.393313][T19125] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 445.606927][T19191] x_tables: duplicate underflow at hook 4 [ 445.619533][T19197] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3504'. [ 445.631799][T19199] x_tables: duplicate underflow at hook 4 [ 445.886176][T19212] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3505'. [ 445.933553][T19212] netlink: 'syz.4.3505': attribute type 1 has an invalid length. [ 445.949069][T19212] netlink: 'syz.4.3505': attribute type 2 has an invalid length. [ 446.148149][T19225] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3510'. [ 446.309369][T19236] netlink: 'syz.0.3513': attribute type 1 has an invalid length. [ 446.354602][T19236] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3513'. [ 446.377085][T19236] x_tables: duplicate underflow at hook 1 [ 446.540189][T19247] netlink: 'syz.3.3518': attribute type 16 has an invalid length. [ 446.903190][T19268] __nla_validate_parse: 1 callbacks suppressed [ 446.903209][T19268] netlink: 4552 bytes leftover after parsing attributes in process `syz.4.3525'. [ 446.932061][T19268] netlink: 4552 bytes leftover after parsing attributes in process `syz.4.3525'. [ 446.942210][ T5488] veth0_vlan: left promiscuous mode [ 447.005579][ T5488] veth0_vlan: entered promiscuous mode [ 447.347176][T19295] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3533'. [ 447.491376][T19310] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3536'. [ 447.529652][T19317] netlink: 7060 bytes leftover after parsing attributes in process `syz.1.3538'. [ 447.551230][T19319] netlink: 'syz.0.3536': attribute type 1 has an invalid length. [ 447.696842][T19319] bond1: entered promiscuous mode [ 447.797995][T19319] 8021q: adding VLAN 0 to HW filter on device bond1 [ 447.904692][T19311] syzkaller0: entered promiscuous mode [ 447.930480][T19311] syzkaller0: entered allmulticast mode [ 447.996638][T19328] 8021q: adding VLAN 0 to HW filter on device bond1 [ 448.018485][T19328] bond1: (slave vti0): The slave device specified does not support setting the MAC address [ 448.049755][T19328] bond1: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 448.077040][T19351] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3544'. [ 448.103089][T19328] bond1: (slave vti0): making interface the new active one [ 448.126055][T19328] vti0: entered promiscuous mode [ 448.145772][T19328] bond1: (slave vti0): Enslaving as an active interface with an up link [ 448.426680][T19364] netlink: 'syz.0.3545': attribute type 10 has an invalid length. [ 448.442857][T19356] netlink: 88 bytes leftover after parsing attributes in process `syz.1.3543'. [ 448.541565][T19366] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3546'. [ 448.678194][T19364] team0: Device veth1_macvtap failed to register rx_handler [ 449.055731][T19388] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3553'. [ 449.066549][T19388] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3553'. [ 449.508327][T19413] set match dimension is over the limit! [ 449.624050][T19421] netlink: 'syz.0.3566': attribute type 21 has an invalid length. [ 449.822295][T19427] tipc: Started in network mode [ 449.827236][T19427] tipc: Node identity 2a8e5acad061, cluster identity 4711 [ 449.849171][T19427] tipc: Enabled bearer , priority 0 [ 449.982347][T19431] syzkaller0: entered promiscuous mode [ 449.993161][T19431] syzkaller0: entered allmulticast mode [ 450.007504][T19431] tipc: Resetting bearer [ 450.024165][T19426] tipc: Resetting bearer [ 450.145524][T19454] netlink: 'syz.3.3576': attribute type 3 has an invalid length. [ 451.740820][T19426] tipc: Disabling bearer [ 451.762009][T19466] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 451.854065][ T5965] tipc: Node number set to 4209990346 [ 452.035431][T19488] __nla_validate_parse: 9 callbacks suppressed [ 452.035451][T19488] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3584'. [ 452.078119][T19490] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3586'. [ 452.087786][T19490] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3586'. [ 452.141128][T19494] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3587'. [ 452.273967][T19501] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3590'. [ 452.364079][T19502] bond2: invalid ARP target 0.0.0.0 specified for addition [ 452.383617][T19502] bond2: option arp_ip_target: invalid value (0) [ 452.433489][T19502] bond2 (unregistering): Released all slaves [ 452.720143][T19530] Bluetooth: MGMT ver 1.23 [ 452.755988][T19497] infiniband syz1: set active [ 452.771208][T19497] infiniband syz1: added bond_slave_0 [ 452.779971][T19497] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 452.783735][T19497] infiniband syz1: Couldn't open port 1 [ 452.832526][T19497] RDS/IB: syz1: added [ 452.836712][T19497] smc: adding ib device syz1 with port count 1 [ 452.856482][T19497] smc: ib device syz1 port 1 has no pnetid [ 453.048949][T19541] netlink: 'syz.1.3600': attribute type 1 has an invalid length. [ 453.071502][T19541] netlink: 184 bytes leftover after parsing attributes in process `syz.1.3600'. [ 453.099305][T19541] netlink: 'syz.1.3600': attribute type 1 has an invalid length. [ 453.114445][T19541] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3600'. [ 453.184398][T19545] netlink: 212408 bytes leftover after parsing attributes in process `syz.0.3601'. [ 453.207942][T19545] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3601'. [ 453.238840][T19545] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3601'. [ 