last executing test programs: 5.303939407s ago: executing program 0 (id=4277): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000280)={'tunl0\x00', &(0x7f0000000000)={'syztnl0\x00', 0x0, 0x700, 0x1, 0xfffffffc, 0x0, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x63, 0x0, 0x0, 0x5e55b37311de6d89, 0x0, @broadcast, @multicast2, {[@timestamp={0x44, 0x4, 0x4e, 0x0, 0x4}]}}}}}) sendmsg$IPSET_CMD_DEL(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000300)={0x2c, 0xa, 0x6, 0x101, 0xd000000, 0x0, {0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x4}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x2c}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_NEWCHAIN={0x34, 0x3, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_POLICY={0x8}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWCHAIN={0x58, 0x3, 0xa, 0x301, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffc}, @NFTA_CHAIN_HOOK={0x1c, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x789cb868}]}, @NFTA_CHAIN_POLICY={0x8}]}], {0x14}}, 0xb4}, 0x1, 0x0, 0x0, 0x80}, 0x24004000) 5.187587224s ago: executing program 0 (id=4281): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001100)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x7f8}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001180)={{r1}, &(0x7f00000010c0), &(0x7f00000002c0)=r0}, 0x20) select(0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x0, 0xea60}) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x16, 0x4, &(0x7f0000000780)=ANY=[@ANYBLOB="b4000000a7102f37d50ef1710000000063000000000000009500000000000000cb5239a01b5b902367fd5ec1a64e367acb74c7e00c2f2bd72b3a0be2ea96caa37fb3469e8505342e47fc8929a6a015"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="61df712bc884fed5722780b6c2a7", 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)="fd", 0x0}, 0x50) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_MAX_CSMA_BACKOFFS(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r4, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@NL802154_ATTR_MAX_CSMA_BACKOFFS={0x5, 0x12, 0xdd}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004004}, 0x0) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42072, 0xffffffffffffffff, 0x0) 5.012723361s ago: executing program 4 (id=4284): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x30628, 0x1, 0xfffffffd}, 0x50) r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r0, &(0x7f0000000000)={0xa0000001}) ppoll(&(0x7f0000000980)=[{r3, 0x1}], 0x1, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000140)={0x4}) 4.857911839s ago: executing program 0 (id=4288): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001480)={&(0x7f00000012c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x1c, 0x1c, 0xa, [@enum={0x6, 0x2, 0x0, 0x6, 0x4, [{0x1}, {0x2}]}]}, {0x0, [0x61, 0x61, 0x5f, 0x0, 0x0, 0x2e, 0x30, 0x61]}}, &(0x7f00000013c0)=""/178, 0x3e, 0xb2, 0x1}, 0x20) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x4000, 0x4) (async) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001980)=0x1200142, 0xfffffffffffffe24) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000340)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x1, 0x4) (async) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000280)={0x70, 0x1, 0x8200, 0xfb9, 0xf, 0x7, 0xffff, 0x10001}, 0x20) (async, rerun: 64) bind$xdp(r0, &(0x7f00000002c0)={0x2c, 0x0, r2}, 0x10) (async, rerun: 64) mmap$xdp(&(0x7f0000eae000/0x3000)=nil, 0x3000, 0x5000004, 0x13, r0, 0x180000000) (async) sendmsg$TIPC_NL_KEY_FLUSH(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x40, 0x0, 0x4, 0x70bd2b, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0x2c, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x2000000}, 0x2004c844) 4.540158391s ago: executing program 3 (id=4290): r0 = socket$netlink(0x10, 0x3, 0x0) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x4, 0x0}, 0x8) bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000040)=r1, 0x4) (async) r2 = accept4$llc(0xffffffffffffffff, &(0x7f0000000080)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, &(0x7f00000000c0)=0x10, 0x182d308fd3ab9f9b) ioctl$AUTOFS_IOC_EXPIRE(r2, 0x810c9365, &(0x7f0000000140)={{0x0, 0x8000}, 0x100, './file0\x00'}) (async) sendmsg$nl_route(r0, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0xffffff1f, 0xffffffbc, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0xfff}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2000c014}, 0x4000080) 4.449157056s ago: executing program 0 (id=4291): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(twofish)\x00'}, 0x58) r2 = socket(0x10, 0x3, 0x0) sendmsg$kcm(r2, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e00000022008102e00f80ecdb4cb9020a", 0x4a}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722", 0x44}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000300)=""/24, 0x18}], 0x1}, 0x2101) r4 = socket$unix(0x1, 0x5, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x9102}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x40480, 0x0) close(r6) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0x0, 0x10}, {0xffff, 0xc}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x28, 0x2, {{0x3, 0x7fffffff, 0x6361, 0x0, 0xffffffff, 0x407}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xfffffffd, 0x101}}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x300, r9, 0x3e}, 0x80, &(0x7f0000003600)=[{&(0x7f0000000180)="27030200590214000600006fb96dbcf706e10500000086ddffff1144ee1611", 0x1f}, {&(0x7f0000000f00)="0b676ae7ce0aa301d6ff23b6557b3e02be56268cb67cc8df76c62092c9dc73bf02e2fbfd0d14f594db9a8faca2d1ee15bc4c2c588479eb0b462fed8714ae90e42c4c1477864b7c37d96279e5c380cb5f53b2983f7e1ec1fb074a8d4be7374be1c9b65b8587e435b5dc319cd5d25258ed81710608c0331449192c63736d71c7fbb72bd9ef8a3be726b464f445638ea32879fe12b88ebe8e141ba4b0efe8ae02c225a3c07cbd1c65a5f9a57267f88213743ea2ab323a2f8f1c50ecca7b6ee9a0fea79147e75e0eca42d7cf6d4d9a1e658e44cd8dc36a7b91cca77237962b41d760dd6e3aed631486ad0f453ef4501e60f923d992103a3845a67fca331897cac2bd51790acf2661efa41d90eda2061ce1aa53cbeab80229844f3954fe9ac6447af516907739ea3e6bbb832770194e6e655ec3a7ab80374b17059080c1fa21970d0147401a1ca1e58e3c86d77d116f4208299d7a3665898b2009c3752c786e4b45042b51366a133974ec564c9d2f0d7cbad234223a19b52e0efeccd654fd2bdd57df81cd7b478ef2b59f8446075d812f9d62e63d1b38375765aa7d63965484ef4d9b0b90ec00b39ac0430cbfee05cd73c34ad9922f50292d69194220339e3c923a9121d0e5ab3b7fc0bc6a33cc87d4cc23eb205848aa1febd8dd07bc25978e", 0x1dd}], 0x2}, 0x0) 4.195362588s ago: executing program 2 (id=4294): bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x7, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="85000000070000006a0a00ff01010000260000000019e1b6950000000000000018100000", @ANYRES32, @ANYBLOB="100000000000002505000000000000009500000000000000"], &(0x7f0000000140)='GPL\x00', 0x1, 0xa3, &(0x7f0000000240)=""/163, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x4720}, 0x94) 4.013487831s ago: executing program 2 (id=4295): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r0, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000001c0)={&(0x7f00000002c0)={0x60, 0x3, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x41}, 0x40002) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000060a010400000000000000000a0000040900010073797a3100000000200004801c0001800a00010072656469720000000c020280080001400000001b0900020073797a3200000000140000001100010000000000000000000200000a"], 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x24000800) 3.768153435s ago: executing program 2 (id=4296): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000040)={@cgroup, 0xffffffffffffffff, 0x2f}, 0x20) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x2f, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, &(0x7f0000003680)}, 0x40) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, 0x0, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, 0x0, 0x0) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x101, 0x0, 0xf, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid_for_children\x00') mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x6, 0x31, 0xffffffffffffffff, 0x0) write$tun(r0, &(0x7f00000018c0)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800, 0x46}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "ec9700", 0x4e, 0x2c, 0x0, @local, @mcast2, {[@fragment={0x67}], @pkt_toobig={0x2, 0x0, 0x0, 0x800, {0xf, 0x6, '*zc', 0x3ff, 0x6c, 0x1, @loopback, @loopback, [@routing={0x2f, 0x0, 0x0, 0x6}, @hopopts={0x3a}], "ab0924172f9c"}}}}}}, 0x84) 3.500844674s ago: executing program 4 (id=4297): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a0500f000000000000000010000000900010073797a300000000048000000030a010200000000000000000a0000000900030073797a320000000014000480080002400000000008000140000000000900010073797a3000000000080007006e6174003c000000060a010400000000000000000100000008000b40000000000900010073797a300000000014000480100001800a000100726564697200000014000000110001"], 0xcc}}, 0x0) 3.395586457s ago: executing program 4 (id=4298): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={0xffffffffffffffff, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x5, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe1, &(0x7f0000000140)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0xaf, 0x8, 0x8, &(0x7f0000000300)}}, 0x10) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) tee(r1, r2, 0x8f5, 0x0) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000340)={@cgroup, 0xffffffffffffffff, 0x2f}, 0x20) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x2f, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, &(0x7f0000003680)}, 0x40) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r3, 0x1, 0x4c, 0x0, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, 0x0, 0x0) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000080000000c"], 0x50) bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000040)={0x49, &(0x7f00000000c0)}) bind$bt_hci(r6, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r6, &(0x7f0000000040)=ANY=[], 0x6) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000000)={0x7}, 0x8) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000009000000000000000000001811ff00", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000000e0000009500000000000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r7, r5}, 0xc) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x101, 0x0, 0xf, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x80}, 0x10) sendmsg$nl_route(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x0, 0x0, {0xa}, [@RTA_DPORT={0x6}, @RTA_SPORT={0x6}]}, 0x2c}}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid_for_children\x00') mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x6, 0x31, 0xffffffffffffffff, 0x0) write$tun(r0, &(0x7f00000018c0)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "ec9700", 0x4e, 0x2c, 0x0, @local, @mcast2, {[@fragment={0x67}], @pkt_toobig={0x2, 0x0, 0x0, 0x800, {0xf, 0x6, '*zc', 0x3ff, 0x6c, 0x1, @loopback, @loopback, [@routing={0x2f, 0x0, 0x0, 0x6}, @hopopts={0x3a}], "ab0924172f9c"}}}}}}, 0x84) 2.008910122s ago: executing program 1 (id=4303): bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000004000000000000000000000300000000030000000300000000000101010000000000000c00000000010000000100000506000000010000000200000000000000005f"], 0x0, 0x58, 0x0, 0xa}, 0x28) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r4], 0x1c}}, 0x840) write$nci(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="71050209020382070f03ac"], 0x18d) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @random="cf3cccaf382f", @void, {@ipv4={0x800, @tcp={{0x7, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0xfe, 0x6, 0x0, @remote, @local, {[@end, @end, @timestamp_addr={0x44, 0x4, 0x7d, 0x1, 0x4}]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff}}}}}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x4, 0x4, &(0x7f0000000140)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x8c}, [@call={0x85, 0x0, 0x0, 0xce}]}, &(0x7f00000001c0)='syzkaller\x00'}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c00000004000000000000000000000300000000030000000300000000000101010000000000000c00000000010000000100000506000000010000000200000000000000005f"], 0x0, 0x58, 0x0, 0xa}, 0x28) (async) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) (async) close(r0) (async) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) (async) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)) (async) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r4], 0x1c}}, 0x840) (async) write$nci(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="71050209020382070f03ac"], 0x18d) (async) syz_emit_ethernet(0x3e, &(0x7f00000000c0)={@local, @random="cf3cccaf382f", @void, {@ipv4={0x800, @tcp={{0x7, 0x4, 0x0, 0x0, 0x30, 0x0, 0x0, 0xfe, 0x6, 0x0, @remote, @local, {[@end, @end, @timestamp_addr={0x44, 0x4, 0x7d, 0x1, 0x4}]}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0xffff}}}}}}, 0x0) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x4, 0x4, &(0x7f0000000140)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x8c}, [@call={0x85, 0x0, 0x0, 0xce}]}, &(0x7f00000001c0)='syzkaller\x00'}, 0x94) (async) 1.819998579s ago: executing program 1 (id=4304): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MIN={0x8, 0x1, 0x1, 0x0, 0x1b}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x74}, 0x1, 0x0, 0x0, 0x40}, 0x24000800) 1.763608335s ago: executing program 1 (id=4305): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xa, 0x5, 0x2, 0x7}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) (async) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="05000000030000004000000040"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000500), &(0x7f0000000700), 0x1003, r1}, 0x38) (async) ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f00000002c0)={r0, &(0x7f0000000080)='\x00', 0x212282, &(0x7f0000000140)={@_ha_fsid={[0x8, 0x101]}, {0x10, 0x0, 0x1ff, 0x8000000000000001}}, 0x8, &(0x7f0000000180), &(0x7f00000001c0)=0xf}) (async) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x0, 0x10, &(0x7f0000000180)=ANY=[], 0x0, 0x2, 0x0, 0x0, 0x0, 0x49, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f00000000c0)=r4, 0x4) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f0000000340)={r1, &(0x7f0000000200)='\x00', 0x103900, &(0x7f0000000240)={@align=0x100000001, {0x0, 0x19, 0x8, 0x9}}, 0x0, &(0x7f0000000280)={@_ha_fsid}, &(0x7f0000000300)=0x3}) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="18020000000000020000000000000000850000001700000095"], &(0x7f00000005c0)='GPL\x00'}, 0x94) (async) r7 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) (async) r8 = socket$netlink(0x10, 0x3, 0x0) (async) getsockname$packet(r7, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r9, @ANYBLOB="00001000252155b21c0012000c000100626f6e64"], 0x3c}}, 0x40000) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r6, r9, 0x25, 0x8, @val=@tcx={@void, @value=r8}}, 0x1c) (async) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={r5, r9, 0x25, 0x18, @void}, 0x10) (async) sendmsg$unix(r3, &(0x7f00000006c0)={0x0, 0x0, 0x0}, 0x0) 1.648708344s ago: executing program 1 (id=4306): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r1, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r0, 0xc6e9f000) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x4000, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x5000004, 0x6e073, r1, 0x0) 1.201409748s ago: executing program 3 (id=4307): syz_emit_ethernet(0xe, &(0x7f00000002c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2c}, @void, {@generic={0x8863}}}, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000002c0)={0xff, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff2300000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000011000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100), 0x10, r0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x2, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000073113800000000008510000300000000c37a22e3b14af9c3d509b53466dd291f850000006b000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, r0}, 0x94) syz_emit_ethernet(0xe, &(0x7f00000002c0)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2c}, @void, {@generic={0x8863}}}, 0x0) (async) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f00000002c0)={0xff}, 0x8) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff2300000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000011000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae5e9ce218a35cd8e7b747887b1a74798982d0b492c3f0ff53189d80733eb04f8124877b648ff438f7d66c7efcc09a8f3330b6c22d14e80db8e5608bdeab9388b758a15f4ce70390c214bc6838798f5b9b0b500d4e8b5174f329b8501c6feb7a6982bcea74a0f2ced7fa2059234a8d10b7f0597151d5c9067d57d85f4ae933eaf5174ba122f3f702ef8695578d3c08562c9fc185f0f65d11b4c58ae52500cbe99cde3758a5cbe6093dd328ac820e2de309d25a324647aadffcecf0f3bbaeda7af4436d9ffbce1b240a2f5e346eba8812e6329e01b087bde7da4a6448f478102e90c8134f531de08d4cf4f6f35b15a202544c0ced0c1715fd3a90099f785a13a2412bedba2981dd22bd9d736c00000000000000000000000000000000eb6fec8d7d2f77f4d470a9caa5b1bfc00cd1d40830ac35f229f8ffe1c02a63d3c2d9"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x18, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100), 0x10, r0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x2, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="050000000000000073113800000000008510000300000000c37a22e3b14af9c3d509b53466dd291f850000006b000000"], &(0x7f0000000080)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, r0}, 0x94) (async) 1.12606259s ago: executing program 3 (id=4308): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000107b8af8ff00000000bfa200000000000007020000f8ffffff"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r0) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574"], 0x38}}, 0x0) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000000), 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x34, r1, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {}, {0x18, 0x17, {0x1b, 0x399f2023, @l2={'eth', 0x3a, 'vlan1\x00'}}}}, [""]}, 0x34}, 0x1, 0x0, 0x0, 0x804}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000500)={'syz_tun\x00', &(0x7f0000000440)=@ethtool_link_settings={0x4d, 0x400, 0xf, 0x80, 0x0, 0x0, 0x0, 0x0, 0xfe, 0x4, [0x0, 0x0, 0x4, 0xffffffbb, 0x0, 0x0, 0x1]}}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x38, 0x38, 0xc, [@var={0xa, 0x0, 0x0, 0x11, 0x4}, @const={0x0, 0x0, 0x0, 0x2}, @restrict={0x0, 0x0, 0x0, 0xb, 0x2}, @var={0x2, 0x0, 0x0, 0xe, 0x3}]}, {0x0, [0x5f, 0x4f, 0x30, 0x61, 0x2e, 0x0, 0x0, 0x0, 0x2e, 0x2e]}}, 0x0, 0x5c}, 0x28) close(0x3) r3 = socket(0x2, 0x80805, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x200000c0, 0xffffffff, 0xfffffff8}, 0x10) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="2c0000001a00110029bd70000000000002"], 0x2c}, 0x1, 0x0, 0x0, 0x20008000}, 0x10) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x7a, &(0x7f0000000340)={r6, @in={{0x2, 0x4e21, @rand_addr=0x64010102}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r3, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x4924924924925c1, 0x8801) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000001080)={r6, 0x4}, &(0x7f00000010c0)=0xc) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000bc0)={'sit0\x00', &(0x7f0000000ac0)={'gre0\x00', 0x0, 0x7, 0x80, 0x7, 0x9, {{0x34, 0x4, 0x2, 0x2, 0xd0, 0x64, 0x0, 0x8, 0x4, 0x0, @broadcast, @rand_addr=0x64010100, {[@generic={0x44, 0xd, "a49630e5829add4a648784"}, @generic={0x54911f271b74025d, 0xa, "bd9c4c9c1041468d"}, @timestamp_addr={0x44, 0x44, 0x2a, 0x1, 0x3, [{@private=0xa010102, 0x6}, {@loopback, 0x5}, {@loopback}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x31}, {@loopback, 0x3}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x9}, {@private=0xa010100, 0x1}, {@loopback, 0x7a8b}]}, @ssrr={0x89, 0xf, 0x2d, [@broadcast, @remote, @dev={0xac, 0x14, 0x14, 0x41}]}, @cipso={0x86, 0x32, 0x0, [{0x0, 0xc, "7516766c008583d3ed2a"}, {0x7, 0x11, "40bb85c0a1716deca9a3794598f04f"}, {0x0, 0xc, "af2c4f778ba401524769"}, {0x6, 0x3, "a7"}]}, @rr={0x7, 0xf, 0x94, [@local, @remote, @dev={0xac, 0x14, 0x14, 0x1f}]}, @rr={0x7, 0xf, 0xd2, [@local, @broadcast, @empty]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r3, 0x89f0, &(0x7f0000000c80)={'syztnl1\x00', &(0x7f0000000c00)={'ip6tnl0\x00', 0x0, 0x4, 0x8, 0x40, 0x0, 0x8, @local, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7800, 0x7, 0x3, 0xfffffff1}}) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x6, 0x4, 0xffd, 0x2}, 0x50) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000004c0)={r10, 0x58, &(0x7f0000003fc0)}, 0x10) sendmsg$inet6(r3, &(0x7f0000002440)={&(0x7f0000000400)={0xa, 0x4e23, 0x9, @dev={0xfe, 0x80, '\x00', 0x37}, 0x5}, 0x1c, &(0x7f0000000a40)=[{&(0x7f0000000480)}, {&(0x7f00000004c0)="a6a5890ef15c91c26543d0e1d2079f217885b8353c831416e441b8e6e314a48a0609f342b27c3f32a28a2dc2c36ac6be322656", 0x33}, {&(0x7f0000000540)="a56e08ac0d351f65fb8e34a00250fa3804ab14975866ffc1bdaff81553072284c972ad257fa7de82614c89fb44a15edc088890eebf447f4eb6635dbed2f023a333e8ce6961849c421bf376c5e668d8933ae6a0b01c6210f7c2e6bbc837c7207bdcf391508670dd6ffc0b4f913a9807c555bd085f7f54ae6240f72c8ca5178b9033aa126d2398d64448d1ef8c7b2c4cb7c487db9e6931ac29843022b951d3369fd08c3a7e3514ecd518f8abe157486ff3c6e312578811d34d87612a01394a1bca7285ec5435aa24758b68d7d79f0ad526f90c311b68583f5ff0b30c9afa3c1393e544164bb8e2350533ba37058c1e812f193d85b0057d5f857a", 0xf9}, {&(0x7f00000006c0)="def8ff47deca8a49", 0x8}, {&(0x7f0000000740)="028b76b71be3fdeefd2bf7e4fdbb01a8f71352c7ac02e54c5be07ddeb9429aaa2e56b86f2820a9d475e7c4729497fe2f9b47fb6b619dd52b5b13ceee17e3c24ce4ec179586756984c58cc864770637a6d64e6380b0264897672f9ad9af7593ff57ad0971960a309a2fef789ec023fbf47b70b3a1c729a971538aae37aca612cf9bbf", 0x82}, {&(0x7f0000000800)="f51d95225d359272a23f9f1c8aedb93665d35b2632742de8fce2b90abb530d757dc8670afb288ddceeae117d8af4e3f394ce7ff619b06a87a91c5414781848c914d1835091fc938c8cabf4374824c0832c69bb1ed699c1134b9aa0c877ac0a6af5ca587064b3e9ee6f89f9ebde9f11ef97353ea246a604e6282f1b17cc6b743d2ede4aced5bc748b7b7c9494a5b9dfdaf64e8844b29d2d5ef8738efd2ab9f751baf341dd1d46c0ae9a14a1494fcf3d285e5d2de88bcc052a7a7a12d3264e045ea350516a8eb5581bdaa72c", 0xcb}, {&(0x7f0000000900)="3dec5a00632a34957572ad259da1648304820121809c12443231157554bd06", 0x1f}, {&(0x7f0000000940)="9d2db464a19c9e1e67017d55c8f9afe66988857adb1a9cf7f1266185ff1d026fbc18c1c80a2c9ef4f73e82bb1001b29f9e3d67960cd2244a4a0dd97bf0761c443d9e4444fd8c78144ccb1d0e88da851d8b9b93d4b32210e9dc577f950ca4a5ede1a062b7faa469b62563f03d0838b13caf78217fa6b1372a45f8c424f999665c3d2b6928fd9e321f025b5f11e3898169370629058659fe8cf8fc7da279f66dad874aa9bc54c111aa359ff120fd7c917ee5cc758250e4b896b738d37eb03654f28dce8727", 0xc4}], 0x8, &(0x7f0000001100)=[@hopopts_2292={{0x20, 0x29, 0x36, {0x0, 0x0, '\x00', [@jumbo={0xc2, 0x4, 0x3}]}}}, @pktinfo={{0x24, 0x29, 0x32, {@empty, r8}}}, @pktinfo={{0x24, 0x29, 0x32, {@remote, r9}}}, @rthdr={{0x78, 0x29, 0x39, {0x6, 0xc, 0x0, 0x6, 0x0, [@private2={0xfc, 0x2, '\x00', 0x1}, @loopback, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast2, @private1, @dev={0xfe, 0x80, '\x00', 0x16}]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x6}}, @hopopts_2292={{0x48, 0x29, 0x36, {0x2b, 0x5, '\x00', [@enc_lim={0x4, 0x1, 0x5}, @ra={0x5, 0x2, 0x7fff}, @calipso={0x7, 0x18, {0x0, 0x4, 0xf7, 0x6, [0x2, 0x0]}}, @generic={0x2, 0xc, "ba82d14dce39533169a2430e"}]}}}, @hopopts={{0x1020, 0x29, 0x36, {0x16, 0x201, '\x00', [@generic={0xff, 0x1000, "416a38e9a1353c338b4d6ae968d29dd906a7fc6c4776cb8d2b763754a6e87933a6852a7cff77caeba9d9d8e357b3dd7de1fee2951cf7c664830191d74b3b53e842e2bdcb9e1be5c1946aa09bfee8abcf89ff55f36e921bd03b9131acab5f499f202db64a43f90dd291a8b2fb2ea56efe5502bbc025519ca7cf3d65af093379e48c643baa07a0e80e9b347dd769f267bcc80bfbba18e4a2b022f62e94387fc193a2e10d09bad65c126597874a3b0074f401f2763c85ab8a60c7062dfa38364aa266ff0bb664716d40fa0d93603db4ac212c83e96d4f6aa516ae7c9aaa04ef71feabcbc0cebae83011f08be91686c5c2abbe1f079af2f96fac59f13a55bb249bb824f1bd7e6a91fccfab378b71a8777bb776fdf0f98a13a228dd2ec6b08159210f423bd86ddfd426f7dca301dc56f92fe31f247025262a1272c54972615161a658317f2b7f3077262f92c2ad4107b6fe673ed4e15bd89d8e33637a77c8804e9418ab0bfdcd30d9a5ffd71ce2fc75ebd89ec234e0b0b315b1e935a840c22d36109da17cad10ea61c16c038af2033da04201549c6f72f77f6b202e7df55b359be6c299e238af8857b18f3ca303780db80f3d7004ee61805b81832a837cc831b5f36a884c3ff9a56fdf7b2966ce1ae55a980e2d4a08bc80f021d206d5ca92891fd24681dc240b4f12ff84394def9bf06dcfe3f4a57af7d8d9792e642dc8e60b02bfa63dd6ff7dc10136fab9861597b658c31dafa39e31a7f49a28bb62272d280ee23e1e6440c063e7dad1263108dfe73b47ed122855d552d4b1b9dcc2d3c554d6fcada1fd302aa7f877e0ab187adb04957020a8af643aa713f86615c9a832f1c4ed40d276bd839015d11980cd63e09a1e289bc0a8784444fb66d1750f7088e4ef1e7e23ecb0e0287d005ac20d8b97750ab3f19b8411c908b1c6456e94623d3f908984e412680e8edc40008bce18f343e16a6fc2efd6a641a328ec206d50afd75657306b264e315a8e2d122bdd7faa6da0b3496c440d644a4116afb98f16d74d5f3e247268f50f5d69febd0784ad3385f1dc9b517d973cf0f2c3227b68e1271ab20071c401af34ce34ecdfc5ec7804e780f6c199b31284284c61fe00e6804dcd01fa2a1dba5903a2143495354ec364e1d42f0fc107d2902b09fe894ec0dc0dcf5839f3b8d3f710bd83e6a245c6d85a8b1681bbcda998232316a4d1d1e66e36009f4e9511652dcecba4e3a39ea03b50aa6d7c643dc3704797323eaf48477ee53abc2e6ad7981558196af3437477ebc68113d33ea39411d70a3aefc6a3346fddf91b62e470c70341402fe058071bd669f43ef8c758c66d41ab1c10a37b03969941d8fa157bbfbd0680e6a200080369c69ab0f519644bd701460b7763bb6b9face17e3e55c51954f8c60cae1a39ab9353788f6193c1e2dbed8fc98a2d3afcdfe3ce6bb4767e8a2d1f94a181ffc57fe1eedf2af07175b263309050b8176341b4aab9daea7f0ed8adb8f308c88b65ce0065a8660f28752577daf3c3e73b6bffe14d84b41bb1ebe61322a22b8d38d63d5bcd7a9e3c2e9833cbcfea37b14acf0eade45c4bbdbf91cc2659245a105d58e77e248ec4bdfd39b097d5c266cc9e06c5ce635f8dab9ac97e83d32f710464e15027652081a940932d6e672cca24cf05473d3f9c7ec1743cd3beb9cf821b9bdf1d1073726a3c0a93d401ab553995f622af4ec72ee27ecb3e1649fe567d369171dfe431b86973babdf3040101e7b7170f798b4eb5b92f1906152b007e47653a70460315b6946fdad9d6e35da98c511daf9be9d2e4011445a62af06ac9d0ca16fb52f022c439db766554316ec2bd8da26c162eb845365a5b98c4e4bdbebd62e3f5e2ec224a6c2457c31b3cf8fa0ab7811b7ba64ec5e78a82916b35d544f281efbf1833673e614f6c2f82230314654d09a1b865767f7b10003048679904d617773648139465530c5672a4514fa686581144d8354b2688eedab793b439eaf7fc02edca2ab0388f9c6da29b0eaedc2efb5225bd5ef6be5a7562138b3d2bea136d6996dea1c8561e398e1ed4f6e2d07454ed814d531013c0ff4e70c1a3cd4f38dc34965e00f835aa47bc8fae5de131942c7ed9f0c51eede6d44b53d24b1d6bf42b2c8ffa400d6188f8d2ad18ed363a6e0d086fdf24fd301879e0a1dd18248c8ae459388505de11ddc96c0b146b9c87da74451992ec31fabf4f5636225ab15565bd96a5d6dcc9693b50bfa76fc52bc936211d4f958fcda089c1e97118130204a925f02daece1fdd267b4c646c58c49ece1fbbec9efc02d3f2d7cdf75ca1b8a49665138882a645a16fec85b39378f7e9bcee7bb8ebf2cc6f4fd31a2e205d45576e12bde0453eddb135b163002f6da7fdd2336702cf17af6453408754b5bdb1d96a67d18f808ad895fa880e95de5a27639c5d3d7843c3fe1313ddcb5b452e1b3ce1d1acd40072e1d4d0be38ff089665331cd7e3fa65c16085e145103b13828d5335f80dcf0056e6a097276778c13a78e88fc43074cc3add8b23fd34a56cd2bdb85609ec26805396676d230db5a3886d5d22800709874d34c190a907835512c119bd6be524fdc3a49b6e790c493a235c990d7dcd0f31249283985557d5d27044722e71916453aa45620f639bbf5476bd8f56c6d48c1681b320f16b217654d7229468e41b0edcc1c03cae683c2128cb64753239d129b73bec7cfbcb844a985037b54ca0e35ea50d3c3993a797366b18574f0eef2d39869303c43cb742ce3504b29a7ec1f28035365610b4c06f0a77b8d21727740889f5f70a54a5fbb856fd785ffd7a1394858bd828521f695070ac94d4a295f21684094b986ac3ab75cbb341805d2f1ec5ad2415f9ef224ee7ac4ac15fbc4e871dca2df6144015f93bf2b5ed258b55f95b0f169490fbc5b11b089c4ea2310c438b397990665766bc94ce5870d8a53a561765098083de084c38b5e1374355463b44d6e91cb08b6fb9cddf95588f51c5390cc7503f861b7b6a036fc209aab37f37e0718850db5edcef0478d778024774b0ff5a92f59290e95e7735e1f15efc08aefeadfa0ebb7f8b049e5e7cda21c933c9dea80580a428ccbb72f410c31a6dd669ef78ed73aec6fb7c18b04a6e1d0075ff1ddc08a571293f891caf26faa380b939ae917c380949e781b7ccac2f5d697c3afc8a303a9879402baf4ccef5611cecf5cc7f77584878263a9870cdf1ec42b452d25bc2e7fdcd1b26aba5395b3f5290972094c5d47a4d2faaa29c6afc9bca231f179e55068b0ec9238f194ddc51c1e993729fd214a8a4d9900c6037b88b8303b9188bab5b6536159fbb9c65bea3f47d1e507c276a06642319884b386e8a784e540b452ccfbc47b3d7318e190d411e16f5add8022dcaa918af106f417fc101bc6c5e60c51fb74981e9a5a80145d624c77bb986a8c6b62239f1e1cd48a20b1b68eed2fb719fa92af9974ed982d9732e4600d910cc97033c7d23904564543549de68ce422332d5be29973c6c2607fd74c74a8c335ebbc6629561ff7186488f0b65d5488a523d74b7b224a3df9810a490a24e63b3c61db79445c575479d05abadbccf53718db491dc1fbd7003892541fb32e28b59efc6ab3a855ef5e1a9ebf5bd14831756ca1ce42e0d9fb41a553c13c33e2ca80c965f5a310a82798c92acdacbd57d18fe78fa67c70d2901b9f50b5b2076193d22d744c629e28b6b6fdde51bd31242cb7592215928b30ac5d30d972bd9006c1f383c4010d141eecae77c3e9997187105c36d9329905b34b8acbee4b0ce4448a6d7f12b771e0516b8fd18d9eb117bdfe0c3072ba5bf6f72a7c3048cf85157acc5bc17222a19e3c677e332112b386853c7294f53b37fa78193534e0f08b581bfda5793fe91b1ae2e0f14e5284f7124c6a51e29f04cb0c10d97e162e44598ba638342980ebdffbc508320b9b9dad75a81f668346a458350b8b9850bb7738217ac4841e43b7a8d58376dba72a726b6fb4fbe93ff60f0ebc4a20d1cdc4d6caff7c214948ed465ccb0c46c6049b3a590fd3ab7d9472ed99a5cb9ce4882f3c8c6c1a1fd8f56c0728d01a69acfaae24e107349750009d511e1508d31a4ca1d38ac6a33d691490d6e88d256a72fcfa9624ef8170b743ec84fd9f5d10817c4cd00822a8b11d7d8153702216895f0654967b4875dd3523357628dbdc0b21dbbbcce682fcc5b082d0d90c8d8f8bddf328f0447a562f2f18cd46addf1155591f17330412e162bca561afccb2fb7f0d5d31010c422df1f9f774a47139b53d61159bb4d16edde4d4de5df1386a1a3dadf846dffad878c5ef5e14238b7970b2a05f92de820d83391c30038a7c3a7e1fd1dda400051eae6ef6b74baf9a32495a493c16f1bed0087831c4fc5c3864cc41393656b59d1843f4d67d2038c17f153a30471ee4448de60ee7df6fec31e5fd1016b4d2da1859615138a43e79c914b72a924f4ebdd81f2ffa265c6b5109740456fdb90bfda4c2f8289a1ad2e3c7b288770fd6ce36ca07aa124a1d399f95a5c6e5e9ac49e99d500428989d140dd452c22218afcc069decdc57fab96f9804418282f9003d78fe0aafb41ee29863643d39dcbca775d6804b3c59a2e329ca5abccbbfdd2d08b0a49b333da995d7faa5700e763afb984de550dc8b711cbee684c295450eeea44ccc9f6cea255798a9e83f84866df6b7dbf575a4c4976170c5c1c7e0fee5c17246651739f5de116b3b74e443b344c2ce2f68111c53d8269056ca7d134a989bc11e13fb4a5a6ac0d9b768593e4a57677aa0413340882e6768f02486874745dbe4bc69ec9d5c922e83c8213d619560c22c1afb831de56f7c5bd75f5c8b82c1bcb1aa2d8d0b093a2c6b7a0d4394d614b28fd6ed20e4417177612faec4094e7bab0127369db327b6bcfac3355132ab7e08d8d655a76fdd1df4944cddfebc7f1cb6c4ad0dd2743c68880a8dbd0d249cdfaad3b83fa13818c8bfb970f08997bcd9a74d9ac611cbe39d9f682769b7cd4d3c19fd00d35d4c40bb3ae9482cbc095d8c9f8213866b2e01aea692e7b260ddc710caab8acfc9551d6cf620953777cb627986f70c465b94c3ed54a81ea4d31d3a0e0d0476695679f6ab4fb137fe6063510075c3da718603165b4ccb01807faa84502450a28cf1e02f38b8c212117286ec329e377578b9f93fd6428ae469a53927a6e8aa76c9ed25b98ca5a8fff2af4d436304d23129a9e2049cbb2bf61998a6c4cee8be608a36053cde267893ded984ce0c7b781cef3125cace91a022aeb40e39959a8f45a52cacaaf716a93cb93261596050d2e13fb708a8715c7e6d5185195ebe5b74acbc3dccaa88d3d903f1b1642245eb98888b37c9c233ab93712378f0a78397ee07a2703405f0d72f0dcd20ada6e985f38a50d775d4ddcf38cdaaeede120d48a62ff052c318bb1e3e972944e3d6d75e43a9957f7d73fff56984d261447819ff6d775782a547b7071f02cb6092ea5706bdb9019c84138c733a66a7fce6ae4c98b3b92b4e1174231a335fd425c4b972f4612d31e9dc0576d152ba51a5f8f4e2fa7a3ceb1d8e80a147085cac5a942ef9192f1f8e03e2f3caf7e12de44652920631244a42460dca2b2d01e6633cd33f609ff6d26bd490600da7ede0fd1d13dc35871bb9403fb944222781d4b9260b44157a46f93232794ec97adeda7a2ac7d21b9c6bde744d9c7814cd23cdb9ed17eb0b70059239c736f6c6e44de647968788d4c5b275b97f893b4994db42452cc77c4284cf14a55597eac2fbaa645f0fcc1bbfc26c4931c0a493d9721c06cc575dfad"}, @jumbo={0xc2, 0x4, 0x101}]}}}, @dstopts={{0x1c8, 0x29, 0x37, {0x2, 0x35, '\x00', [@generic={0x6, 0x62, "3b9666a1e6a2e2e2f578a2399237632e71f2e78ba98addef4540791065ddd4f5e75cb6722b14a733ddeac3a14495fc02ab5f1e5b0b1ecd5741e8f30e696f7490ba7768a221d08728bda06b0888fe16be54955ad3fc994923bfd8f9865f80a8e338c2"}, @calipso={0x7, 0x48, {0x2, 0x10, 0x2, 0x6, [0x9, 0x5, 0x2, 0x8001, 0x0, 0x7, 0x8000000000000000, 0x4]}}, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x80000001}, @enc_lim={0x4, 0x1, 0xfc}, @calipso={0x7, 0x20, {0x3, 0x6, 0x0, 0x3, [0x5, 0x4, 0x1]}}, @generic={0x75, 0xce, "2a1b6df3a47dcf9b77a0643665d16d1da644152008ef17c3853a6c0592c6c92a39c004a6915e047df7d9bd5a61c565d7ea1e1bf0f17ff89c99d9d187037af0a3391bb04afbbd1b73a99e31f11a1c60d5f3c93cd29771a161ceba9584f9764f7de68788c32bb1e8743664600c357bbd3feac9cd7520ade595d1b3aa488b433b7c814a0540af73e752c48fb76851271e9515e432dc79872f45c211dd2a3fba8f9b69124fa1b97017de2d7dc84e5f40bdb8326d3e1c97f634a5612b82ac72427d4ee745da0517aaa7b8a1ba55c78ec5"}]}}}], 0x1330}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00f90000000000000005000200fc000000080005"], 0x3c}, 0x1, 0x0, 0x0, 0x4044851}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="1800000041ffffff00000000080000009111d8000000000095"], &(0x7f00000001c0)='syzkaller\x00', 0x5, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) 1.020862291s ago: executing program 2 (id=4309): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a0500f000000000000000010000000900010073797a300000000048000000030a01020000000000000000300000000900030073797a320000000014000480080002400000000008000140000000000900010073797a3000000000080007006e6174003c000000060a010400000000000000000100000008000b40000000000900010073797a300000000014000480100001800a000100726564697200000014000000110001"], 0xcc}}, 0x0) 1.020059151s ago: executing program 0 (id=4310): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) r1 = socket$inet(0xa, 0x801, 0x84) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x1f, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x70}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, 0x0, 0x0) listen(r1, 0x8) r3 = socket$inet(0xa, 0x801, 0x84) listen(r3, 0xfffffffd) r4 = socket$inet(0xa, 0x801, 0x84) listen(r4, 0x8) r5 = socket$inet(0xa, 0x801, 0x84) listen(r5, 0x8) r6 = socket$inet6(0xa, 0x1, 0x8010000000000084) listen(r6, 0x7) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r7, 0x100) r8 = socket$netlink(0x10, 0x3, 0x4) writev(r8, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r10 = accept4(r9, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) recvmmsg(r10, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x1032, 0xffffffffffffffff, 0x21d67000) pselect6(0x40, &(0x7f0000000180)={0x400000000000001, 0x200000000cc, 0xffffffffffffffff, 0xffffffff00000000, 0x7def1099, 0x8, 0x5, 0x7}, 0x0, &(0x7f0000001380)={0x80000000, 0x8, 0x401, 0xfff, 0x3, 0x9, 0xfffffffffffffff9, 0x9}, &(0x7f00000013c0)={0x77359400}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005700000095"], 0x0}, 0x94) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r11, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.019763812s ago: executing program 1 (id=4311): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x23c, 0x19, 0x1, 0x0, 0x0, {{@in6=@private2, @in6=@mcast2, 0x0, 0x3, 0x0, 0x0, 0x2, 0x0, 0x20, 0x8}, {0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x1d}, {0x0, 0x0, 0x0, 0x2dd}}, [@tmpl={0x184, 0x5, [{{@in=@local, 0x0, 0x2b}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xf}, 0x0, 0x0, 0x0, 0xff}, {{@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x32}, 0x0, @in6=@mcast2, 0x3502}, {{@in6=@loopback, 0x0, 0x3c}, 0x2, @in=@remote, 0x0, 0x1, 0x3, 0x0, 0x0, 0x7}, {{@in6=@mcast2, 0x0, 0x3c}, 0x2, @in6=@rand_addr=' \x01\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in=@local, 0x0, 0x33}, 0x2, @in=@empty, 0xffffffff, 0x0, 0x1}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x3c}, 0xa, @in6=@mcast1, 0x0, 0x1}]}]}, 0x23c}}, 0x0) unshare(0xc040480) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$unix(r1, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) ppoll(&(0x7f0000000100)=[{r1, 0x5082}], 0x1, 0x0, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg$alg(r2, &(0x7f0000000140), 0x4924b68, 0x0) ioctl$SIOCPNADDRESOURCE(r2, 0x89e0, &(0x7f0000000000)=0x1) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e23, @multicast1}}}, &(0x7f0000000180)=0x84) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f00000001c0)={r3, @in={{0x2, 0x4e21, @local}}, 0xfffa, 0x9}, 0x90) 981.623632ms ago: executing program 4 (id=4312): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000040)}, 0x20) close(r0) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) r1 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000540)={'bond0\x00', &(0x7f0000000040)=@ethtool_sfeatures={0x3b, 0x2, [{0x301}, {0xfffffffd, 0x80000}]}}) socket$nl_generic(0x10, 0x3, 0x10) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x2}, 0x28) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000180)={0x545b, 0x0}, 0x8) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000640)=ANY=[@ANYRES64=r2], &(0x7f0000000080)='GPL\x00', 0x5, 0xa8, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @fallback=0x24, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x10, r3}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001b40)) socket(0x11, 0x3, 0x800) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet6(0xa, 0x5, 0x0) listen(r6, 0x50) r7 = socket$netlink(0x10, 0x3, 0x4) writev(r7, &(0x7f0000000080)=[{&(0x7f00000000c0)="480000001400190d09004beafc0d8c560a84696080040000000000000000bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed51000000000000000000", 0x48}], 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r7) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000080)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYRES64=r8, @ANYRES64=0x0, @ANYRES64=r4], 0x20) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c0000001600010027bd5000fedbdf250a8080fd", @ANYRES32=0x0, @ANYBLOB="14000200fe800000000000000000000000000034"], 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="01e7ae28390ea4d04048fd5efa52d76d6c5507e0860e3a96bae0244d40f0be750343b0cc42c126a6b7524e8f8193511cabbf48f209c75d2ab419fcc5c8e9f6201100f10ccf306b25bd23b7ee8c2a1580dacc88360af00a40f1a2dfbc7bd4b19ea6bab066b6b478db8649118f5bb77c738e18bba21994d202d143", @ANYRES32=r0, @ANYRESHEX=0x0, @ANYRES8=0x0, @ANYRES8=r5, @ANYBLOB="00000000080000000100"/28], 0x50) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000002000010029a9790000000000020000f0ffffff0100000000"], 0x1c}}, 0x0) openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f0000000000), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) 893.795476ms ago: executing program 2 (id=4313): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), r1) getsockname$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[@ANYBLOB="380000001000390400"/20, @ANYRES32=0x0, @ANYBLOB="00000000408000001800128008000100736974000c00028008000100", @ANYRES32=r2], 0x38}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000340)={'syztnl1\x00', r2, 0x1, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x9, 0x0, 0x0, @empty, @empty}}}}) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r1, 0x89f2, &(0x7f0000000040)={'sit0\x00', &(0x7f0000000340)={'syztnl1\x00', r2, 0x1, 0x0, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x9, 0x0, 0x0, @empty, @empty}}}}) 804.537497ms ago: executing program 1 (id=4314): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000001c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={0x34, r5, 0x1, 0x0, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x20, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfff}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x40080c1}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r3}, &(0x7f00000000c0), 0x0}, 0x20) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000001080)={@multicast, @local, @void, {@ipv4={0x800, @igmp={{0x6, 0x4, 0x3, 0x33, 0x20, 0x66, 0x0, 0x40, 0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@generic={0x44, 0x4, "0f24"}]}}, {0x1e, 0xb, 0x0, @loopback}}}}}, 0x0) r7 = socket(0x840000000002, 0x3, 0x100) connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e24, @remote}, 0x10) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x15, 0x5, 0x0) getsockopt(r9, 0x200000000114, 0x2713, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x28, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3000a}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r7) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r7, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4004800}, 0x800) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x8c}}, 0x0) sendmmsg$inet(r7, &(0x7f0000005240), 0x4000095, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r11, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newlink={0x5c, 0x10, 0xffffff1f, 0x70bd26, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1605, 0xf74}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gretap={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}, @IFLA_GRE_REMOTE={0x8, 0x7, @multicast1}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}, @IFLA_IFNAME={0x14, 0x3, 'vlan0\x00'}]}, 0x5c}}, 0x4000) 789.946636ms ago: executing program 4 (id=4315): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe}, 0x1c) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000300)={@ifindex, 0xffffffffffffffff, 0x36, 0x4}, 0x20) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip_vti0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x5}, @IFLA_BOND_PRIMARY={0x8, 0xb, r2}]}}}]}, 0x44}}, 0x0) socket$packet(0x11, 0x3, 0x300) (async) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000002c0)=@req3={0x10000, 0x1, 0x100, 0x100, 0xe}, 0x1c) (async) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000300)={@ifindex, 0xffffffffffffffff, 0x36, 0x4}, 0x20) (async) socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip_vti0\x00'}) (async) sendmsg$nl_route(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x5}, @IFLA_BOND_PRIMARY={0x8, 0xb, r2}]}}}]}, 0x44}}, 0x0) (async) 779.529338ms ago: executing program 3 (id=4316): mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x41071, 0xffffffffffffffff, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000e40)=@newtaction={0x5c, 0x30, 0x800, 0x5, 0x0, {}, [{0x48, 0x1, [@m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x80000001, 0xfdffffff, 0xcc51b9dba933aa18, 0x0, 0x400}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8890}, 0x40) (async, rerun: 64) r0 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) sendmsg$nl_generic(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000900)=ANY=[@ANYRESHEX=r0, @ANYRES32, @ANYBLOB="2d0529800c00f800030000000000000004006080fa003b800400df00c1becb03dbe55b6c782cebd6a7bc78a21d1bc9f3c1bd441ada5266780599eaf18965bbfcc07c2037129672275c399e1e03f8a0664d807385cc4d566f230400db800400498096d9641e8b1887b25501b11ecd71313a47df368b078d7b825bff33b9eab3964d7b2394b1950c7aeaba6014fe2cd33c89fd070ce0f1f306494a44adf6609d8ad55a5080b36b05cb0b9a57833b14fcd62c0aba0ac67f03b20e87ba6f3610a5bd1d3369ae014c8036c1e596b800991698810ff706e98871c17ad581b0695476273ac6c33a7a51d4a44a5b95684befe95ef49b03458bce89d87355f35b766b242b9f98b661269bb9255d836fb4e30d0000c72ec5561adf6112ca278273b4af42597e7bfa1f5c228f13161b34517c92bc352c017afac22d14047e6fbdc61536f9e51738ea935cb2a577ec2b788433bc13a9e976cfee267f36d988b766a29632c84c94d4cf31d780ef683293d7eacfc93f248d137affcae7cffa699237ea9c74919850dc164f1483f3f352bf7dd787191705b26936e1d090526b6ac5765df318f160cc84b15b94c662cf92611c9eb0b92bfbd3512bffed96a4150d653e130625b6ae5a78da2c4b9c70c736a224b18d89222095fbc4c61bcad1eb73be9c6efaaae48f871223694999b2a925a37138be8220008180cc20e57a92076b2308003200", @ANYRES32, @ANYBLOB="040044800800c800e00000027a01f380a2b4c1dbd4f221c0a1fd468ca63ae97de147e5bc2d0313377dc17591b491acf18312bee324decf810970090c77ec4ca173b12577aeb13c354245be77050365697b3b4707060c00045e46d612b09c487d7c9c94f778c0a015ecfa70d229085252956142772f9ff5a61a9b7fbc6712f8e64566b7ade87d293b81bd3cd1b2ad2852dc1dbb07d54f5544759f0eb23131b5780de6354f0714b2c5b86323969d0b4f5bd8c4489e0e7471c6a84feb9dead9d156d060a9373c7f80f4f1ec2a87efdeceec8d99c9664ee184f112929fe92da18f26929f98233f18dcbe0c638c040061800400058012fc33716331943112df1a6d89852782e376609e4a38717148d34e9d36191fe607748ad822c89800b204bd5831c55511fc4e85d09c44ef3be8ce710d034d394057d88e12db87eb032cd30fdcb489cd5ac92a44f96b6e463971c730796efaab04ce1b42faea757fc0a50c4feef468c80d7cac7db3bfd67140c04f88892b1d19a91ac5d2bef2af704fed3f92e84f78f98e97b8460000602ca31cc4edb57168863fe0e930a6030e47048c91da29a2c691894cd27b28480642302c6816b308d3eaceb9c1404c696e8a2deb97c278ca9d9b1ea4aa17255b400acdda233dde73b32098f837494e43a67bbb722f105f5ae23d8e4c9586ac0ff8c1c6c330601a9c007659ce63c0387d6692d791abdb14b8b66d6b30e5556865a6e97922f3fddcfd1a7e2cbf30b30479b4f7b824b49b1a8e5cd1ec171c8fd41bc3b14ced446eadedd90178f121d6e4d3ae3031231f39fcad0501455538f57fc305f449144d0e4f1f642ff19c53dea5322d30d680f6efdce4f7310225fa8e8a3035d925f51090e4fa74346825d16d400b9cea013e88ea47db2efbbbe73c3ae0059974efa840d4ee88ae1f85d6ba36caa8df64cbf4c1716de586b6fce1424c8bc3a0218953ea42dc7e83bda5a4319b59d7926fe04553fe79056a397ea85f6255d093a345aaf5f3d91cdce17cc9d38493e7eb952b132dc8f7953706ea7b7ff81e88a2a87f18730ca7f6f16f2c23b85f549a8b0cce6f8f0ec61fa8ba01aa114fbd63373ae3189338aa5f585a6d454733937712eb5a4cbd810c91bf5f19e0a508db8a57bdd8000000960203"], 0x85c}, 0x1, 0x0, 0x0, 0x24048011}, 0xc000) r1 = socket(0x10, 0x3, 0x800000) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x8607}, 0x10) (async) sendmsg$nl_generic(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x1c, 0x16, 0xa01, 0x200, 0x0, {0x11}, [@typed={0x8, 0xa, 0x0, 0x0, @ipv4}]}, 0x1c}}, 0x8000) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f0000000200)=0x9, 0x2) mmap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x42073, 0xffffffffffffffff, 0x0) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r2, 0x0) (async) sendmsg$key(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x10, 0x1, 0x7, 0x1e, 0x0, 0x70bd28, 0x25dfdbfd, [@sadb_lifetime={0x4, 0x4, 0x6, 0x8da8, 0x2, 0x8}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e21}, @sadb_lifetime={0x4, 0x2, 0x2, 0xffffffffffff4c4c, 0x80000001}, @sadb_key={0x13, 0x8, 0x460, 0x0, "9d0e3d5f9ce796c69ce1eba8d1772672aa2521b103cac0d1590b51d4278deac04854ce3db2b69c92de8def475d8f1a476e681cfbde73120e182ebe5c996be23031f93d03deed020e855fc7a54145df206dc8ce38875ada562228374655be3d57222d2e73988c9dd6877dd5b20311742ce569d4b2a9d58dc3efce088b32d66b454e05b6963c1d7ab88bf378f6"}]}, 0xf0}}, 0x20000000) 595.921869ms