453.413149][T19556] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 453.447324][T19558] xt_connbytes: Forcing CT accounting to be enabled [ 453.610011][T19565] openvswitch: netlink: Flow key attr not present in new flow. [ 454.264359][T18205] nci: nci_rsp_packet: unknown rsp opcode 0x3f [ 454.402272][T10649] IPVS: starting estimator thread 0... [ 454.488809][T19610] IPVS: using max 28 ests per chain, 67200 per kthread [ 455.877869][T19643] syzkaller0: entered promiscuous mode [ 455.883721][T19643] syzkaller0: entered allmulticast mode [ 457.165461][T19596] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 457.673105][T19678] nbd: socks must be embedded in a SOCK_ITEM attr [ 458.599912][ T1738] block nbd1: Possible stuck request ffff888027050000: control (read@0,1024B). Runtime 60 seconds [ 458.610753][ T1738] block nbd1: Possible stuck request ffff888027050200: control (read@1024,1024B). Runtime 60 seconds [ 458.622648][ T1738] block nbd1: Possible stuck request ffff888027050400: control (read@2048,1024B). Runtime 60 seconds [ 458.633710][ T1738] block nbd1: Possible stuck request ffff888027050600: control (read@3072,1024B). Runtime 60 seconds [ 458.943875][T19705] __nla_validate_parse: 13 callbacks suppressed [ 458.943895][T19705] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3638'. [ 458.980330][T19705] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3638'. [ 459.049010][T19705] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3638'. [ 459.351620][T19728] netlink: 'syz.3.3644': attribute type 1 has an invalid length. [ 459.821183][T19756] xt_connbytes: Forcing CT accounting to be enabled [ 459.913503][T19760] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3646'. [ 460.095682][T19767] netlink: 96 bytes leftover after parsing attributes in process `syz.1.3650'. [ 460.173014][T19767] 8021q: VLANs not supported on gre0 [ 460.453616][T19781] netlink: 168 bytes leftover after parsing attributes in process `syz.1.3653'. [ 460.572766][T19791] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3656'. [ 460.659945][T19793] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 460.807792][T19803] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3661'. [ 461.166190][T19828] netlink: 9 bytes leftover after parsing attributes in process `syz.0.3665'. [ 462.082166][T19819] netlink: 'syz.4.3664': attribute type 4 has an invalid length. [ 462.113650][T19803] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 462.128747][T19803] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 462.420935][T19860] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3669'. [ 462.477101][T19803] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 462.504526][T19803] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 462.719047][T19803] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 462.725014][T19803] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 462.913237][T19803] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 462.936291][T19803] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 463.121623][T19889] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 463.216625][T19889] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 463.307310][T19904] netlink: 'syz.0.3681': attribute type 1 has an invalid length. [ 463.335620][T19893] erspan0: entered promiscuous mode [ 463.562701][T19915] SET target dimension over the limit! [ 463.720612][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 463.875053][T19931] netlink: 'syz.1.3687': attribute type 32 has an invalid length. [ 463.989895][T19940] netlink: 'syz.0.3688': attribute type 1 has an invalid length. [ 464.013619][T19940] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 464.252478][T19956] __nla_validate_parse: 2 callbacks suppressed [ 464.252498][T19956] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3690'. [ 464.565198][T19971] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3692'. [ 465.145465][T20007] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3702'. [ 465.196671][T20011] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3702'. [ 465.526693][T20007] xfrm1: entered promiscuous mode [ 465.539278][T20007] xfrm1: entered allmulticast mode [ 465.760648][T20039] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3711'. [ 465.826684][T20044] FAULT_INJECTION: forcing a failure. [ 465.826684][T20044] name failslab, interval 1, probability 0, space 0, times 0 [ 465.844824][T20044] CPU: 1 UID: 0 PID: 20044 Comm: syz.3.3714 Not tainted syzkaller #0 PREEMPT(full) [ 465.844854][T20044] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 465.844870][T20044] Call Trace: [ 465.844880][T20044] [ 465.844888][T20044] dump_stack_lvl+0xe8/0x150 [ 465.844924][T20044] should_fail_ex+0x412/0x560 [ 465.844955][T20044] should_failslab+0xa8/0x100 [ 465.844980][T20044] ? skb_clone+0x212/0x3a0 [ 465.845011][T20044] kmem_cache_alloc_noprof+0x87/0x650 [ 465.845044][T20044] ? __netlink_lookup+0xc6/0x8b0 [ 465.845077][T20044] skb_clone+0x212/0x3a0 [ 465.845112][T20044] __netlink_deliver_tap+0x404/0x850 [ 465.845151][T20044] ? netlink_deliver_tap+0x2e/0x1b0 [ 465.845177][T20044] netlink_deliver_tap+0x19c/0x1b0 [ 465.845203][T20044] netlink_unicast+0x7e3/0x9b0 [ 465.845235][T20044] ? __pfx_netlink_unicast+0x10/0x10 [ 465.845259][T20044] ? netlink_sendmsg+0x650/0xb40 [ 465.845291][T20044] netlink_sendmsg+0x813/0xb40 [ 465.845334][T20044] ? __pfx_netlink_sendmsg+0x10/0x10 [ 465.845364][T20044] ? aa_sock_msg_perm+0xf1/0x1b0 [ 465.845391][T20044] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 465.845415][T20044] ? __pfx_netlink_sendmsg+0x10/0x10 [ 465.845439][T20044] ____sys_sendmsg+0xa68/0xad0 [ 465.845480][T20044] ? __pfx_____sys_sendmsg+0x10/0x10 [ 465.845520][T20044] ? import_iovec+0x73/0xa0 [ 465.845553][T20044] ___sys_sendmsg+0x2a5/0x360 [ 465.845590][T20044] ? __pfx____sys_sendmsg+0x10/0x10 [ 465.845669][T20044] ? __fget_files+0x2a/0x420 [ 465.845696][T20044] ? __fget_files+0x3a0/0x420 [ 465.845735][T20044] __x64_sys_sendmsg+0x1bd/0x2a0 [ 465.845768][T20044] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 465.845831][T20044] ? __pfx_ksys_write+0x10/0x10 [ 465.845865][T20044] do_syscall_64+0x14d/0xf80 [ 465.845897][T20044] ? trace_irq_disable+0x3b/0x150 [ 465.845925][T20044] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.845947][T20044] ? clear_bhb_loop+0x40/0x90 [ 465.845973][T20044] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 465.845998][T20044] RIP: 0033:0x7f9d6879c629 [ 465.846019][T20044] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 465.846039][T20044] RSP: 002b:00007f9d695a6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 465.846061][T20044] RAX: ffffffffffffffda RBX: 00007f9d68a15fa0 RCX: 00007f9d6879c629 [ 465.846077][T20044] RDX: 0000000000048040 RSI: 0000200000000240 RDI: 0000000000000003 [ 465.846090][T20044] RBP: 00007f9d695a6090 R08: 0000000000000000 R09: 0000000000000000 [ 465.846103][T20044] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 465.846115][T20044] R13: 00007f9d68a16038 R14: 00007f9d68a15fa0 R15: 00007ffc878103e8 [ 465.846151][T20044] [ 466.280518][T20052] openvswitch: netlink: IP tunnel dst address not specified [ 466.334123][ T5193] udevd[5193]: worker [16692] /devices/virtual/block/nbd1 is taking a long time [ 466.381454][T20060] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3718'. [ 466.471063][T20061] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3717'. [ 466.562752][T20069] netlink: 'syz.2.3719': attribute type 1 has an invalid length. [ 466.667104][T20069] bond2: entered promiscuous mode [ 466.673330][T20069] bond2: entered allmulticast mode [ 466.679744][T20069] 8021q: adding VLAN 0 to HW filter on device bond2 [ 466.750271][T20069] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3719'. [ 466.760062][T20069] netlink: 'syz.2.3719': attribute type 7 has an invalid length. [ 466.772063][T20069] netlink: 'syz.2.3719': attribute type 8 has an invalid length. [ 466.829145][T20077] erspan1: entered allmulticast mode [ 466.855746][T20069] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3719'. [ 466.913884][T20077] bond2: (slave erspan1): making interface the new active one [ 467.012290][T20077] erspan1: entered promiscuous mode [ 467.037498][T20077] bond2: (slave erspan1): Enslaving as an active interface with an up link [ 467.051663][T20078] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 467.065309][T20078] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 467.101663][T20078] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 467.130403][T20078] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 467.185843][T20093] tipc: Enabled bearer , priority 0 [ 467.192893][T20089] netlink: 'syz.2.3719': attribute type 29 has an invalid length. [ 467.218968][T20089] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3719'. [ 467.319018][T20098] syzkaller0: entered promiscuous mode [ 467.324678][T20098] syzkaller0: entered allmulticast mode [ 467.333352][T20098] tipc: Resetting bearer [ 467.417826][T20076] tipc: Resetting bearer [ 469.011814][T20076] tipc: Disabling bearer [ 469.061818][ T24] tipc: Node number set to 4243144023 [ 469.267311][T20148] mac80211_hwsim hwsim44 syzkaller0: entered promiscuous mode [ 469.289501][T20152] No such timeout policy "syz0" [ 469.302950][T20148] mac80211_hwsim hwsim44 syzkaller0: entered allmulticast mode [ 469.374045][T20161] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3739'. [ 469.404372][T20150] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3736'. [ 469.442511][T20164] bond0: Caught tx_queue_len zero misconfig [ 469.543324][T20150] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3736'. [ 469.754428][T20182] netlink: 7064 bytes leftover after parsing attributes in process `syz.0.3743'. [ 469.772432][T20183] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 469.795664][T20182] openvswitch: netlink: Missing key (keys=40, expected=100) [ 469.832805][T20182] ip6gre2: entered promiscuous mode [ 469.934278][T20192] netlink: 232 bytes leftover after parsing attributes in process `syz.2.3747'. [ 470.536704][T20228] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3756'. [ 470.690699][T20244] netlink: 'syz.0.3761': attribute type 2 has an invalid length. [ 470.881000][T20257] syzkaller0: entered promiscuous mode [ 470.911291][T20257] syzkaller0: entered allmulticast mode [ 471.069474][T20269] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3768'. [ 471.457993][T20282] openvswitch: netlink: IP tunnel TTL not specified. [ 471.590881][T20296] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3774'. [ 471.819489][T20320] netlink: 'syz.4.3777': attribute type 10 has an invalid length. [ 471.893456][T20320] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.921448][T20320] bridge_slave_1: left allmulticast mode [ 471.943215][T20320] bridge_slave_1: left promiscuous mode [ 471.961514][T20320] bridge0: port 2(bridge_slave_1) entered disabled state [ 