ago: executing program 2 (id=4317): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(0xffffffffffffffff) r2 = socket$kcm(0x29, 0x5, 0x0) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001800)={&(0x7f0000001780)=ANY=[@ANYBLOB="100000000414040029bd9700fe776409"], 0x10}, 0x1, 0x0, 0x0, 0x5}, 0x4008880) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) r5 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r5, &(0x7f0000000280)={0x0, 0xffe4, &(0x7f0000000ac0)=[{&(0x7f0000000b00)="b6bd7e4983a45b31f79d80060400000000000000a33734d88229acf96457ad59d0b87f8659b614043e3d21a7cacecab8bbd26251b93b28b4d83e618673f9c74d0a28a5146c5511549fa617e908352c87d8ddff2ce042a1e58eb7b63759cab3526dd8ae1566ddcfb5fa83e8b2940b3ed1b8", 0x71}, {&(0x7f0000000880)="3aa854", 0x3}, {&(0x7f0000000a40)="746b9120a32aaf78043a9b07000000000000003c44", 0xfffffe16}], 0x3}, 0xc854) setsockopt$sock_int(r5, 0x1, 0x12, &(0x7f0000000180)=0x4c, 0x4) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) sendfile(r2, r4, 0x0, 0xffffffff000) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r6, 0x0, 0x70bd2c, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44010}, 0x40000) sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r7, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) r8 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r8, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) connect$inet(r8, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r8, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f00000000c0)='bbr', 0x3) recvfrom$inet(r8, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) ioctl$AUTOFS_IOC_CATATONIC(r0, 0x9362, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000001980)={&(0x7f0000009b80)=@newchain={0x24, 0x64, 0x300, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff2}, {0xf}, {0xa, 0x1ffe4}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x10) socket$netlink(0x10, 0x3, 0x0) 497.691295ms ago: executing program 3 (id=4318): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r0, &(0x7f0000000640)=ANY=[@ANYBLOB="6d6ff16900e011fffe880000000000000000000000000001fc0100000000000000000000000000004e254e2100e09078ee373935ef0f8da10b47000507b0025a9001e6cc070855848340507e8bd26f3ca1d633ec368e2be6a38e100ad79a38fb5c1436b5988215e096f64a843aafad7b82e65587c020411aefc61cb5c51b9788796ac34f4a8e455dd1d07d4684c7b2e91b6fd3fbaeffe77e10e2bd1d0cde2e814806120485b4b6f5c6d14b23c1b00be5fe8ca59610a206c47126484462b109828cae2dbbdd69bf1f853aaaac48ed7002cfe08806b1a56c2886d7fd3c77f48ae33282aa4e245082bbcabdba8d34197fec5a19521e8557bb8c690fdd6f108251a924d3740ce4effb9f7c89ca60e0f70c2b203a3781395b228249ff5dc4755242ffd9b4a526fad4aa28a0b94e123563012e73656c526002ebc8c339e20d3085d5f9afea446958"], 0x108) (async, rerun: 32) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) (rerun: 32) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x11, 0x13, &(0x7f0000000080)=ANY=[], &(0x7f0000000280)='syzkaller\x00', 0xa, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40000}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61122800000000006113380000000000bf1000000000000025000200091b00003d200000000000008701000000000000bc26000000000000bf67000000000000150300000ee600f0670200000300000015030000ffffffffbf050000000000000f650000000000006507f4ff02000400070700006b3128fe1f75000000000000bf540000000000000705000003001500ae430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305863f970eac3590ac99b798f8125f1c322c2a154a8a8d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @sk_msg}, 0x48) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000800)=ANY=[], 0x141) (async, rerun: 64) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) (rerun: 64) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) (async, rerun: 64) r3 = socket$inet_sctp(0x2, 0x1, 0x84) (rerun: 64) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) (async) r4 = socket$inet_udp(0x2, 0x2, 0x0) (async, rerun: 64) unshare(0x28000600) (rerun: 64) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000200)=@o_path={&(0x7f00000001c0)='./file0\x00', 0x0, 0x4000, r4}, 0x18) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)={0x2c, r2, 0x701, 0x0, 0x0, {{}, {@void, @val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}]}, 0x2c}}, 0x0) (async) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$SMC_PNETID_ADD(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x60, 0x0, 0x300, 0x70bd25, 0x25dfdbff, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x60}, 0x1, 0x0, 0x0, 0x40010}, 0x2001c801) (async) ioctl$sock_ifreq(r7, 0x8949, &(0x7f0000000080)={'pim6reg1\x00', @ifru_names='vlan0\x00'}) 445.595493ms ago: executing program 4 (id=4319): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$kcm(0x2, 0x3, 0x84) r2 = bpf$OBJ_GET_PROG(0x9, &(0x7f00000000c0)=@generic={0x0, 0x11}, 0x18) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={'pim6reg0\x00', 0x2}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f0000000140)={0x40000000}) ioctl$TUNSETPERSIST(r3, 0x400454c9, 0x1) ioctl$TUNDETACHFILTER(r3, 0x401054d6, 0x0) sendmsg$inet(r1, &(0x7f0000000d40)={&(0x7f0000000000)={0x2, 0x0, @broadcast}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="18000000000000000000000007000000890704e068000000110000000000000000dbc790ad000000fc0000000000000014000000000000000000000034"], 0x68}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="6c00000002060500000000000000000000000000120003006369746d61703a69702c63000000050005000700000009000200fbfa1460d745626f7173717b9672040000000007800c00018008238a0542fa340001400000000008000840000000a20800094000007fff05000500020000000500"], 0x6c}}, 0x200040c0) 88.326332ms ago: executing program 3 (id=4320): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000040)={@cgroup, 0xffffffffffffffff, 0x2f}, 0x20) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000240)={@fallback, 0x2f, 0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, 0x0, 0x0, &(0x7f0000003680)}, 0x40) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$sock_attach_bpf(r1, 0x1, 0x4c, 0x0, 0x0) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2e, 0x0, 0x0) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x101, 0x0, 0xf, 0x0, 0x0}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid_for_children\x00') mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x6, 0x31, 0xffffffffffffffff, 0x0) write$tun(r0, &(0x7f00000018c0)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x11, 0x800, 0x4e}, @mpls={[], @ipv6=@icmpv6={0x0, 0x6, "ec9700", 0x4e, 0x2c, 0x0, @local, @mcast2, {[@fragment={0x67}], @pkt_toobig={0x2, 0x0, 0x0, 0x800, {0xf, 0x6, '*zc', 0x3ff, 0x6c, 0x1, @loopback, @loopback, [@routing={0x2f, 0x0, 0x0, 0x6}, @hopopts={0x3a}], "ab0924172f9c"}}}}}}, 0x84) 0s ago: executing program 0 (id=4321): openat$nci(0xffffffffffffff9c, 0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee7, 0x8031, 0xffffffffffffffff, 0x2000) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000540), r4) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r6, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01000000000000000000010000002400048005000300020000000500030000000500030002000000050003000200000008000100ffffffff08000200020000000000"], 0x48}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a58000000090a010400000000010000000a0000040900010073797a310000000008000a40fffffffc08000540000000020900020073797a0000080003400000011c08000640ffffff000c000980080001400000003900000000000000000000000700000af492f0ded4bbcbbc4b635e2f68ba42fde884911c913b710a0fff91415b00000071f80000"], 0x80}, 0x1, 0x0, 0x0, 0x4000850}, 0x0) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r1, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, 0x3, 0x2, 0x101, 0x0, 0x0, {0x7, 0x0, 0xa}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x10) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000010900010073797a310000000054000000030a0104000000000000000001"], 0xc4}, 0x1, 0x0, 0x0, 0x20004000}, 0x4000) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$sock_inet6_SIOCSIFDSTADDR(r7, 0x8918, &(0x7f0000000000)={@mcast2, 0x75}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x4, 0x5, &(0x7f0000000240)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r9, 0x0, 0xe, 0x0, &(0x7f0000000840)="5fc83dd3b7a25254be360df7b8e1", 0x0, 0x6333, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008900000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r8}, &(0x7f0000000000), &(0x7f0000000040)=r10}, 0x20) r11 = socket$packet(0x11, 0x2, 0x300) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000002fc0)=ANY=[@ANYBLOB="7a0af8ff75257078bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b2595285faa6ead0169191d54f8196217fc560e2fc91f6da4dad4fdc2eb1b5986fc4a3f611a7c8edd3aa5d6ee7ab10b1a297cf52866651ddd73f30f2382f6cda4bfdd45be583823c0f09621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000000db453620ce72d75946c2b638d91dbef661962239c77edf2d34b12cd48a1b20fb7dd8432619f2c50d77bc0ea9b0af58e6fff4942eb613eff289026d5045ef76d7d864409eb2dc9518a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5208ff0df2db761014b1b999a12df6bee431a668135b8214afa5827b56a8074bf1e6cf5d84b35a3a3a4c66824fe12dbe20fcf50a194185b9e2d8b815fedb0d982936156be3cdda66fb977aef7c9cb92428ef25d9bf665bd60024c09e9eed544126fabe4cb8d826e1ec03cc492f5cad6227c94fea467aea7fa8b58abc37056433edf43fba5566a3e022034ac81fd48f9b7314ffa730017fbd37fdb23bc26992529402a520ef67e246415a6a8ca9d4aa797a95ca3314ded0d8a24abd57e042888a9141ab4e6c6b939aaefc248791464970c43120211b9bc82a85cd2fc18f535c7986c2d52ba62f74f00000000008000000000000000000000000040000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r11, 0x1, 0x32, &(0x7f0000002900)=r12, 0x4) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r13, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000380)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0x4e20, @broadcast}, 0x2, 0x0, 0xa, 0x2}}, 0x26) sendmsg$tipc(r14, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) kernel console output (not intermixed with test programs): nk: 4 bytes leftover after parsing attributes in process `syz.3.3105'. [ 442.357854][T17868] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3105'. [ 442.397506][T17868] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3105'. [ 442.425718][T17868] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3105'. [ 442.804943][T17893] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 442.952472][ T4946] Bluetooth: hci0: command tx timeout [ 443.107216][T17899] IPVS: Scheduler module ip_vs_sip not found [ 443.255698][T17649] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 443.278213][T17649] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 443.307045][T17649] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 443.374034][T17649] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 443.403823][T17649] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 443.447205][T17649] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 443.463941][T17649] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 443.490386][T17649] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 443.909952][T17649] 8021q: adding VLAN 0 to HW filter on device bond0 [ 443.966891][T17945] netlink: 'syz.2.3125': attribute type 1 has an invalid length. [ 444.003756][T17649] 8021q: adding VLAN 0 to HW filter on device team0 [ 444.047537][T17945] netlink: 'syz.2.3125': attribute type 322 has an invalid length. [ 444.107823][ T6297] bridge0: port 1(bridge_slave_0) entered blocking state [ 444.115975][ T6297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 444.199650][ T6297] bridge0: port 2(bridge_slave_1) entered blocking state [ 444.207727][ T6297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 444.365095][T17965] C: renamed from veth1_to_team (while UP) [ 444.586253][T17975] netlink: 'syz.0.3131': attribute type 1 has an invalid length. [ 444.611020][T17978] netlink: 'syz.3.3132': attribute type 12 has an invalid length. [ 444.841696][T17987] net_ratelimit: 10 callbacks suppressed [ 444.841713][T17987] netlink: del zone limit has 4 unknown bytes [ 444.988522][T17992] tipc: Started in network mode [ 445.015135][T17992] tipc: Node identity 9676598eebf, cluster identity 4711 [ 445.033160][ T4946] Bluetooth: hci0: command tx timeout [ 445.082832][T17992] tipc: Enabled bearer , priority 0 [ 445.139385][T18002] netlink: 'syz.2.3133': attribute type 1 has an invalid length. [ 445.203165][T17998] syzkaller0: entered promiscuous mode [ 445.214314][T17998] syzkaller0: entered allmulticast mode [ 445.221385][T17998] tipc: Resetting bearer [ 445.276593][T17991] tipc: Resetting bearer [ 445.305689][T18007] sctp: [Deprecated]: syz.1.3139 (pid 18007) Use of struct sctp_assoc_value in delayed_ack socket option. [ 445.305689][T18007] Use struct sctp_sack_info instead [ 449.300945][T17991] tipc: Disabling bearer [ 449.314210][T18002] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 449.346196][ T5814] tipc: Node number set to 2105956750 [ 449.956281][T18050] __nla_validate_parse: 60 callbacks suppressed [ 449.956301][T18050] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3145'. [ 450.069646][T18054] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 450.250343][T18046] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3144'. [ 450.354783][T18046] bridge0: port 4(vlan4) entered disabled state [ 450.517376][T18046] vlan4 (unregistering): left allmulticast mode [ 450.549748][T18046] dummy0 (unregistering): left allmulticast mode [ 450.582555][T18046] vlan4 (unregistering): left promiscuous mode [ 450.598416][T18046] bridge0: port 4(vlan4) entered disabled state [ 450.816667][T17649] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 451.596362][T18101] syzkaller0: entered promiscuous mode [ 451.627548][T18101] syzkaller0: entered allmulticast mode [ 451.648625][T18101] TC_ACT_REPEAT abuse ? [ 451.669168][T18110] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 451.691343][T18111] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3156'. [ 451.821238][T18119] netlink: 'syz.3.3158': attribute type 10 has an invalid length. [ 452.259277][T18136] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3162'. [ 452.435967][ T13] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.460278][ T13] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.482907][ T13] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.501400][ T13] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.525814][ T13] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.545378][ T13] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.570525][T18143] tipc: Bearer : already 2 bearers with priority 10 [ 452.613460][T18143] tipc: Bearer : trying with adjusted priority [ 452.640322][T18143] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 452.695932][ T13] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 452.715000][ T13] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 452.815675][T17649] veth0_vlan: entered promiscuous mode [ 452.882973][T17649] veth1_vlan: entered promiscuous mode [ 452.963910][T18166] netlink: 'syz.3.3167': attribute type 12 has an invalid length. [ 453.038069][T17649] veth0_macvtap: entered promiscuous mode [ 453.061830][T17649] veth1_macvtap: entered promiscuous mode [ 453.107317][T17649] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 453.157007][T17649] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 453.200901][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.225242][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.244616][T18175] macsec0: entered promiscuous mode [ 453.260136][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.292851][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.621214][ T57] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 453.650743][ T57] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 453.724714][T18180] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3170'. [ 453.729507][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 453.736829][T18180] netlink: 'syz.0.3170': attribute type 3 has an invalid length. [ 453.751680][T18180] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3170'. [ 453.757723][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 453.771994][T18164] macsec0: left promiscuous mode [ 454.536818][T18200] netlink: 'syz.4.3179': attribute type 1 has an invalid length. [ 454.583916][T18203] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3177'. [ 454.799800][T16894] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 454.815459][T16894] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 454.825022][T16894] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 454.836060][T16894] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 454.871783][T16894] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 455.131101][T18213] syzkaller0: entered promiscuous mode [ 455.156436][T18213] syzkaller0: entered allmulticast mode [ 455.214959][T18216] syzkaller1: entered promiscuous mode [ 455.231233][T18216] syzkaller1: entered allmulticast mode [ 455.350069][T18216] syzkaller0: entered promiscuous mode [ 455.359586][T18216] syzkaller0: entered allmulticast mode [ 455.514746][T18239] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3186'. [ 455.645997][T18243] netlink: 'syz.0.3187': attribute type 1 has an invalid length. [ 455.674096][T18243] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3187'. [ 455.924871][T18247] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3188'. [ 456.526476][T18264] bond17: invalid ARP target 0.0.0.0 specified for addition [ 456.547491][T18264] bond17: option arp_ip_target: invalid value (0) [ 456.558264][T18264] bond17 (unregistering): Released all slaves [ 456.920250][T18277] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 456.943272][T16894] Bluetooth: hci3: command tx timeout [ 456.947407][T18277] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 456.968889][T18279] netlink: 'syz.1.3196': attribute type 5 has an invalid length. [ 457.018199][T18277] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 457.930537][T18205] bridge0: port 1(bridge_slave_0) entered blocking state [ 457.943990][T18205] bridge0: port 1(bridge_slave_0) entered disabled state [ 457.969227][T18205] bridge_slave_0: entered allmulticast mode [ 458.014050][T18205] bridge_slave_0: entered promiscuous mode [ 458.061194][T18205] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.109352][T18205] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.136018][T18205] bridge_slave_1: entered allmulticast mode [ 458.176598][T18205] bridge_slave_1: entered promiscuous mode [ 458.232718][ T5725] IPVS: starting estimator thread 0... [ 458.322257][T18314] IPVS: using max 28 ests per chain, 67200 per kthread [ 458.427334][T18205] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 458.463477][T18308] syzkaller0: entered promiscuous mode [ 458.489691][T18308] syzkaller0: entered allmulticast mode [ 458.537221][T18205] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 459.022309][T16894] Bluetooth: hci3: command tx timeout [ 459.163079][T18205] team0: Port device team_slave_0 added [ 459.197665][T18205] team0: Port device team_slave_1 added [ 459.423691][T18205] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 459.438701][T18205] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 459.533093][T18205] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 459.549574][T18205] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 459.557644][T18205] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 459.606961][T18205] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 459.928687][T18205] hsr_slave_0: entered promiscuous mode [ 459.947530][T18205] hsr_slave_1: entered promiscuous mode [ 459.958821][T18357] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3219'. [ 459.974323][T18205] debugfs: 'hsr0' already exists in 'hsr' [ 459.987564][T18205] Cannot create hsr debugfs directory [ 460.030027][T18359] A link change request failed with some changes committed already. Interface veth0_vlan may have been left with an inconsistent configuration, please check. [ 460.297293][T18368] netlink: 'syz.0.3223': attribute type 1 has an invalid length. [ 460.391598][T18368] bond1: entered promiscuous mode [ 460.438312][T18368] bond1: entered allmulticast mode [ 460.465752][T18368] 8021q: adding VLAN 0 to HW filter on device bond1 [ 460.686945][T18372] erspan1: entered allmulticast mode [ 461.087364][T18390] netlink: 'syz.0.3227': attribute type 1 has an invalid length. [ 461.103525][T16894] Bluetooth: hci3: command tx timeout [ 461.235061][T18394] 8021q: adding VLAN 0 to HW filter on device bond3 [ 461.271311][T18398] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3227'. [ 461.338775][T18394] bond2: (slave bond3): making interface the new active one [ 461.366076][T18394] bond2: (slave bond3): Enslaving as an active interface with an up link [ 461.426878][T18390] bond2: (slave gretap2): Enslaving as a backup interface with an up link [ 461.445492][T18398] 8021q: adding VLAN 0 to HW filter on device bond2 [ 461.653531][T18411] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3231'. [ 461.948341][T18419] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3234'. [ 462.324081][T18421] A link change request failed with some changes committed already. Interface batadv_slave_1 may have been left with an inconsistent configuration, please check. [ 462.736056][T18427] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.744021][T18427] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.749642][T18436] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3238'. [ 462.998130][T18453] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3239'. [ 463.032961][T18427] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 463.069971][T18427] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 463.076559][T18453] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3239'. [ 463.187439][T16894] Bluetooth: hci3: command tx timeout [ 463.214228][T18453] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3239'. [ 463.396873][ T112] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.423550][ T6298] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.555227][ T6298] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.571009][ T6298] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 463.675679][T18469] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3243'. [ 463.758297][T18466] syzkaller0: entered promiscuous mode [ 463.774502][T18466] syzkaller0: entered allmulticast mode [ 464.031051][T18205] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 464.106055][T18205] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 464.141881][T18205] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 464.164916][T18205] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 464.200340][T18205] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 464.252926][T18205] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 464.303436][T18480] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3246'. [ 464.339107][T18480] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3246'. [ 464.402887][T18205] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 464.449183][T18205] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 464.477591][T18507] netlink: 'syz.1.3251': attribute type 1 has an invalid length. [ 464.503580][T18508] vlan0: entered promiscuous mode [ 464.658281][T18500] bond17: (slave bridge9): making interface the new active one [ 464.668484][T18500] bond17: (slave bridge9): Enslaving as an active interface with an up link [ 464.770351][T18518] vlan2: entered promiscuous mode [ 465.134832][T18205] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.239706][T18205] 8021q: adding VLAN 0 to HW filter on device team0 [ 465.339634][ T6298] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.346836][ T6298] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.360459][T18539] netlink: 'syz.1.3258': attribute type 13 has an invalid length. [ 465.387079][ T199] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.394444][ T199] bridge0: port 2(bridge_slave_1) entered forwarding state [ 465.940264][T18558] netlink: 'syz.1.3265': attribute type 1 has an invalid length. [ 466.205601][T18558] 8021q: adding VLAN 0 to HW filter on device bond18 [ 466.640086][T18588] __nla_validate_parse: 9 callbacks suppressed [ 466.640106][T18588] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3269'. [ 466.831709][T18593] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3270'. [ 466.860154][T18593] netlink: 15 bytes leftover after parsing attributes in process `syz.4.3270'. [ 467.205124][T18601] syzkaller0: entered promiscuous mode [ 467.232827][T18601] syzkaller0: entered allmulticast mode [ 467.276853][T18205] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 467.700418][T18205] veth0_vlan: entered promiscuous mode [ 467.750267][T18205] veth1_vlan: entered promiscuous mode [ 467.880988][T18205] veth0_macvtap: entered promiscuous mode [ 467.889339][T18624] netlink: 'syz.3.3278': attribute type 1 has an invalid length. [ 467.903854][T18626] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3279'. [ 467.938187][T18624] bond15: entered promiscuous mode [ 467.945228][T18624] 8021q: adding VLAN 0 to HW filter on device bond15 [ 467.998219][T18205] veth1_macvtap: entered promiscuous mode [ 468.095304][T18629] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3279'. [ 468.160801][T18635] netlink: 140 bytes leftover after parsing attributes in process `syz.4.3281'. [ 468.207287][T18205] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 468.210791][T18626] netlink: 'syz.0.3279': attribute type 13 has an invalid length. [ 468.229739][T18626] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3279'. [ 468.257593][T18205] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 468.306256][ T6298] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.317235][ T6298] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.340404][ T6298] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.362345][ T6298] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 468.378352][T18626] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3279'. [ 468.852486][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 468.881798][T18661] openvswitch: netlink: IP tunnel dst address not specified [ 468.898292][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 468.991113][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 469.029514][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 469.048846][T18665] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3288'. [ 469.157387][T18665] netlink: 68 bytes leftover after parsing attributes in process `syz.1.3288'. [ 469.361828][T18675] batadv_slave_1: entered promiscuous mode [ 469.384075][T18675] tipc: Started in network mode [ 469.409700][T18675] tipc: Node identity 00000000000000000000000000000001, cluster identity 4711 [ 469.431730][T18675] tipc: Enabled bearer , priority 10 [ 469.449099][T18674] batadv_slave_1: left promiscuous mode [ 469.459372][T18671] syzkaller0: entered promiscuous mode [ 469.497514][T18671] syzkaller0: entered allmulticast mode [ 469.893810][T18689] gtp0: entered promiscuous mode [ 469.916760][T18689] gtp0: entered allmulticast mode [ 469.944072][T18689] team0: Device gtp0 is of different type [ 470.120901][ T4946] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 470.138741][ T4946] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 470.154045][ T4946] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 470.167438][ T4946] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 470.176439][ T4946] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 470.451645][T18708] netlink: 'syz.0.3299': attribute type 10 has an invalid length. [ 470.507333][T18708] bridge0: port 3(netdevsim1) entered blocking state [ 470.552678][T18708] bridge0: port 3(netdevsim1) entered disabled state [ 470.567387][T18708] netdevsim netdevsim0 netdevsim1: entered allmulticast mode [ 470.634228][T18708] netdevsim netdevsim0 netdevsim1: entered promiscuous mode [ 470.675434][ T5814] tipc: Node number set to 1 [ 470.913608][T18723] netlink: 'syz.1.3304': attribute type 11 has an invalid length. [ 471.220108][T18742] netlink: 'syz.2.3309': attribute type 10 has an invalid length. [ 471.246619][T18742] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.254474][T18742] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.383875][T18742] bridge0: port 2(bridge_slave_1) entered blocking state [ 471.391165][T18742] bridge0: port 2(bridge_slave_1) entered forwarding state [ 471.398830][T18742] bridge0: port 1(bridge_slave_0) entered blocking state [ 471.406443][T18742] bridge0: port 1(bridge_slave_0) entered forwarding state [ 471.470163][T18742] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 471.799855][T18760] tipc: Enabling of bearer rejected, failed to enable media [ 472.067679][T16894] Bluetooth: hci0: command tx timeout [ 472.222881][T16894] Bluetooth: hci1: command tx timeout [ 472.343242][T18781] __nla_validate_parse: 9 callbacks suppressed [ 472.343260][T18781] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3320'. [ 472.399466][T18781] unsupported nlmsg_type 40 [ 472.779523][T18797] netlink: 'syz.0.3325': attribute type 1 has an invalid length. [ 472.944862][T18802] 8021q: adding VLAN 0 to HW filter on device bond5 [ 472.956418][T18802] bond4: (slave bond5): making interface the new active one [ 472.966167][T18802] bond4: (slave bond5): Enslaving as an active interface with an up link [ 472.994617][T18800] syzkaller0: entered promiscuous mode [ 473.001168][T18800] syzkaller0: entered allmulticast mode [ 473.114525][T18700] bridge0: port 1(bridge_slave_0) entered blocking state [ 473.134750][T18700] bridge0: port 1(bridge_slave_0) entered disabled state [ 473.149903][T18700] bridge_slave_0: entered allmulticast mode [ 473.173266][T18700] bridge_slave_0: entered promiscuous mode [ 473.198085][T18800] tipc: Started in network mode [ 473.207765][T18800] tipc: Node identity 16d62785623c, cluster identity 4711 [ 473.227578][T18800] tipc: Enabled bearer , priority 0 [ 473.249420][T18700] bridge0: port 2(bridge_slave_1) entered blocking state [ 473.278922][T18700] bridge0: port 2(bridge_slave_1) entered disabled state [ 473.300984][T18700] bridge_slave_1: entered allmulticast mode [ 473.342019][T18700] bridge_slave_1: entered promiscuous mode [ 473.371232][T18798] tipc: Resetting bearer [ 473.450915][T18798] tipc: Disabling bearer [ 473.564137][T18700] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 473.625622][T18700] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 473.755356][T18830] netlink: 'syz.4.3330': attribute type 32 has an invalid length. [ 473.769200][T18829] netlink: 'syz.0.3332': attribute type 12 has an invalid length. [ 473.804274][T18700] team0: Port device team_slave_0 added [ 473.837922][T18700] team0: Port device team_slave_1 added [ 473.951001][T18836] sock: sock_timestamping_bind_phc: sock not bind to device [ 474.115999][T18837] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3332'. [ 474.166370][T18700] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 474.189544][T18700] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 474.228499][T18834] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3332'. [ 474.267003][T18700] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 474.296146][T18841] macsec0: entered promiscuous mode [ 474.302700][ T4946] Bluetooth: hci1: command tx timeout [ 474.336285][T18834] macsec0 (unregistering): left promiscuous mode [ 474.379134][T18700] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 474.389067][T18700] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 474.428624][T18700] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 474.504853][T18849] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3337'. [ 474.572054][T18850] netlink: 'syz.2.3337': attribute type 11 has an invalid length. [ 474.671928][T18858] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3339'. [ 474.811300][T18700] hsr_slave_0: entered promiscuous mode [ 474.837735][T18861] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3339'. [ 474.844361][T18700] hsr_slave_1: entered promiscuous mode [ 474.886176][T18700] debugfs: 'hsr0' already exists in 'hsr' [ 474.899866][T18861] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3339'. [ 474.926515][T18700] Cannot create hsr debugfs directory [ 474.987037][T18858] netlink: 'syz.1.3339': attribute type 1 has an invalid length. [ 475.037755][T18872] RDS: rds_bind could not find a transport for fc01::, load rds_tcp or rds_rdma? [ 475.071997][T18858] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3339'. [ 475.500426][T18886] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3343'. [ 475.686396][T18901] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3346'. [ 475.766838][T18904] netlink: 'syz.0.3347': attribute type 30 has an invalid length. [ 475.808159][T18904] bond6: option arp_missed_max: mode dependency failed, not supported in mode 802.3ad(4) [ 475.820026][T18904] bond6 (unregistering): Released all slaves [ 476.393654][ T4946] Bluetooth: hci1: command 0x040f tx timeout [ 478.477553][T16894] Bluetooth: hci1: command 0x040f tx timeout [ 480.542942][T16894] Bluetooth: hci1: command 0x040f tx timeout [ 480.948635][T18942] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci1/hci1:200/input5 [ 480.957259][T18947] __nla_validate_parse: 3 callbacks suppressed [ 480.957277][T18947] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3358'. [ 481.080198][T18947] syz_tun: entered promiscuous mode [ 481.097662][T18947] macsec1: entered promiscuous mode [ 481.115124][T18947] macsec1: entered allmulticast mode [ 481.874171][T18700] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 481.892777][T18700] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 481.913265][T18700] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 481.929350][T18700] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 481.944154][T18700] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 481.970050][T18700] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 481.976131][T18983] sctp: [Deprecated]: syz.2.3368 (pid 18983) Use of struct sctp_assoc_value in delayed_ack socket option. [ 481.976131][T18983] Use struct sctp_sack_info instead [ 481.991806][T18700] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 482.028797][T18700] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 482.307368][T18700] 8021q: adding VLAN 0 to HW filter on device bond0 [ 482.374521][T18700] 8021q: adding VLAN 0 to HW filter on device team0 [ 482.425309][ T37] bridge0: port 1(bridge_slave_0) entered blocking state [ 482.432574][ T37] bridge0: port 1(bridge_slave_0) entered forwarding state [ 482.515869][T19002] sctp: [Deprecated]: syz.0.3372 (pid 19002) Use of int in max_burst socket option. [ 482.515869][T19002] Use struct sctp_assoc_value instead [ 482.610221][ T6298] bridge0: port 2(bridge_slave_1) entered blocking state [ 482.618311][ T6298] bridge0: port 2(bridge_slave_1) entered forwarding state [ 483.379393][T19035] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3383'. [ 483.393606][T19035] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3383'. [ 484.118508][T19063] syzkaller0: entered promiscuous mode [ 484.139024][T19063] syzkaller0: entered allmulticast mode [ 484.201191][T18700] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 484.287708][T19073] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3390'. [ 484.499158][T18700] veth0_vlan: entered promiscuous mode [ 484.546316][T18700] veth1_vlan: entered promiscuous mode [ 484.675634][T19084] openvswitch: netlink: IP tunnel dst address not specified [ 484.688333][T18700] veth0_macvtap: entered promiscuous mode [ 484.714005][T18700] veth1_macvtap: entered promiscuous mode [ 484.766111][T18700] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 484.856174][T18700] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 484.867524][T19092] netlink: 'syz.1.3393': attribute type 10 has an invalid length. [ 484.881672][T19074] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 484.887693][T19092] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3393'. [ 484.911291][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.942763][ T112] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 484.987328][ T112] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.027824][ T112] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 485.305830][T19103] netlink: 'syz.0.3397': attribute type 10 has an invalid length. [ 485.350977][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 485.378978][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 485.396637][T19109] IPVS: sync thread started: state = BACKUP, mcast_ifn = veth0_to_bond, syncid = 3, id = 0 [ 485.476367][T19108] tunl0: left promiscuous mode [ 485.527582][T19113] xt_hashlimit: size too large, truncated to 1048576 [ 485.580647][T19108] bridge0: left promiscuous mode [ 485.677553][T19108] vlan2: left promiscuous mode [ 485.683961][T19108] geneve1: left promiscuous mode [ 485.692045][T19108] bridge0: port 1(batadv1) entered blocking state [ 485.698887][T19108] bridge0: port 1(batadv1) entered forwarding state [ 485.709135][T19108] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 485.725339][T19108] bridge0: port 2(batadv2) entered blocking state [ 485.732039][T19108] bridge0: port 2(batadv2) entered forwarding state [ 485.741345][T19108] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 485.763806][T19108] 8021q: adding VLAN 0 to HW filter on device bond1 [ 485.788728][T19108] 8021q: adding VLAN 0 to HW filter on device batadv3 [ 485.797569][T19108] bond2: left promiscuous mode [ 485.803738][T19108] 8021q: adding VLAN 0 to HW filter on device bond2 [ 485.818083][T19108] 8021q: adding VLAN 0 to HW filter on device eth0 [ 485.837354][T19108] 8021q: adding VLAN 0 to HW filter on device eth1 [ 485.847700][T19108] 8021q: adding VLAN 0 to HW filter on device eth2 [ 485.858162][T19108] 8021q: adding VLAN 0 to HW filter on device eth3 [ 485.874256][T19108] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 486.146098][ T13] bond1: (slave veth3): link status definitely up, 10000 Mbps full duplex [ 486.236835][ T13] bond1: (slave veth3): making interface the new active one [ 486.245945][ T13] veth3: entered allmulticast mode [ 486.275635][ T13] bond1: active interface up! [ 486.306275][T19138] netlink: 244 bytes leftover after parsing attributes in process `syz.1.3403'. [ 486.307184][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 486.327207][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 487.016331][T19169] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3411'. [ 487.263239][ T5814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.329154][T19175] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3413'. [ 487.426284][ T29] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 487.446896][ T4946] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 487.461348][ T4946] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 487.476585][ T4946] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 487.488048][ T4946] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 487.498252][ T4946] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 487.921815][ T7935] IPVS: starting estimator thread 0... [ 487.949889][T19187] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3415'. [ 488.016968][T19192] xt_hashlimit: size too large, truncated to 1048576 [ 488.042287][T19188] IPVS: using max 31 ests per chain, 74400 per kthread [ 488.068052][ T5644] syz_tun (unregistering): left allmulticast mode [ 488.110063][T19198] netlink: 'syz.3.3417': attribute type 1 has an invalid length. [ 488.117247][T19202] netlink: 'syz.0.3414': attribute type 1 has an invalid length. [ 488.131858][T19202] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3414'. [ 488.160615][T19187] ip6gre1: entered promiscuous mode [ 488.174505][T19187] ip6gre1: entered allmulticast mode [ 488.209021][T19197] bridge_slave_0 (unregistering): left allmulticast mode [ 488.240067][T19197] bridge_slave_0 (unregistering): left promiscuous mode [ 488.281882][T19197] bridge0: port 1(bridge_slave_0) entered disabled state [ 488.357790][T19210] netlink: 304 bytes leftover after parsing attributes in process `syz.2.3418'. [ 488.384899][ T5814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.415304][T19211] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3418'. [ 488.465716][ T7736] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 488.639318][T19216] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3419'. [ 488.769703][T19219] netlink: 'syz.2.3419': attribute type 1 has an invalid length. [ 488.848900][T19194] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 488.909039][T19219] bond1: entered promiscuous mode [ 488.915492][T19219] 8021q: adding VLAN 0 to HW filter on device bond1 [ 489.060452][T19225] netlink: 'syz.4.3421': attribute type 1 has an invalid length. [ 489.121314][T19226] block nbd4: NBD_DISCONNECT [ 489.130863][T19226] block nbd4: Send disconnect failed -32 [ 489.140536][T19219] bond1: (slave bridge1): making interface the new active one [ 489.151461][T19226] block nbd4: shutting down sockets [ 489.161900][T19219] bridge1: entered promiscuous mode [ 489.176403][T19227] netlink: 'syz.0.3420': attribute type 10 has an invalid length. [ 489.200804][T19219] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 489.295363][T19225] 8021q: adding VLAN 0 to HW filter on device bond1 [ 489.338331][ T3302] batadv1: left allmulticast mode [ 489.349157][ T5814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 489.378430][ T3302] batadv1: left promiscuous mode [ 489.394672][ T3302] bridge0: port 4(batadv1) entered disabled state [ 489.436643][ T3302] team0: left allmulticast mode [ 489.454243][ T3302] team_slave_1: left allmulticast mode [ 489.475884][T19233] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3422'. [ 489.478494][ T3302] veth1_to_hsr: left allmulticast mode [ 489.488408][T19233] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3422'. [ 489.503634][ T7736] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 489.526279][ T3302] team0: left promiscuous mode [ 489.531783][ T3302] team_slave_1: left promiscuous mode [ 489.539949][ T3302] veth1_to_hsr: left promiscuous mode [ 489.556227][ T3302] bridge0: port 3(team0) entered disabled state [ 489.570428][ T3302] bridge_slave_1: left allmulticast mode [ 489.577244][ T3302] bridge_slave_1: left promiscuous mode [ 489.585850][ T4946] Bluetooth: hci2: command tx timeout [ 489.600083][ T3302] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.613157][ T3302] bridge_slave_0: left allmulticast mode [ 489.620259][ T3302] bridge_slave_0: left promiscuous mode [ 489.628253][ T3302] bridge0: port 1(bridge_slave_0) entered disabled state [ 490.178551][ T3302] bond4 (unregistering): (slave bridge4): Releasing backup interface [ 490.196034][ T3302] bridge4 (unregistering): left promiscuous mode [ 490.230230][ T3302] bond0 (unregistering): Released all slaves [ 490.250359][ T3302] bond1 (unregistering): Released all slaves [ 490.276098][ T3302] bond2 (unregistering): Released all slaves [ 490.295575][ T3302] bond3 (unregistering): Released all slaves [ 490.302554][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.336719][ T3302] bond4 (unregistering): Released all slaves [ 490.364338][ T3302] bond5 (unregistering): Released all slaves [ 490.391460][ T3302] bond6 (unregistering): (slave veth0_to_bond): Releasing active interface [ 490.410392][ T3302] bond6 (unregistering): Released all slaves [ 490.432812][ T3302] bond7 (unregistering): Released all slaves [ 490.457913][T19227] team_slave_0: left promiscuous mode [ 490.471602][T19227] team0 (unregistering): Port device team_slave_0 removed [ 490.484578][T19227] team_slave_1: left promiscuous mode [ 490.496341][T19227] team0 (unregistering): Port device team_slave_1 removed [ 490.558085][T19233] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 490.571773][ T7736] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.600393][ T3302] hmó3)ó€: left promiscuous mode [ 490.648634][ T6298] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.670871][ T7736] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.702204][ T5814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.727190][ T5725] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.758071][ T5814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.766691][ T5814] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.786699][ T5725] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.823917][ T5725] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 490.914533][ T30] audit: type=1800 audit(1781413023.363:39): pid=19265 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3428" name="memory.events" dev="tmpfs" ino=345 res=0 errno=0 [ 491.070420][T19257] pim6reg: entered allmulticast mode [ 491.171106][ T3302] tipc: Disabling bearer [ 491.190579][ T3302] tipc: Disabling bearer [ 491.217656][ T3302] tipc: Disabling bearer [ 491.259312][ T3302] tipc: Left network mode [ 491.400935][T19280] __nla_validate_parse: 1 callbacks suppressed [ 491.400970][T19280] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3432'. [ 491.513625][T19281] tunl0: entered allmulticast mode [ 491.554649][T19284] netlink: 'syz.3.3433': attribute type 1 has an invalid length. [ 491.621599][T19284] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 491.663381][ T4946] Bluetooth: hci2: command tx timeout [ 493.742402][ T4946] Bluetooth: hci2: command tx timeout [ 495.430471][ T5725] net_ratelimit: 7 callbacks suppressed [ 495.430493][ T5725] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.744651][ T5831] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.769838][ T7736] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 495.822712][ T4946] Bluetooth: hci2: command tx timeout [ 495.932960][T19296] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 496.337191][T19316] netlink: 'syz.2.3438': attribute type 1 has an invalid length. [ 496.388366][T19313] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3438'. [ 496.734914][T19341] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3446'. [ 