472.057587][T20320] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 472.085204][T20321] mac80211_hwsim hwsim44 syzkaller0: left promiscuous mode [ 472.093660][T20321] mac80211_hwsim hwsim44 syzkaller0: left allmulticast mode [ 472.267336][T20331] netlink: 'syz.4.3780': attribute type 13 has an invalid length. [ 472.296981][T20331] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3780'. [ 472.518424][T20347] netlink: 'syz.4.3782': attribute type 7 has an invalid length. [ 472.530412][T20346] netlink: 'syz.4.3782': attribute type 7 has an invalid length. [ 472.718058][T20358] syz.4.3784: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 472.740307][T20358] CPU: 0 UID: 0 PID: 20358 Comm: syz.4.3784 Not tainted syzkaller #0 PREEMPT(full) [ 472.740338][T20358] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 472.740352][T20358] Call Trace: [ 472.740361][T20358] [ 472.740370][T20358] dump_stack_lvl+0xe8/0x150 [ 472.740406][T20358] warn_alloc+0x249/0x340 [ 472.740431][T20358] ? stack_trace_save+0xa9/0x100 [ 472.740457][T20358] ? __pfx_warn_alloc+0x10/0x10 [ 472.740489][T20358] ? kasan_save_track+0x4f/0x80 [ 472.740508][T20358] ? kasan_save_track+0x3e/0x80 [ 472.740527][T20358] ? __kasan_kmalloc+0x93/0xb0 [ 472.740548][T20358] ? __kmalloc_cache_noprof+0x31c/0x660 [ 472.740568][T20358] ? xskq_create+0x56/0x170 [ 472.740596][T20358] ? xsk_setsockopt+0x54c/0x990 [ 472.740621][T20358] ? do_sock_setsockopt+0x17c/0x1b0 [ 472.740650][T20358] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 472.740676][T20358] ? do_syscall_64+0x14d/0xf80 [ 472.740713][T20358] __vmalloc_node_range_noprof+0x132/0x1730 [ 472.740770][T20358] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 472.740800][T20358] ? __kasan_kmalloc+0x93/0xb0 [ 472.740829][T20358] vmalloc_user_noprof+0xad/0xe0 [ 472.740851][T20358] ? xskq_create+0xbf/0x170 [ 472.740880][T20358] xskq_create+0xbf/0x170 [ 472.740921][T20358] xsk_init_queue+0x8a/0xe0 [ 472.740952][T20358] xsk_setsockopt+0x54c/0x990 [ 472.740980][T20358] ? __pfx_xsk_setsockopt+0x10/0x10 [ 472.741038][T20358] ? __pfx_aa_sk_perm+0x10/0x10 [ 472.741067][T20358] ? aa_sock_opt_perm+0xff/0x1a0 [ 472.741096][T20358] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 472.741118][T20358] ? __pfx_xsk_setsockopt+0x10/0x10 [ 472.741151][T20358] do_sock_setsockopt+0x17c/0x1b0 [ 472.741186][T20358] __x64_sys_setsockopt+0x13d/0x1b0 [ 472.741222][T20358] do_syscall_64+0x14d/0xf80 [ 472.741252][T20358] ? trace_irq_disable+0x3b/0x150 [ 472.741283][T20358] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.741305][T20358] ? clear_bhb_loop+0x40/0x90 [ 472.741332][T20358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 472.741353][T20358] RIP: 0033:0x7fc62679c629 [ 472.741373][T20358] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 472.741391][T20358] RSP: 002b:00007fc627658028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 472.741414][T20358] RAX: ffffffffffffffda RBX: 00007fc626a15fa0 RCX: 00007fc62679c629 [ 472.741429][T20358] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 472.741443][T20358] RBP: 00007fc626832b39 R08: 0000000000000004 R09: 0000000000000000 [ 472.741456][T20358] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 472.741469][T20358] R13: 00007fc626a16038 R14: 00007fc626a15fa0 R15: 00007ffd01353cb8 [ 472.741506][T20358] [ 472.741553][T20358] Mem-Info: [ 472.819862][T20364] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3786'. [ 473.039860][T20358] active_anon:6345 inactive_anon:0 isolated_anon:0 [ 473.039860][T20358] active_file:2902 inactive_file:40513 isolated_file:0 [ 473.039860][T20358] unevictable:769 dirty:71 writeback:0 [ 473.039860][T20358] slab_reclaimable:12812 slab_unreclaimable:119128 [ 473.039860][T20358] mapped:29598 shmem:1371 pagetables:3534 [ 473.039860][T20358] sec_pagetables:0 bounce:0 [ 473.039860][T20358] kernel_misc_reclaimable:0 [ 473.039860][T20358] free:1284151 free_pcp:10191 free_cma:0 [ 473.088994][T20358] Node 0 active_anon:25452kB inactive_anon:0kB active_file:11608kB inactive_file:161868kB unevictable:1540kB isolated(anon):0kB isolated(file):0kB mapped:118440kB dirty:292kB writeback:0kB shmem:3940kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15932kB pagetables:13996kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 473.132443][T20358] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:176kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 473.245965][T20358] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 473.328767][T20358] lowmem_reserve[]: 0 2493 2493 2493 2493 [ 473.358692][T20358] Node 0 DMA32 free:1197712kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:25352kB inactive_anon:0kB active_file:11608kB inactive_file:161868kB unevictable:1540kB writepending:292kB zspages:0kB present:3129332kB managed:2552852kB mlocked:4kB bounce:0kB free_pcp:45064kB local_pcp:21248kB free_cma:0kB [ 473.443692][T20358] lowmem_reserve[]: 0 0 0 0 0 [ 473.453874][T20358] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:884kB mlocked:0kB bounce:0kB free_pcp:24kB local_pcp:12kB free_cma:0kB [ 473.554225][T20358] lowmem_reserve[]: 0 0 0 0 0 [ 473.572028][T20358] Node 1 Normal free:3939884kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:196kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 473.627594][T20358] lowmem_reserve[]: 0 0 0 0 0 [ 473.633048][T20358] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 473.687603][T20358] Node 0 DMA32: 8647*4kB (U) 5242*8kB (UME) 2111*16kB (UME) 243*32kB (UME) 99*64kB (UME) 664*128kB (UM) 