496.782803][ T5831] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 496.879294][T19348] netlink: 324 bytes leftover after parsing attributes in process `syz.0.3448'. [ 496.949272][T19178] bridge0: port 1(bridge_slave_0) entered blocking state [ 496.967315][T19178] bridge0: port 1(bridge_slave_0) entered disabled state [ 496.984922][T19178] bridge_slave_0: entered allmulticast mode [ 497.006191][T19178] bridge_slave_0: entered promiscuous mode [ 497.030180][T19356] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3448'. [ 497.121458][T19345] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3447'. [ 497.220318][T19178] bridge0: port 2(bridge_slave_1) entered blocking state [ 497.228075][T19178] bridge0: port 2(bridge_slave_1) entered disabled state [ 497.238231][T19178] bridge_slave_1: entered allmulticast mode [ 497.249343][T19178] bridge_slave_1: entered promiscuous mode [ 497.257343][T19358] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3449'. [ 497.413169][T19178] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 497.458569][T19178] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 497.543874][T19364] bond7: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 497.557386][T19364] bond7 (unregistering): Released all slaves [ 497.650023][T19372] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3452'. [ 497.669272][T19372] Bluetooth: MGMT ver 1.23 [ 497.765496][T19178] team0: Port device team_slave_0 added [ 497.783374][T19178] team0: Port device team_slave_1 added [ 497.826409][ T5831] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 498.015880][T19385] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3457'. [ 498.025632][T19386] netlink: 'syz.3.3456': attribute type 10 has an invalid length. [ 498.038107][T19386] netlink: 40 bytes leftover after parsing attributes in process `syz.3.3456'. [ 498.136792][T19391] netlink: 'syz.2.3457': attribute type 39 has an invalid length. [ 498.188512][T19383] bridge0: port 2(bridge_slave_1) entered disabled state [ 498.196358][T19383] bridge0: port 1(bridge_slave_0) entered disabled state [ 498.332911][T19383] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 498.350048][T19383] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 498.467508][T19178] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 498.496364][T19178] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 498.524437][T19178] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 498.536153][T19386] team0: entered promiscuous mode [ 498.543331][T19386] team_slave_0: entered promiscuous mode [ 498.549207][T19386] team_slave_1: entered promiscuous mode [ 498.556038][T19386] team0: entered allmulticast mode [ 498.561229][T19386] team_slave_0: entered allmulticast mode [ 498.567496][T19386] team_slave_1: entered allmulticast mode [ 498.574314][T19386] 8021q: adding VLAN 0 to HW filter on device team0 [ 498.581856][T19386] bridge0: port 3(team0) entered blocking state [ 498.588899][T19386] bridge0: port 3(team0) entered disabled state [ 498.656995][ T199] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.668900][ T199] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.738814][T19178] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 498.747386][T19178] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 498.767065][T19400] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3460'. [ 498.780209][T19178] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 498.810547][ T199] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.821074][ T199] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 498.935293][ T3302] hsr_slave_0: left promiscuous mode [ 498.944949][ T3302] hsr_slave_1: left promiscuous mode [ 498.960687][ T3302] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 498.968575][ T3302] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 498.979702][ T3302] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 498.990034][ T3302] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 499.022440][ T3302] dummy0: left allmulticast mode [ 499.745030][ T3302] team0 (unregistering): Port device veth1_to_hsr removed [ 499.875281][ T3302] team0 (unregistering): Port device team_slave_1 removed [ 500.281653][T19443] openvswitch: netlink: Missing valid actions attribute. [ 500.290731][T19443] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 500.337517][T19443] lo speed is unknown, defaulting to 1000 [ 500.363298][T19178] hsr_slave_0: entered promiscuous mode [ 500.388643][T19178] hsr_slave_1: entered promiscuous mode [ 500.410571][T19448] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3471'. [ 500.421792][T19178] debugfs: 'hsr0' already exists in 'hsr' [ 500.446607][T19178] Cannot create hsr debugfs directory [ 500.896164][T19443] lo speed is unknown, defaulting to 1000 [ 501.029799][T19443] lo speed is unknown, defaulting to 1000 [ 501.197674][ T3302] IPVS: stop unused estimator thread 0... [ 501.401062][T19486] netlink: 'syz.0.3478': attribute type 10 has an invalid length. [ 501.863387][T19178] netdevsim netdevsim1 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 501.910622][T19178] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 501.938224][T19443] infiniband syz0: set active [ 501.955473][T19443] infiniband syz0: added lo [ 502.035318][ T5831] lo speed is unknown, defaulting to 1000 [ 502.066126][T19443] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 502.080250][T19443] infiniband syz0: Couldn't open port 1 [ 502.095822][T19443] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 502.111200][T19443] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 502.152306][T19443] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 502.305506][T19178] netdevsim netdevsim1 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 502.325105][T19537] __nla_validate_parse: 2 callbacks suppressed [ 502.325124][T19537] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3486'. [ 502.348929][T19178] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.427808][T19541] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3487'. [ 502.498012][T19443] RDS/IB: syz0: added [ 502.532293][T19443] smc: adding ib device syz0 with port count 1 [ 502.539361][T19443] smc: ib device syz0 port 1 has no pnetid [ 502.561091][T19178] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 502.586719][T19178] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.639191][T19550] vlan0: left promiscuous mode [ 502.661228][ T7736] lo speed is unknown, defaulting to 1000 [ 502.723061][T19556] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3490'. [ 502.776471][T19178] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 502.813512][T19178] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 502.893561][T19443] lo speed is unknown, defaulting to 1000 [ 503.175559][T19575] netlink: 260 bytes leftover after parsing attributes in process `syz.2.3493'. [ 503.669515][T19178] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 503.691423][T19178] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 503.715612][T19178] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 503.760016][T19178] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 503.783657][T19178] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 503.809981][T19178] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 503.826280][T19553] lo speed is unknown, defaulting to 1000 [ 503.837621][T19178] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 503.878480][T19178] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 504.176459][T19178] 8021q: adding VLAN 0 to HW filter on device bond0 [ 504.211857][T19620] tipc: Enabling of bearer rejected, failed to enable media [ 504.243681][T19620] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3500'. [ 504.247162][T19178] 8021q: adding VLAN 0 to HW filter on device team0 [ 504.305552][T19622] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3500'. [ 504.344601][T19443] lo speed is unknown, defaulting to 1000 [ 504.379831][ T8444] bridge0: port 1(bridge_slave_0) entered blocking state [ 504.387126][ T8444] bridge0: port 1(bridge_slave_0) entered forwarding state [ 504.491217][ T8444] bridge0: port 2(bridge_slave_1) entered blocking state [ 504.498441][ T8444] bridge0: port 2(bridge_slave_1) entered forwarding state [ 504.628295][T19616] netlink: 27 bytes leftover after parsing attributes in process `syz.2.3499'. [ 504.954247][T19443] lo speed is unknown, defaulting to 1000 [ 504.990620][T19639] bridge1: entered promiscuous mode [ 505.000512][T19639] bridge1: entered allmulticast mode [ 505.548688][T19443] lo speed is unknown, defaulting to 1000 [ 505.652505][T19178] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 505.792073][T19178] veth0_vlan: entered promiscuous mode [ 505.844434][T19178] veth1_vlan: entered promiscuous mode [ 505.918522][T19178] veth0_macvtap: entered promiscuous mode [ 505.944323][T19178] veth1_macvtap: entered promiscuous mode [ 505.958012][T19682] IPVS: set_ctl: invalid protocol: 43 172.20.20.187:20001 [ 505.986480][T19681] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3509'. [ 506.013424][T19178] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 506.044847][T19178] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 506.070540][T19443] lo speed is unknown, defaulting to 1000 [ 506.090423][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 506.115793][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 506.155619][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 506.170712][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 506.468799][ T3302] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 506.486326][ T3302] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 506.563796][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 506.572799][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 506.608395][T19697] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3512'. [ 506.639237][T19699] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3513'. [ 506.639505][T19443] lo speed is unknown, defaulting to 1000 [ 507.058643][T19443] lo speed is unknown, defaulting to 1000 [ 507.503383][T19443] lo speed is unknown, defaulting to 1000 [ 507.546945][T19738] netlink: 'syz.0.3521': attribute type 1 has an invalid length. [ 507.656864][T19738] 8021q: adding VLAN 0 to HW filter on device bond7 [ 507.689305][T19739] veth3: entered allmulticast mode [ 507.714240][T19739] bond7: (slave veth3): Enslaving as an active interface with an up link [ 507.756551][T19740] bond7 (unregistering): (slave veth3): Releasing backup interface [ 507.778234][T19740] bond7 (unregistering): Released all slaves [ 508.148427][T19755] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 508.181915][T19757] __nla_validate_parse: 2 callbacks suppressed [ 508.181937][T19757] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3525'. [ 508.411716][T19766] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input6 [ 508.444767][T19763] syzkaller0: entered promiscuous mode [ 508.457635][T19763] syzkaller0: entered allmulticast mode [ 508.969534][T19800] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.990439][T19800] bridge_slave_0 (unregistering): left allmulticast mode [ 509.006721][T19800] bridge_slave_0 (unregistering): left promiscuous mode [ 509.019554][T19800] bridge0: port 1(bridge_slave_0) entered disabled state [ 509.069676][T19803] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3539'. [ 509.118971][T19803] ipvlan2: entered allmulticast mode [ 509.129790][T19803] gretap0: entered allmulticast mode [ 509.514694][T19825] syzkaller0: entered promiscuous mode [ 509.531278][T19825] syzkaller0: entered allmulticast mode [ 509.608162][T19835] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 509.609102][T19829] netlink: 'syz.1.3548': attribute type 10 has an invalid length. [ 509.615478][T19835] IPv6: NLM_F_CREATE should be set when creating new route [ 509.615597][T19835] IPv6: NLM_F_CREATE should be set when creating new route [ 509.663354][T19829] netlink: 228 bytes leftover after parsing attributes in process `syz.1.3548'. [ 509.881560][T19851] bridge0: port 1(team0) entered blocking state [ 509.896357][T19851] bridge0: port 1(team0) entered disabled state [ 509.917600][T19851] team0: entered allmulticast mode [ 509.935081][T19851] team_slave_0: entered allmulticast mode [ 509.952584][T19851] team_slave_1: entered allmulticast mode [ 509.976727][T19851] team0: entered promiscuous mode [ 509.992525][T19851] team_slave_0: entered promiscuous mode [ 510.012783][T19851] team_slave_1: entered promiscuous mode [ 510.028087][T19851] bridge0: port 1(team0) entered blocking state [ 510.034894][T19851] bridge0: port 1(team0) entered forwarding state [ 510.166408][T19870] tipc: Enabling of bearer rejected, failed to enable media [ 510.340101][T19879] syzkaller0: entered promiscuous mode [ 510.364054][T19879] syzkaller0: entered allmulticast mode [ 510.410887][T19882] netlink: 96 bytes leftover after parsing attributes in process `syz.0.3559'. [ 510.459546][T19887] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3562'. [ 510.794293][T19896] nbd: nbd2 already in use [ 510.825169][T19896] netlink: 'syz.2.3565': attribute type 27 has an invalid length. [ 510.911698][T19906] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3568'. [ 510.955951][T19904] netdevsim netdevsim4: Direct firmware load for ./file0 failed with error -2 [ 510.975974][T19904] netdevsim netdevsim4: Falling back to sysfs fallback for: ./file0 [ 511.060692][T19915] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3573'. [ 511.090821][T19920] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3572'. [ 511.108770][T19912] tap0: tun_chr_ioctl cmd 2148553947 [ 511.154064][T19918] bond1: option packets_per_slave: invalid value (1048582) [ 511.162558][T19918] bond1: option packets_per_slave: allowed values 0 - 65535 [ 511.171736][T19918] bond1 (unregistering): Released all slaves [ 511.205738][T19920] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 511.313813][T19931] netlink: 'syz.0.3576': attribute type 1 has an invalid length. [ 511.321725][T19931] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3576'. [ 511.413832][T19933] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3577'. [ 511.531574][T19937] lo speed is unknown, defaulting to 1000 [ 511.605000][T19942] syzkaller1: entered promiscuous mode [ 511.610851][T19942] syzkaller1: entered allmulticast mode [ 511.855722][T19951] bridge0: port 2(bridge_slave_1) entered disabled state [ 511.865650][T19951] bridge0: port 1(bridge_slave_0) entered disabled state [ 512.015864][T19959] netlink: 'syz.4.3586': attribute type 1 has an invalid length. [ 512.108078][T19959] 8021q: adding VLAN 0 to HW filter on device bond2 [ 512.165503][T19967] 8021q: adding VLAN 0 to HW filter on device bond2 [ 512.176964][T19967] bond2: (slave gre3): The slave device specified does not support setting the MAC address [ 512.204086][T19967] bond2: (slave gre3): Error -95 calling set_mac_address [ 512.327535][T19959] gretap1: entered promiscuous mode [ 512.747261][T19984] lo speed is unknown, defaulting to 1000 [ 513.384490][T20033] __nla_validate_parse: 9 callbacks suppressed [ 513.384507][T20033] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3604'. [ 513.430134][T20012] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3597'. [ 513.438860][T20033] macsec1: entered promiscuous mode [ 513.444780][T20033] dummy0: entered promiscuous mode [ 513.450638][T20033] macsec1: entered allmulticast mode [ 513.459108][T20033] dummy0: entered allmulticast mode [ 513.469017][T20038] netlink: 'syz.3.3602': attribute type 1 has an invalid length. [ 513.580019][T20041] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3605'. [ 513.626431][T20038] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 513.668631][T20041] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3605'. [ 514.202678][T20066] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input7 [ 514.472091][T20079] IPVS: set_ctl: invalid protocol: 8 0.0.0.0:20003 [ 514.496597][T20077] IPVS: set_ctl: invalid protocol: 8 0.0.0.0:20003 [ 514.935881][T20097] netlink: 'syz.4.3620': attribute type 12 has an invalid length. [ 515.002939][T20097] sch_tbf: burst 19872 is lower than device lo mtu (32783) ! [ 515.097150][T20112] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3624'. [ 515.169204][T20116] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3623'. [ 515.189849][T20116] nbd: must specify a size in bytes for the device [ 515.629763][T20127] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3629'. [ 515.652354][T20127] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3629'. [ 515.817579][T20137] can: request_module (can-proto-0) failed. [ 516.113567][T20165] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3639'. [ 516.470840][T20171] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3640'. [ 516.497483][T20171] netlink: 'syz.0.3640': attribute type 1 has an invalid length. [ 516.744432][T20136] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 517.283279][T20201] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 517.494470][T20205] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 517.621339][T20205] bond1: (slave lo): Enslaving as an active interface with an up link [ 517.663169][T20205] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 517.734175][T20225] sctp: [Deprecated]: syz.1.3653 (pid 20225) Use of struct sctp_assoc_value in delayed_ack socket option. [ 517.734175][T20225] Use struct sctp_sack_info instead [ 518.529715][T20252] __nla_validate_parse: 7 callbacks suppressed [ 518.529735][T20252] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3660'. [ 518.796207][T20277] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3667'. [ 519.671080][T20326] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.712587][T20326] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.749224][T20326] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.808149][T20326] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.840323][T20326] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 520.075515][T20340] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3687'. [ 520.111048][T20343] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3688'. [ 520.134258][T20340] ipvlan2: entered allmulticast mode [ 520.156630][T20340] gretap0: entered allmulticast mode [ 520.352649][T20355] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3691'. [ 520.375530][T20355] netlink: 9 bytes leftover after parsing attributes in process `syz.0.3691'. [ 520.385274][T20355] 0·: renamed from hsr0 [ 520.397392][T20355] 0·: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 520.423851][T20355] 0·: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 520.450961][T20355] 0·: entered allmulticast mode [ 520.470405][T20355] hsr_slave_0: entered allmulticast mode [ 520.511626][T20355] hsr_slave_1: entered allmulticast mode [ 520.540791][T20355] A link change request failed with some changes committed already. Interface c0· may have been left with an inconsistent configuration, please check. [ 520.567533][T20357] tipc: Enabled bearer , priority 10 [ 521.438053][T20404] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3707'. [ 521.527748][T20405] macsec1: entered promiscuous mode [ 521.722574][ T7736] tipc: Node number set to 1961502597 [ 522.219588][T20436] netlink: 'syz.0.3715': attribute type 11 has an invalid length. [ 522.268016][T20436] netlink: 60 bytes leftover after parsing attributes in process `syz.0.3715'. [ 522.365693][T20445] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3719'. [ 522.411545][T20436] 8021q: adding VLAN 0 to HW filter on device bond0 [ 522.461842][T20436] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 522.630070][T20436] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 522.684720][T20436] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 522.753904][T20436] veth1_vlan: left promiscuous mode [ 522.773783][T20436] veth0_vlan: left promiscuous mode [ 522.785542][T20436] veth0_vlan: entered promiscuous mode [ 522.807526][T20436] veth1_vlan: entered promiscuous mode [ 522.845623][T20436] veth0_macvtap: left promiscuous mode [ 522.856269][T20436] veth0_macvtap: entered promiscuous mode [ 522.897615][T20436] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 522.916295][T20436] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 522.935764][T20436] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 522.954937][T20436] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 523.003180][T20436] 8021q: adding VLAN 0 to HW filter on device bond1 [ 523.034859][T20436] 8021q: adding VLAN 0 to HW filter on device bond2 [ 523.059476][T20436] 8021q: adding VLAN 0 to HW filter on device bond3 [ 523.095585][T20436] 8021q: adding VLAN 0 to HW filter on device bond4 [ 523.115433][T20436] 8021q: adding VLAN 0 to HW filter on device bond5 [ 523.143056][T20436] 8021q: adding VLAN 0 to HW filter on device bond6 [ 523.160293][T20436] 8021q: adding VLAN 0 to HW filter on device bond7 [ 523.206343][ T199] bridge0: port 2(bridge_slave_1) entered blocking state [ 523.213613][ T199] bridge0: port 2(bridge_slave_1) entered forwarding state [ 523.360939][T20455] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3720'. [ 523.378594][ T37] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 523.406169][ T37] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 523.518060][ T37] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 523.686152][ T37] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 523.729653][T20484] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3726'. [ 523.836600][T20484] ip6gre1: entered promiscuous mode [ 523.846332][T20484] ip6gre1: entered allmulticast mode [ 524.008095][T20497] netlink: 'syz.0.3731': attribute type 3 has an invalid length. [ 524.034851][T20497] netlink: 'syz.0.3731': attribute type 16 has an invalid length. [ 524.056863][T20497] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3731'. [ 524.108413][T20497] netlink: 148 bytes leftover after parsing attributes in process `syz.0.3731'. [ 524.683968][T20513] lo speed is unknown, defaulting to 1000 [ 525.323060][T20541] hsr0: entered promiscuous mode [ 525.374744][T20541] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3743'. [ 526.669080][T20581] lo: entered allmulticast mode [ 526.913449][T20587] syzkaller0: entered promiscuous mode [ 526.936268][T20587] syzkaller0: entered allmulticast mode [ 526.942591][T20590] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3760'. [ 527.215031][T20598] lo speed is unknown, defaulting to 1000 [ 527.563914][T20606] RDS: rds_bind could not find a transport for 0:0:20::, load rds_tcp or rds_rdma? [ 527.840976][T20613] IPVS: set_ctl: invalid protocol: 24 3.0.0.0:0 [ 527.877349][T20612] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3764'. [ 527.916569][T20613] IPVS: set_ctl: invalid protocol: 0 48.0.0.0:0 [ 527.935240][T20584] IPVS: set_ctl: invalid protocol: 0 48.0.0.0:0 [ 528.628103][T20642] netlink: 200 bytes leftover after parsing attributes in process `syz.1.3769'. [ 529.050355][T20649] netlink: 