574*256kB (UME) 428*512kB (UM) 270*1024kB (UM) 69*2048kB (UM) 56*4096kB (UM) = 1222652kB [ 473.738894][T20358] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 473.787681][T20358] Node 1 Normal: 3*4kB (UME) 4*8kB (UME) 18*16kB (UME) 9*32kB (UME) 11*64kB (UM) 8*128kB (UME) 3*256kB (UM) 3*512kB (UM) 5*1024kB (UME) 3*2048kB (UE) 958*4096kB (M) = 3939884kB [ 473.844978][T20358] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 473.886878][T20358] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 473.923542][T20358] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 473.976528][T20358] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 474.032708][T20358] 44783 total pagecache pages [ 474.037468][T20358] 0 pages in swap cache [ 474.089260][T20358] Free swap = 124996kB [ 474.093486][T20358] Total swap = 124996kB [ 474.130223][T20358] 2097051 pages RAM [ 474.134104][T20358] 0 pages HighMem/MovableOnly [ 474.144494][T20358] 427002 pages reserved [ 474.151834][T20358] 0 pages cma reserved [ 474.182856][T20419] xt_TCPMSS: Only works on TCP SYN packets [ 474.374826][T20429] netlink: 'syz.0.3803': attribute type 4 has an invalid length. [ 474.428038][T20429] netlink: 'syz.0.3803': attribute type 4 has an invalid length. [ 474.499379][T20435] __nla_validate_parse: 2 callbacks suppressed [ 474.499402][T20435] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3806'. [ 474.533087][T20432] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.3804'. [ 474.673806][T20445] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3808'. [ 474.712962][T20445] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3808'. [ 475.000068][T20463] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3813'. [ 475.011003][T20463] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3813'. [ 475.040264][T20463] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3813'. [ 475.108752][T20472] netlink: 'syz.3.3816': attribute type 1 has an invalid length. [ 475.170696][T20472] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 475.211073][T20479] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3819'. [ 475.263699][T20484] netlink: 'syz.1.3821': attribute type 4 has an invalid length. [ 475.283392][T20483] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 475.290263][T20483] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 475.298443][T20486] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3818'. [ 476.028116][T20529] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3831'. [ 476.344587][T20543] ip6gre0: Master is either lo or non-ether device [ 476.427173][T20543] ip6gre0: Master is either lo or non-ether device [ 476.440970][T20549] netlink: 'syz.4.3835': attribute type 29 has an invalid length. [ 476.452168][T20541] netlink: 'syz.4.3835': attribute type 29 has an invalid length. [ 477.022924][T20577] validate_nla: 5 callbacks suppressed [ 477.022945][T20577] netlink: 'syz.2.3843': attribute type 32 has an invalid length. [ 477.409655][T20577] bond3: Setting coupled_control to off (0) [ 477.523790][T20602] IPv6: addrconf: prefix option has invalid lifetime [ 477.688456][T20589] netlink: 'syz.0.3845': attribute type 11 has an invalid length. [ 477.699079][T20583] netlink: 'syz.0.3845': attribute type 11 has an invalid length. [ 477.707655][T20583] Cannot find del_set index 1 as target [ 477.715906][T20613] netlink: 'syz.1.3850': attribute type 1 has an invalid length. [ 477.724041][T20613] netlink: 'syz.1.3850': attribute type 1 has an invalid length. [ 477.739743][T20613] netlink: 'syz.1.3850': attribute type 2 has an invalid length. [ 478.199528][T20642] bond4: Invalid ad_actor_system MAC address. [ 478.205709][T20642] bond4: option ad_actor_system: invalid value (1) [ 478.224211][T20642] bond4 (unregistering): Released all slaves [ 478.578917][T20676] nbd: must specify a device to reconfigure [ 478.593144][T20675] nbd: must specify a device to reconfigure [ 478.645312][T20681] netlink: 'syz.1.3867': attribute type 1 has an invalid length. [ 478.674093][T20683] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 478.686679][T20681] netlink: 'syz.1.3867': attribute type 1 has an invalid length. [ 478.762428][T20681] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 479.369685][T20717] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 479.413519][T20722] ipt_ECN: cannot use operation on non-tcp rule [ 479.649205][T20733] __nla_validate_parse: 13 callbacks suppressed [ 479.649228][T20733] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3882'. [ 479.663774][T20737] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3883'. [ 479.697453][T20737] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3883'. [ 479.863678][T20746] netlink: 19 bytes leftover after parsing attributes in process `syz.2.3885'. [ 479.992901][T20751] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 480.007127][T20751] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 480.224231][T20763] netlink: 'syz.4.3890': attribute type 11 has an invalid length. [ 480.244348][T20763] netlink: 'syz.4.3890': attribute type 6 has an invalid length. [ 480.431344][T20776] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3893'. [ 480.443486][T20777] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 480.723000][T20785] ip6tnl0: Caught tx_queue_len zero misconfig [ 481.043423][T20807] syzkaller0: create flow: hash 358586900 index 1 [ 481.116268][ T3473] syzkaller0: tun_net_xmit 76 [ 481.122826][ T3473] syzkaller0: tun_net_xmit 48 [ 481.139464][ T5945] syzkaller0: tun_net_xmit 76 [ 481.282888][T20815] veth0: entered promiscuous mode [ 481.299139][T13699] syzkaller0: tun_net_xmit 76 [ 481.307467][T20814] veth0: left promiscuous mode [ 481.314556][T13699] syzkaller0: tun_net_xmit 76 [ 481.322962][T20803] syzkaller0: delete flow: hash 358586900 index 1 [ 481.345111][T20821] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3906'. [ 481.386774][T20822] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3906'. [ 481.403231][T20821] netlink: 'syz.1.3906': attribute type 5 has an invalid length. [ 481.433041][T20821] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3906'. [ 481.491902][T20827] netlink: 244 bytes leftover after parsing attributes in process `syz.3.3907'. [ 481.503269][T20827] netlink: 'syz.3.3907': attribute type 8 has an invalid length. [ 481.521155][T20827] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3907'. [ 483.094345][T20827] bond0: entered promiscuous mode [ 483.100572][T20827] bond_slave_0: entered promiscuous mode [ 483.106384][T20827] bond_slave_1: entered promiscuous mode [ 483.114255][T20827] gretap0: entered promiscuous mode [ 483.124338][T20827] bond0: left promiscuous mode [ 483.129721][T20827] bond_slave_0: left promiscuous mode [ 483.136475][T20827] bond_slave_1: left promiscuous mode [ 483.158707][T20827] gretap0: left promiscuous mode [ 483.324252][T20859] bridge0: entered promiscuous mode [ 483.331037][T20859] macsec1: entered promiscuous mode [ 483.336442][T20859] macsec1: entered allmulticast mode [ 483.356937][T20859] bridge0: entered allmulticast mode [ 483.362574][T20863] netlink: 'syz.4.3913': attribute type 11 has an invalid length. [ 483.383009][T20859] bridge0: port 3(macsec1) entered blocking state [ 483.391867][T20859] bridge0: port 3(macsec1) entered disabled state [ 483.421286][T20859] bridge0: left allmulticast mode [ 483.426689][T20859] bridge0: left promiscuous mode [ 483.556976][T20872] syzkaller0: entered promiscuous mode [ 483.574379][T20872] syzkaller0: entered allmulticast mode [ 483.599801][T20881] netlink: 'syz.2.3918': attribute type 16 has an invalid length. [ 483.618279][T20881] netlink: 'syz.2.3918': attribute type 3 has an invalid length. [ 483.637744][T20881] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 484.359419][T20932] mac80211_hwsim hwsim40 syzkaller0: entered promiscuous mode [ 484.417439][T20932] mac80211_hwsim hwsim40 syzkaller0: entered allmulticast mode [ 484.497597][T20941] netlink: 'syz.4.3935': attribute type 21 has an invalid length. [ 484.560505][T20945] netlink: 'syz.3.3940': attribute type 1 has an invalid length. [ 484.578726][T20945] netlink: 'syz.3.3940': attribute type 2 has an invalid length. [ 484.695939][T20950] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 484.709009][T20950] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 484.802719][T20963] __nla_validate_parse: 9 callbacks suppressed [ 484.802739][T20963] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3945'. [ 484.847126][T20963] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3945'. [ 484.895733][T20958] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3944'. [ 484.944800][T20963] netlink: 'syz.1.3945': attribute type 11 has an invalid length. [ 484.993281][T20970] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 485.010137][T20970] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 485.141198][T20980] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3951'. [ 485.477091][T20998] bond2 (unregistering): Released all slaves [ 485.612664][T21008] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3961'. [ 485.715366][T21014] netlink: 'syz.3.3965': attribute type 2 has an invalid length. [ 485.762521][T21014] 9: entered promiscuous mode [ 485.822517][T21023] netlink: 'syz.0.3968': attribute type 9 has an invalid length. [ 485.830464][T21023] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3968'. [ 485.849283][T18196] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 485.849800][T21023] netlink: 'syz.0.3968': attribute type 9 has an invalid length. [ 485.871813][T21023] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3968'. [ 485.872936][T18196] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 485.930125][T18196] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 485.969075][T18196] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 486.023594][T21031] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3969'. [ 486.501890][T21069] netlink: 'syz.0.3977': attribute type 10 has an invalid length. [ 486.509935][T21069] netlink: 228 bytes leftover after parsing attributes in process `syz.0.3977'. [ 486.798808][T21086] netlink: 'syz.3.3981': attribute type 1 has an invalid length. [ 486.832682][T21086] 8021q: adding VLAN 0 to HW filter on device bond2 [ 486.877201][T21089] bond2: (slave gretap2): making interface the new active one [ 486.944741][T21089] bond2: (slave gretap2): Enslaving as an active interface with an up link [ 487.308861][T21098] netlink: 7064 bytes leftover after parsing attributes in process `syz.4.3983'. [ 487.335846][T21098] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 488.046670][T21138] syzkaller0: entered promiscuous mode [ 488.075996][T21138] syzkaller0: entered allmulticast mode [ 488.683394][ T1738] block nbd1: Possible stuck request ffff888027050000: control (read@0,1024B). Runtime 90 seconds [ 488.694556][ T1738] block nbd1: Possible stuck request ffff888027050200: control (read@1024,1024B). Runtime 90 seconds [ 