'syz.3.3770': attribute type 11 has an invalid length. [ 529.094534][T20649] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3770'. [ 529.141701][T20649] x_tables: duplicate underflow at hook 3 [ 529.503907][T20668] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3773'. [ 529.535090][T20666] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3774'. [ 530.097156][T20689] bond2: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 530.172022][T20689] bond2 (unregistering): Released all slaves [ 530.275248][T20705] netlink: 240 bytes leftover after parsing attributes in process `syz.3.3783'. [ 530.306478][T20705] netlink: 'syz.3.3783': attribute type 9 has an invalid length. [ 530.326188][T20696] ip6gretap0: entered promiscuous mode [ 530.508210][ T30] audit: type=1800 audit(1781413062.953:40): pid=20718 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3785" name="memory.events" dev="tmpfs" ino=951 res=0 errno=0 [ 530.511813][T20700] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3781'. [ 530.606846][T20700] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3781'. [ 530.692067][T20725] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3788'. [ 530.830664][T20721] xt_CT: No such helper "snmp_trap" [ 530.893276][T20733] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 530.902689][T20731] syzkaller0: entered promiscuous mode [ 530.921519][T20731] syzkaller0: entered allmulticast mode [ 530.968561][T20737] netlink: 'syz.2.3791': attribute type 7 has an invalid length. [ 530.988770][T20737] netlink: 'syz.2.3791': attribute type 8 has an invalid length. [ 531.041485][T20739] xt_policy: too many policy elements [ 531.463609][ T37] nci: nci_rsp_packet: unknown rsp opcode 0x606 [ 532.189256][T20755] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 532.238049][T20773] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 532.574988][T20802] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3809'. [ 532.596708][T20804] tipc: Can't bind to reserved service type 2 [ 532.605491][T20802] ip6erspan0: entered allmulticast mode [ 533.054721][T20834] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3821'. [ 533.067887][T20836] netlink: 212344 bytes leftover after parsing attributes in process `syz.3.3820'. [ 533.323405][T20852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.335765][T20848] netlink: 'syz.0.3826': attribute type 3 has an invalid length. [ 533.352519][T20848] netlink: 'syz.0.3826': attribute type 1 has an invalid length. [ 533.378135][T20852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.387606][T20850] netlink: 'syz.0.3826': attribute type 3 has an invalid length. [ 533.395670][ T5725] IPVS: starting estimator thread 0... [ 533.402787][T20852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.413549][T20850] netlink: 'syz.0.3826': attribute type 1 has an invalid length. [ 533.451855][T20852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.488625][T20852] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 533.506047][T20858] IPVS: using max 27 ests per chain, 64800 per kthread [ 533.682891][T20869] A link change request failed with some changes committed already. Interface gre2 may have been left with an inconsistent configuration, please check. [ 533.931522][T20879] netlink: 'syz.0.3834': attribute type 4 has an invalid length. [ 533.994423][T20879] netlink: 'syz.0.3834': attribute type 4 has an invalid length. [ 534.303171][T16894] Bluetooth: hci5: command 0x0406 tx timeout [ 534.428093][T20897] __nla_validate_parse: 4 callbacks suppressed [ 534.428112][T20897] netlink: 332 bytes leftover after parsing attributes in process `syz.1.3840'. [ 534.445311][T20897] netlink: 'syz.1.3840': attribute type 9 has an invalid length. [ 534.453544][T20897] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3840'. [ 534.462932][T20897] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3840'. [ 534.629601][T20873] Bluetooth: hci2: Opcode 0x0401 failed: -4 [ 534.820205][T20878] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 534.858059][T20878] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 535.137549][T20878] dummy0: left allmulticast mode [ 535.178579][ T37] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.216256][ T37] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.257472][ T37] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.352890][ T37] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.392395][T20905] netlink: 600 bytes leftover after parsing attributes in process `syz.3.3842'. [ 535.437324][T20905] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3842'. [ 535.521955][T20921] netlink: 'syz.2.3848': attribute type 5 has an invalid length. [ 535.540280][T20922] syz_tun: entered allmulticast mode [ 535.609561][T20922] bond0: entered promiscuous mode [ 535.625318][T20922] bond_slave_0: entered promiscuous mode [ 535.643063][T20922] bond_slave_1: entered promiscuous mode [ 535.839710][T20948] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3854'. [ 535.904718][ T4946] Bluetooth: hci2: command 0x0405 tx timeout [ 536.337822][T20975] wg0: entered promiscuous mode [ 536.357686][T20975] wg0: entered allmulticast mode [ 536.365582][T20975] team0: Device wg0 is of different type [ 536.376713][T20975] A link change request failed with some changes committed already. Interface wg0 may have been left with an inconsistent configuration, please check. [ 536.693511][T20995] mac80211_hwsim hwsim47 wlan0: entered promiscuous mode [ 536.701026][T20995] mac80211_hwsim hwsim47 wlan0: entered allmulticast mode [ 537.016458][T21011] syzkaller0: entered promiscuous mode [ 537.034156][T21011] syzkaller0: entered allmulticast mode [ 537.063087][T21006] nbd1: detected capacity change from 0 to 63 [ 537.075293][T21019] block nbd1: NBD_DISCONNECT [ 537.090604][T21019] block nbd1: Disconnected due to user request. [ 537.131836][T21019] block nbd1: shutting down sockets [ 537.158142][T21011] netlink: 'syz.0.3872': attribute type 11 has an invalid length. [ 537.166075][ C0] blk_print_req_error: 138 callbacks suppressed [ 537.166098][ C0] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 537.166140][ C0] buffer_io_error: 138 callbacks suppressed [ 537.166152][ C0] Buffer I/O error on dev nbd1, logical block 0, async page read [ 537.166351][ C0] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 537.166375][ C0] Buffer I/O error on dev nbd1, logical block 1, async page read [ 537.166454][ C0] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 537.166477][ C0] Buffer I/O error on dev nbd1, logical block 2, async page read [ 537.166556][ C0] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 537.166576][ C0] Buffer I/O error on dev nbd1, logical block 3, async page read [ 537.197673][T19692] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 537.268040][T19692] Buffer I/O error on dev nbd1, logical block 0, async page read [ 537.293216][T19692] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 537.307112][T19692] Buffer I/O error on dev nbd1, logical block 1, async page read [ 537.328570][T19692] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 537.341204][T19692] Buffer I/O error on dev nbd1, logical block 2, async page read [ 537.356720][T19692] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 537.366931][T19692] Buffer I/O error on dev nbd1, logical block 3, async page read [ 537.380998][T19692] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 537.381925][T21003] mac80211_hwsim hwsim47 wlan0: left promiscuous mode [ 537.398578][T19692] Buffer I/O error on dev nbd1, logical block 0, async page read [ 537.406827][T19692] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 537.416259][T19692] Buffer I/O error on dev nbd1, logical block 1, async page read [ 537.428213][T19692] ldm_validate_partition_table(): Disk read failed. [ 537.445324][T19692] Dev nbd1: unable to read RDB block 0 [ 537.453634][T19692] nbd1: unable to read partition table [ 537.468327][T19692] ldm_validate_partition_table(): Disk read failed. [ 537.477639][T19692] Dev nbd1: unable to read RDB block 0 [ 537.479750][T21032] : entered promiscuous mode [ 537.486672][T19692] nbd1: unable to read partition table [ 537.520919][ T12] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 537.996116][T21059] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3884'. [ 538.047488][T21056] syzkaller0: entered promiscuous mode [ 538.075706][T21056] syzkaller0: entered allmulticast mode [ 538.263846][T21083] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3889'. [ 539.076300][T21111] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3891'. [ 539.181681][T21115] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20000 [ 540.973388][T21111] ip6gre1: entered promiscuous mode [ 540.979334][T21111] ip6gre1: entered allmulticast mode [ 541.189440][T21086] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 541.342306][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 541.569327][T21144] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3898'. [ 541.692954][ T30] audit: type=1800 audit(1781413074.143:41): pid=21153 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3900" name="memory.events" dev="tmpfs" ino=464 res=0 errno=0 [ 542.073261][ T30] audit: type=1800 audit(1781413074.513:42): pid=21175 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3906" name="memory.events" dev="tmpfs" ino=733 res=0 errno=0 [ 542.521527][T21147] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.213090][T21147] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.236769][T21193] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 543.237354][T21192] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.254056][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 543.328194][T21192] netlink: 324 bytes leftover after parsing attributes in process `syz.3.3910'. [ 543.425433][T21197] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3914'. [ 543.446597][T21147] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.468417][T21205] netlink: 27 bytes leftover after parsing attributes in process `syz.2.3912'. [ 543.506309][T21197] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 543.520118][T21197] netdevsim netdevsim4 netdevsim0: left promiscuous mode [ 543.628511][T21147] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 543.807627][T21213] netlink: 'syz.2.3918': attribute type 4 has an invalid length. [ 543.930067][ T8444] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.022520][T21227] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 544.037561][ T8444] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.080516][ T8444] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.168145][ T13] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 544.288267][T21237] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3925'. [ 544.318260][T21237] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3925'. [ 544.360362][T21237] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3925'. [ 544.557329][T21257] netlink: 296 bytes leftover after parsing attributes in process `syz.4.3930'. [ 544.611617][T21257] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3930'. [ 544.630681][T21261] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3931'. [ 544.723849][T21265] tipc: Enabled bearer , priority 10 [ 544.934487][T21278] FAULT_INJECTION: forcing a failure. [ 544.934487][T21278] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 544.981178][ T30] audit: type=1800 audit(1781413077.423:43): pid=21280 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3936" name="memory.events" dev="tmpfs" ino=1084 res=0 errno=0 [ 544.984178][T21278] CPU: 1 UID: 0 PID: 21278 Comm: syz.2.3937 Not tainted syzkaller #0 PREEMPT(full) [ 544.984204][T21278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 544.984215][T21278] Call Trace: [ 544.984222][T21278] [ 544.984229][T21278] dump_stack_lvl+0xe8/0x150 [ 544.984256][T21278] should_fail_ex+0x40c/0x560 [ 544.984288][T21278] _copy_to_user+0x31/0xb0 [ 544.984310][T21278] bpf_test_finish+0x1db/0x6b0 [ 544.984357][T21278] ? __pfx____migrate_enable+0x10/0x10 [ 544.984380][T21278] ? __pfx_bpf_test_finish+0x10/0x10 [ 544.984412][T21278] bpf_prog_test_run_sk_lookup+0x94f/0xbb0 [ 544.984454][T21278] ? __pfx_bpf_prog_test_run_sk_lookup+0x10/0x10 [ 544.984477][T21278] ? __fget_files+0x3a2/0x420 [ 544.984497][T21278] ? __fget_files+0x2a/0x420 [ 544.984528][T21278] ? __pfx_bpf_prog_test_run_sk_lookup+0x10/0x10 [ 544.984549][T21278] bpf_prog_test_run+0x2c5/0x340 [ 544.984570][T21278] __sys_bpf+0x643/0x950 [ 544.984597][T21278] ? __pfx___sys_bpf+0x10/0x10 [ 544.984636][T21278] ? ksys_write+0x242/0x270 [ 544.984662][T21278] ? __pfx_ksys_write+0x10/0x10 [ 544.984689][T21278] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.984708][T21278] __x64_sys_bpf+0x7c/0x90 [ 544.984730][T21278] do_syscall_64+0x174/0x580 [ 544.984748][T21278] ? trace_irq_disable+0x3b/0x140 [ 544.984772][T21278] ? clear_bhb_loop+0x40/0x90 [ 544.984794][T21278] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 544.984810][T21278] RIP: 0033:0x7f3e2339ce59 [ 544.984827][T21278] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 544.984842][T21278] RSP: 002b:00007f3e24254028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 544.984861][T21278] RAX: ffffffffffffffda RBX: 00007f3e23615fa0 RCX: 00007f3e2339ce59 [ 544.984874][T21278] RDX: 0000000000000048 RSI: 0000200000000440 RDI: 000000000000000a [ 544.984885][T21278] RBP: 00007f3e24254090 R08: 0000000000000000 R09: 0000000000000000 [ 544.984895][T21278] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 544.984905][T21278] R13: 00007f3e23616038 R14: 00007f3e23615fa0 R15: 00007fff8c8b9718 [ 544.984935][T21278] [ 545.222011][ T30] audit: type=1800 audit(1781413077.543:44): pid=21285 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3937" name="memory.events" dev="tmpfs" ino=771 res=0 errno=0 [ 545.400476][T21293] IPv6: sit1: Disabled Multicast RS [ 546.217246][ T30] audit: type=1800 audit(1781413078.663:45): pid=21347 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3950" name="memory.events" dev="tmpfs" ino=1105 res=0 errno=0 [ 546.344984][T21352] FAULT_INJECTION: forcing a failure. [ 546.344984][T21352] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 546.362896][T21354] x_tables: duplicate underflow at hook 2 [ 546.379890][T21352] CPU: 0 UID: 0 PID: 21352 Comm: syz.2.3953 Not tainted syzkaller #0 PREEMPT(full) [ 546.379916][T21352] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 546.379926][T21352] Call Trace: [ 546.379934][T21352] [ 546.379942][T21352] dump_stack_lvl+0xe8/0x150 [ 546.379968][T21352] should_fail_ex+0x40c/0x560 [ 546.379999][T21352] _copy_to_user+0x31/0xb0 [ 546.380020][T21352] bpf_test_finish+0x22c/0x6b0 [ 546.380047][T21352] ? __pfx____migrate_enable+0x10/0x10 [ 546.380070][T21352] ? __pfx_bpf_test_finish+0x10/0x10 [ 546.380104][T21352] bpf_prog_test_run_sk_lookup+0x94f/0xbb0 [ 546.380146][T21352] ? __pfx_bpf_prog_test_run_sk_lookup+0x10/0x10 [ 546.380170][T21352] ? __fget_files+0x3a2/0x420 [ 546.380192][T21352] ? __fget_files+0x2a/0x420 [ 546.380217][T21352] ? __pfx_bpf_prog_test_run_sk_lookup+0x10/0x10 [ 546.380239][T21352] bpf_prog_test_run+0x2c5/0x340 [ 546.380261][T21352] __sys_bpf+0x643/0x950 [ 546.380290][T21352] ? __pfx___sys_bpf+0x10/0x10 [ 546.380331][T21352] ? ksys_write+0x242/0x270 [ 546.380359][T21352] ? __pfx_ksys_write+0x10/0x10 [ 546.380388][T21352] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.380407][T21352] __x64_sys_bpf+0x7c/0x90 [ 546.380431][T21352] do_syscall_64+0x174/0x580 [ 546.380451][T21352] ? trace_irq_disable+0x3b/0x140 [ 546.380476][T21352] ? clear_bhb_loop+0x40/0x90 [ 546.380498][T21352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 546.380515][T21352] RIP: 0033:0x7f3e2339ce59 [ 546.380533][T21352] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 546.380549][T21352] RSP: 002b:00007f3e24254028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 546.380590][T21352] RAX: ffffffffffffffda RBX: 00007f3e23615fa0 RCX: 00007f3e2339ce59 [ 546.380604][T21352] RDX: 0000000000000048 RSI: 0000200000000440 RDI: 000000000000000a [ 546.380616][T21352] RBP: 00007f3e24254090 R08: 0000000000000000 R09: 0000000000000000 [ 546.380627][T21352] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 546.380638][T21352] R13: 00007f3e23616038 R14: 00007f3e23615fa0 R15: 00007fff8c8b9718 [ 546.380669][T21352] [ 546.595767][T21366] __nla_validate_parse: 2 callbacks suppressed [ 546.595786][T21366] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3956'. [ 546.601334][T21354] x_tables: duplicate underflow at hook 2 [ 546.666713][ T30] audit: type=1800 audit(1781413079.043:46): pid=21364 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3953" name="memory.events" dev="tmpfs" ino=797 res=0 errno=0 [ 546.823030][T21372] netlink: 220 bytes leftover after parsing attributes in process `syz.4.3957'. [ 546.844295][T21374] Bluetooth: MGMT ver 1.23 [ 546.849924][T21374] TCP: TCP_TX_DELAY enabled [ 547.132354][T21390] netlink: 'syz.3.3964': attribute type 2 has an invalid length. [ 547.153934][T21382] netlink: 80 bytes leftover after parsing attributes in process `syz.0.3961'. [ 547.216042][T21395] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3961'. [ 547.290549][T21399] netlink: 'syz.4.3965': attribute type 1 has an invalid length. [ 547.324915][T21399] 8021q: adding VLAN 0 to HW filter on device bond4 [ 547.449612][T21406] netlink: 'syz.3.3967': attribute type 1 has an invalid length. [ 547.460314][T21406] netlink: 'syz.3.3967': attribute type 1 has an invalid length. [ 547.469982][T21406] netlink: 'syz.3.3967': attribute type 1 has an invalid length. [ 547.501020][T21407] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3967'. [ 547.516358][T21407] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3967'. [ 547.533414][T21407] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3967'. [ 547.543743][T21407] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3967'. [ 547.553211][T21405] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3967'. [ 547.562531][T21407] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3967'. [ 547.890639][T21424] FAULT_INJECTION: forcing a failure. [ 547.890639][T21424] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 547.924598][T21424] CPU: 1 UID: 0 PID: 21424 Comm: syz.4.3972 Not tainted syzkaller #0 PREEMPT(full) [ 547.924625][T21424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 547.924635][T21424] Call Trace: [ 547.924642][T21424] [ 547.924649][T21424] dump_stack_lvl+0xe8/0x150 [ 547.924675][T21424] should_fail_ex+0x40c/0x560 [ 547.924707][T21424] _copy_to_user+0x31/0xb0 [ 547.924729][T21424] bpf_test_finish+0x53c/0x6b0 [ 547.924763][T21424] ? __pfx____migrate_enable+0x10/0x10 [ 547.924786][T21424] ? __pfx_bpf_test_finish+0x10/0x10 [ 547.924819][T21424] bpf_prog_test_run_sk_lookup+0x94f/0xbb0 [ 547.924858][T21424] ? __pfx_bpf_prog_test_run_sk_lookup+0x10/0x10 [ 547.924882][T21424] ? __fget_files+0x3a2/0x420 [ 547.924902][T21424] ? __fget_files+0x2a/0x420 [ 547.924928][T21424] ? __pfx_bpf_prog_test_run_sk_lookup+0x10/0x10 [ 547.924947][T21424] bpf_prog_test_run+0x2c5/0x340 [ 547.924967][T21424] __sys_bpf+0x643/0x950 [ 547.924991][T21424] ? __pfx___sys_bpf+0x10/0x10 [ 547.925031][T21424] ? ksys_write+0x242/0x270 [ 547.925057][T21424] ? __pfx_ksys_write+0x10/0x10 [ 547.925085][T21424] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.925104][T21424] __x64_sys_bpf+0x7c/0x90 [ 547.925128][T21424] do_syscall_64+0x174/0x580 [ 547.925149][T21424] ? trace_irq_disable+0x3b/0x140 [ 547.925173][T21424] ? clear_bhb_loop+0x40/0x90 [ 547.925195][T21424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 547.925211][T21424] RIP: 0033:0x7f475819ce59 [ 547.925228][T21424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 547.925242][T21424] RSP: 002b:00007f4759048028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 547.925261][T21424] RAX: ffffffffffffffda RBX: 00007f4758415fa0 RCX: 00007f475819ce59 [ 547.925274][T21424] RDX: 0000000000000048 RSI: 0000200000000440 RDI: 000000000000000a [ 547.925286][T21424] RBP: 00007f4759048090 R08: 0000000000000000 R09: 0000000000000000 [ 547.925297][T21424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 547.925307][T21424] R13: 00007f4758416038 R14: 00007f4758415fa0 R15: 00007ffda85d67b8 [ 547.925338][T21424] [ 548.164813][T21433] netlink: 'syz.0.3975': attribute type 1 has an invalid length. [ 548.223546][ T30] audit: type=1800 audit(1781413080.653:47): pid=21435 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3972" name="memory.events" dev="tmpfs" ino=878 res=0 errno=0 [ 548.466581][T21436] bond8: (slave dummy0): making interface the new active one [ 548.509131][T21436] bond8: (slave dummy0): Enslaving as an active interface with an up link [ 548.535426][T21440] bond8: entered promiscuous mode [ 548.551270][T21440] dummy0: entered promiscuous mode [ 548.695539][T21432] bond8: left promiscuous mode [ 548.700922][T21432] dummy0: left promiscuous mode [ 548.862331][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 549.344134][T21486] tipc: Enabled bearer , priority 0 [ 549.353383][T21486] syzkaller0: entered promiscuous mode [ 549.359169][T21486] syzkaller0: entered allmulticast mode [ 549.395193][T21486] tipc: Resetting bearer [ 549.566222][T21494] only policy match revision 0 supported [ 549.566238][T21494] unable to load match [ 549.695127][T21494] bond5: entered allmulticast mode [ 549.700806][T21494] 8021q: adding VLAN 0 to HW filter on device bond5 [ 550.168599][T21485] tipc: Resetting bearer [ 550.212092][T21485] tipc: Disabling bearer [ 550.488442][T21526] netlink: 'syz.0.3994': attribute type 1 has an invalid length. [ 551.752629][T21578] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.775684][T21583] __nla_validate_parse: 74 callbacks suppressed [ 551.775719][T21583] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4005'. [ 551.793380][T21578] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.810878][T21578] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.826773][T21578] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.838458][T21578] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.850778][T21578] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.863331][T21578] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.875501][T21578] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.886264][T21578] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 551.897777][T21578] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 554.527627][T21567] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 554.789954][T21645] xt_hashlimit: size too large, truncated to 1048576 [ 554.819124][T21645] xt_hashlimit: max too large, truncated to 1048576 [ 555.454547][T21649] bridge0: port 2(bridge_slave_1) entered disabled state [ 555.462293][T21649] bridge0: port 1(bridge_slave_0) entered disabled state [ 555.771729][T21649] bridge_slave_0: left allmulticast mode [ 555.782720][T21649] bridge_slave_0: left promiscuous mode [ 555.793845][T21649] bridge0: port 1(bridge_slave_0) entered disabled state [ 555.865281][T21649] bridge_slave_1: left