488.705901][ T1738] block nbd1: Possible stuck request ffff888027050400: control (read@2048,1024B). Runtime 90 seconds [ 488.719245][ T1738] block nbd1: Possible stuck request ffff888027050600: control (read@3072,1024B). Runtime 90 seconds [ 490.324047][T21150] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 490.349454][T21186] syzkaller1: entered promiscuous mode [ 490.379167][T21186] syzkaller1: entered allmulticast mode [ 490.459612][T21205] __nla_validate_parse: 3 callbacks suppressed [ 490.459633][T21205] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4008'. [ 490.516712][T21211] validate_nla: 3 callbacks suppressed [ 490.516732][T21211] netlink: 'syz.4.4009': attribute type 1 has an invalid length. [ 490.537179][T21211] netlink: 'syz.4.4009': attribute type 3 has an invalid length. [ 490.547745][T21208] netlink: 256 bytes leftover after parsing attributes in process `syz.0.4007'. [ 490.548915][T21211] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4009'. [ 490.669616][T21219] ------------[ cut here ]------------ [ 490.675361][T21219] 1 [ 490.675395][T21219] WARNING: net/ipv4/route.c:1275 at ip_rt_bug+0x2d/0x140, CPU#0: syz.3.4010/21219 [ 490.687155][T21219] Modules linked in: [ 490.691339][T21219] CPU: 0 UID: 0 PID: 21219 Comm: syz.3.4010 Not tainted syzkaller #0 PREEMPT(full) [ 490.700889][T21219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 490.711050][T21219] RIP: 0010:ip_rt_bug+0x2d/0x140 [ 490.716054][T21219] Code: fa 55 41 57 41 56 41 55 41 54 53 48 89 d3 e8 2a e2 bb f7 66 90 e8 23 e2 bb f7 31 ff 48 89 de ba 02 00 00 00 e8 64 61 6a ff 90 <0f> 0b 90 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d e9 8f 4e a6 01 cc 49 [ 490.735778][T21219] RSP: 0018:ffffc9000cbc71d8 EFLAGS: 00010296 [ 490.741931][T21219] RAX: cffe876a5b86ff00 RBX: ffff88807496c3c0 RCX: 0000000000000401 [ 490.750018][T21219] RDX: 0000000000000002 RSI: ffffffff8def1a4d RDI: ffffffff8c27a480 [ 490.758054][T21219] RBP: 0000000000000001 R08: ffffffff901172b7 R09: 1ffffffff2022e56 [ 490.766298][T21219] R10: dffffc0000000000 R11: fffffbfff2022e57 R12: dffffc0000000000 [ 490.774341][T21219] R13: 0000000000000000 R14: ffff88807496c3c0 R15: ffff88801bbbb480 [ 490.782424][T21219] FS: 00007f9d695a66c0(0000) GS:ffff888125466000(0000) knlGS:0000000000000000 [ 490.791462][T21219] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 490.798104][T21219] CR2: 000000110c2433cf CR3: 0000000076c36000 CR4: 00000000003526f0 [ 490.806266][T21219] Call Trace: [ 490.809624][T21219] [ 490.812596][T21219] ip_push_pending_frames+0xbe/0x150 [ 490.817962][T21219] __icmp_send+0x118d/0x1590 [ 490.822759][T21219] ? __icmp_send+0x22b/0x1590 [ 490.827499][T21219] ? __pfx___icmp_send+0x10/0x10 [ 490.832559][T21219] ? ip_route_input_noref+0xad/0x270 [ 490.837914][T21219] ? __pfx_ip_route_input_noref+0x10/0x10 [ 490.843763][T21219] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 490.849308][T21219] ? ipt_do_table+0x2b2/0x1630 [ 490.854217][T21219] ip_options_compile+0x80/0xb0 [ 490.859170][T21219] ip_rcv_finish_core+0xaa2/0x1c00 [ 490.864339][T21219] ip_rcv_finish+0x14c/0x2f0 [ 490.869050][T21219] NF_HOOK+0x336/0x3c0 [ 490.873172][T21219] ? __pfx_ip_rcv_finish+0x10/0x10 [ 490.878348][T21219] ? NF_HOOK+0x9e/0x3c0 [ 490.882609][T21219] ? __pfx_NF_HOOK+0x10/0x10 [ 490.887244][T21219] ? __pfx_ip_rcv_finish+0x10/0x10 [ 490.892522][T21219] ? netif_receive_skb+0x102/0xc50 [ 490.897766][T21219] ? __pfx_ip_rcv+0x10/0x10 [ 490.902358][T21219] netif_receive_skb+0x45b/0xc50 [ 490.907406][T21219] ? __pfx_netif_receive_skb+0x10/0x10 [ 490.912961][T21219] ? __lock_acquire+0x6b5/0x2cf0 [ 490.917956][T21219] ? tun_rx_batched+0x185/0x790 [ 490.922954][T21219] tun_rx_batched+0x1de/0x790 [ 490.927683][T21219] ? __build_skb+0x62/0x440 [ 490.932292][T21219] ? __pfx_tun_rx_batched+0x10/0x10 [ 490.937554][T21219] ? tun_get_user+0x2354/0x3dd0 [ 490.942592][T21219] ? __local_bh_enable_ip+0xd0/0x130 [ 490.947940][T21219] ? tun_get_user+0x2669/0x3dd0 [ 490.952894][T21219] tun_get_user+0x2a78/0x3dd0 [ 490.957735][T21219] ? aa_file_perm+0x440/0x1630 [ 490.962590][T21219] ? __pfx_tun_get_user+0x10/0x10 [ 490.967686][T21219] ? ref_tracker_alloc+0x363/0x4d0 [ 490.972897][T21219] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 490.978415][T21219] ? tun_get+0x1c/0x2f0 [ 490.982705][T21219] ? tun_get+0x1c/0x2f0 [ 490.986906][T21219] ? tun_get+0x1c/0x2f0 [ 490.991159][T21219] tun_chr_write_iter+0x113/0x200 [ 490.996240][T21219] vfs_write+0x61d/0xb90 [ 491.000594][T21219] ? __pfx_vfs_write+0x10/0x10 [ 491.005414][T21219] ? __fget_files+0x2a/0x420 [ 491.010127][T21219] ksys_write+0x150/0x270 [ 491.014507][T21219] ? __pfx_ksys_write+0x10/0x10 [ 491.019458][T21219] do_syscall_64+0x14d/0xf80 [ 491.024108][T21219] ? trace_irq_disable+0x3b/0x150 [ 491.029231][T21219] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.035338][T21219] ? clear_bhb_loop+0x40/0x90 [ 491.040092][T21219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.046033][T21219] RIP: 0033:0x7f9d6875cece [ 491.050516][T21219] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 491.070295][T21219] RSP: 002b:00007f9d695a5fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 491.078799][T21219] RAX: ffffffffffffffda RBX: 00007f9d695a66c0 RCX: 00007f9d6875cece [ 491.086808][T21219] RDX: 0000000000000032 RSI: 0000200000000340 RDI: 00000000000000c8 [ 491.094847][T21219] RBP: 00007f9d68832b39 R08: 0000000000000000 R09: 0000000000000000 [ 491.102965][T21219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 491.111001][T21219] R13: 00007f9d68a16038 R14: 00007f9d68a15fa0 R15: 00007ffc878103e8 [ 491.119425][T21219] [ 491.122612][T21219] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 491.129927][T21219] CPU: 0 UID: 0 PID: 21219 Comm: syz.3.4010 Not tainted syzkaller #0 PREEMPT(full) [ 491.139371][T21219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 491.149460][T21219] Call Trace: [ 491.152780][T21219] [ 491.155725][T21219] vpanic+0x56c/0xa60 [ 491.159756][T21219] ? __pfx__printk+0x10/0x10 [ 491.164385][T21219] ? __pfx_vpanic+0x10/0x10 [ 491.168913][T21219] ? is_bpf_text_address+0x292/0x2b0 [ 491.174228][T21219] ? is_bpf_text_address+0x26/0x2b0 [ 491.179464][T21219] panic+0xc5/0xd0 [ 491.183221][T21219] ? __pfx_panic+0x10/0x10 [ 491.187845][T21219] __warn+0x315/0x4f0 [ 491.191937][T21219] ? ip_rt_bug+0x2d/0x140 [ 491.196287][T21219] ? ip_rt_bug+0x2d/0x140 [ 491.200647][T21219] __report_bug+0x29a/0x540 [ 491.205193][T21219] ? NF_HOOK+0x336/0x3c0 [ 491.209491][T21219] ? netif_receive_skb+0x45b/0xc50 [ 491.214632][T21219] ? tun_rx_batched+0x1de/0x790 [ 491.219501][T21219] ? ip_rt_bug+0x2d/0x140 [ 491.223846][T21219] ? __pfx___report_bug+0x10/0x10 [ 491.228994][T21219] ? ip_rt_bug+0x2d/0x140 [ 491.233362][T21219] report_bug+0x16a/0x220 [ 491.237727][T21219] ? ip_rt_bug+0x2d/0x140 [ 491.242107][T21219] ? ip_rt_bug+0x2f/0x140 [ 491.246458][T21219] handle_bug+0x98/0x200 [ 491.250724][T21219] exc_invalid_op+0x1a/0x50 [ 491.255260][T21219] asm_exc_invalid_op+0x1a/0x20 [ 491.260127][T21219] RIP: 0010:ip_rt_bug+0x2d/0x140 [ 491.265089][T21219] Code: fa 55 41 57 41 56 41 55 41 54 53 48 89 d3 e8 2a e2 bb f7 66 90 e8 23 e2 bb f7 31 ff 48 89 de ba 02 00 00 00 e8 64 61 6a ff 90 <0f> 0b 90 31 c0 5b 41 5c 41 5d 41 5e 41 5f 5d e9 8f 4e a6 01 cc 49 [ 491.284731][T21219] RSP: 0018:ffffc9000cbc71d8 EFLAGS: 00010296 [ 491.290848][T21219] RAX: cffe876a5b86ff00 RBX: ffff88807496c3c0 RCX: 0000000000000401 [ 491.298839][T21219] RDX: 0000000000000002 RSI: ffffffff8def1a4d RDI: ffffffff8c27a480 [ 491.306851][T21219] RBP: 0000000000000001 R08: ffffffff901172b7 R09: 1ffffffff2022e56 [ 491.314834][T21219] R10: dffffc0000000000 R11: fffffbfff2022e57 R12: dffffc0000000000 [ 491.322821][T21219] R13: 0000000000000000 R14: ffff88807496c3c0 R15: ffff88801bbbb480 [ 491.331098][T21219] ? ip_rt_bug+0x2c/0x140 [ 491.335465][T21219] ip_push_pending_frames+0xbe/0x150 [ 491.340807][T21219] __icmp_send+0x118d/0x1590 [ 491.345513][T21219] ? __icmp_send+0x22b/0x1590 [ 491.350328][T21219] ? __pfx___icmp_send+0x10/0x10 [ 491.355355][T21219] ? ip_route_input_noref+0xad/0x270 [ 491.360698][T21219] ? __pfx_ip_route_input_noref+0x10/0x10 [ 491.366463][T21219] ? __pfx_nft_do_chain_inet+0x10/0x10 [ 491.371995][T21219] ? ipt_do_table+0x2b2/0x1630 [ 491.376805][T21219] ip_options_compile+0x80/0xb0 [ 491.381710][T21219] ip_rcv_finish_core+0xaa2/0x1c00 [ 491.386893][T21219] ip_rcv_finish+0x14c/0x2f0 [ 491.391785][T21219] NF_HOOK+0x336/0x3c0 [ 491.395895][T21219] ? __pfx_ip_rcv_finish+0x10/0x10 [ 491.401036][T21219] ? NF_HOOK+0x9e/0x3c0 [ 491.405246][T21219] ? __pfx_NF_HOOK+0x10/0x10 [ 491.409850][T21219] ? __pfx_ip_rcv_finish+0x10/0x10 [ 491.414985][T21219] ? netif_receive_skb+0x102/0xc50 [ 491.420138][T21219] ? __pfx_ip_rcv+0x10/0x10 [ 491.424690][T21219] netif_receive_skb+0x45b/0xc50 [ 491.429679][T21219] ? __pfx_netif_receive_skb+0x10/0x10 [ 491.435181][T21219] ? __lock_acquire+0x6b5/0x2cf0 [ 491.440182][T21219] ? tun_rx_batched+0x185/0x790 [ 491.445067][T21219] tun_rx_batched+0x1de/0x790 [ 491.449849][T21219] ? __build_skb+0x62/0x440 [ 491.454487][T21219] ? __pfx_tun_rx_batched+0x10/0x10 [ 491.459813][T21219] ? tun_get_user+0x2354/0x3dd0 [ 491.464678][T21219] ? __local_bh_enable_ip+0xd0/0x130 [ 491.469980][T21219] ? tun_get_user+0x2669/0x3dd0 [ 491.474852][T21219] tun_get_user+0x2a78/0x3dd0 [ 491.479618][T21219] ? aa_file_perm+0x440/0x1630 [ 491.484418][T21219] ? __pfx_tun_get_user+0x10/0x10 [ 491.489515][T21219] ? ref_tracker_alloc+0x363/0x4d0 [ 491.494707][T21219] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 491.500222][T21219] ? tun_get+0x1c/0x2f0 [ 491.504431][T21219] ? tun_get+0x1c/0x2f0 [ 491.508645][T21219] ? tun_get+0x1c/0x2f0 [ 491.512938][T21219] tun_chr_write_iter+0x113/0x200 [ 491.518016][T21219] vfs_write+0x61d/0xb90 [ 491.522340][T21219] ? __pfx_vfs_write+0x10/0x10 [ 491.527145][T21219] ? __fget_files+0x2a/0x420 [ 491.531788][T21219] ksys_write+0x150/0x270 [ 491.536130][T21219] ? __pfx_ksys_write+0x10/0x10 [ 491.541016][T21219] do_syscall_64+0x14d/0xf80 [ 491.545689][T21219] ? trace_irq_disable+0x3b/0x150 [ 491.550754][T21219] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.556833][T21219] ? clear_bhb_loop+0x40/0x90 [ 491.561536][T21219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 491.567476][T21219] RIP: 0033:0x7f9d6875cece [ 491.571938][T21219] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 491.591678][T21219] RSP: 002b:00007f9d695a5fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 491.600140][T21219] RAX: ffffffffffffffda RBX: 00007f9d695a66c0 RCX: 00007f9d6875cece [ 491.608132][T21219] RDX: 0000000000000032 RSI: 0000200000000340 RDI: 00000000000000c8 [ 491.616124][T21219] RBP: 00007f9d68832b39 R08: 0000000000000000 R09: 0000000000000000 [ 491.624158][T21219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 491.632165][T21219] R13: 00007f9d68a16038 R14: 00007f9d68a15fa0 R15: 00007ffc878103e8 [ 491.640182][T21219] [ 491.643831][T21219] Kernel Offset: disabled [ 491.648256][T21219] Rebooting in 86400 seconds..