allmulticast mode [ 555.886651][T21649] bridge_slave_1: left promiscuous mode [ 555.898747][T21649] bridge0: port 2(bridge_slave_1) entered disabled state [ 555.989376][T21649] bond0: (slave bond_slave_0): Releasing backup interface [ 556.011105][T21649] bond_slave_0: left promiscuous mode [ 556.074521][T21649] bond0: (slave bond_slave_1): Releasing backup interface [ 556.096373][T21649] bond_slave_1: left promiscuous mode [ 556.165097][T21649] team0: Port device team_slave_0 removed [ 556.248650][T21649] team0: Port device team_slave_1 removed [ 556.280017][T21649] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 556.300585][T21649] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 556.319501][T21649] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 556.332675][T21649] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 556.557425][ T7724] lo speed is unknown, defaulting to 1000 [ 556.569232][ T7724] syz0: Port: 1 Link DOWN [ 556.724607][T21666] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4021'. [ 556.860589][ T13] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.891267][ T13] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.912841][ T7732] lo speed is unknown, defaulting to 1000 [ 556.920352][ T13] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 556.982574][ T13] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 557.548863][T21698] bond9: option primary_reselect: invalid value (6) [ 557.633364][T21698] bond9 (unregistering): Released all slaves [ 558.223890][ T30] audit: type=1800 audit(1781413090.673:48): pid=21728 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.4029" name="blkio.bfq.time_recursive" dev="tmpfs" ino=554 res=0 errno=0 [ 558.359333][T21716] syzkaller0: entered promiscuous mode [ 558.373334][T21716] syzkaller0: entered allmulticast mode [ 558.454184][T21743] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4032'. [ 558.526055][T21746] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4032'. [ 558.741436][T21754] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4032'. [ 559.032553][T21760] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4034'. [ 562.593014][T21803] netlink: 148 bytes leftover after parsing attributes in process `syz.3.4048'. [ 562.757131][T21821] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4051'. [ 562.849877][T21821] lo speed is unknown, defaulting to 1000 [ 562.932238][T21828] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4051'. [ 563.561139][T21837] tunl0: left allmulticast mode [ 563.646201][T21837] ip6gre1: left promiscuous mode [ 563.651598][T21837] ip6gre1: left allmulticast mode [ 563.657626][T21837] bond1: left promiscuous mode [ 563.673035][T21837] bridge1: left promiscuous mode [ 563.679291][T21837] macsec1: left promiscuous mode [ 563.684856][T21837] macsec1: left allmulticast mode [ 563.691548][T21837] ip6erspan0: left allmulticast mode [ 564.222526][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 564.409356][T21869] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4061'. [ 564.488837][T21869] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap4 [ 564.587343][T21883] net_ratelimit: 1016 callbacks suppressed [ 564.587366][T21883] netlink: zone id is out of range [ 564.588983][T21869] batman_adv: batadv0: Adding interface: gretap4 [ 564.617720][T21883] netlink: zone id is out of range [ 564.638371][T21883] netlink: zone id is out of range [ 564.664884][T21883] netlink: zone id is out of range [ 564.667345][T21869] batman_adv: batadv0: The MTU of interface gretap4 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 564.683606][T21883] netlink: zone id is out of range [ 564.723251][T21883] netlink: zone id is out of range [ 564.739379][T21883] netlink: zone id is out of range [ 564.754207][T21869] batman_adv: batadv0: Interface activated: gretap4 [ 564.772859][T21883] netlink: zone id is out of range [ 564.816020][T21883] netlink: zone id is out of range [ 564.857934][T21883] netlink: zone id is out of range [ 565.729978][T21908] batadv0: entered promiscuous mode [ 565.754899][T21910] netlink: 'syz.2.4067': attribute type 15 has an invalid length. [ 565.788543][T21910] netlink: 666 bytes leftover after parsing attributes in process `syz.2.4067'. [ 565.843656][T21915] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4066'. [ 566.010960][T21930] FAULT_INJECTION: forcing a failure. [ 566.010960][T21930] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 566.048728][T21930] CPU: 0 UID: 0 PID: 21930 Comm: syz.4.4073 Not tainted syzkaller #0 PREEMPT(full) [ 566.048755][T21930] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 566.048766][T21930] Call Trace: [ 566.048773][T21930] [ 566.048781][T21930] dump_stack_lvl+0xe8/0x150 [ 566.048809][T21930] should_fail_ex+0x40c/0x560 [ 566.048841][T21930] _copy_from_user+0x2d/0xb0 [ 566.048862][T21930] __sys_sendto+0x2b0/0x710 [ 566.048891][T21930] ? __pfx___sys_sendto+0x10/0x10 [ 566.048914][T21930] ? __mutex_unlock_slowpath+0x1be/0x6f0 [ 566.048947][T21930] ? __fget_files+0x3a2/0x420 [ 566.048979][T21930] ? ksys_write+0x242/0x270 [ 566.049005][T21930] ? __pfx_ksys_write+0x10/0x10 [ 566.049034][T21930] __x64_sys_sendto+0xde/0x100 [ 566.049060][T21930] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.049080][T21930] do_syscall_64+0x174/0x580 [ 566.049098][T21930] ? trace_irq_disable+0x3b/0x140 [ 566.049123][T21930] ? clear_bhb_loop+0x40/0x90 [ 566.049144][T21930] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 566.049162][T21930] RIP: 0033:0x7f475819ce59 [ 566.049179][T21930] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 566.049194][T21930] RSP: 002b:00007f4759048028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 566.049213][T21930] RAX: ffffffffffffffda RBX: 00007f4758415fa0 RCX: 00007f475819ce59 [ 566.049226][T21930] RDX: 000000000000fce0 RSI: 00002000000002c0 RDI: 0000000000000003 [ 566.049237][T21930] RBP: 00007f4759048090 R08: 0000200000000140 R09: 0000000000000014 [ 566.049249][T21930] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000001 [ 566.049259][T21930] R13: 00007f4758416038 R14: 00007f4758415fa0 R15: 00007ffda85d67b8 [ 566.049288][T21930] [ 566.316100][T21943] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4078'. [ 566.379740][T21948] bridge2: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 566.395800][T21948] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4079'. [ 566.474616][T21954] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4079'. [ 566.820267][T21966] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4083'. [ 566.869346][T21966] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4083'. [ 567.081511][T21987] syzkaller0: entered promiscuous mode [ 567.102301][T21987] syzkaller0: entered allmulticast mode [ 567.197862][T22000] FAULT_INJECTION: forcing a failure. [ 567.197862][T22000] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 567.229274][T22000] CPU: 0 UID: 0 PID: 22000 Comm: syz.3.4092 Not tainted syzkaller #0 PREEMPT(full) [ 567.229299][T22000] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 567.229309][T22000] Call Trace: [ 567.229316][T22000] [ 567.229324][T22000] dump_stack_lvl+0xe8/0x150 [ 567.229351][T22000] should_fail_ex+0x40c/0x560 [ 567.229383][T22000] _copy_to_user+0x31/0xb0 [ 567.229405][T22000] simple_read_from_buffer+0xe1/0x170 [ 567.229432][T22000] proc_fail_nth_read+0x1bb/0x230 [ 567.229458][T22000] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 567.229483][T22000] ? rw_verify_area+0x24a/0x4c0 [ 567.229509][T22000] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 567.229530][T22000] vfs_read+0x213/0xa80 [ 567.229561][T22000] ? __pfx___mutex_lock+0x10/0x10 [ 567.229583][T22000] ? __pfx_vfs_read+0x10/0x10 [ 567.229608][T22000] ? __fget_files+0x2a/0x420 [ 567.229633][T22000] ? __fget_files+0x3a2/0x420 [ 567.229653][T22000] ? __fget_files+0x2a/0x420 [ 567.229687][T22000] ksys_read+0x150/0x270 [ 567.229714][T22000] ? __pfx_ksys_read+0x10/0x10 [ 567.229747][T22000] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.229766][T22000] do_syscall_64+0x174/0x580 [ 567.229784][T22000] ? trace_irq_disable+0x3b/0x140 [ 567.229808][T22000] ? clear_bhb_loop+0x40/0x90 [ 567.229831][T22000] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 567.229847][T22000] RIP: 0033:0x7fadf495d68e [ 567.229864][T22000] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 567.229878][T22000] RSP: 002b:00007fadf5902fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 567.229896][T22000] RAX: ffffffffffffffda RBX: 00007fadf59036c0 RCX: 00007fadf495d68e [ 567.229909][T22000] RDX: 000000000000000f RSI: 00007fadf59030a0 RDI: 0000000000000004 [ 567.229924][T22000] RBP: 00007fadf5903090 R08: 0000000000000000 R09: 0000000000000000 [ 567.229935][T22000] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 567.229945][T22000] R13: 00007fadf4c16038 R14: 00007fadf4c15fa0 R15: 00007ffe5e6f8508 [ 567.229976][T22000] [ 567.739993][T21986] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 568.020011][T22014] netlink: 40 bytes leftover after parsing attributes in process `syz.0.4096'. [ 568.100326][T22021] ip6tnl0: entered promiscuous mode [ 568.108475][T22021] ip6tnl0: entered allmulticast mode [ 568.138737][T22022] netlink: 'syz.3.4100': attribute type 21 has an invalid length. [ 568.159130][T22022] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4100'. [ 568.446723][T22049] geneve1: entered promiscuous mode [ 568.467727][T22049] bond1: (slave lo): Releasing backup interface [ 568.492941][T22049] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 568.520390][T22047] geneve1: left promiscuous mode [ 569.037398][T22073] lo speed is unknown, defaulting to 1000 [ 569.175954][T22078] can: request_module (can-proto-0) failed. [ 569.477205][T22095] syzkaller0: entered promiscuous mode [ 569.492304][T22095] syzkaller0: entered allmulticast mode [ 569.523956][T22101] __nla_validate_parse: 3 callbacks suppressed [ 569.523974][T22101] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4119'. [ 569.583366][T22095] tipc: Enabled bearer , priority 0 [ 569.760531][T22106] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4121'. [ 569.857053][T22094] tipc: Resetting bearer [ 569.898535][T22094] tipc: Disabling bearer [ 570.050122][T22106] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4121'. [ 570.076237][T22117] 5nè‹Ò: entered promiscuous mode [ 570.098436][T22106] sctp: [Deprecated]: syz.3.4121 (pid 22106) Use of struct sctp_assoc_value in delayed_ack socket option. [ 570.098436][T22106] Use struct sctp_sack_info instead [ 570.237445][T22120] bridge0: port 2(bridge_slave_1) entered disabled state [ 570.377051][T22142] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4130'. [ 570.831810][T22170] netlink: 65051 bytes leftover after parsing attributes in process `syz.3.4140'. [ 570.864846][T22170] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4140'. [ 570.887492][T22176] netlink: 'syz.2.4142': attribute type 15 has an invalid length. [ 570.897784][T22176] netlink: 666 bytes leftover after parsing attributes in process `syz.2.4142'. [ 570.947828][T22176] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4142'. [ 570.986460][T22176] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4142'. [ 571.004144][T22180] netlink: 52 bytes leftover after parsing attributes in process `syz.1.4143'. [ 571.177271][T22190] FAULT_INJECTION: forcing a failure. [ 571.177271][T22190] name failslab, interval 1, probability 0, space 0, times 0 [ 571.230645][T22190] CPU: 0 UID: 0 PID: 22190 Comm: syz.2.4146 Not tainted syzkaller #0 PREEMPT(full) [ 571.230671][T22190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 571.230682][T22190] Call Trace: [ 571.230689][T22190] [ 571.230696][T22190] dump_stack_lvl+0xe8/0x150 [ 571.230724][T22190] should_fail_ex+0x40c/0x560 [ 571.230756][T22190] should_failslab+0xa8/0x100 [ 571.230785][T22190] __kmalloc_cache_node_noprof+0x8c/0x690 [ 571.230815][T22190] ? unwind_next_frame+0x8f/0x2550 [ 571.230836][T22190] ? __get_vm_area_node+0x136/0x300 [ 571.230862][T22190] __get_vm_area_node+0x136/0x300 [ 571.230888][T22190] __vmalloc_node_range_noprof+0x358/0x1730 [ 571.230911][T22190] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 571.230962][T22190] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 571.230985][T22190] ? __lock_acquire+0x683/0x2cd0 [ 571.231013][T22190] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 571.231036][T22190] __vmalloc_noprof+0xd2/0x120 [ 571.231059][T22190] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 571.231086][T22190] bpf_prog_alloc_no_stats+0x47/0x4f0 [ 571.231110][T22190] ? bpf_prog_alloc+0x2a/0x1a0 [ 571.231135][T22190] bpf_prog_alloc+0x3c/0x1a0 [ 571.231162][T22190] bpf_prog_load+0x788/0x1a10 [ 571.231194][T22190] ? get_pid_task+0x20/0x1f0 [ 571.231220][T22190] ? __pfx_bpf_prog_load+0x10/0x10 [ 571.231245][T22190] ? __might_fault+0xaf/0x130 [ 571.231276][T22190] ? bpf_lsm_bpf+0x9/0x20 [ 571.231289][T22190] ? security_bpf+0x7e/0x2d0 [ 571.231312][T22190] __sys_bpf+0x618/0x950 [ 571.231338][T22190] ? __pfx___sys_bpf+0x10/0x10 [ 571.231377][T22190] ? ksys_write+0x242/0x270 [ 571.231404][T22190] ? __pfx_ksys_write+0x10/0x10 [ 571.231431][T22190] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.231451][T22190] __x64_sys_bpf+0x7c/0x90 [ 571.231475][T22190] do_syscall_64+0x174/0x580 [ 571.231494][T22190] ? trace_irq_disable+0x3b/0x140 [ 571.231517][T22190] ? clear_bhb_loop+0x40/0x90 [ 571.231538][T22190] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.231555][T22190] RIP: 0033:0x7f3e2339ce59 [ 571.231571][T22190] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 571.231585][T22190] RSP: 002b:00007f3e24254028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 571.231602][T22190] RAX: ffffffffffffffda RBX: 00007f3e23615fa0 RCX: 00007f3e2339ce59 [ 571.231613][T22190] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 571.231623][T22190] RBP: 00007f3e24254090 R08: 0000000000000000 R09: 0000000000000000 [ 571.231633][T22190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 571.231643][T22190] R13: 00007f3e23616038 R14: 00007f3e23615fa0 R15: 00007fff8c8b9718 [ 571.231672][T22190] [ 571.231681][T22190] syz.2.4146: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 571.529551][T22190] CPU: 0 UID: 0 PID: 22190 Comm: syz.2.4146 Not tainted syzkaller #0 PREEMPT(full) [ 571.529576][T22190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 571.529588][T22190] Call Trace: [ 571.529595][T22190] [ 571.529603][T22190] dump_stack_lvl+0xe8/0x150 [ 571.529629][T22190] warn_alloc+0x249/0x340 [ 571.529660][T22190] ? __pfx_warn_alloc+0x10/0x10 [ 571.529686][T22190] ? __get_vm_area_node+0x136/0x300 [ 571.529713][T22190] ? __get_vm_area_node+0x2af/0x300 [ 571.529741][T22190] __vmalloc_node_range_noprof+0x37d/0x1730 [ 571.529790][T22190] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 571.529814][T22190] ? __lock_acquire+0x683/0x2cd0 [ 571.529842][T22190] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 571.529867][T22190] __vmalloc_noprof+0xd2/0x120 [ 571.529890][T22190] ? bpf_prog_alloc_no_stats+0x47/0x4f0 [ 571.529919][T22190] bpf_prog_alloc_no_stats+0x47/0x4f0 [ 571.529943][T22190] ? bpf_prog_alloc+0x2a/0x1a0 [ 571.529970][T22190] bpf_prog_alloc+0x3c/0x1a0 [ 571.530013][T22190] bpf_prog_load+0x788/0x1a10 [ 571.530044][T22190] ? get_pid_task+0x20/0x1f0 [ 571.530068][T22190] ? __pfx_bpf_prog_load+0x10/0x10 [ 571.530093][T22190] ? __might_fault+0xaf/0x130 [ 571.530129][T22190] ? bpf_lsm_bpf+0x9/0x20 [ 571.530144][T22190] ? security_bpf+0x7e/0x2d0 [ 571.530169][T22190] __sys_bpf+0x618/0x950 [ 571.530194][T22190] ? __pfx___sys_bpf+0x10/0x10 [ 571.530259][T22190] ? ksys_write+0x242/0x270 [ 571.530305][T22190] ? __pfx_ksys_write+0x10/0x10 [ 571.530335][T22190] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.530355][T22190] __x64_sys_bpf+0x7c/0x90 [ 571.530379][T22190] do_syscall_64+0x174/0x580 [ 571.530398][T22190] ? trace_irq_disable+0x3b/0x140 [ 571.530429][T22190] ? clear_bhb_loop+0x40/0x90 [ 571.530450][T22190] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.530467][T22190] RIP: 0033:0x7f3e2339ce59 [ 571.530484][T22190] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 571.530498][T22190] RSP: 002b:00007f3e24254028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 571.530516][T22190] RAX: ffffffffffffffda RBX: 00007f3e23615fa0 RCX: 00007f3e2339ce59 [ 571.530527][T22190] RDX: 0000000000000094 RSI: 0000200000000040 RDI: 0000000000000005 [ 571.530537][T22190] RBP: 00007f3e24254090 R08: 0000000000000000 R09: 0000000000000000 [ 571.530547][T22190] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 571.530556][T22190] R13: 00007f3e23616038 R14: 00007f3e23615fa0 R15: 00007fff8c8b9718 [ 571.530583][T22190] [ 571.531232][T22190] Mem-Info: [ 571.794519][T22190] active_anon:6537 inactive_anon:6 isolated_anon:0 [ 571.794519][T22190] active_file:3160 inactive_file:40388 isolated_file:0 [ 571.794519][T22190] unevictable:768 dirty:218 writeback:0 [ 571.794519][T22190] slab_reclaimable:12143 slab_unreclaimable:155961 [ 571.794519][T22190] mapped:29918 shmem:1422 pagetables:1521 [ 571.794519][T22190] sec_pagetables:0 bounce:0 [ 571.794519][T22190] kernel_misc_reclaimable:0 [ 571.794519][T22190] free:1249202 free_pcp:25342 free_cma:0 [ 571.842681][T22190] Node 0 active_anon:26248kB inactive_anon:24kB active_file:12640kB inactive_file:161348kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:119672kB dirty:872kB writeback:0kB shmem:4152kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16512kB pagetables:5952kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 571.913491][T22190] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 571.957710][T22190] Node 0 DMA free:15344kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:16kB free_cma:0kB [ 572.009321][T22190] lowmem_reserve[]: 0 2493 2493 2493 2493 [ 572.032863][T22190] Node 0 DMA32 free:1104268kB boost:0kB min:34188kB low:42732kB high:51276kB reserved_highatomic:0KB free_highatomic:0KB active_anon:29196kB inactive_anon:24kB active_file:12640kB inactive_file:161348kB unevictable:1536kB writepending:888kB zspages:0kB present:3129332kB managed:2552928kB mlocked:0kB bounce:0kB free_pcp:35232kB local_pcp:21212kB free_cma:0kB [ 572.107564][T22190] lowmem_reserve[]: 0 0 0 0 0 [ 572.117679][T22190] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:680kB mlocked:0kB bounce:0kB free_pcp:4kB local_pcp:0kB free_cma:0kB [ 572.178804][T22190] lowmem_reserve[]: 0 0 0 0 0 [ 572.193434][T22190] Node 1 Normal free:3879560kB boost:0kB min:55704kB low:69628kB high:83552kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:204kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:60944kB local_pcp:33616kB free_cma:0kB [ 572.240971][T22214] ip6tnl3: entered allmulticast mode [ 572.243991][T22190] lowmem_reserve[]: 0 0 0 0 0 [ 572.258641][T22221] bridge0: entered allmulticast mode [ 572.264376][T22190] Node 0 DMA: 0*4kB 0*8kB 1*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 2*1024kB (U) 2*2048kB (UM) 2*4096kB (UM) = 15344kB [ 572.281818][T22223] bridge0: port 3(team0) entered disabled state [ 572.285748][T22214] netlink: 'syz.4.4155': attribute type 11 has an invalid length. [ 572.289124][T22190] Node 0 DMA32: 7251*4kB (UME) 5565*8kB (UM) 2947*16kB (UME) 599*32kB (UM) 404*64kB (UME) 964*128kB (UME) 690*256kB (UME) 355*512kB (UM) 226*1024kB (UM) 108*2048kB (UM) 1*4096kB (U) = 1104196kB [ 572.321058][T22190] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 572.336383][T22223] bridge_slave_1: left allmulticast mode [ 572.342855][T22223] bridge_slave_1: left promiscuous mode [ 572.348805][T22223] bridge0: port 2(bridge_slave_1) entered disabled state [ 572.356499][T22190] Node 1 Normal: 0*4kB 4*8kB (UM) 9*16kB (UM) 6*32kB (UM) 10*64kB (UM) 8*128kB (UM) 5*256kB (UM) 5*512kB (UM) 5*1024kB (UM) 1*2048kB (U) 944*4096kB (UM) = 3879664kB [ 572.374326][T22190] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 572.391970][T22223] bridge_slave_0: left allmulticast mode [ 572.410239][T22223] bridge_slave_0: left promiscuous mode [ 572.418932][T22190] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 572.429514][T22223] bridge0: port 1(bridge_slave_0) entered disabled state [ 572.439130][T22190] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 572.449539][T22190] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 572.461453][T22190] 44966 total pagecache pages [ 572.466662][T22190] 0 pages in swap cache [ 572.475662][T22190] Free swap = 124996kB [ 572.490611][T22190] Total swap = 124996kB [ 572.494966][T22190] 2097051 pages RAM [ 572.498925][T22190] 0 pages HighMem/MovableOnly [ 572.509362][T22190] 427034 pages reserved [ 572.514159][T22190] 0 pages cma reserved [ 572.944964][T22262] netlink: 'syz.0.4169': attribute type 21 has an invalid length. [ 573.028326][T22265] team0: left allmulticast mode [ 573.049530][T22265] team_slave_0: left allmulticast mode [ 573.075639][T22265] team_slave_1: left allmulticast mode [ 573.096715][T22265] team0: left promiscuous mode [ 573.111667][T22265] team_slave_0: left promiscuous mode [ 573.132876][T22265] team_slave_1: left promiscuous mode [ 573.165381][T22265] bridge0: port 1(team0) entered disabled state [ 573.206520][T22265] bridge_slave_1: left allmulticast mode [ 573.218741][T22265] bridge_slave_1: left promiscuous mode [ 573.232181][T22265] bridge0: port 2(bridge_slave_1) entered disabled state [ 573.273352][T22265] bond0: (slave bond_slave_0): Releasing backup interface [ 573.314178][T22265] bond0: (slave bond_slave_1): Releasing backup interface [ 573.344613][T22265] team0: Port device team_slave_0 removed [ 573.373528][T22265] team0: Port device team_slave_1 removed [ 573.389518][T22265] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 573.400029][T22265] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 573.410357][T22265] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 573.419225][T22265] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 573.429756][T22265] net_ratelimit: 171 callbacks suppressed [ 573.429775][T22265] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 573.453018][T22262] netlink: 'syz.0.4169': attribute type 4 has an invalid length. [ 573.461386][T22262] netlink: 'syz.0.4169': attribute type 3 has an invalid length. [ 573.529061][T22283] tipc: Enabled bearer , priority 0 [ 573.731855][T22278] tipc: Disabling bearer [ 574.231602][ T30] audit: type=1107 audit(1781413106.673:49): pid=22309 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 574.307682][T22314] syzkaller0: entered promiscuous mode [ 574.351096][T22314] syzkaller0: entered allmulticast mode [ 574.466268][T22331] netlink: 'syz.0.4182': attribute type 4 has an invalid length. [ 574.567881][T22334] __nla_validate_parse: 11 callbacks suppressed [ 574.567899][T22334] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4185'. [ 574.715102][T22338] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4186'. [ 574.743255][T22339] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4186'. [ 574.761725][T22343] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 8 [ 574.796570][T22346] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4188'. [ 574.818289][T22346] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4188'. [ 575.126862][T22367] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4192'. [ 575.681375][T22400] sch_tbf: peakrate 7 is lower than or equals to rate 7 ! [ 575.796849][T22413] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 576.036105][T22423] netlink: 'syz.0.4206': attribute type 21 has an invalid length. [ 576.052953][T22423] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4206'. [ 576.487170][T22443] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 576.573121][T22444] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4212'. [ 576.717559][T22454] netlink: 'syz.1.4215': attribute type 1 has an invalid length. [ 576.764533][T22459] netlink: 'syz.0.4216': attribute type 3 has an invalid length. [ 576.851184][T22459] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4216'. [ 576.875499][T22454] 8021q: adding VLAN 0 to HW filter on device bond1 [ 576.916449][T22462] vlan2: entered promiscuous mode [ 576.935023][T22462] bond1: entered promiscuous mode [ 576.948270][T22462] vlan2: entered allmulticast mode [ 576.955402][T22462] bond1: entered allmulticast mode [ 577.091709][T22476] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 577.128385][T22470] netlink: 'syz.0.4218': attribute type 21 has an invalid length. [ 577.144947][T22476] veth1_to_batadv: entered promiscuous mode [ 577.161990][T22470] netlink: 'syz.0.4218': attribute type 20 has an invalid length. [ 577.533836][T22505] lo speed is unknown, defaulting to 1000 [ 577.638132][T22511] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4228'. [ 578.088219][T22535] netlink: 'syz.3.4233': attribute type 4 has an invalid length. [ 578.158804][T22540] netlink: 'syz.3.4233': attribute type 4 has an invalid length. [ 578.414835][T22552] netlink: 'syz.3.4237': attribute type 11 has an invalid length. [ 578.436823][T22554] netlink: 'syz.1.4238': attribute type 16 has an invalid length. [ 578.657735][T22555] mac80211_hwsim hwsim45 wlan0: entered promiscuous mode [ 578.694930][T22555] mac80211_hwsim hwsim45 wlan0: entered allmulticast mode [ 578.940931][T22580] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 578.952525][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.459580][T22564] syzkaller0: entered promiscuous mode [ 579.470979][T22564] syzkaller0: entered allmulticast mode [ 579.658127][T22589] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.669683][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 579.683718][T22581] lo speed is unknown, defaulting to 1000 [ 579.694239][T22589] __nla_validate_parse: 7 callbacks suppressed [ 579.694257][T22589] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4245'. [ 579.781119][T22589] bridge2: port 1(dummy0) entered blocking state [ 579.800423][T22589] bridge2: port 1(dummy0) entered disabled state [ 579.820930][T22589] dummy0: entered allmulticast mode [ 579.854740][T22592] netlink: 'syz.3.4245': attribute type 10 has an invalid length. [ 579.865768][T22589] dummy0: entered promiscuous mode [ 579.896761][T22592] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4245'. [ 579.950917][T22592] bridge2: port 1(dummy0) entered blocking state [ 579.957459][T22592] bridge2: port 1(dummy0) entered forwarding state [ 580.009774][T22592] dummy0: left allmulticast mode [ 580.034714][T22592] bridge2: port 1(dummy0) entered disabled state [ 580.381854][T22610] netlink: 'syz.3.4251': attribute type 3 has an invalid length. [ 580.392294][T16894] Bluetooth: hci3: command 0x0406 tx timeout [ 580.794916][T22619] nbd: nbd3 already in use [ 580.803049][T22619] openvswitch: netlink: IP tunnel dst address not specified [ 580.828779][T22619] block nbd3: NBD_DISCONNECT [ 580.850036][T22619] block nbd3: Send disconnect failed -32 [ 580.864308][T22619] block nbd3: shutting down sockets [ 580.889243][T22622] RDS: rds_bind could not find a transport for ::ffff:10.1.1.3, load rds_tcp or rds_rdma? [ 581.045037][T22617] 8021q: adding VLAN 0 to HW filter on device bond0 [ 581.061836][T22629] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4256'. [ 581.063504][T22617] team0: left promiscuous mode [ 581.082494][T22629] netlink: 'syz.0.4256': attribute type 2 has an invalid length. [ 581.090833][T22617] team_slave_0: left promiscuous mode [ 581.097997][T22629] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4256'. [ 581.109081][T22631] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4258'. [ 581.112834][T22617] team_slave_1: left promiscuous mode [ 581.128185][T22617] dummy0: left promiscuous mode [ 581.140356][T22617] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 581.159908][ T7730] IPVS: starting estimator thread 0... [ 581.174295][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.184024][ T3302] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.193723][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.204259][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.226895][ T37] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 581.227608][T22631] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4258'. [ 581.281433][T22640] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4258'. [ 581.295307][T22634] IPVS: using max 35 ests per chain, 84000 per kthread [ 581.313493][T22617] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 581.364314][T22617] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 581.396996][T22617] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 581.408451][T22617] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 581.675725][T22664] netlink: 'syz.0.4262': attribute type 1 has an invalid length. [ 581.884519][T22682] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4268'. [ 581.937062][T22682] netlink: 'syz.3.4268': attribute type 5 has an invalid length. [ 581.963532][T22682] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4268'. [ 582.001265][T22682] geneve2: entered promiscuous mode [ 582.026335][T22682] geneve2: entered allmulticast mode [ 582.057997][ T3302] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 256 - 0 [ 582.077794][T22684] lo speed is unknown, defaulting to 1000 [ 582.085686][ T3302] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 256 - 0 [ 582.098950][T22688] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4269'. [ 582.099460][ T3302] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 256 - 0 [ 582.132224][ T3302] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 256 - 0 [ 582.293170][T22699] netlink: 'syz.3.4273': attribute type 1 has an invalid length. [ 582.970254][T22741] netlink: 'syz.2.4287': attribute type 1 has an invalid length. [ 583.132451][T22741] bond3: entered promiscuous mode [ 583.177508][T22741] 8021q: adding VLAN 0 to HW filter on device bond3 [ 583.284572][T22752] 8021q: adding VLAN 0 to HW filter on device bond3 [ 583.302923][T22752] bond3: (slave ip6gre2): The slave device specified does not support setting the MAC address [ 583.324392][T22752] bond3: (slave ip6gre2): Setting fail_over_mac to active for active-backup mode [ 583.362812][T22752] bond3: (slave ip6gre2): making interface the new active one [ 583.386796][T22752] ip6gre2: entered promiscuous mode [ 583.417262][T22752] bond3: (slave ip6gre2): Enslaving as an active interface with an up link [ 584.314636][ T7935] net_ratelimit: 16 callbacks suppressed [ 584.314655][ T7935] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 584.382905][ T7730] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 585.423981][ T7730] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 585.756594][T22813] netlink: 'syz.1.4302': attribute type 1 has an invalid length. [ 585.900838][T22815] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 586.463867][ T7732] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.628348][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.639413][ T7935] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.652793][ T7725] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.661429][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.669720][ T8444] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 586.677966][ T7723] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 587.081229][T22851] tipc: Enabling of bearer rejected, failed to enable media [ 587.143806][T22855] 8021q: adding VLAN 0 to HW filter on device bond6 [ 587.259999][T22865] netlink: 'syz.1.4314': attribute type 1 has an invalid length. [ 587.602800][T22851] ip6tnl0: left promiscuous mode [ 587.641877][T22851] ip6tnl0: left allmulticast mode [ 587.903017][ C0] [ 587.905396][ C0] ====================================================== [ 587.912429][ C0] WARNING: possible circular locking dependency detected [ 587.919471][ C0] syzkaller #0 Not tainted [ 587.923987][ C0] ------------------------------------------------------ [ 587.931027][ C0] kworker/0:12/7935 is trying to acquire lock: [ 587.937325][ C0] ffff888037489030 (&hsr->seqnr_lock){+.-.}-{3:3}, at: hsr_dev_xmit+0x237/0x360 [ 587.946412][ C0] [ 587.946412][ C0] but task is already holding lock: [ 587.953776][ C0] ffff888057d0a958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 587.963637][ C0] [ 587.963637][ C0] which lock already depends on the new lock. [ 587.963637][ C0] [ 587.974116][ C0] [ 587.974116][ C0] the existing dependency chain (in reverse order) is: [ 587.983206][ C0] [ 587.983206][ C0] -> #1 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}: [ 587.991461][ C0] _raw_spin_lock+0x2e/0x40 [ 587.996489][ C0] sch_direct_xmit+0x15f/0x4c0 [ 588.001769][ C0] __dev_queue_xmit+0x1754/0x37f0 [ 588.007349][ C0] hsr_forward_skb+0x152a/0x28c0 [ 588.012912][ C0] hsr_dev_xmit+0x242/0x360 [ 588.017944][ C0] dev_hard_start_xmit+0x2cd/0x830 [ 588.023569][ C0] __dev_queue_xmit+0x1435/0x37f0 [ 588.029112][ C0] ip6_output+0x337/0x540 [ 588.033978][ C0] NF_HOOK+0x177/0x4f0 [ 588.038659][ C0] mld_sendpack+0x890/0xe10 [ 588.043683][ C0] mld_ifc_work+0x839/0xe70 [ 588.048718][ C0] process_scheduled_works+0xa8e/0x14e0 [ 588.054795][ C0] worker_thread+0xa47/0xfb0 [ 588.059902][ C0] kthread+0x389/0x470 [ 588.064678][ C0] ret_from_fork+0x514/0xb70 [ 588.069800][ C0] ret_from_fork_asm+0x1a/0x30 [ 588.075112][ C0] [ 588.075112][ C0] -> #0 (&hsr->seqnr_lock){+.-.}-{3:3}: [ 588.082842][ C0] __lock_acquire+0x1520/0x2cd0 [ 588.088213][ C0] lock_acquire+0x106/0x350 [ 588.093312][ C0] _raw_spin_lock_bh+0x36/0x50 [ 588.098632][ C0] hsr_dev_xmit+0x237/0x360 [ 588.103675][ C0] dev_hard_start_xmit+0x2cd/0x830 [ 588.109329][ C0] __dev_queue_xmit+0x1435/0x37f0 [ 588.114959][ C0] NF_HOOK+0x33a/0x3c0 [ 588.119555][ C0] arp_xmit+0x16c/0x270 [ 588.124227][ C0] arp_solicit+0xbdc/0xe40 [ 588.129159][ C0] __neigh_event_send+0xf0c/0x1510 [ 588.134875][ C0] neigh_resolve_output+0x1a1/0x720 [ 588.140591][ C0] ip_finish_output2+0xc4b/0x10b0 [ 588.146132][ C0] ip_output+0x29f/0x450 [ 588.150892][ C0] iptunnel_xmit+0x626/0xd10 [ 588.156011][ C0] ip_tunnel_xmit+0x195b/0x2040 [ 588.161387][ C0] __gre_xmit+0x19e/0x240 [ 588.166236][ C0] erspan_xmit+0xad5/0x1590 [ 588.171262][ C0] dev_hard_start_xmit+0x2cd/0x830 [ 588.176894][ C0] sch_direct_xmit+0x257/0x4c0 [ 588.182178][ C0] __dev_queue_xmit+0x1754/0x37f0 [ 588.187901][ C0] ip6_output+0x337/0x540 [ 588.192787][ C0] ndisc_send_skb+0xcb2/0x1650 [ 588.198073][ C0] addrconf_rs_timer+0x2d2/0x6c0 [ 588.203525][ C0] call_timer_fn+0x192/0x5e0 [ 588.208628][ C0] __run_timer_base+0x652/0x8b0 [ 588.213983][ C0] run_timer_softirq+0xb7/0x170 [ 588.219342][ C0] handle_softirqs+0x225/0x840 [ 588.224620][ C0] __irq_exit_rcu+0xca/0x220 [ 588.229724][ C0] irq_exit_rcu+0x9/0x30 [ 588.234485][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 588.240712][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 588.247207][ C0] nf_ct_iterate_cleanup+0xb7/0x500 [ 588.252921][ C0] iterate_cleanup_work+0xdc/0x180 [ 588.258560][ C0] process_scheduled_works+0xa8e/0x14e0 [ 588.264636][ C0] worker_thread+0xa47/0xfb0 [ 588.269740][ C0] kthread+0x389/0x470 [ 588.274334][ C0] ret_from_fork+0x514/0xb70 [ 588.279449][ C0] ret_from_fork_asm+0x1a/0x30 [ 588.284729][ C0] [ 588.284729][ C0] other info that might help us debug this: [ 588.284729][ C0] [ 588.294942][ C0] Possible unsafe locking scenario: [ 588.294942][ C0] [ 588.302577][ C0] CPU0 CPU1 [ 588.307936][ C0] ---- ---- [ 588.313285][ C0] lock(&qdisc_xmit_lock_key#4); [ 588.318565][ C0] lock(&hsr->seqnr_lock); [ 588.325585][ C0] lock(&qdisc_xmit_lock_key#4); [ 588.333177][ C0] lock(&hsr->seqnr_lock); [ 588.337671][ C0] [ 588.337671][ C0] *** DEADLOCK *** [ 588.337671][ C0] [ 588.345797][ C0] 14 locks held by kworker/0:12/7935: [ 588.351152][ C0] #0: ffff88813fe43140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 588.362467][ C0] #1: ffffc9000362fc40 ((work_completion)(&w->work)#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 [ 588.374121][ C0] #2: ffffffff8fe409c0 (nf_conntrack_mutex){+.+.}-{4:4}, at: nf_ct_iterate_cleanup+0x3f/0x500 [ 588.384514][ C0] #3: ffffc90000007cc0 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd4/0x5e0 [ 588.394103][ C0] #4: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: ndisc_send_skb+0x203/0x1650 [ 588.403600][ C0] #5: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x11e/0x540 [ 588.412757][ C0] #6: ffffffff8e95c7e0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x37f0 [ 588.422760][ C0] #7: ffff88806b537228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#5){+...}-{3:3}, at: __dev_queue_xmit+0x112b/0x37f0 [ 588.435427][ C0] #8: ffff888057d0a958 (&qdisc_xmit_lock_key#4){+.-.}-{3:3}, at: sch_direct_xmit+0x15f/0x4c0 [ 588.445703][ C0] #9: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5a/0x450 [ 588.454584][ C0] #10: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3de/0x10b0 [ 588.464594][ C0] #11: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: arp_xmit+0x23/0x270 [ 588.473735][ C0] #12: ffffffff8e95c7e0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x29b/0x37f0 [ 588.483768][ C0] #13: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: hsr_dev_xmit+0x2d/0x360 [ 588.492990][ C0] [ 588.492990][ C0] stack backtrace: [ 588.499130][ C0] CPU: 0 UID: 0 PID: 7935 Comm: kworker/0:12 Not tainted syzkaller #0 PREEMPT(full) [ 588.499148][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 588.499159][ C0] Workqueue: events iterate_cleanup_work [ 588.499180][ C0] Call Trace: [ 588.499187][ C0] [ 588.499194][ C0] dump_stack_lvl+0xe8/0x150 [ 588.499212][ C0] print_circular_bug+0x2e1/0x300 [ 588.499234][ C0] check_noncircular+0x12e/0x150 [ 588.499254][ C0] __lock_acquire+0x1520/0x2cd0 [ 588.499272][ C0] ? __siphash_unaligned+0x28d/0x3e0 [ 588.499291][ C0] ? skb_network_protocol+0x23d/0x400 [ 588.499308][ C0] ? hsr_dev_xmit+0x237/0x360 [ 588.499326][ C0] lock_acquire+0x106/0x350 [ 588.499340][ C0] ? hsr_dev_xmit+0x237/0x360 [ 588.499362][ C0] ? hsr_dev_xmit+0x237/0x360 [ 588.499381][ C0] _raw_spin_lock_bh+0x36/0x50 [ 588.499403][ C0] ? hsr_dev_xmit+0x237/0x360 [ 588.499421][ C0] hsr_dev_xmit+0x237/0x360 [ 588.499439][ C0] ? hsr_dev_xmit+0x2d/0x360 [ 588.499458][ C0] dev_hard_start_xmit+0x2cd/0x830 [ 588.499487][ C0] __dev_queue_xmit+0x1435/0x37f0 [ 588.499508][ C0] ? __dev_queue_xmit+0x29b/0x37f0 [ 588.499526][ C0] ? __lock_acquire+0x683/0x2cd0 [ 588.499540][ C0] ? arpt_do_table+0x25b/0x1f90 [ 588.499558][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 588.499578][ C0] ? __pfx_arpt_do_table+0x10/0x10 [ 588.499602][ C0] ? NF_HOOK+0xa2/0x3c0 [ 588.499623][ C0] NF_HOOK+0x33a/0x3c0 [ 588.499643][ C0] ? __pfx_arp_xmit_finish+0x10/0x10 [ 588.499662][ C0] ? NF_HOOK+0xa2/0x3c0 [ 588.499680][ C0] ? __pfx_NF_HOOK+0x10/0x10 [ 588.499698][ C0] ? lock_acquire+0x106/0x350 [ 588.499713][ C0] ? __pfx_arp_xmit_finish+0x10/0x10 [ 588.499732][ C0] ? inet_addr_type_dev_table+0x25/0x190 [ 588.499756][ C0] arp_xmit+0x16c/0x270 [ 588.499774][ C0] ? arp_xmit+0x23/0x270 [ 588.499793][ C0] arp_solicit+0xbdc/0xe40 [ 588.499818][ C0] ? __pfx_arp_solicit+0x10/0x10 [ 588.499839][ C0] ? __neigh_event_send+0xea4/0x1510 [ 588.499861][ C0] ? __pfx_arp_solicit+0x10/0x10 [ 588.499880][ C0] __neigh_event_send+0xf0c/0x1510 [ 588.499906][ C0] neigh_resolve_output+0x1a1/0x720 [ 588.499929][ C0] ? __pfx_ip_neigh_gw4+0x10/0x10 [ 588.499955][ C0] ? ip_finish_output2+0x3de/0x10b0 [ 588.499977][ C0] ip_finish_output2+0xc4b/0x10b0 [ 588.499999][ C0] ? ip_skb_dst_mtu+0x811/0xa50 [ 588.500018][ C0] ? ip_finish_output2+0x3de/0x10b0 [ 588.500041][ C0] ? ip_finish_output+0x40b/0x530 [ 588.500062][ C0] ip_output+0x29f/0x450 [ 588.500082][ C0] ? ip_output+0x5a/0x450 [ 588.500101][ C0] iptunnel_xmit+0x626/0xd10 [ 588.500128][ C0] ip_tunnel_xmit+0x195b/0x2040 [ 588.500156][ C0] ? __pfx_ip_tunnel_xmit+0x10/0x10 [ 588.500178][ C0] ? __pfx_gre_build_header+0x10/0x10 [ 588.500197][ C0] ? unwind_next_frame+0x1baf/0x2550 [ 588.500217][ C0] __gre_xmit+0x19e/0x240 [ 588.500235][ C0] ? __pfx___gre_xmit+0x10/0x10 [ 588.500252][ C0] ? iptunnel_handle_offloads+0x2fd/0x630 [ 588.500278][ C0] erspan_xmit+0xad5/0x1590 [ 588.500300][ C0] ? __pfx_erspan_xmit+0x10/0x10 [ 588.500319][ C0] ? __lock_acquire+0x683/0x2cd0 [ 588.500336][ C0] dev_hard_start_xmit+0x2cd/0x830 [ 588.500357][ C0] sch_direct_xmit+0x257/0x4c0 [ 588.500382][ C0] ? __pfx_sch_direct_xmit+0x10/0x10 [ 588.500407][ C0] __dev_queue_xmit+0x1754/0x37f0 [ 588.500428][ C0] ? __dev_queue_xmit+0x29b/0x37f0 [ 588.500444][ C0] ? __pfx_nf_confirm+0x10/0x10 [ 588.500465][ C0] ? __pfx___dev_queue_xmit+0x10/0x10 [ 588.500487][ C0] ? ip6_output+0x337/0x540 [ 588.500503][ C0] ? lock_acquire+0x106/0x350 [ 588.500518][ C0] ? ip6_output+0x337/0x540 [ 588.500538][ C0] ? ip6_finish_output2+0xd41/0x13c0 [ 588.500561][ C0] ? ip6_output+0x11e/0x540 [ 588.500577][ C0] ip6_output+0x337/0x540 [ 588.500594][ C0] ? __pfx_ip6_output+0x10/0x10 [ 588.500610][ C0] ndisc_send_skb+0xcb2/0x1650 [ 588.500635][ C0] ? ndisc_send_skb+0x203/0x1650 [ 588.500659][ C0] ? __pfx_ndisc_send_skb+0x10/0x10 [ 588.500682][ C0] ? __pfx_dst_output+0x10/0x10 [ 588.500711][ C0] addrconf_rs_timer+0x2d2/0x6c0 [ 588.500732][ C0] ? call_timer_fn+0xd4/0x5e0 [ 588.500748][ C0] ? lock_acquire+0x106/0x350 [ 588.500763][ C0] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 588.500782][ C0] ? do_raw_spin_lock+0x12b/0x2f0 [ 588.500805][ C0] call_timer_fn+0x192/0x5e0 [ 588.500820][ C0] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 588.500839][ C0] ? call_timer_fn+0xd4/0x5e0 [ 588.500854][ C0] ? __pfx_call_timer_fn+0x10/0x10 [ 588.500873][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 588.500886][ C0] ? __pfx_addrconf_rs_timer+0x10/0x10 [ 588.500906][ C0] __run_timer_base+0x652/0x8b0 [ 588.500919][ C0] ? ktime_get+0x45/0x220 [ 588.500944][ C0] ? __pfx___run_timer_base+0x10/0x10 [ 588.500959][ C0] ? ktime_get+0x1f5/0x220 [ 588.500981][ C0] ? lapic_next_event+0x11/0x20 [ 588.500999][ C0] run_timer_softirq+0xb7/0x170 [ 588.501014][ C0] handle_softirqs+0x225/0x840 [ 588.501029][ C0] ? __irq_exit_rcu+0xca/0x220 [ 588.501046][ C0] __irq_exit_rcu+0xca/0x220 [ 588.501060][ C0] irq_exit_rcu+0x9/0x30 [ 588.501072][ C0] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 588.501088][ C0] [ 588.501093][ C0] [ 588.501099][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 588.501115][ C0] RIP: 0010:nf_ct_iterate_cleanup+0xb7/0x500 [ 588.501139][ C0] Code: 18 45 31 e4 44 89 e0 45 89 e4 25 ff 03 00 00 c1 e0 06 48 8d 80 40 4d 66 8e 48 89 44 24 10 4a 8d 04 e5 00 00 00 00 4c 89 24 24 <48> 89 44 24 28 4c 8b 2d 4d 51 6a 06 49 01 c5 4d 89 ec 49 c1 ec 03 [ 588.501153][ C0] RSP: 0018:ffffc9000362f9c8 EFLAGS: 00000206 [ 588.501165][ C0] RAX: 000000000012ac58 RBX: ffffc9000362fa60 RCX: ffff888036890000 [ 588.501177][ C0] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 588.501186][ C0] RBP: 0000000000000001 R08: ffffffff90300cf7 R09: 1ffffffff206019e [ 588.501196][ C0] R10: dffffc0000000000 R11: fffffbfff206019f R12: 000000000002558b [ 588.501207][ C0] R13: ffff88814952ac50 R14: dffffc0000000000 R15: 1ffff920006c5f4c [ 588.501226][ C0] ? nf_ct_iterate_cleanup+0x4b5/0x500 [ 588.501248][ C0] ? nf_ct_iterate_cleanup+0xff/0x500 [ 588.501271][ C0] ? __pfx_inet_cmp+0x10/0x10 [ 588.501287][ C0] iterate_cleanup_work+0xdc/0x180 [ 588.501303][ C0] ? __pfx_iterate_cleanup_work+0x10/0x10 [ 588.501322][ C0] ? rcu_is_watching+0x15/0xb0 [ 588.501339][ C0] ? process_scheduled_works+0xa20/0x14e0 [ 588.501354][ C0] process_scheduled_works+0xa8e/0x14e0 [ 588.501378][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 588.501394][ C0] ? assign_work+0x3cf/0x5d0 [ 588.501409][ C0] worker_thread+0xa47/0xfb0 [ 588.501433][ C0] kthread+0x389/0x470 [ 588.501451][ C0] ? __pfx_worker_thread+0x10/0x10 [ 588.501465][ C0] ? __pfx_kthread+0x10/0x10 [ 588.501488][ C0] ret_from_fork+0x514/0xb70 [ 588.501505][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 588.501519][ C0] ? __switch_to+0xc89/0x1420 [ 588.501541][ C0] ? __pfx_kthread+0x10/0x10 [ 588.501559][ C0] ret_from_fork_asm+0x1a/0x30 [ 588.501582][ C0] [ 589.362422][T22889] __nla_validate_parse: 2 callbacks suppressed [ 589.362443][T22889] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4321'. [ 589.391016][T22889] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4321'. [ 589.404413][T22889] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4321'. [ 589.457818][T22851] mac80211_hwsim hwsim47 wlan0: left allmulticast mode [ 589.477306][T22851] vlan2: left promiscuous mode [ 589.492651][T22851] bond1: left promiscuous mode [ 589.497760][T22851] vlan2: left allmulticast mode [ 589.503590][T22851] bond1: left allmulticast mode [ 589.519372][T22865] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 589.522987][T22879] pim6reg0: tun_chr_ioctl cmd 1074812118 [ 589.558058][T22876] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 589.568628][T22876] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 589.578288][T22876] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 589.611145][T19252] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.619713][T19252] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.633058][T19252] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.641574][T19252] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 589.742361][ T5742] net_ratelimit: 5 callbacks suppressed [ 589.742379][ T5742] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 590.223122][ T7737] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 591.264203][ T7737] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.302702][ T7729] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.383190][ T199] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.391872][T19252] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.400558][ T8275] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.409136][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.417978][ T7729] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 592.426122][ T7928] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.502725][ T7929] net_ratelimit: 5 callbacks suppressed [ 595.502745][ T7929] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.582687][ T7737] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.622488][ T7737] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 597.662541][ T7729] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog