last executing test programs: 7.836591333s ago: executing program 3 (id=5311): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) r0 = socket(0x8, 0x3, 0x0) pselect6(0x40, &(0x7f0000000000)={0x10, 0x4, 0x80000000000, 0x3, 0x0, 0x0, 0x0, 0x8f}, 0x0, 0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x6180, 0x0) writev(r0, &(0x7f0000002c00)=[{&(0x7f0000002940)="59721f1223e8d1f829bfa3e27a317bdab2973149c7b70b981e5e3dbd2a155a52d656b4905bdd", 0x26}], 0x1) 4.691882489s ago: executing program 3 (id=5325): openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x8100, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@dev, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{@in=@private=0xa010101, 0x0, 0x3c}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xfd}, 0x3503, 0x0, 0x0, 0x7, 0x0, 0x6}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) accept4$phonet_pipe(r5, 0x0, 0x0, 0x80000) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, 0x0, &(0x7f0000000180)) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) 4.455933083s ago: executing program 0 (id=5326): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000006080)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd21, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x2, 0x8}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x8848}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0xc, 0xc}, {0x0, 0xfff1}, {0xfff2, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4041080) 4.274603591s ago: executing program 0 (id=5327): openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x8100, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@dev, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{@in=@private=0xa010101, 0x0, 0x3c}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xfd}, 0x3503, 0x0, 0x0, 0x7, 0x0, 0x6}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) accept4$phonet_pipe(r5, 0x0, 0x0, 0x80000) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, 0x0, &(0x7f0000000180)) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) 3.709210057s ago: executing program 3 (id=5334): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000200)={@val={0xa}, @void, @eth={@multicast, @remote, @void, {@ipv6={0x86dd, @udp={0xd, 0x6, '\x00 \x00', 0x18, 0x11, 0xff, @empty, @mcast2, {[], {0x4f19, 0x4e20, 0x18, 0x0, @wg=@data={0x4, 0xb, 0x10000}}}}}}}}, 0x52) 3.366037697s ago: executing program 0 (id=5337): r0 = socket$inet(0x2, 0x80001, 0x84) r1 = socket$inet(0x2, 0x80001, 0x84) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000280)=0x3, 0x4) bind$inet(r1, &(0x7f0000000180)={0x2, 0xce20, @empty}, 0x10) listen(r1, 0x3) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000280)=0x3, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0xce20, @local}, 0x10) listen(r0, 0x3) r2 = socket$inet(0x2, 0x80001, 0x84) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000280)=0x3, 0x4) bind$inet(r2, &(0x7f0000000180)={0x2, 0xce20, @empty}, 0x10) listen(r2, 0x3) 3.317973269s ago: executing program 3 (id=5338): unshare(0x6a040000) unshare(0x44000000) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={0x2, 0x1, 0x0, 0x3, 0xa, 0x0, 0x0, 0x25dfdbfc, [@sadb_x_nat_t_type={0x1, 0x14, 0xf}, @sadb_address={0x5, 0x5, 0x32, 0x0, 0x0, @in6={0xa, 0x4e20, 0x8, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1ff}}, @sadb_x_sa2={0x2, 0x13, 0x1, 0x0, 0x0, 0x70bd2a, 0x3507}]}, 0x50}}, 0x0) close(r0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r2, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001380)={0x0, 0x0, 0x0}, 0x40) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x40) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x4000}, 0x800) recvfrom(r3, 0x0, 0x0, 0x4100, 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x68041, 0x0) socket$pppoe(0x18, 0x1, 0x0) socket$rxrpc(0x21, 0x2, 0xa) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r5, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x2}, 0x8) sendmsg$NL802154_CMD_NEW_SEC_KEY(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x80001, 0x0) socket$inet6(0xa, 0x1, 0x0) close(r2) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r6, 0x0) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) 3.224809844s ago: executing program 0 (id=5339): socket$inet6(0xa, 0x3, 0x6) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf83, 0x3}, 0x1c) r3 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r3, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x38, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0x69801}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @dev}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendto$packet(r0, &(0x7f0000000280)="31bb6f", 0x3, 0x6040004, &(0x7f0000000200)={0x11, 0x88a8, r4, 0x1, 0x4, 0x6, @local}, 0x14) 3.120921908s ago: executing program 0 (id=5341): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r0, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) writev(r0, &(0x7f0000000200)=[{&(0x7f00000000c0)='X', 0x8030000}], 0x11) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000004c0)='pids.current\x00', 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$rds(0x15, 0x5, 0x0) getsockopt$rose(0xffffffffffffffff, 0x104, 0x7, 0x0, 0x0) bind$rds(r2, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$rds(r2, &(0x7f00000002c0)={&(0x7f00000000c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000640)}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00"/12], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) socket$netlink(0x10, 0x3, 0x5) syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0), r1) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0xac}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x71be}, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) accept(r2, &(0x7f0000000240)=@sco, &(0x7f0000000000)=0x80) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r5, 0x0) mmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1800000, 0x22051, r2, 0x10000000) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x2000009, 0x12, 0xffffffffffffffff, 0x194e000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x1c, 0x0, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x97, &(0x7f0000001300)=""/151, 0x0, 0xa}, 0x94) shutdown(r0, 0x1) 2.835913694s ago: executing program 2 (id=5343): r0 = socket$kcm(0x10, 0x2, 0x4) setsockopt$kcm_KCM_RECV_DISABLE(0xffffffffffffffff, 0x119, 0x1, 0x0, 0x0) close(r0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0xfffffffe}, [@alu={0x4, 0x0, 0xd, 0xa, 0x0, 0x0, 0x10}]}, &(0x7f0000000000)='GPL\x00', 0x1, 0x7d, &(0x7f00000001c0)=""/125, 0x40f00, 0x4}, 0x94) socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40000) close(0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER_AVC(0xffffffffffffffff, 0x0, 0x4000084) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514000cc008001b0007000200060001c00200bc24eab556a705251e618294ff4051f60a84c9f4d4938037e786a6d000106b062e585e4a85dc9b1335d1", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4) 2.610193595s ago: executing program 1 (id=5344): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r1, 0x0, 0xfffffe4f) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0x18}, 0x4e21, 0x3, 'lblcr\x00', 0x1c, 0x4, 0x8000005}, 0x2c) r3 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010101, 0x4e21, 0x3, 'wrr\x00', 0x23, 0x81, 0x5}, {@dev={0xac, 0x14, 0x14, 0x3c}, 0x4e23, 0x10000, 0x1cb, 0x12d61, 0x12d58}}, 0x44) sendmsg$sock(r3, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 2.550708632s ago: executing program 2 (id=5345): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x50, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x0, 0x21018}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_LABEL={0x8, 0xb, 0x1, 0x0, 0x1}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve0\x00'}]}, 0x50}}, 0x80) r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$IP_SET_OP_GET_FNAME(r0, 0x1, 0x53, &(0x7f0000000240)={0x8, 0x7, 0x0, 'syz2\x00'}, &(0x7f0000000300)=0x2c) r1 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockname(r1, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) r4 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r3, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r3, {}, {}, {0xfff3}}}, 0x24}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x2, 0x8, 0xff1, 0x41000, 0xffffffffffffffff, 0x82f, '\x00', r3, 0xffffffffffffffff, 0x5, 0x5, 0x4}, 0x50) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$igmp6(0xa, 0x3, 0x2) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000340), r5) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x200000c1}, 0x8000850) syz_genetlink_get_family_id$netlbl_mgmt(0x0, r5) pipe(0x0) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000000380)={0xa, 0x14e24}, 0x1c) connect$inet6(r6, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmmsg(r6, &(0x7f00000092c0), 0x4ff, 0x41) 2.500261328s ago: executing program 1 (id=5346): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000280)='contention_end\x00', r2}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@gettfilter={0x24, 0x2e, 0x1, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff3}, {0x2, 0xfff1}, {0xc, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0x24000010) 2.115533252s ago: executing program 4 (id=5347): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000400)=@bpf_lsm={0x6, 0x5, &(0x7f00000004c0)=ANY=[@ANYBLOB="180000000000000000000000000000046110000000000000620002000000000095"], &(0x7f0000000100)='GPL\x00', 0x5, 0xd2, &(0x7f00000002c0)=""/210, 0x0, 0x5}, 0x94) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000440)=[{0x20, 0x0, 0x5, 0xfffff010}, {0x6, 0x0, 0x2}]}, 0x10) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r1, &(0x7f0000000040)='\f\x00', 0xffeb, 0x0, &(0x7f0000000340), 0x10) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x9}, 0x1c) listen(r2, 0x3) syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @link_local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "2a8435", 0x14, 0x6, 0xff, @empty, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x4, 0x5, 0xc2}}}}}}}, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '@\x00', 0x14, 0x6, 0x1, @empty, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x0, 0x0, 0xe}}}}}}}, 0x0) 2.109356897s ago: executing program 1 (id=5348): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000840)=@newtfilter={0x24, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xfff3, 0x7}, {}, {0xfff3, 0xfff2}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000080}, 0x40010) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000800)=@newtfilter={0xf0, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r6, {0x0, 0xfff2}, {}, {0xa, 0x6}}, [@filter_kind_options=@f_flower={{0xb}, {0xc0, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x8, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_GENEVE={0x4}]}, @TCA_FLOWER_KEY_ENC_OPTS={0xb4}]}}]}, 0xf0}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) 2.060529902s ago: executing program 2 (id=5349): openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x8100, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@dev, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{@in=@private=0xa010101, 0x0, 0x3c}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xfd}, 0x3503, 0x0, 0x0, 0x7, 0x0, 0x6}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) accept4$phonet_pipe(r4, 0x0, 0x0, 0x80000) r5 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, 0x0, &(0x7f0000000180)) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) 1.986178568s ago: executing program 4 (id=5350): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IEEE802154_SCAN_REQ(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="8d2206001100ff002800128009000100766c616e00000000180002800c0002001f0000001f000000060001000100000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x58}, 0x1, 0x0, 0x0, 0x20000645}, 0x0) 1.82064935s ago: executing program 0 (id=5351): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, 0x0, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.bfq.time\x00', 0x26e1, 0x0) close(r0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) unshare(0x68040200) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f00000001c0)=@ccm_128={{0x304}, "0300", "95670cff05e29ee8dcfc54e13b2dd711", "fdffb26f", "a2deb79f8c96bff4"}, 0x28) socket$inet6_mptcp(0xa, 0x1, 0x106) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8923, &(0x7f00000000c0)={'bond_slave_0\x00', @random="013301300108"}) socket$inet_mptcp(0x2, 0x1, 0x106) r3 = socket$inet(0x2, 0x2, 0x0) bpf$MAP_GET_NEXT_KEY(0x15, 0x0, 0x0) shutdown(r3, 0x0) r4 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@map=r4, 0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) syz_open_procfs$namespace(0x0, 0x0) unshare(0x6a040000) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040), 0xc, 0x0}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000640)={'ip6gre0\x00', &(0x7f00000005c0)={'syztnl2\x00', 0x0, 0x4, 0x6, 0x4, 0x6, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}, @loopback, 0x0, 0x40, 0xde9, 0x3b5f}}) getsockopt$inet_mptcp_buf(0xffffffffffffffff, 0x11c, 0x3, &(0x7f0000000040)=""/185, &(0x7f0000000100)=0xb9) socket(0x8, 0x3, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000040)={'dummy0\x00', &(0x7f0000000080)=@ethtool_channels={0x3c, 0x1, 0x9040, 0x3, 0x1, 0xc000, 0x8, 0x2f, 0x1ff}}) write(r1, &(0x7f00000006c0)="91", 0x1) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000880)=0x3, 0x4) 1.771838325s ago: executing program 1 (id=5352): ioctl$INCFS_IOC_CREATE_FILE(0xffffffffffffffff, 0xc058671e, &(0x7f00000005c0)={{'\x00', 0x3}, {0x4}, 0x40, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)="88ff7c33bdcbc8349cfc7b9412a8026e3cb06304ed03cef662a2b8a27602cf6857117ab00cf1a937dce17459b876ac1d394142f48dacafccfb7259a80f8a213fd6fdf2c53200f3dfef55305052b6", 0x4e, 0x0, 0x0}) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a0b040000000000000000020000002c0004802800018007000100637400001c000280080001400000"], 0x80}}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)=ANY=[@ANYRES16, @ANYRES32=0x0, @ANYBLOB="97020000000000005c00128009000100626f6e64000000001800088000000000e00000017f0000016401010247d606336f40dc4a0000000008000700"/71], 0x8c}}, 0x0) write$tun(r1, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x16, 0x0, 0x14}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x0, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2}, @generic={0x0, 0x2, "d58838068b91"}]}}}}}}, 0xfd6c) 1.406189438s ago: executing program 4 (id=5353): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000060a0b040000000000000000020000002c0004802800018007000100637400001c0002800800014000000002080002400000000b05000300000000000900010073797a30000000000900020073797a3200000000"], 0x80}}, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f00000003c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socket$nl_rdma(0x10, 0x3, 0x14) write$tun(r2, &(0x7f0000001700)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x1, 0x0, 0x14}, @ipv4=@generic={{0x5, 0x4, 0x2, 0x2, 0xfbc, 0x64, 0x0, 0xb, 0x88, 0x0, @private=0xa0100fe, @dev={0xac, 0x14, 0x14, 0x1a}}, "3297e3ba0fa8a2e71bd9fe1a399b5110420b70460c0dad392d66248a43540df968e7fcaab34569c0e36170578c0d3c546a98b26295e2592f360905866eb4720fed03a977a3df4224895629fd6ccec64f13a999f18f518e3ee28798381975e862f1db9dccdb2f1c1fb60f5ffc7a339d40a8bd1f24cede8a32f186f142e194d4fb48224759faf813ea80e6a853e79b4fe27fe3e1aec5897b314a7f0d515b07b1835986b4885e9826d902c40f16cd77c58b6433ab039955ce9db11f36f459e7114ace6c9989eecea80a81fd39f339356c7c3391af83da2486503a7973f6db4806cf3e5ca94cf7e1f79fd00decd76100c18251a59d1474caabf4d3ca6a9a9885df710e68c5b0dc11832dbb5eecb5c88c2f8f02bdbd88569ad4a740359cbca8c378118220d73bdd1e661c3a74f77aa931b11cd38119b0f084bb96e84803fca6566c33ee1e4e34ab0253fbf24f9f5974af5e1fc2a43a4ec9dd9928a8f38a128ea27c429300ae5a6bd7740471f973d8224b2b07879f4fbe7dcbed776a72ebdc713bcf1d7aa45b01c32a1003e6670d58510bd79ba2fde5cb2b82cef2cc315648f4e9d96d848ba327949b8926253cbdef6888a8982108b6ac7a1108533dd3fe125002e2e286362d1055082a9d73ec5ac3080f2a501ff27250b62c8965f371cf92b32d6422d79f66261eb08a2f8fe50049e102c69ce703d116d0834208cc957d0f1376457a90245816d7642412897fdd2f982fdfbc3af65aa0446b00c767b79aec40e460887ea02188e3a0960eea39b144859467b881978378c9fd593259e0f63148179fe2c2f6d40987b63a6e384e63027f03d8039d707522942d5dc88fd842524d006290b6a65e9cc86cc5b401a60ec4aedfb3bf4d0447bb681810a16b9684b72c2f4593ef834a0203e78cd1d9dbc978e9ae8f3ab62c07f1e41d59470decee7b0cc41ac49e4b75a9ab6da65849f62ec217bb39ed161e7d337822d96badbd74d66451ea9a74bed591dc9631bf639dcf7846ee428a9fa55bfceedf3b1c23642f3b58dd0a7273664c6c49c9160a4b9cc5b72d0210e305b94e2cb09ae1d4af9d365b5093851f229c8c30aef75d45ccdbab4b86d801a9ad3b27f26ba601d531c0743717aa7aae29d37f496fec7682c5a1abd321ad61941a2d23fcac6af1d1875e308c8d8c64a5152be47b59c09d293f46b857310a99f1885f0a49d432aa0d39a3e8fc885e75e66b63215133175a19267c8d0adf7d8f644e742ed5369d1405e99e63b78727f135e0243f24d9ce354a1562102ee8de4c191508343b86bf7e7519ddd770ce55e17e590561b2f437194c97ad46622a6ae3dd68d9993e6744954f4cd308bd6594fdccedc578e80aed274a65219697229059723ac37d535cca0e9c314e7941b4160bbd2ffba71f26ffe3228431bc81463078ad70583277ef18bce23ca2e5b9a00670956ea8e0e2c739c006106c8c9ee3f92ba728d8490742b74a9a18cbedfc4e69bb87e0da4c7dfb964374c28c837d4641fb99a19b233675f8526af395335e0185cf3934805442ac379980b687a7128e53284ba9e741b5fe9bc969bfbd55cbce76842915e076e2adf844338d16d3802c681bafdcc60465bd34dfc2d1c069ceee40060e0570fc1275ccabfe3f9be3e84ceedf72cd649c082232008e2b0c94594588c00e0fe911bbf1c12eb6c37ce05674a7597feecf27f5e051ffa824d9ff93638dfa9a84c77562aa2cf897f55a97b79c18544ad03480e1011b8f93e0ead9c2c6672448f585c5803ae99be777fbc662ef4450c1e936ed8b3c8047f00e72adc84561f417f8e5e1dde4967005d96a64fc75d9f486b3ebdb5904a0a56ec48542f0efce939f66fd69259e7376ad37e84434ea90f35b2d3bd63b5c36b267d8f2c7dc5a50b46e00ed086dff8b039e07b84c60611269d4f282ad04dc8e0b481eece2f8a614734be73617f0ad5be195446b09dca4cf1f32653dd3e188aece76f3014deb2ba61744835c0f735234b6a4637c948a7b4fd4203b286ca87d669e325d70277075b094f59eb1dff6c9c05c40d5e464c563df79486e1a32e6ed9bcf675aac7968b4e98dc4e210215b0d3b6a2525b2e3df11f3f1490eb39cabffbe32e23659121fde8e4e346e0f595aaf3666a5f6f118c1a1128039502ac04c40b85eb4c54e6c95b8d1c2aac74ae9e1c355ccde9d54d5d833293f5df09224482179e5bcd8e227c9eaacb5793498be490de32baba49172a6e14c2cd4e6462ceb0a905a1d64804840ce62e350c6efac10a7fcb029f84af64e2256d45afd3b3f59379895740e0cd2fd24c63264f785bb6e3f40ec72ed67d1a7d87dd264743d9c951cb5aa8bc6f1d1bc9b23303d5aa7f8f6f961326757456057000cb2bacf78cc229002777e932c2640b8dfa793846ca49fa93996db95104a8808a1906b19df17e754b90582b6c49efb3ddce067dd9292291cfd2bb0323ce8098f29e4fce0de31cf5c7e2e2da5d0d0996a8be776de8fecfd3ce68e80d21f1701f6b90ac51278abbd727d19411e0ebe001b990b177b8db0c592b18a4b5e4a6221902362e5b20e6e6f2131a5a5e03c1150b179ef40c933c2fef1b79de738652ec4c32565f5cf751a11db177099c4e2e5bd7616cd0dd501d5bfccf5691de3cca590365328648baf8a9487a3c212193c9bb837594460967e823067a9465eba7001eaf609a810488ef5c147aaa5e9e8c75b585ac3582b6915e20b5aa2f79b7a94857122988c56dbce1ea52de1a56652e839bb853be3ee16052b33fb83ca54d8e4e19440a5e81492107043a66286f63ca87a1f7b8a4e9547a7eb6005419cfd28cb37e9e374f4d0143973286e87070754025c1a6fccfdc6858eaca8c35ecb19584ce7141cc79a5bc813469161b87a19fc21f3373d1f25b3427916dd1be2a589b70ea3b39fcc7801e13beaf19b76164faf3dc4ab8faa5648d24eddd6caceaa0d5ac9cad633c19a4a4d059ee823a49b7cf82c5777d376c111f58ea8fd473429907852301a2c856f27bd0c687ab5be0e2bbef64ddee1601375a4440e3f59d60f57caebfe457f82432523ec4a61cdbb7f1e91e4b05fda892df131c274b19929d26f7a5a6d3ca487983f729601ed9bb4bf5c1cc3d453d406e9534688dec6a2dd0b9db149365c125a95e129565e62cc91f7d960abe1055b730ae0994e7eb08392d5745d0e4f529c4defc3d3e43d0815b0cc63effa88d20c13b14e780c2f6c89a1ee5e4db45a5c272186cc3e51b13dab3add5f467e8ca0f4c45a1fc76db2f0cbf794102946aafcd8cd8a3e935a606b9721645c4d550ae0907f345593736506efc626498c974753d474a73626041d3a54f8fb50de2a6335611a3779da3a02daceb2256d9b102d4d30dd3cd389a04b1a7a6076879f36534bb3379debb46ed1fa2c40096c752017dd024345c58313b43070ff7bef94dc3cafbe6ec20d59e5ea3c196ba3b783bfa87384407efc664cd350c80ac397516018e35371956e414755cde304d2a228c1540ba6fd6a7402d11c666964f024da4c016eb556ba2c5fab86c60c12efb1496295d80f0383526e8e0fc55a287bbd3cb966a916f57958d8b6ef97aa0c4b47f7746bab6b99698c1c96b25c4e2e084147866fe0970b109dd26984adc0758eb6442712cc46dcd8ed3038b0595252eed1b8a46525862662d1e67eba66ac341f8d27853eed54854f488f079bd48df6ce7a4be8b1b61fd23a2dc4d3ade0992011539cc63f80fcfc75008c20cb639348cb218f8f476a6d56917f4ca07e67fc20ea2e9642eaf2182b397e279f5f6c70438fb8aa39cba788588c181461ea7efe1a0dd5b95eb26f7158b91012f7ce0ee1b4e79ce4da377bea4551738a0f491a84f19b3be9827b4469c299527aa9c20b8bf12f919976a0356bba720fb97800763c79bcbb10d89280f0f97cdd19aa0d54828b308195fac170613cf4b515e340a9ef2c97f618a9f50b30ae34ebeed9a38b4c6969680accc740b154ecb014fb5d543a59ccb98a7de2823a2dec39f331cb503eb74fef61262c6d4050bc723caee834eb28c64ce007f6027375e936b62387cf1778970e88b0574a0106d4c855be7425767c551b2fa644d9d8a59f787e7610581b768057d229673344571c3d6e3f10975b2859f568398b1f38f89524d9ad0c1588617c3883a1227b714c81cdf28da54f33968c1c50f28da01c308eb31d319b3e77f96bec001c9300000000000000009cc0062283ac112868592619db14d629c47bfb793a723dcd2f7b07ae4ec14ca3ef4b955ea5b2b153a279b080f6236d418075b86850974c8850efb306d5c304e726bf2643b4403e6d46b0e0395b02e93308b4b2c3e957308d497dc51c753344a7878f1f0c91295fd76e3d1cc9ef813161c6b92b7ea6068ceb97d8f45a4ce57af7d7632d699951f7fe3c71c3a32b014c74425c67e5030546b10cf7edcec2eca5ba31dc62c08f83f35bc2e36b93f15f071bc2537ebe9ca19f86dce4e84272e10323d0ceaa2cc47fe4f6ad101d454c761f9863e94af91199ce5f12469bca7ba39314b84aa7efa4bdc18f7700c19511d48d6132450111d70401a8ac73565d5386ca12345e884d08b23f9c901000a95eb4167865e58c28b112f47c96beeaa6657c923e25e56529107c5c30e65bb485d5ed21b91332db4e09df7e59dcfa05c994570deb3f9b838e22ae4abbf9a9a8c319cc9112c8dba7c2278f78b9578b0254c46a4c04b8fa4fedad6bd275f70b1618971ef6503379bfb0a508c9944328af2c820091a89e3f75e68e7f980ddc9154d273f7f2ce7a6294aefe93136860786679b80e41f6636ff45efeacfb52e2ba2bd9bd9c9030079a46caca5c4b340c17d01ba8ecbc5c561b2038481a8321c009d12136a3ad5461881d998eeaac5236fdcd8f81fb5e53848bb096d9198fd0d38830d1809f2a632b31e2b67754140c907ed58aead048b2d8af9a1c407e48db815212cfdcca97222dabdfe01f311a73e1e82c3e189ec5add48d3f8190eb9e14b58e540f7f1388a7c687629eadb19fd8a133dc8177629270ecaabff79efb6c1f750d89b9e6c5f34c6238066f8e3e425e46a27b3c0d2e9e2ed3cffe2a6f39b8e0137ea5de689b94107fb4748a5feb3902f0feba64dae4c2e69bc8d86463575c6b0ef4a8a64fef41121e57a8c67eda07e9fc8f98299677de198ea0a649ef3c00591940b2c27ba1414aaa1633deb52e3a44cfa8d7a00d014317c026a7d7f42a34b97128e1bf9cda4d8315819ac73ed5061bf9b5631d07b09b85b78ff1b6eb86e9e8c4faa0f991cd6fa0b0eb71b39c20ca9bc7c156f3bd255a5b408df172396bafd7f0fb11c6eaf1eb0a06576d37bee00424bf699584b1dfed68f0d8d8a35f0427c783fe2d79b4373628971e87501a5e4bb05b5058d0b2132741f26e76065b6f4017d963c8ee5605c4c5b6eebb96fca0a41893cb6add3fb0d728abeb860f22cedbd36e464bdaf124a7041460f7af3d64b54e9ffd240b5afad9baf6e5dd8406bc1b205da5848f51fc9dd5197716e144e1b0386614bd3cfd5ddb80ada1e5ca74c8960093a553b1f6288aa7f53663cdd867f658e51b95772dc7a6fa45fa03e14988a33250e6c16fbf0351769080d64ddfbdbf77e1215563bf2e82ecc38a682846d7e2e2ac4e87d715f97f15e84c3df04affee49612a735907d3c4d310a54a6f60"}}, 0xfca) 1.24983341s ago: executing program 1 (id=5354): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x2, &(0x7f0000000640)=ANY=[@ANYBLOB="850000"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000100)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="3f000000010000", 0x7) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)={0x28, r1, 0x50dc85624ea6cf59, 0x0, 0x1, {}, [@IPVS_CMD_ATTR_SERVICE={0x14, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x400c081}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x89a0, &(0x7f0000000040)={'veth1_virt_wifi\x00'}) 1.157348916s ago: executing program 4 (id=5355): socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b703000000000000850000007000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='tlb_flush\x00', r1}, 0x10) socket$netlink(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x15, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000073"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000edff0000000000000000850000000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0), 0x48) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r2, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) 1.156336737s ago: executing program 1 (id=5356): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x200440e5}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) r2 = getpid() r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r4, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r2}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) 1.124349871s ago: executing program 2 (id=5357): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route_sched(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@newtfilter={0x30, 0x2c, 0xd27, 0x1070bd28, 0xfffff003, {0x0, 0x0, 0x0, r3, {0xf000, 0x7}, {}, {0xf, 0x4}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8084}, 0x200c8000) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x6c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {0x3}, {}, {0x2, 0xfff1}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x80000001, 0x3, 0x8, 0xb, 0x101, 0xffffcbef, 0x183, 0x5, 0x7, 0x1, 0xd, 0xb, 0x1a, 0x3, 0xd0b, 0x3}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40098}, 0x4000000) 1.076967595s ago: executing program 3 (id=5358): openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x8100, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@dev, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{@in=@private=0xa010101, 0x0, 0x3c}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xfd}, 0x3503, 0x0, 0x0, 0x7, 0x0, 0x6}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) accept4$phonet_pipe(r5, 0x0, 0x0, 0x80000) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, 0x0, &(0x7f0000000180)) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) 1.056079292s ago: executing program 4 (id=5359): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x10, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan1\x00'}) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x8, &(0x7f0000000180)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x2f}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r0}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r1, 0x18000000000002a0, 0x4f, 0x0, &(0x7f00000002c0)="d2ff03076003008cb89e08f086dd", 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x2, 0x9, 0xfa, 0x0, 0x4, 0x0, 0x70bd25, 0x25dfdbfe, [@sadb_x_sec_ctx={0x1, 0x18, 0x7, 0xff}, @sadb_x_nat_t_type={0x1, 0x14, 0x57}]}, 0x20}}, 0x24000800) bind$unix(r2, &(0x7f0000003000)=@abs={0x1, 0x0, 0xffffffff}, 0x6e) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000040)={@private1, 0x6, 0x0, 0x1, 0x7}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r4, 0x8b32, &(0x7f0000000040)) r5 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r5, &(0x7f0000000340)=@nameseq={0x1e, 0x1, 0x3, {0x43, 0x0, 0xfffffffc}}, 0x2f) r6 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000000)={0x41, 0x2, 0x1}, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080), r6) r8 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r8, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_int(r8, 0x29, 0x3, 0x0, 0x0) recvmmsg(r8, &(0x7f00000049c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=""/4096, 0x1000}, 0x7}], 0x1, 0x2, 0x0) setsockopt$inet6_int(r8, 0x29, 0x8, &(0x7f0000000000)=0x7f, 0x4) sendto$inet6(r8, 0x0, 0x0, 0x20000001, &(0x7f0000000300)={0xa, 0x4e20, 0x5, @mcast1}, 0x1c) sendmsg$TIPC_CMD_GET_NODES(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)={0x1c, r7, 0x1, 0x1d, 0x0, {{}, {0x0, 0x6}}}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) 637.251551ms ago: executing program 2 (id=5360): socket$inet_tcp(0x2, 0x1, 0x0) socket$kcm(0x10, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket(0x400000000010, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x9, 0x3, 0xc, 0x3, 0x0, 0xffffffffffffffff, 0x3}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x11, 0xc, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1000009}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x17, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r1}, 0x10) socket$unix(0x1, 0x5, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r2, @ANYBLOB="08000100", @ANYRES32=r3], 0x90}}, 0x0) 444.721079ms ago: executing program 2 (id=5361): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbee1, 0x8031, 0xffffffffffffffff, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, 0x0) r1 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x61f0, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_CQ_GET(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000400)={0x18, 0x140c, 0x4, 0x70bd26, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x20000056) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)=ANY=[@ANYBLOB="180100002e00"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) close(0x4) 129.362928ms ago: executing program 4 (id=5362): openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x8100, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6(0xa, 0x3, 0x7) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@dev, @in6=@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80}, {}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{@in=@private=0xa010101, 0x0, 0x3c}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0xfd}, 0x3503, 0x0, 0x0, 0x7, 0x0, 0x6}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet6_sctp(0xa, 0x5, 0x84) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) accept4$phonet_pipe(r5, 0x0, 0x0, 0x80000) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) 0s ago: executing program 3 (id=5363): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB="b820000003144a6b208dedf5ac8043"], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8844) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) socket(0x22, 0x2, 0x4) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000000)="89e7ee2c7cdad9b4b47380c988ca", 0x140}], 0x1) kernel console output (not intermixed with test programs): upported socket: should be TCP or UNIX. [ 626.925132][T17951] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3471'. [ 627.007506][T17947] bond7: option tlb_dynamic_lb: invalid value (71) [ 627.024363][T17951] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3471'. [ 627.058790][T17947] bond7 (unregistering): Released all slaves [ 627.158526][T17958] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3472'. [ 627.276299][T17958] nbd: socks must be embedded in a SOCK_ITEM attr [ 629.559128][T18024] __nla_validate_parse: 3 callbacks suppressed [ 629.559147][T18024] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3484'. [ 629.731731][T18029] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 630.864796][T18056] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3491'. [ 631.065400][T18056] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3491'. [ 631.817145][T18088] netlink: 1 bytes leftover after parsing attributes in process `syz.3.3497'. [ 631.884282][T18089] netlink: 80 bytes leftover after parsing attributes in process `syz.3.3497'. [ 631.912232][T18089] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 632.185379][T18094] lo speed is unknown, defaulting to 1000 [ 632.244136][T18095] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3499'. [ 632.553026][T18105] syzkaller1: entered promiscuous mode [ 632.561346][T18105] syzkaller1: entered allmulticast mode [ 632.855741][T18122] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3505'. [ 634.515537][T18142] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 634.538083][T18143] netlink: 'syz.0.3509': attribute type 13 has an invalid length. [ 634.587036][T18143] netlink: 'syz.0.3509': attribute type 17 has an invalid length. [ 634.734077][T18143] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 635.051839][T18134] lo speed is unknown, defaulting to 1000 [ 635.518188][T18159] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3512'. [ 635.780070][T18172] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3515'. [ 635.889978][T18174] syzkaller0: entered promiscuous mode [ 635.895495][T18174] syzkaller0: entered allmulticast mode [ 636.048332][T18183] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3518'. [ 636.202492][T18192] lo speed is unknown, defaulting to 1000 [ 636.582577][T18206] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 636.780873][T18210] bond0: (slave bond_slave_0): Releasing backup interface [ 636.806377][T18210] bond_slave_0: left promiscuous mode [ 636.834605][T18210] bond0: (slave bond_slave_1): Releasing backup interface [ 636.845127][T18210] bond_slave_1: left promiscuous mode [ 636.878506][T18210] bond1: (slave bridge1): Releasing active interface [ 636.984226][T18210] bond2: (slave ip6erspan0): Releasing active interface [ 636.997488][T18210] bond3: (slave gre1): Releasing backup interface [ 637.017076][T18210] bond5: (slave bridge10): Releasing backup interface [ 637.172160][T18210] team0: Port device bridge14 removed [ 637.321479][T18210] team0: Mode changed to "loadbalance" [ 637.525915][T18225] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 637.916667][T18239] lo speed is unknown, defaulting to 1000 [ 637.956989][T18239] lo speed is unknown, defaulting to 1000 [ 637.964825][T18239] lo speed is unknown, defaulting to 1000 [ 638.111035][T18252] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3532'. [ 638.165417][T18239] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 638.501073][T18239] lo speed is unknown, defaulting to 1000 [ 638.509061][T18239] lo speed is unknown, defaulting to 1000 [ 638.583548][T18258] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3533'. [ 638.766160][T18239] lo speed is unknown, defaulting to 1000 [ 638.972380][T18239] lo speed is unknown, defaulting to 1000 [ 638.974842][T18272] A link change request failed with some changes committed already. Interface ªªªªªªòÓ»ö濾1I may have been left with an inconsistent configuration, please check. [ 639.019110][T18239] lo speed is unknown, defaulting to 1000 [ 639.033611][T18257] lo speed is unknown, defaulting to 1000 [ 639.042555][T18239] lo speed is unknown, defaulting to 1000 [ 639.629012][T18293] netlink: 'syz.4.3542': attribute type 9 has an invalid length. [ 640.247380][T18313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 640.273183][T18313] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 640.295622][ T5895] lo speed is unknown, defaulting to 1000 [ 640.322861][ T5895] syz1: Port: 1 Link ACTIVE [ 640.398370][T18318] netlink: 'syz.0.3547': attribute type 1 has an invalid length. [ 640.413966][T18317] lo speed is unknown, defaulting to 1000 [ 640.420694][T18318] netlink: 172 bytes leftover after parsing attributes in process `syz.0.3547'. [ 640.533408][T18322] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3548'. [ 641.347368][T18333] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 641.396564][T18335] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3552'. [ 641.406279][T18335] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3552'. [ 641.415575][T18335] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3552'. [ 641.460086][T18335] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3552'. [ 641.660540][T18339] lo speed is unknown, defaulting to 1000 [ 641.675513][T18317] lo speed is unknown, defaulting to 1000 [ 642.257296][T18339] lo speed is unknown, defaulting to 1000 [ 642.266024][T18355] lo speed is unknown, defaulting to 1000 [ 642.724590][T18355] lo speed is unknown, defaulting to 1000 [ 643.494427][T18374] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3561'. [ 643.622719][T18378] lo speed is unknown, defaulting to 1000 [ 643.654726][T18381] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3560'. [ 643.678312][T18383] macsec2: entered promiscuous mode [ 643.684233][T18381] netlink: 'syz.1.3560': attribute type 5 has an invalid length. [ 643.684257][T18381] netlink: 'syz.1.3560': attribute type 8 has an invalid length. [ 643.684271][T18381] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3560'. [ 643.714910][T18383] mac80211_hwsim hwsim9 wlan1: entered promiscuous mode [ 643.777488][T18383] mac80211_hwsim hwsim9 wlan1: left promiscuous mode [ 643.925155][T18381] geneve6: entered promiscuous mode [ 643.931361][T18381] geneve6: entered allmulticast mode [ 643.942662][T18387] veth0_to_bond: left allmulticast mode [ 643.963849][T18387] veth0_to_bond: left promiscuous mode [ 643.969829][T18387] bridge9: port 2(veth0_to_bond) entered disabled state [ 643.982254][T18387] bond1: (slave geneve2): Releasing active interface [ 643.991764][T18393] netlink: 'syz.2.3565': attribute type 303 has an invalid length. [ 644.001087][T18387] bond2: (slave bridge6): Releasing backup interface [ 644.007936][T18387] bridge6: left promiscuous mode [ 644.013358][T18387] bridge6: left allmulticast mode [ 644.016688][T18391] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3565'. [ 644.030646][T18387] bond3: (slave bridge7): Releasing active interface [ 644.040030][T18387] bond3: (slave gretap1): Releasing active interface [ 644.048845][T18387] bond4: (slave vcan1): Releasing backup interface [ 644.056012][T18387] bond4: (slave vcan2): making interface the new active one [ 644.065940][T18387] bond4: (slave vcan2): Releasing backup interface [ 644.074245][T18387] veth9: left allmulticast mode [ 644.080334][T18387] veth9: left promiscuous mode [ 644.085294][T18387] bridge9: port 1(veth9) entered disabled state [ 644.094228][T18387] vlan0: left promiscuous mode [ 644.098995][T18387] veth1: left promiscuous mode [ 644.104789][T18387] bridge9: port 3(vlan0) entered disabled state [ 644.114517][T18378] lo speed is unknown, defaulting to 1000 [ 644.123103][T18380] lo speed is unknown, defaulting to 1000 [ 644.431245][T18402] netlink: 1 bytes leftover after parsing attributes in process `syz.2.3567'. [ 644.601397][T18405] Cannot find add_set index 0 as target [ 644.715241][T18380] lo speed is unknown, defaulting to 1000 [ 645.011984][T18415] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 645.187658][T18414] lo speed is unknown, defaulting to 1000 [ 645.492269][T18414] lo speed is unknown, defaulting to 1000 [ 645.494922][T18424] lo speed is unknown, defaulting to 1000 [ 646.158737][T18424] lo speed is unknown, defaulting to 1000 [ 646.265445][T18433] __nla_validate_parse: 1 callbacks suppressed [ 646.265470][T18433] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3574'. [ 647.343299][T18466] syzkaller0: entered promiscuous mode [ 647.348907][T18466] syzkaller0: entered allmulticast mode [ 647.503129][T18468] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 647.543821][T18472] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 647.752308][T18478] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3588'. [ 648.200933][T18486] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3589'. [ 648.465274][T18489] lo speed is unknown, defaulting to 1000 [ 648.980325][T18496] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3590'. [ 649.200103][T18493] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3590'. [ 649.328043][T18503] syzkaller0: entered promiscuous mode [ 649.333654][T18503] syzkaller0: entered allmulticast mode [ 649.388805][T18489] lo speed is unknown, defaulting to 1000 [ 649.834877][T18509] netlink: 'syz.4.3594': attribute type 303 has an invalid length. [ 649.886948][T18509] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3594'. [ 650.026642][T18521] lo speed is unknown, defaulting to 1000 [ 650.205120][T18523] syzkaller0: entered promiscuous mode [ 650.220971][T18523] syzkaller0: entered allmulticast mode [ 650.530767][T18521] lo speed is unknown, defaulting to 1000 [ 650.563212][T18532] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 650.890069][T18538] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3602'. [ 650.917625][T18538] netlink: 'syz.3.3602': attribute type 5 has an invalid length. [ 650.972305][T18538] netlink: 'syz.3.3602': attribute type 8 has an invalid length. [ 651.028365][T18538] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3602'. [ 651.165590][T18538] geneve3: entered promiscuous mode [ 651.173846][T18538] geneve3: entered allmulticast mode [ 651.190083][ T49] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 651.263983][ T49] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 651.275922][ T49] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 651.310044][ T49] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 651.323514][T18545] syzkaller0: entered promiscuous mode [ 651.355548][T18545] syzkaller0: entered allmulticast mode [ 651.506363][T18546] lo speed is unknown, defaulting to 1000 [ 651.704916][T18558] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3607'. [ 652.080990][T18546] lo speed is unknown, defaulting to 1000 [ 652.081032][T18548] lo speed is unknown, defaulting to 1000 [ 652.474205][T18566] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 652.559001][T18548] lo speed is unknown, defaulting to 1000 [ 652.677275][T18566] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 653.294306][T18566] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 653.465924][T18566] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 653.725239][T14041] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 653.781563][T14041] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 653.834195][T14041] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 653.864457][T14041] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 654.217083][T18596] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 654.813275][T18605] netlink: 'syz.2.3615': attribute type 23 has an invalid length. [ 655.229814][T18621] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3616'. [ 655.382163][T18627] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3620'. [ 655.758361][T18635] lo speed is unknown, defaulting to 1000 [ 655.789981][T18640] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3623'. [ 656.399783][T18635] lo speed is unknown, defaulting to 1000 [ 656.400254][T18643] lo speed is unknown, defaulting to 1000 [ 656.867837][T18663] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3627'. [ 657.088359][T18643] lo speed is unknown, defaulting to 1000 [ 657.406521][T18673] lo speed is unknown, defaulting to 1000 [ 657.674933][T18681] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3631'. [ 657.745767][T18674] lo speed is unknown, defaulting to 1000 [ 658.003427][T18681] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3631'. [ 658.031378][T18674] lo speed is unknown, defaulting to 1000 [ 658.044810][T18678] lo speed is unknown, defaulting to 1000 [ 658.050656][T18673] lo speed is unknown, defaulting to 1000 [ 658.716782][T18691] netlink: 'syz.0.3632': attribute type 303 has an invalid length. [ 658.733351][T18691] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3632'. [ 658.808868][T18699] netlink: 'syz.2.3634': attribute type 13 has an invalid length. [ 658.817526][T18699] netlink: 'syz.2.3634': attribute type 17 has an invalid length. [ 658.927766][T18678] lo speed is unknown, defaulting to 1000 [ 659.040800][T18699] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 659.065717][T18705] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3635'. [ 659.151927][T18708] tipc: Can't bind to reserved service type 1 [ 659.164535][T18708] netlink: 'syz.0.3636': attribute type 39 has an invalid length. [ 659.219092][T18710] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3636'. [ 659.229032][T18710] netlink: 43 bytes leftover after parsing attributes in process `syz.0.3636'. [ 659.251426][T18710] netlink: 'syz.0.3636': attribute type 5 has an invalid length. [ 659.275019][T18710] netlink: 43 bytes leftover after parsing attributes in process `syz.0.3636'. [ 659.353141][T18700] lo speed is unknown, defaulting to 1000 [ 659.388127][T18716] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3637'. [ 659.391502][T18710] vlan2: entered allmulticast mode [ 659.890867][T18700] lo speed is unknown, defaulting to 1000 [ 659.923560][T18729] lo speed is unknown, defaulting to 1000 [ 660.378587][T18729] lo speed is unknown, defaulting to 1000 [ 660.735274][T18748] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3646'. [ 660.793648][T18749] lo speed is unknown, defaulting to 1000 [ 660.992969][T18761] tipc: Enabled bearer , priority 0 [ 661.405804][T18749] lo speed is unknown, defaulting to 1000 [ 661.428426][T18772] lo speed is unknown, defaulting to 1000 [ 661.825960][T18769] lo speed is unknown, defaulting to 1000 [ 661.841935][T18772] lo speed is unknown, defaulting to 1000 [ 662.180853][T18797] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 662.310012][T18791] lo speed is unknown, defaulting to 1000 [ 662.310534][T18769] lo speed is unknown, defaulting to 1000 [ 663.110515][T18817] lo speed is unknown, defaulting to 1000 [ 663.413790][T18826] __nla_validate_parse: 2 callbacks suppressed [ 663.413808][T18826] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3661'. [ 663.912889][T18791] lo speed is unknown, defaulting to 1000 [ 664.027361][T18817] lo speed is unknown, defaulting to 1000 [ 664.197642][T18829] tipc: Enabling of bearer rejected, failed to enable media [ 664.757418][T18839] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3663'. [ 665.178703][T18842] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3664'. [ 665.617784][T18847] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3665'. [ 665.736375][T18851] netlink: 'syz.4.3666': attribute type 2 has an invalid length. [ 665.760768][T18851] netlink: 'syz.4.3666': attribute type 9 has an invalid length. [ 665.768647][T18851] netlink: 184 bytes leftover after parsing attributes in process `syz.4.3666'. [ 665.918201][T18854] lo speed is unknown, defaulting to 1000 [ 666.273847][T18868] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3671'. [ 666.763957][T18853] lo speed is unknown, defaulting to 1000 [ 666.780189][T18854] lo speed is unknown, defaulting to 1000 [ 666.834491][T18873] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3672'. [ 667.291381][T18879] tipc: Enabled bearer , priority 0 [ 667.299083][T18879] syzkaller0: entered promiscuous mode [ 667.305756][T18879] syzkaller0: entered allmulticast mode [ 667.345618][T18879] tipc: Resetting bearer [ 667.420045][T18878] tipc: Resetting bearer [ 667.610743][T18878] tipc: Disabling bearer [ 667.744367][T18860] lo speed is unknown, defaulting to 1000 [ 667.751190][T18853] lo speed is unknown, defaulting to 1000 [ 667.903496][T18881] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3674'. [ 668.125276][T18866] lo speed is unknown, defaulting to 1000 [ 668.291004][T18885] syzkaller0: entered promiscuous mode [ 668.296579][T18885] syzkaller0: entered allmulticast mode [ 668.426813][T18860] lo speed is unknown, defaulting to 1000 [ 668.492407][T18866] lo speed is unknown, defaulting to 1000 [ 668.524371][T18799] Set syz1 is full, maxelem 65536 reached [ 668.764880][T18889] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3677'. [ 669.456860][ T49] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 669.489265][ T49] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 54406 - 0 [ 669.498255][ T49] netdevsim netdevsim1 eth0: set [1, 2] type 2 family 0 port 44162 - 0 [ 669.572233][T14041] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 669.581196][T14041] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 54406 - 0 [ 669.592397][T14041] netdevsim netdevsim1 eth1: set [1, 2] type 2 family 0 port 44162 - 0 [ 669.648851][T14041] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 669.664981][T14041] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 54406 - 0 [ 669.673800][T14041] netdevsim netdevsim1 eth2: set [1, 2] type 2 family 0 port 44162 - 0 [ 669.698293][ T69] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 669.706873][ T69] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 54406 - 0 [ 669.730113][ T69] netdevsim netdevsim1 eth3: set [1, 2] type 2 family 0 port 44162 - 0 [ 670.054596][T18918] tun0: tun_chr_ioctl cmd 1074025675 [ 670.109465][T18918] tun0: persist enabled [ 670.117015][T18918] tun0: tun_chr_ioctl cmd 1074025675 [ 670.134735][T18918] tun0: persist disabled [ 670.277297][T18923] syzkaller0: entered promiscuous mode [ 670.283334][T18923] syzkaller0: entered allmulticast mode [ 670.355326][T18929] lo speed is unknown, defaulting to 1000 [ 670.766547][T18929] lo speed is unknown, defaulting to 1000 [ 671.003278][T18944] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3690'. [ 671.085221][T18947] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 671.264560][T18951] tipc: Enabled bearer , priority 0 [ 671.281144][T18951] syzkaller0: entered promiscuous mode [ 671.286994][T18951] syzkaller0: entered allmulticast mode [ 671.305174][T18951] tipc: Resetting bearer [ 671.322354][T18950] tipc: Resetting bearer [ 671.375627][T18950] tipc: Disabling bearer [ 671.617118][T18960] lo speed is unknown, defaulting to 1000 [ 671.825212][T18960] lo speed is unknown, defaulting to 1000 [ 672.137149][T18974] lo speed is unknown, defaulting to 1000 [ 672.156926][T18977] bond0: (slave gre0): Error: Device type is different from other slaves [ 672.169153][T18977] netlink: 'syz.0.3700': attribute type 39 has an invalid length. [ 672.801584][T18974] lo speed is unknown, defaulting to 1000 [ 673.775819][T19009] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 673.928786][T19009] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 673.947390][T19024] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3710'. [ 673.976255][T19025] netlink: 'syz.0.3709': attribute type 16 has an invalid length. [ 674.026003][T19025] netlink: 'syz.0.3709': attribute type 17 has an invalid length. [ 674.026723][T19021] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3709'. [ 674.110769][T19026] IPv6: NLM_F_REPLACE set, but no existing node found! [ 674.196439][T19009] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 674.292748][T19029] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3711'. [ 674.315935][T19009] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 674.382715][ T69] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 256 - 0 [ 674.401924][ T69] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 256 - 0 [ 674.411561][ T69] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 256 - 0 [ 674.436712][ T69] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 256 - 0 [ 674.496143][ T69] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 674.554129][ T12] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 674.587662][ T1137] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 674.615234][ T69] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 674.867265][T19046] syzkaller0: entered promiscuous mode [ 674.874574][T19046] syzkaller0: entered allmulticast mode [ 674.956810][T19051] netlink: 'syz.2.3716': attribute type 29 has an invalid length. [ 674.968382][T19051] netlink: 'syz.2.3716': attribute type 29 has an invalid length. [ 674.978723][T19051] netlink: 500 bytes leftover after parsing attributes in process `syz.2.3716'. [ 674.991149][T19051] netlink: 68 bytes leftover after parsing attributes in process `syz.2.3716'. [ 675.698255][T19072] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3724'. [ 675.716490][T19073] netlink: 100 bytes leftover after parsing attributes in process `syz.3.3723'. [ 675.874252][T19082] netlink: 'syz.2.3727': attribute type 39 has an invalid length. [ 675.903331][T19086] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3726'. [ 675.904374][T19080] veth21: entered promiscuous mode [ 675.934712][T19088] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3727'. [ 675.954678][T19088] netlink: 43 bytes leftover after parsing attributes in process `syz.2.3727'. [ 675.999673][T19088] netlink: 'syz.2.3727': attribute type 5 has an invalid length. [ 676.225090][T19090] vlan4: entered allmulticast mode [ 676.508055][T19100] syzkaller0: entered promiscuous mode [ 676.515770][T19100] syzkaller0: entered allmulticast mode [ 676.525742][T19098] lo speed is unknown, defaulting to 1000 [ 676.742279][T19110] netlink: 'syz.1.3732': attribute type 58 has an invalid length. [ 676.902125][T19098] lo speed is unknown, defaulting to 1000 [ 677.595481][T19135] netlink: 'syz.4.3737': attribute type 1 has an invalid length. [ 677.736970][T19141] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 677.810268][T19141] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 677.833197][T19141] netdevsim netdevsim1 eth3 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 678.048265][T19134] lo speed is unknown, defaulting to 1000 [ 678.065573][T19141] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 678.083901][T19141] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 678.125421][T19141] netdevsim netdevsim1 eth2 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 678.242777][T19141] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 678.254294][T19141] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 678.289074][T19141] netdevsim netdevsim1 eth1 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 678.522186][T19141] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 678.546928][T19141] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 678.568624][T19141] netdevsim netdevsim1 eth0 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 678.724047][T19171] tipc: Enabling of bearer rejected, failed to enable media [ 678.735329][T19171] syzkaller0: entered promiscuous mode [ 678.740966][T19171] syzkaller0: entered allmulticast mode [ 678.838222][ T36] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 678.860914][ T36] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 54406 - 0 [ 678.880040][ T36] netdevsim netdevsim1 eth0: set [1, 2] type 2 family 0 port 44162 - 0 [ 678.906319][T19134] lo speed is unknown, defaulting to 1000 [ 678.923624][ T1137] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 678.935208][ T1137] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 54406 - 0 [ 678.945281][ T1137] netdevsim netdevsim1 eth1: set [1, 2] type 2 family 0 port 44162 - 0 [ 678.974766][ T1137] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 678.998168][ T1137] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 54406 - 0 [ 679.014385][ T1137] netdevsim netdevsim1 eth2: set [1, 2] type 2 family 0 port 44162 - 0 [ 679.081973][ T1137] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 679.101579][ T1137] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 54406 - 0 [ 679.126809][ T1137] netdevsim netdevsim1 eth3: set [1, 2] type 2 family 0 port 44162 - 0 [ 679.857495][T19192] __nla_validate_parse: 4 callbacks suppressed [ 679.857514][T19192] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3749'. [ 679.956902][T19195] lo speed is unknown, defaulting to 1000 [ 680.433887][T19201] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3751'. [ 680.830674][T19195] lo speed is unknown, defaulting to 1000 [ 681.087117][T19222] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3754'. [ 681.123796][T19223] tipc: Enabling of bearer rejected, failed to enable media [ 681.222683][T19217] syzkaller0: entered promiscuous mode [ 681.228189][T19217] syzkaller0: entered allmulticast mode [ 681.640022][T19232] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3757'. [ 681.660606][T19232] netlink: 'syz.3.3757': attribute type 7 has an invalid length. [ 681.668379][T19232] netlink: 'syz.3.3757': attribute type 8 has an invalid length. [ 681.734339][T19233] SET target dimension over the limit! [ 681.965074][T19231] A link change request failed with some changes committed already. Interface bond1 may have been left with an inconsistent configuration, please check. [ 682.098448][T14041] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 682.119957][T14041] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 682.128189][T14041] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 682.184473][T14041] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 682.231290][T19243] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3760'. [ 683.147529][T19251] lo speed is unknown, defaulting to 1000 [ 683.204112][T19253] syzkaller0: entered promiscuous mode [ 683.218324][T19253] syzkaller0: entered allmulticast mode [ 683.320455][T19257] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3763'. [ 683.598424][T19251] lo speed is unknown, defaulting to 1000 [ 683.814832][T19271] tipc: Enabling of bearer rejected, failed to enable media [ 683.880791][T19280] syzkaller0: entered promiscuous mode [ 683.886793][T19280] syzkaller0: entered allmulticast mode [ 684.208868][T19262] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3766'. [ 684.273115][T19291] syzkaller0: entered promiscuous mode [ 684.280873][T19291] syzkaller0: entered allmulticast mode [ 684.306676][T19293] netlink: 256 bytes leftover after parsing attributes in process `syz.0.3771'. [ 684.603287][T19303] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3774'. [ 684.900108][T19309] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3775'. [ 685.158479][T19313] syzkaller0: entered promiscuous mode [ 685.164851][T19313] syzkaller0: entered allmulticast mode [ 685.747488][T19340] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3783'. [ 685.847792][T19338] lo speed is unknown, defaulting to 1000 [ 685.900805][ T5148] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 686.685057][T19349] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3788'. [ 687.089609][T19343] lo speed is unknown, defaulting to 1000 [ 687.150240][T19338] lo speed is unknown, defaulting to 1000 [ 687.272278][T19363] syzkaller0: entered promiscuous mode [ 687.277893][T19363] syzkaller0: entered allmulticast mode [ 687.835243][T19343] lo speed is unknown, defaulting to 1000 [ 688.881082][T19388] lo speed is unknown, defaulting to 1000 [ 689.504900][T19388] lo speed is unknown, defaulting to 1000 [ 689.876532][T19408] netlink: 'syz.0.3801': attribute type 1 has an invalid length. [ 689.884640][T19408] netlink: 140 bytes leftover after parsing attributes in process `syz.0.3801'. [ 689.893883][T19408] netlink: 96 bytes leftover after parsing attributes in process `syz.0.3801'. [ 690.223258][T19417] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3803'. [ 690.453687][T19416] lo speed is unknown, defaulting to 1000 [ 690.941545][T19440] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 691.202580][T19416] lo speed is unknown, defaulting to 1000 [ 691.583405][T19452] lo speed is unknown, defaulting to 1000 [ 691.769603][T19457] netlink: 'syz.3.3814': attribute type 13 has an invalid length. [ 691.789702][T19457] netlink: 'syz.3.3814': attribute type 17 has an invalid length. [ 691.924690][T19457] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 692.074625][T19452] lo speed is unknown, defaulting to 1000 [ 692.173292][T19462] netlink: 'syz.0.3815': attribute type 1 has an invalid length. [ 692.181504][T19462] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3815'. [ 692.234732][T19459] lo speed is unknown, defaulting to 1000 [ 692.812881][T19473] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3817'. [ 692.928451][T19459] lo speed is unknown, defaulting to 1000 [ 694.110390][T19510] tipc: Enabling of bearer rejected, already enabled [ 694.378685][T19517] netlink: 'syz.4.3826': attribute type 15 has an invalid length. [ 694.805996][T19534] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3829'. [ 695.107450][T19537] netlink: 'syz.0.3830': attribute type 13 has an invalid length. [ 695.115754][T19537] netlink: 'syz.0.3830': attribute type 17 has an invalid length. [ 695.149794][T19537] geneve3: left promiscuous mode [ 695.154799][T19537] geneve3: left allmulticast mode [ 695.358785][T19539] lo speed is unknown, defaulting to 1000 [ 695.532836][T19547] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3836'. [ 695.553662][T19548] netlink: 'syz.0.3835': attribute type 1 has an invalid length. [ 695.611461][T19552] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3835'. [ 695.689661][T19551] tipc: Enabled bearer , priority 0 [ 695.710742][T19551] syzkaller0: entered promiscuous mode [ 695.716244][T19551] syzkaller0: entered allmulticast mode [ 695.745554][T19539] lo speed is unknown, defaulting to 1000 [ 695.792309][T19548] macvlan2: entered promiscuous mode [ 695.816694][T19548] macvlan2: entered allmulticast mode [ 695.836852][T19548] bond15: entered promiscuous mode [ 695.859030][T19548] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 695.916261][T19548] bond15: left promiscuous mode [ 696.243476][T19557] tipc: Resetting bearer [ 696.266424][T19550] tipc: Resetting bearer [ 696.352753][T19550] tipc: Disabling bearer [ 696.483663][T19575] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3842'. [ 696.921352][T19581] IPVS: Scheduler module ip_vs_sip not found [ 696.985353][T19581] IPVS: length: 141 != 8 [ 697.205547][T19592] wg1: left promiscuous mode [ 697.229079][T19592] wg1: left allmulticast mode [ 697.243525][T19592] veth1_vlan: left allmulticast mode [ 697.259982][T19592] bond5: left promiscuous mode [ 697.268242][T19592] wireguard0: left promiscuous mode [ 697.284338][T19592] geneve4: left promiscuous mode [ 697.299856][T19592] tipc: Resetting bearer [ 697.314111][T19592] syzkaller0: left promiscuous mode [ 697.328715][T19592] syzkaller0: left allmulticast mode [ 697.347313][T15920] lo speed is unknown, defaulting to 1000 [ 697.369845][T15920] syz0: Port: 1 Link DOWN [ 697.386140][T15920] lo speed is unknown, defaulting to 1000 [ 697.436076][T19600] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3848'. [ 697.858789][T19607] lo speed is unknown, defaulting to 1000 [ 698.143467][T19622] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3854'. [ 698.478580][T19608] lo speed is unknown, defaulting to 1000 [ 698.711791][T19607] lo speed is unknown, defaulting to 1000 [ 698.847320][T19608] lo speed is unknown, defaulting to 1000 [ 698.915202][T19640] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3858'. [ 699.269140][T19647] ip6tnl3: entered promiscuous mode [ 699.276593][T19647] ip6tnl3: entered allmulticast mode [ 699.585216][T19651] netlink: 'syz.4.3859': attribute type 1 has an invalid length. [ 699.593909][T19651] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3859'. [ 700.062144][T19660] lo speed is unknown, defaulting to 1000 [ 700.482974][T19660] lo speed is unknown, defaulting to 1000 [ 700.895239][T19680] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3866'. [ 701.531944][T19697] netlink: 'syz.0.3871': attribute type 13 has an invalid length. [ 701.543370][T19697] netlink: 'syz.0.3871': attribute type 17 has an invalid length. [ 701.748171][T19697] 8021q: adding VLAN 0 to HW filter on device bond0 [ 701.767444][T19697] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 701.895622][T19700] lo speed is unknown, defaulting to 1000 [ 702.216396][T19708] netlink: 'syz.3.3873': attribute type 1 has an invalid length. [ 702.218394][T19700] lo speed is unknown, defaulting to 1000 [ 702.239864][T19708] netlink: 140 bytes leftover after parsing attributes in process `syz.3.3873'. [ 702.259806][T19708] netlink: 96 bytes leftover after parsing attributes in process `syz.3.3873'. [ 702.493729][T19717] tipc: Enabled bearer , priority 0 [ 702.502734][T19717] syzkaller0: entered promiscuous mode [ 702.516387][T19717] syzkaller0: entered allmulticast mode [ 702.571738][T19717] tipc: Resetting bearer [ 702.591870][T19716] tipc: Resetting bearer [ 702.635500][T19716] tipc: Disabling bearer [ 702.680468][T19720] siw: device registration error -23 [ 702.812615][T19720] lo speed is unknown, defaulting to 1000 [ 703.134801][T19730] netlink: 'syz.0.3879': attribute type 1 has an invalid length. [ 703.218263][T19732] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3879'. [ 703.373942][T19720] lo speed is unknown, defaulting to 1000 [ 703.870304][T19752] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 704.308978][T19765] tipc: Enabled bearer , priority 0 [ 704.328225][T19765] syzkaller0: entered promiscuous mode [ 704.359788][T19765] syzkaller0: entered allmulticast mode [ 704.446101][T19766] tipc: Resetting bearer [ 704.542376][T19764] tipc: Resetting bearer [ 704.565236][T19764] tipc: Disabling bearer [ 704.725494][T19776] : renamed from bond_slave_0 [ 704.846721][T19779] lo speed is unknown, defaulting to 1000 [ 705.251367][T19797] netlink: 'syz.4.3897': attribute type 13 has an invalid length. [ 705.271066][T19797] netlink: 'syz.4.3897': attribute type 17 has an invalid length. [ 705.428537][T19797] 8021q: adding VLAN 0 to HW filter on device bond0 [ 705.466047][T19797] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 705.505570][T13694] lo speed is unknown, defaulting to 1000 [ 705.516125][T13694] syz0: Port: 1 Link ACTIVE [ 705.525804][T19779] lo speed is unknown, defaulting to 1000 [ 705.532253][T19782] lo speed is unknown, defaulting to 1000 [ 705.538143][T16998] lo speed is unknown, defaulting to 1000 [ 706.418179][T19799] lo speed is unknown, defaulting to 1000 [ 706.640297][T19803] lo speed is unknown, defaulting to 1000 [ 706.852739][T19805] lo speed is unknown, defaulting to 1000 [ 707.070227][T19799] lo speed is unknown, defaulting to 1000 [ 707.077089][T19808] lo speed is unknown, defaulting to 1000 [ 707.126713][T19782] lo speed is unknown, defaulting to 1000 [ 707.195629][T19805] lo speed is unknown, defaulting to 1000 [ 707.299868][T19803] lo speed is unknown, defaulting to 1000 [ 707.663980][T19808] lo speed is unknown, defaulting to 1000 [ 708.395737][T19811] lo speed is unknown, defaulting to 1000 [ 708.655642][T19817] tipc: Enabling of bearer rejected, already enabled [ 708.665166][T19817] syzkaller0: entered promiscuous mode [ 708.671564][T19817] syzkaller0: entered allmulticast mode [ 709.241982][T19832] netlink: 'syz.4.3906': attribute type 13 has an invalid length. [ 709.324854][T19830] bond8: option arp_validate: invalid value (18446744073491447809) [ 709.362643][T19830] bond8 (unregistering): Released all slaves [ 709.593806][T19832] tipc: Resetting bearer [ 709.603939][T19811] lo speed is unknown, defaulting to 1000 [ 709.603988][T15920] lo speed is unknown, defaulting to 1000 [ 709.622272][T15920] syz0: Port: 1 Link DOWN [ 709.654337][T15920] lo speed is unknown, defaulting to 1000 [ 709.983113][T19843] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 710.104127][T19841] lo speed is unknown, defaulting to 1000 [ 710.195004][T19850] netlink: 'syz.4.3909': attribute type 10 has an invalid length. [ 710.340116][T19850] bond0: (slave wlan1): Opening slave failed [ 710.792694][T19841] lo speed is unknown, defaulting to 1000 [ 711.251004][T19867] rdma_rxe: rxe_newlink: failed to add lo [ 711.277816][T19863] tipc: Enabled bearer , priority 0 [ 711.286106][T19868] syzkaller0: entered promiscuous mode [ 711.292737][T19868] syzkaller0: entered allmulticast mode [ 711.337102][T19865] syzkaller0: entered promiscuous mode [ 711.350786][T19865] syzkaller0: entered allmulticast mode [ 711.377956][T19863] tipc: Resetting bearer [ 711.407441][T19862] tipc: Resetting bearer [ 711.511919][T19862] tipc: Disabling bearer [ 711.667049][T19886] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3919'. [ 711.811347][T19886] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3919'. [ 711.906451][T19893] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 711.946922][T19880] lo speed is unknown, defaulting to 1000 [ 712.007188][T19899] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3922'. [ 712.515810][T19913] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3923'. [ 712.553966][T19914] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3924'. [ 713.204345][T19924] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3926'. [ 713.267023][T19880] lo speed is unknown, defaulting to 1000 [ 713.267078][T19889] lo speed is unknown, defaulting to 1000 [ 713.765556][T19889] lo speed is unknown, defaulting to 1000 [ 714.010979][T19949] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3931'. [ 714.172326][T19952] netlink: 'syz.4.3932': attribute type 13 has an invalid length. [ 714.220940][T19952] netlink: 'syz.4.3932': attribute type 17 has an invalid length. [ 714.226866][T19956] ip6tnl1: entered promiscuous mode [ 714.264199][T19956] ip6tnl1: entered allmulticast mode [ 714.376541][T19952] 8021q: adding VLAN 0 to HW filter on device bond0 [ 714.403923][T19952] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 714.448876][T19964] dvmrp0: entered allmulticast mode [ 714.476126][T19963] netlink: 'syz.2.3934': attribute type 1 has an invalid length. [ 714.490804][T13692] lo speed is unknown, defaulting to 1000 [ 714.508548][T13692] syz0: Port: 1 Link ACTIVE [ 714.559109][T13691] lo speed is unknown, defaulting to 1000 [ 714.618616][T19963] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3934'. [ 714.708390][T19962] lo speed is unknown, defaulting to 1000 [ 715.061242][T19979] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3936'. [ 715.082986][T19968] lo speed is unknown, defaulting to 1000 [ 715.088846][T19962] lo speed is unknown, defaulting to 1000 [ 715.474574][T19993] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3939'. [ 715.585497][T19968] lo speed is unknown, defaulting to 1000 [ 715.981771][T19997] lo speed is unknown, defaulting to 1000 [ 716.334525][T19997] lo speed is unknown, defaulting to 1000 [ 716.334533][T20008] lo speed is unknown, defaulting to 1000 [ 716.647790][T20011] lo speed is unknown, defaulting to 1000 [ 716.875681][T20022] netlink: 596 bytes leftover after parsing attributes in process `syz.2.3949'. [ 717.062461][T20011] lo speed is unknown, defaulting to 1000 [ 717.165075][T20035] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3952'. [ 717.356487][T20008] lo speed is unknown, defaulting to 1000 [ 717.489960][T20043] netlink: 'syz.2.3956': attribute type 1 has an invalid length. [ 717.512380][T20044] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3955'. [ 717.529787][T20043] netlink: 'syz.2.3956': attribute type 2 has an invalid length. [ 717.691605][T20043] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3956'. [ 718.122635][T20061] lo speed is unknown, defaulting to 1000 [ 718.154746][T20059] Bluetooth: hci0: invalid length 0, exp 2 for type 0 [ 719.051939][T20090] netlink: 'syz.1.3965': attribute type 15 has an invalid length. [ 719.120901][T20078] lo speed is unknown, defaulting to 1000 [ 719.172746][T20061] lo speed is unknown, defaulting to 1000 [ 719.523689][T20078] lo speed is unknown, defaulting to 1000 [ 719.846985][T20105] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3968'. [ 719.903818][T20097] lo speed is unknown, defaulting to 1000 [ 720.187063][T20113] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3969'. [ 720.239127][T20113] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3969'. [ 720.270767][T20113] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 720.303902][T20114] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3969'. [ 720.354097][T20112] netlink: 'syz.3.3970': attribute type 10 has an invalid length. [ 720.390085][T20112] bond0: (slave wlan1): refused to change device type [ 720.611873][T20097] lo speed is unknown, defaulting to 1000 [ 720.633755][T20119] netlink: 'syz.3.3972': attribute type 6 has an invalid length. [ 720.909814][T20121] netlink: 'syz.3.3972': attribute type 12 has an invalid length. [ 720.923482][T20121] netlink: 9472 bytes leftover after parsing attributes in process `syz.3.3972'. [ 721.175647][T20132] lo speed is unknown, defaulting to 1000 [ 721.653145][T20159] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3980'. [ 721.679941][T20128] lo speed is unknown, defaulting to 1000 [ 721.687299][T20132] lo speed is unknown, defaulting to 1000 [ 722.065948][T20128] lo speed is unknown, defaulting to 1000 [ 722.196822][T20151] netlink: 'syz.3.3978': attribute type 9 has an invalid length. [ 722.683405][T20183] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 722.815366][T20186] lo speed is unknown, defaulting to 1000 [ 724.085049][T20186] lo speed is unknown, defaulting to 1000 [ 724.610441][T20208] dvmrp0: entered allmulticast mode [ 724.919865][T20216] lo speed is unknown, defaulting to 1000 [ 724.996693][T20220] __nla_validate_parse: 3 callbacks suppressed [ 724.996711][T20220] netlink: 200 bytes leftover after parsing attributes in process `syz.1.3985'. [ 725.065402][T20209] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3985'. [ 725.299081][T20216] lo speed is unknown, defaulting to 1000 [ 725.491405][T20225] netlink: 'syz.0.3990': attribute type 13 has an invalid length. [ 725.533366][T20225] netlink: 'syz.0.3990': attribute type 17 has an invalid length. [ 725.547628][T20228] netlink: 'syz.3.3991': attribute type 1 has an invalid length. [ 725.623121][T20228] 8021q: adding VLAN 0 to HW filter on device bond6 [ 725.657606][T20237] veth9: left allmulticast mode [ 725.677319][T20237] veth9: left promiscuous mode [ 725.682531][T20237] bridge9: port 1(veth9) entered disabled state [ 725.703397][T20228] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3991'. [ 725.718302][T20237] vlan3: left allmulticast mode [ 725.723998][T20237] veth1: left allmulticast mode [ 725.728868][T20237] vlan3: left promiscuous mode [ 725.734411][T20237] veth1: left promiscuous mode [ 725.744144][T20237] bridge9: port 2(vlan3) entered disabled state [ 725.757528][T20237] bond4: (slave macvlan2): Releasing active interface [ 725.771765][T20245] netlink: 'syz.2.3993': attribute type 10 has an invalid length. [ 725.781624][T20237] bond5: (slave bond6): Releasing backup interface [ 725.801261][T20225] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 725.877954][T20234] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 725.903764][T20234] bond6: (slave batadv0): making interface the new active one [ 725.940619][T20234] bond6: (slave batadv0): Enslaving as an active interface with an up link [ 726.135503][T20228] bond6 (unregistering): (slave batadv0): Releasing active interface [ 726.155555][T20228] bond6 (unregistering): Released all slaves [ 726.196590][T20245] bond0: (slave wlan1): refused to change device type [ 726.233778][T20229] lo speed is unknown, defaulting to 1000 [ 726.457193][T20254] netlink: 'syz.3.3995': attribute type 15 has an invalid length. [ 726.732714][T20236] lo speed is unknown, defaulting to 1000 [ 726.856623][T20236] lo speed is unknown, defaulting to 1000 [ 726.872541][T20229] lo speed is unknown, defaulting to 1000 [ 726.878603][T20256] lo speed is unknown, defaulting to 1000 [ 727.124350][T20235] lo speed is unknown, defaulting to 1000 [ 727.242404][T20246] lo speed is unknown, defaulting to 1000 [ 727.423174][T20267] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3997'. [ 727.540898][T20269] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3998'. [ 727.552105][T20269] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3998'. [ 727.629094][T20271] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 727.637680][T20257] lo speed is unknown, defaulting to 1000 [ 727.802860][T20256] lo speed is unknown, defaulting to 1000 [ 727.889750][T20246] lo speed is unknown, defaulting to 1000 [ 728.085680][T20235] lo speed is unknown, defaulting to 1000 [ 728.255885][T20257] lo speed is unknown, defaulting to 1000 [ 728.730199][T20277] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 728.921303][T20276] lo speed is unknown, defaulting to 1000 [ 729.031421][T20283] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4002'. [ 729.581132][ T5148] Bluetooth: hci1: command 0x0406 tx timeout [ 729.744187][T20295] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4005'. [ 729.903588][T20290] lo speed is unknown, defaulting to 1000 [ 729.905476][T20276] lo speed is unknown, defaulting to 1000 [ 730.442418][T20310] tipc: Enabled bearer , priority 0 [ 730.452415][T20310] syzkaller0: entered promiscuous mode [ 730.470899][T20310] syzkaller0: entered allmulticast mode [ 730.551553][T20310] tipc: Resetting bearer [ 730.564238][T20296] lo speed is unknown, defaulting to 1000 [ 730.595580][T20309] tipc: Resetting bearer [ 730.633990][T20309] tipc: Disabling bearer [ 730.906306][T20319] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4009'. [ 730.925468][T20294] lo speed is unknown, defaulting to 1000 [ 731.042034][T20322] tipc: Enabled bearer , priority 0 [ 731.081443][T20322] tipc: Resetting bearer [ 731.115268][T20321] tipc: Disabling bearer [ 731.277694][T20290] lo speed is unknown, defaulting to 1000 [ 731.315393][T20294] lo speed is unknown, defaulting to 1000 [ 731.444808][T20296] lo speed is unknown, defaulting to 1000 [ 731.837318][T20335] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4014'. [ 731.846564][T20335] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4014'. [ 731.949705][T20331] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4012'. [ 732.302185][T15920] lo speed is unknown, defaulting to 1000 [ 732.308236][T15920] syz1: Port: 1 Link DOWN [ 732.704466][T20352] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4017'. [ 733.149286][T20357] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4019'. [ 733.168495][T20357] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4019'. [ 733.222427][T20363] netlink: 64 bytes leftover after parsing attributes in process `syz.3.4019'. [ 733.233551][T20365] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4022'. [ 733.263339][T20363] netlink: 232 bytes leftover after parsing attributes in process `syz.3.4019'. [ 733.598754][T20378] lo speed is unknown, defaulting to 1000 [ 733.781442][T20382] netlink: 'syz.4.4026': attribute type 4 has an invalid length. [ 733.940679][T20389] netlink: 'syz.1.4025': attribute type 10 has an invalid length. [ 734.689156][T20395] lo speed is unknown, defaulting to 1000 [ 734.689850][T20378] lo speed is unknown, defaulting to 1000 [ 735.251072][T20397] lo speed is unknown, defaulting to 1000 [ 735.291325][T20395] lo speed is unknown, defaulting to 1000 [ 735.533903][T20420] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 735.541222][T20420] IPv6: NLM_F_CREATE should be set when creating new route [ 735.582600][T20418] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 735.589931][T20418] IPv6: NLM_F_CREATE should be set when creating new route [ 735.961607][T20425] netlink: 'syz.0.4038': attribute type 1 has an invalid length. [ 735.976685][T20425] __nla_validate_parse: 7 callbacks suppressed [ 735.976704][T20425] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4038'. [ 736.135343][T20411] lo speed is unknown, defaulting to 1000 [ 736.219802][T20438] syzkaller0: entered promiscuous mode [ 736.249580][T20438] syzkaller0: entered allmulticast mode [ 736.610530][T20412] lo speed is unknown, defaulting to 1000 [ 736.804737][T20451] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4042'. [ 736.972704][T20397] lo speed is unknown, defaulting to 1000 [ 737.104228][T20462] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 737.163750][T20412] lo speed is unknown, defaulting to 1000 [ 737.398220][T20411] lo speed is unknown, defaulting to 1000 [ 738.189042][T20480] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4049'. [ 738.595619][T20484] netlink: 'syz.0.4050': attribute type 3 has an invalid length. [ 738.939724][T16021] Bluetooth: hci4: command 0x0406 tx timeout [ 739.564465][T20495] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4052'. [ 739.625398][T20495] lo speed is unknown, defaulting to 1000 [ 739.883826][T20495] lo speed is unknown, defaulting to 1000 [ 739.984610][T20505] netlink: 'syz.3.4055': attribute type 4 has an invalid length. [ 740.040012][T20511] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 740.658992][T20520] netlink: 'syz.3.4060': attribute type 1 has an invalid length. [ 740.730846][T20520] bond6 (unregistering): Released all slaves [ 741.830672][T20542] lo speed is unknown, defaulting to 1000 [ 742.168242][T20542] lo speed is unknown, defaulting to 1000 [ 742.168274][T20543] lo speed is unknown, defaulting to 1000 [ 742.396491][T20571] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4070'. [ 742.447593][T20543] lo speed is unknown, defaulting to 1000 [ 742.453389][T20546] lo speed is unknown, defaulting to 1000 [ 743.038010][T20545] lo speed is unknown, defaulting to 1000 [ 743.170551][T20584] lec:lec_atm_close: lec0: Shut down! [ 743.296993][T20545] lo speed is unknown, defaulting to 1000 [ 743.351816][T20586] lo speed is unknown, defaulting to 1000 [ 743.437470][T20546] lo speed is unknown, defaulting to 1000 [ 743.658099][T20592] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 744.012593][T20600] syz.3.4076 (20600) used obsolete PPPIOCDETACH ioctl [ 744.070002][T16021] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 744.198361][T20586] lo speed is unknown, defaulting to 1000 [ 744.702454][T20603] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 744.952482][T20608] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4079'. [ 745.624994][T20626] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4082'. [ 746.345359][T20641] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4088'. [ 746.454398][T20641] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4088'. [ 746.500690][T20641] netlink: 34 bytes leftover after parsing attributes in process `syz.2.4088'. [ 746.918070][T20653] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4089'. [ 746.970883][T20653] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 746.981746][T20653] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 746.997353][T20653] netdevsim netdevsim1 eth3 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 747.187349][T20653] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 747.225511][T20653] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 747.268867][T20653] netdevsim netdevsim1 eth2 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 747.411975][T20655] lo speed is unknown, defaulting to 1000 [ 747.644188][T20653] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 747.678292][T20653] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 747.694147][T20687] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 747.729945][T20653] netdevsim netdevsim1 eth1 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 747.877850][T20655] lo speed is unknown, defaulting to 1000 [ 747.904392][T20653] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 747.926827][T20653] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 747.937434][T20653] netdevsim netdevsim1 eth0 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 747.957139][T20658] lo speed is unknown, defaulting to 1000 [ 748.137838][ T1137] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 748.159753][ T1137] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 54406 - 0 [ 748.181264][ T1137] netdevsim netdevsim1 eth0: set [1, 2] type 2 family 0 port 44162 - 0 [ 748.462126][ T69] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 748.477660][ T69] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 54406 - 0 [ 748.509865][ T69] netdevsim netdevsim1 eth1: set [1, 2] type 2 family 0 port 44162 - 0 [ 748.560160][ T1155] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 748.568563][ T1155] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 54406 - 0 [ 748.600108][ T1155] netdevsim netdevsim1 eth2: set [1, 2] type 2 family 0 port 44162 - 0 [ 748.630525][ T69] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 748.638669][ T69] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 54406 - 0 [ 748.658406][ T69] netdevsim netdevsim1 eth3: set [1, 2] type 2 family 0 port 44162 - 0 [ 748.681104][T20658] lo speed is unknown, defaulting to 1000 [ 748.874366][T20707] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 749.207779][T20714] netlink: 'syz.3.4099': attribute type 13 has an invalid length. [ 749.279813][T20714] netlink: 'syz.3.4099': attribute type 17 has an invalid length. [ 749.434263][T20714] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 749.598945][T20719] lo speed is unknown, defaulting to 1000 [ 749.739577][T16021] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 750.130973][T20719] lo speed is unknown, defaulting to 1000 [ 750.158205][T20728] lo speed is unknown, defaulting to 1000 [ 750.247539][T20737] tipc: Enabling of bearer rejected, already enabled [ 750.340740][T20733] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4104'. [ 750.505919][T20742] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 750.600778][T20747] tipc: Failed to remove unknown binding: 66,1,1/1963531426:2910969383/2910969385 [ 750.770292][T20747] tipc: Failed to remove unknown binding: 66,1,1/1963531426:2910969383/2910969385 [ 750.863275][T20747] tipc: Failed to remove unknown binding: 66,1,1/1963531426:2910969383/2910969385 [ 751.173299][T20756] : renamed from bond_slave_0 [ 751.656457][T20728] lo speed is unknown, defaulting to 1000 [ 751.841223][T20769] batadv0: entered promiscuous mode [ 752.104283][T20777] IPVS: stopping backup sync thread 15885 ... [ 752.127574][T20772] lo speed is unknown, defaulting to 1000 [ 752.351073][T20785] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 752.472178][T20772] lo speed is unknown, defaulting to 1000 [ 752.891997][T20790] lo speed is unknown, defaulting to 1000 [ 753.617284][T20799] bond0 (unregistering): Released all slaves [ 753.625491][T20804] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 753.666693][T20795] lo speed is unknown, defaulting to 1000 [ 753.673016][T20790] lo speed is unknown, defaulting to 1000 [ 753.909449][T20808] netlink: 3 bytes leftover after parsing attributes in process `syz.2.4120'. [ 754.097645][T20808] batadv2: entered promiscuous mode [ 754.104634][T20808] batadv2: entered allmulticast mode [ 754.194689][T20795] lo speed is unknown, defaulting to 1000 [ 754.520079][T20818] netlink: 'syz.2.4121': attribute type 12 has an invalid length. [ 755.157181][T20825] sock: sock_timestamping_bind_phc: sock not bind to device [ 755.688850][T20846] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4130'. [ 755.871895][T20855] netlink: 100 bytes leftover after parsing attributes in process `syz.0.4129'. [ 756.875277][T20865] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 757.420726][ T5148] Bluetooth: hci4: command 0x0406 tx timeout [ 757.621131][T20882] lo speed is unknown, defaulting to 1000 [ 757.786331][T20886] Bluetooth: hci0: invalid length 0, exp 1 for type 31 [ 757.994633][T20882] lo speed is unknown, defaulting to 1000 [ 757.994656][T20883] lo speed is unknown, defaulting to 1000 [ 758.034282][T20890] batman_adv: batadv0: Adding interface: dummy0 [ 758.041490][T20890] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 758.089524][T20890] batman_adv: batadv0: Interface activated: dummy0 [ 758.128669][T20894] batadv0: mtu less than device minimum [ 758.140161][T20894] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 758.152475][T20894] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 758.164323][T20894] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 758.176156][T20894] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 758.187998][T20894] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 758.199885][T20894] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 758.211736][T20894] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 758.223676][T20894] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 758.235507][T20894] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 758.491331][T20897] syzkaller0: entered promiscuous mode [ 758.509362][T20897] syzkaller0: entered allmulticast mode [ 758.674703][T20912] wg1: entered promiscuous mode [ 758.682894][T20912] wg1: entered allmulticast mode [ 758.715574][T20901] lo speed is unknown, defaulting to 1000 [ 758.735581][T20918] tipc: Enabled bearer , priority 0 [ 758.744794][T20918] syzkaller0: entered promiscuous mode [ 758.755654][T20918] syzkaller0: entered allmulticast mode [ 758.776478][T20918] tipc: Resetting bearer [ 758.786716][T20917] tipc: Resetting bearer [ 758.814769][T20917] tipc: Disabling bearer [ 758.914453][T20893] lo speed is unknown, defaulting to 1000 [ 759.033611][T20923] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4144'. [ 759.337687][T20883] lo speed is unknown, defaulting to 1000 [ 759.369972][T20901] lo speed is unknown, defaulting to 1000 [ 759.413475][T20893] lo speed is unknown, defaulting to 1000 [ 760.225367][T20950] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4149'. [ 760.513454][T20946] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4149'. [ 760.708816][T20959] netlink: 'syz.2.4151': attribute type 9 has an invalid length. [ 761.149070][T20959] can: request_module (can-proto-0) failed. [ 761.216752][T20970] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 761.246267][T20972] netlink: 'syz.4.4153': attribute type 13 has an invalid length. [ 761.256855][T20972] netlink: 'syz.4.4153': attribute type 17 has an invalid length. [ 761.318183][T20974] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4155'. [ 761.470336][T20976] lo speed is unknown, defaulting to 1000 [ 761.557886][T20984] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4156'. [ 761.760289][T20976] lo speed is unknown, defaulting to 1000 [ 761.800870][T20977] lo speed is unknown, defaulting to 1000 [ 762.667721][T20977] lo speed is unknown, defaulting to 1000 [ 762.824942][T21004] lo speed is unknown, defaulting to 1000 [ 762.876947][T21012] netlink: 277 bytes leftover after parsing attributes in process `syz.0.4161'. [ 763.524054][T21025] netlink: 260 bytes leftover after parsing attributes in process `syz.3.4164'. [ 763.712133][T21031] netlink: 'syz.3.4166': attribute type 15 has an invalid length. [ 763.818643][T21002] lo speed is unknown, defaulting to 1000 [ 763.906752][T21035] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4166'. [ 764.028419][T21002] lo speed is unknown, defaulting to 1000 [ 764.037207][T21022] lo speed is unknown, defaulting to 1000 [ 764.104425][T21004] lo speed is unknown, defaulting to 1000 [ 764.494921][T21029] lo speed is unknown, defaulting to 1000 [ 764.648952][T21037] netlink: 'syz.4.4167': attribute type 1 has an invalid length. [ 764.657960][T21037] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4167'. [ 764.776634][T21028] lo speed is unknown, defaulting to 1000 [ 764.938807][T21028] lo speed is unknown, defaulting to 1000 [ 765.024973][T21041] lo speed is unknown, defaulting to 1000 [ 765.056625][T21022] lo speed is unknown, defaulting to 1000 [ 765.125671][T21029] lo speed is unknown, defaulting to 1000 [ 765.435133][T21041] lo speed is unknown, defaulting to 1000 [ 766.561502][T21058] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 766.667704][T21055] sysfs: cannot create duplicate filename '/class/ieee80211/žÀ^–>º>ùMv^µâ侦¸ÑKc'A¥»–_à›xDä±pj8¼•TTí!' [ 766.682107][T21055] CPU: 0 UID: 0 PID: 21055 Comm: syz.2.4172 Not tainted syzkaller #0 PREEMPT(full) [ 766.682142][T21055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 766.682161][T21055] Call Trace: [ 766.682169][T21055] [ 766.682179][T21055] dump_stack_lvl+0x189/0x250 [ 766.682209][T21055] ? __pfx_dump_stack_lvl+0x10/0x10 [ 766.682230][T21055] ? __pfx__printk+0x10/0x10 [ 766.682258][T21055] ? kernfs_path_from_node+0x2f/0x290 [ 766.682276][T21055] ? kernfs_path_from_node+0x250/0x290 [ 766.682291][T21055] ? kernfs_path_from_node+0x2f/0x290 [ 766.682313][T21055] sysfs_warn_dup+0x8e/0xa0 [ 766.682341][T21055] sysfs_do_create_link_sd+0xc0/0x110 [ 766.682371][T21055] device_add_class_symlinks+0x1cf/0x240 [ 766.682398][T21055] device_add+0x475/0xb50 [ 766.682426][T21055] wiphy_register+0x1c81/0x2aa0 [ 766.682464][T21055] ? __pfx_wiphy_register+0x10/0x10 [ 766.682482][T21055] ? minstrel_ht_alloc+0x6e0/0x7e0 [ 766.682515][T21055] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 766.682543][T21055] ieee80211_register_hw+0x3473/0x40d0 [ 766.682581][T21055] ? ieee80211_register_hw+0x14a1/0x40d0 [ 766.682615][T21055] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 766.682636][T21055] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 766.682667][T21055] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 766.682693][T21055] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 766.682726][T21055] ? __hrtimer_setup+0x187/0x210 [ 766.682749][T21055] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 766.682773][T21055] mac80211_hwsim_new_radio+0x2f7a/0x5220 [ 766.682834][T21055] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 766.682858][T21055] ? trace_kmalloc+0x1f/0xd0 [ 766.682874][T21055] ? __kmalloc_node_track_caller_noprof+0x587/0x800 [ 766.682895][T21055] ? kstrndup+0xbf/0x160 [ 766.682929][T21055] hwsim_new_radio_nl+0xf5b/0x1bd0 [ 766.682961][T21055] ? __pfx___nla_validate_parse+0x10/0x10 [ 766.682996][T21055] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 766.683027][T21055] ? rcu_is_watching+0x15/0xb0 [ 766.683061][T21055] ? __nla_parse+0x40/0x60 [ 766.683086][T21055] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 766.683118][T21055] genl_family_rcv_msg_doit+0x215/0x300 [ 766.683148][T21055] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 766.683185][T21055] ? bpf_lsm_capable+0x9/0x20 [ 766.683200][T21055] ? security_capable+0x7e/0x2e0 [ 766.683227][T21055] genl_rcv_msg+0x60e/0x790 [ 766.683255][T21055] ? __pfx_genl_rcv_msg+0x10/0x10 [ 766.683275][T21055] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 766.683318][T21055] netlink_rcv_skb+0x208/0x470 [ 766.683340][T21055] ? __lock_acquire+0xab9/0xd20 [ 766.683363][T21055] ? __pfx_genl_rcv_msg+0x10/0x10 [ 766.683384][T21055] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 766.683431][T21055] ? down_read+0x1ad/0x2e0 [ 766.683454][T21055] genl_rcv+0x28/0x40 [ 766.683471][T21055] netlink_unicast+0x82f/0x9e0 [ 766.683506][T21055] ? __pfx_netlink_unicast+0x10/0x10 [ 766.683530][T21055] ? netlink_sendmsg+0x642/0xb30 [ 766.683553][T21055] ? skb_put+0x11b/0x210 [ 766.683583][T21055] netlink_sendmsg+0x805/0xb30 [ 766.683619][T21055] ? __pfx_netlink_sendmsg+0x10/0x10 [ 766.683648][T21055] ? aa_sock_msg_perm+0xf1/0x1d0 [ 766.683671][T21055] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 766.683692][T21055] ? __pfx_netlink_sendmsg+0x10/0x10 [ 766.683719][T21055] __sock_sendmsg+0x21c/0x270 [ 766.683745][T21055] ____sys_sendmsg+0x505/0x830 [ 766.683778][T21055] ? __pfx_____sys_sendmsg+0x10/0x10 [ 766.683817][T21055] ? import_iovec+0x74/0xa0 [ 766.683845][T21055] ___sys_sendmsg+0x21f/0x2a0 [ 766.683865][T21055] ? __pfx____sys_sendmsg+0x10/0x10 [ 766.683926][T21055] ? __fget_files+0x2a/0x420 [ 766.683947][T21055] ? __fget_files+0x3a0/0x420 [ 766.683987][T21055] __x64_sys_sendmsg+0x19b/0x260 [ 766.684009][T21055] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 766.684047][T21055] ? do_syscall_64+0xbe/0xfa0 [ 766.684077][T21055] do_syscall_64+0xfa/0xfa0 [ 766.684093][T21055] ? lockdep_hardirqs_on+0x9c/0x150 [ 766.684111][T21055] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.684130][T21055] ? clear_bhb_loop+0x60/0xb0 [ 766.684153][T21055] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 766.684178][T21055] RIP: 0033:0x7f0c6bb8efc9 [ 766.684198][T21055] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 766.684214][T21055] RSP: 002b:00007f0c6cb13038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 766.684242][T21055] RAX: ffffffffffffffda RBX: 00007f0c6bde5fa0 RCX: 00007f0c6bb8efc9 [ 766.684256][T21055] RDX: 0000000000000300 RSI: 0000200000000040 RDI: 000000000000000e [ 766.684268][T21055] RBP: 00007f0c6bc11f91 R08: 0000000000000000 R09: 0000000000000000 [ 766.684280][T21055] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 766.684291][T21055] R13: 00007f0c6bde6038 R14: 00007f0c6bde5fa0 R15: 00007ffcfc534e08 [ 766.684326][T21055] [ 767.216224][T21073] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4175'. [ 767.272815][T21069] netlink: 'syz.4.4177': attribute type 21 has an invalid length. [ 767.286852][T21069] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4177'. [ 767.457649][T21079] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4179'. [ 767.466550][T21074] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 767.716618][T21096] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4181'. [ 768.427398][T21109] 8021q: adding VLAN 0 to HW filter on device bond0 [ 768.732037][T21118] netlink: 'syz.1.4188': attribute type 31 has an invalid length. [ 768.744851][T21118] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4188'. [ 768.783958][T21118] vlan3: entered allmulticast mode [ 768.867404][T21128] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4189'. [ 768.867596][T21130] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4190'. [ 769.016985][T21134] netlink: 'syz.0.4191': attribute type 2 has an invalid length. [ 769.061182][T21136] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4192'. [ 769.117900][T21138] netlink: 'syz.0.4191': attribute type 2 has an invalid length. [ 769.306132][T21149] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4193'. [ 769.623982][T21164] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4196'. [ 769.805493][T21170] netlink: 'syz.2.4198': attribute type 13 has an invalid length. [ 769.950801][T21176] tipc: Enabled bearer , priority 0 [ 769.960100][T21176] syzkaller0: entered promiscuous mode [ 769.965714][T21176] syzkaller0: entered allmulticast mode [ 769.983050][T21176] tipc: Resetting bearer [ 769.990617][T21175] tipc: Resetting bearer [ 770.012848][T21175] tipc: Disabling bearer [ 770.200891][T21187] tipc: Enabling of bearer rejected, already enabled [ 770.392013][T21192] lo speed is unknown, defaulting to 1000 [ 771.013205][T21206] vlan3: entered promiscuous mode [ 771.023215][T21206] macvtap0: entered promiscuous mode [ 771.067039][T21192] lo speed is unknown, defaulting to 1000 [ 771.126821][T21206] IPVS: length: 120 != 46600 [ 772.348885][T21242] __nla_validate_parse: 6 callbacks suppressed [ 772.348905][T21242] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4217'. [ 772.643704][T21259] lo speed is unknown, defaulting to 1000 [ 772.714086][T21269] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4224'. [ 772.870993][T21275] netlink: 'syz.1.4225': attribute type 31 has an invalid length. [ 772.879100][T21275] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4225'. [ 772.912643][T21275] vlan3: entered allmulticast mode [ 773.100177][ T5148] Bluetooth: hci4: command 0x0406 tx timeout [ 773.223111][T21290] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4227'. [ 773.478456][T21259] lo speed is unknown, defaulting to 1000 [ 773.481427][T21285] lo speed is unknown, defaulting to 1000 [ 773.810962][T21301] netlink: 'syz.0.4230': attribute type 1 has an invalid length. [ 773.931591][T21301] 8021q: adding VLAN 0 to HW filter on device bond16 [ 774.047604][T21303] 8021q: adding VLAN 0 to HW filter on device bond16 [ 774.110911][T21303] bond16: (slave vxcan3): The slave device specified does not support setting the MAC address [ 774.145384][T21303] bond16: (slave vxcan3): Error -95 calling set_mac_address [ 774.253180][T21289] lo speed is unknown, defaulting to 1000 [ 774.259129][T21285] lo speed is unknown, defaulting to 1000 [ 774.305425][T21315] netlink: 3 bytes leftover after parsing attributes in process `syz.4.4232'. [ 774.407535][T21305] veth19: entered promiscuous mode [ 774.425302][T21305] bond16: (slave veth19): Enslaving as an active interface with a down link [ 774.588608][T21315] batadv2: entered promiscuous mode [ 774.594851][T21315] batadv2: entered allmulticast mode [ 774.838124][T21289] lo speed is unknown, defaulting to 1000 [ 775.016114][T21332] tipc: Enabling of bearer rejected, already enabled [ 775.557255][T21346] netlink: 'syz.4.4238': attribute type 31 has an invalid length. [ 775.580404][T21346] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4238'. [ 775.846497][T21346] vlan2: entered allmulticast mode [ 776.290730][T21365] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 776.679331][T21377] siw: device registration error -23 [ 776.870057][T21381] netlink: 'syz.1.4245': attribute type 1 has an invalid length. [ 776.898096][T21381] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4245'. [ 776.943390][T21381] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4245'. [ 777.015293][T21383] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4245'. [ 777.246165][T21392] tipc: Enabled bearer , priority 0 [ 777.254934][T21392] syzkaller0: entered promiscuous mode [ 777.274802][T21390] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4247'. [ 777.277058][T21392] syzkaller0: entered allmulticast mode [ 777.302391][T21394] netlink: 'syz.3.4249': attribute type 13 has an invalid length. [ 777.341514][T21397] netlink: 'syz.0.4250': attribute type 31 has an invalid length. [ 777.349490][T21397] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4250'. [ 777.752590][T21398] tipc: Resetting bearer [ 777.777898][T21397] vlan2: entered allmulticast mode [ 777.817991][ T49] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 256 - 0 [ 777.843286][ T49] netdevsim netdevsim3 eth0: unset [1, 1] type 2 family 0 port 6081 - 0 [ 777.852179][ T49] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 256 - 0 [ 777.860930][ T49] netdevsim netdevsim3 eth1: unset [1, 1] type 2 family 0 port 6081 - 0 [ 777.887376][T21391] tipc: Resetting bearer [ 777.947398][T21391] tipc: Disabling bearer [ 777.980789][T21407] sctp: [Deprecated]: syz.0.4253 (pid 21407) Use of int in max_burst socket option deprecated. [ 777.980789][T21407] Use struct sctp_assoc_value instead [ 778.010288][ T49] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 256 - 0 [ 778.028798][ T49] netdevsim netdevsim3 eth2: unset [1, 1] type 2 family 0 port 6081 - 0 [ 778.047805][ T49] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 256 - 0 [ 778.056329][ T49] netdevsim netdevsim3 eth3: unset [1, 1] type 2 family 0 port 6081 - 0 [ 778.110864][T21407] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4253'. [ 778.137138][T21411] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4251'. [ 778.150671][T21411] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4251'. [ 778.159955][T21411] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4251'. [ 778.210149][T21404] lo speed is unknown, defaulting to 1000 [ 778.220514][T21417] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4254'. [ 778.275270][T21417] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 778.309418][T21417] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 778.310298][T21421] net_ratelimit: 11 callbacks suppressed [ 778.310314][T21421] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 778.351016][T21417] netdevsim netdevsim1 eth3 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 778.524075][T21427] netlink: 260 bytes leftover after parsing attributes in process `syz.0.4255'. [ 778.584604][T21417] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 778.621089][T21417] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 778.649353][T21417] netdevsim netdevsim1 eth2 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 778.885457][T21417] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 778.909638][T21417] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 778.930124][T21417] netdevsim netdevsim1 eth1 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 779.061606][T21417] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 779.097229][T21417] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 779.131651][T21451] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 779.138989][T21417] netdevsim netdevsim1 eth0 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 779.233501][T21439] syzkaller0: entered promiscuous mode [ 779.255516][T21448] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4260'. [ 779.270918][T21443] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4258'. [ 779.272483][T21439] syzkaller0: entered allmulticast mode [ 779.508278][T21404] lo speed is unknown, defaulting to 1000 [ 779.564846][ T69] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 779.573130][ T69] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 54406 - 0 [ 779.583426][ T69] netdevsim netdevsim1 eth0: set [1, 2] type 2 family 0 port 44162 - 0 [ 779.693606][ T36] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 779.703465][ T36] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 54406 - 0 [ 779.715090][ T36] netdevsim netdevsim1 eth1: set [1, 2] type 2 family 0 port 44162 - 0 [ 779.752270][T21465] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4271'. [ 779.794857][ T36] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 256 - 0 [ 779.807570][ T36] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 54406 - 0 [ 779.816570][ T36] netdevsim netdevsim1 eth2: set [1, 2] type 2 family 0 port 44162 - 0 [ 780.045843][ T36] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 256 - 0 [ 780.087843][ T36] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 54406 - 0 [ 780.127547][ T36] netdevsim netdevsim1 eth3: set [1, 2] type 2 family 0 port 44162 - 0 [ 780.215787][T21473] netlink: 'syz.1.4262': attribute type 10 has an invalid length. [ 781.163589][T21493] veth0_to_bridge: entered promiscuous mode [ 781.470850][T21487] veth0_to_bridge: left promiscuous mode [ 781.886441][T21521] netlink: 'syz.0.4274': attribute type 1 has an invalid length. [ 781.897186][T21521] netlink: 'syz.0.4274': attribute type 1 has an invalid length. [ 781.933041][T21521] bond17: entered promiscuous mode [ 781.938769][T21521] 8021q: adding VLAN 0 to HW filter on device bond17 [ 782.037476][T21521] 8021q: adding VLAN 0 to HW filter on device bond17 [ 782.059951][T21521] bond17: (slave gre2): The slave device specified does not support setting the MAC address [ 782.071993][T21521] bond17: (slave gre2): Setting fail_over_mac to active for active-backup mode [ 782.102291][T21521] bond17: (slave gre2): Opening slave failed [ 782.397488][T21547] dvmrp0: entered allmulticast mode [ 783.365797][T21584] __nla_validate_parse: 8 callbacks suppressed [ 783.365814][T21584] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4282'. [ 783.381619][T21584] netlink: 'syz.1.4282': attribute type 5 has an invalid length. [ 783.389736][T21585] netlink: 'syz.4.4283': attribute type 13 has an invalid length. [ 783.395064][T21584] netlink: 'syz.1.4282': attribute type 8 has an invalid length. [ 783.398289][T21585] netlink: 'syz.4.4283': attribute type 17 has an invalid length. [ 783.417907][T21587] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4284'. [ 783.428765][T21584] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4282'. [ 783.460907][T21585] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 783.567698][T21579] lo speed is unknown, defaulting to 1000 [ 783.870453][T21599] netlink: 128 bytes leftover after parsing attributes in process `syz.2.4288'. [ 783.905790][T21600] netlink: 277 bytes leftover after parsing attributes in process `syz.3.4287'. [ 784.027346][T21598] netlink: 136 bytes leftover after parsing attributes in process `syz.1.4286'. [ 784.432099][T21579] lo speed is unknown, defaulting to 1000 [ 784.737805][T21617] lo speed is unknown, defaulting to 1000 [ 784.827852][T21623] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4291'. [ 785.209004][T21631] : renamed from bond_slave_0 [ 785.221825][T21617] lo speed is unknown, defaulting to 1000 [ 785.378375][T21628] lo speed is unknown, defaulting to 1000 [ 785.730077][T21645] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4296'. [ 785.764483][T21642] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4295'. [ 785.846902][T21653] tipc: Enabled bearer , priority 10 [ 785.872807][T21646] netlink: 'syz.0.4295': attribute type 12 has an invalid length. [ 785.883203][T21646] netlink: 9472 bytes leftover after parsing attributes in process `syz.0.4295'. [ 786.108490][T21660] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 786.255142][T21634] lo speed is unknown, defaulting to 1000 [ 786.260275][T21628] lo speed is unknown, defaulting to 1000 [ 786.985358][T21634] lo speed is unknown, defaulting to 1000 [ 788.329511][T21710] lo speed is unknown, defaulting to 1000 [ 789.030278][T21710] lo speed is unknown, defaulting to 1000 [ 789.051732][T21733] lo speed is unknown, defaulting to 1000 [ 789.095336][T21723] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 789.152026][T21723] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 789.233729][T21723] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 789.240964][T21723] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 789.301286][T21723] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 789.307235][T21723] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 789.371745][T21723] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 789.377678][T21723] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 789.675232][T21730] lo speed is unknown, defaulting to 1000 [ 789.941787][T21730] lo speed is unknown, defaulting to 1000 [ 789.947997][T21754] wg1: entered promiscuous mode [ 789.953245][T21754] wg1: entered allmulticast mode [ 790.042100][T21733] lo speed is unknown, defaulting to 1000 [ 790.638980][T21756] tipc: Enabled bearer , priority 0 [ 790.657259][T21756] syzkaller0: entered promiscuous mode [ 790.663588][T21756] syzkaller0: entered allmulticast mode [ 790.689591][T21756] tipc: Resetting bearer [ 790.700582][T21755] tipc: Resetting bearer [ 790.737784][T21755] tipc: Disabling bearer [ 790.858270][T21762] __nla_validate_parse: 9 callbacks suppressed [ 790.858288][T21762] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4313'. [ 791.231637][T21778] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4317'. [ 791.377527][T21785] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4319'. [ 791.396696][T21786] netlink: 'syz.3.4316': attribute type 1 has an invalid length. [ 791.609429][T21786] 8021q: adding VLAN 0 to HW filter on device bond6 [ 791.643642][T21791] bond6: (slave wlan0): Opening slave failed [ 791.737038][T21793] vlan1: entered allmulticast mode [ 791.753005][T21793] veth1: entered allmulticast mode [ 791.771035][T21793] bond6: (slave vlan1): Opening slave failed [ 791.924681][T21804] netlink: 'syz.1.4321': attribute type 9 has an invalid length. [ 792.032334][T21799] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4321'. [ 792.155901][T21821] lo speed is unknown, defaulting to 1000 [ 792.851422][T21842] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4331'. [ 793.205197][T21852] netlink: 'syz.1.4333': attribute type 2 has an invalid length. [ 793.258423][T21852] : entered promiscuous mode [ 793.305285][T21858] netlink: 'syz.0.4334': attribute type 9 has an invalid length. [ 793.322774][T21821] lo speed is unknown, defaulting to 1000 [ 793.332637][T21858] netlink: 448 bytes leftover after parsing attributes in process `syz.0.4334'. [ 793.693378][T21869] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4336'. [ 794.040150][T21881] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4340'. [ 794.418535][T21896] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4344'. [ 794.731375][T21905] lo speed is unknown, defaulting to 1000 [ 795.156443][T21916] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4347'. [ 795.313655][T21905] lo speed is unknown, defaulting to 1000 [ 796.216984][T21934] netlink: 136 bytes leftover after parsing attributes in process `syz.4.4352'. [ 796.243456][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 796.255989][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 796.472043][T21947] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4355'. [ 796.499801][T21949] netlink: 'syz.2.4356': attribute type 31 has an invalid length. [ 796.532737][T21949] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4356'. [ 796.571481][T21949] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4356'. [ 796.598739][T21949] vlan4: entered allmulticast mode [ 796.836141][T21958] netlink: 'syz.2.4358': attribute type 1 has an invalid length. [ 797.194000][T21973] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4363'. [ 797.226687][T21977] netlink: 'syz.1.4364': attribute type 1 has an invalid length. [ 797.314504][T21977] 8021q: adding VLAN 0 to HW filter on device bond6 [ 797.406030][T21979] 8021q: adding VLAN 0 to HW filter on device bond6 [ 797.413384][T21979] bond6: (slave vxcan1): The slave device specified does not support setting the MAC address [ 797.424884][T21979] bond6: (slave vxcan1): Error -95 calling set_mac_address [ 797.492359][T21973] vlan4: entered allmulticast mode [ 797.497537][T21973] bridge0: entered allmulticast mode [ 797.512183][T21973] bridge0: port 1(vlan4) entered blocking state [ 797.518960][T21973] bridge0: port 1(vlan4) entered disabled state [ 797.562859][T21983] veth15: entered promiscuous mode [ 797.571262][T21981] mac80211_hwsim hwsim5 wlan0: entered allmulticast mode [ 797.602327][T14041] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 797.613758][T14041] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 798.101746][T22004] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4372'. [ 798.182069][T22008] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4371'. [ 798.182744][T21992] netlink: 'syz.0.4368': attribute type 4 has an invalid length. [ 798.300196][T22013] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4370'. [ 798.331201][T22014] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4372'. [ 798.454307][T21998] netlink: 288 bytes leftover after parsing attributes in process `syz.3.4372'. [ 798.583051][T22021] Cannot find del_set index 65471 as target [ 798.965840][T22032] syzkaller0: Caught tx_queue_len zero misconfig [ 798.992580][T22030] lo speed is unknown, defaulting to 1000 [ 799.269891][ T49] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 799.292048][T16998] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 799.300716][ T49] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 799.430876][T22033] lo speed is unknown, defaulting to 1000 [ 799.438469][T22030] lo speed is unknown, defaulting to 1000 [ 799.540057][T16998] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 799.841902][T22043] netem: incorrect ge model size [ 799.847815][T22043] netem: change failed [ 800.065735][T22033] lo speed is unknown, defaulting to 1000 [ 800.065773][T22035] lo speed is unknown, defaulting to 1000 [ 800.300014][T16998] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 800.511389][T22078] netlink: 'syz.3.4394': attribute type 9 has an invalid length. [ 800.657099][T22038] lo speed is unknown, defaulting to 1000 [ 800.838847][T22087] bond7: entered promiscuous mode [ 800.856696][T22087] 8021q: adding VLAN 0 to HW filter on device bond7 [ 801.123428][T22098] lo speed is unknown, defaulting to 1000 [ 801.130309][T22035] lo speed is unknown, defaulting to 1000 [ 801.219034][T22038] lo speed is unknown, defaulting to 1000 [ 801.460781][T22098] lo speed is unknown, defaulting to 1000 [ 801.468687][T22112] __nla_validate_parse: 6 callbacks suppressed [ 801.468703][T22112] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4403'. [ 801.827345][T22117] lo speed is unknown, defaulting to 1000 [ 802.237508][T22120] lo speed is unknown, defaulting to 1000 [ 802.374868][T22120] lo speed is unknown, defaulting to 1000 [ 802.458499][T22117] lo speed is unknown, defaulting to 1000 [ 802.794626][T22130] netlink: 'syz.0.4407': attribute type 9 has an invalid length. [ 802.885826][T22138] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4409'. [ 802.952309][T22132] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4407'. [ 803.212929][T22144] bond8: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 803.250711][T22144] bond8 (unregistering): Released all slaves [ 803.394226][T22152] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4413'. [ 803.624493][T22157] netlink: 'syz.0.4415': attribute type 1 has an invalid length. [ 803.717505][T22157] 8021q: adding VLAN 0 to HW filter on device bond18 [ 803.739482][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 803.791044][T22162] 8021q: adding VLAN 0 to HW filter on device bond18 [ 803.798357][T22162] bond18: (slave vxcan3): The slave device specified does not support setting the MAC address [ 803.810806][T22162] bond18: (slave vxcan3): Error -95 calling set_mac_address [ 803.941383][T22157] veth21: entered promiscuous mode [ 803.976356][T22157] bond18: (slave veth21): Enslaving as an active interface with a down link [ 804.561095][T22194] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4429'. [ 804.561868][T22200] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 804.693571][T22206] netlink: 'syz.3.4431': attribute type 23 has an invalid length. [ 805.250173][T22223] lo speed is unknown, defaulting to 1000 [ 805.590257][T22223] lo speed is unknown, defaulting to 1000 [ 805.608929][T22224] lo speed is unknown, defaulting to 1000 [ 806.305715][T22224] lo speed is unknown, defaulting to 1000 [ 807.164977][T22263] netlink: 136 bytes leftover after parsing attributes in process `syz.3.4445'. [ 807.268567][T22275] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4448'. [ 807.443044][T22282] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4451'. [ 808.176951][T22314] netlink: 'syz.2.4464': attribute type 8 has an invalid length. [ 808.368771][T22323] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4463'. [ 808.452062][T22333] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4467'. [ 808.707345][T22344] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4475'. [ 809.448072][T22378] netlink: 'syz.0.4483': attribute type 31 has an invalid length. [ 809.462544][T22378] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4483'. [ 809.517266][T22378] vlan2: entered allmulticast mode [ 809.594707][T22385] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4485'. [ 809.647412][T22389] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4487'. [ 809.669545][T22390] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 809.709349][T22389] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4487'. [ 809.881821][T22402] x_tables: duplicate underflow at hook 3 [ 810.611397][T22447] netlink: 'syz.3.4511': attribute type 1 has an invalid length. [ 810.631152][T22449] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 810.656137][T22447] 8021q: adding VLAN 0 to HW filter on device bond8 [ 810.745545][T22447] 8021q: adding VLAN 0 to HW filter on device bond8 [ 810.759895][T22447] bond8: (slave vxcan1): The slave device specified does not support setting the MAC address [ 810.788460][T22447] bond8: (slave vxcan1): Error -95 calling set_mac_address [ 811.023240][T22456] veth23: entered promiscuous mode [ 811.067568][T22456] bond8: (slave veth23): Enslaving as an active interface with a down link [ 811.199334][T22468] lo speed is unknown, defaulting to 1000 [ 811.223446][T22476] IPv6: NLM_F_CREATE should be specified when creating new route [ 811.522677][T22471] lo speed is unknown, defaulting to 1000 [ 811.529578][T22468] lo speed is unknown, defaulting to 1000 [ 812.171036][T22471] lo speed is unknown, defaulting to 1000 [ 812.219387][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 812.336815][T22509] __nla_validate_parse: 3 callbacks suppressed [ 812.336833][T22509] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4530'. [ 812.542246][T22521] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4535'. [ 812.782158][T22534] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4537'. [ 813.125976][T22546] lo speed is unknown, defaulting to 1000 [ 813.473721][T22546] lo speed is unknown, defaulting to 1000 [ 813.524102][T22549] lo speed is unknown, defaulting to 1000 [ 813.871034][T22582] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4556'. [ 813.986009][T22584] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 814.315567][T22591] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4558'. [ 814.387891][T22596] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4559'. [ 814.611536][T22549] lo speed is unknown, defaulting to 1000 [ 815.119997][T22620] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4569'. [ 815.468839][T22629] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4573'. [ 815.607531][T22632] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4574'. [ 817.462924][T22696] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4598'. [ 817.489512][T22696] netlink: 620 bytes leftover after parsing attributes in process `syz.1.4598'. [ 817.499549][T22696] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4598'. [ 818.167308][T22737] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4611'. [ 818.433484][T22740] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4612'. [ 818.973878][T22759] netlink: 700 bytes leftover after parsing attributes in process `syz.4.4619'. [ 818.984286][T22759] netlink: 700 bytes leftover after parsing attributes in process `syz.4.4619'. [ 819.110162][T22769] netlink: 'syz.1.4622': attribute type 31 has an invalid length. [ 819.121589][T22769] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4622'. [ 819.152640][T22773] netlink: 19 bytes leftover after parsing attributes in process `syz.2.4624'. [ 819.156859][T22769] vlan4: entered allmulticast mode [ 819.415095][T22794] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4629'. [ 821.645682][T22865] block nbd0: not configured, cannot reconfigure [ 822.731193][T22920] __nla_validate_parse: 2 callbacks suppressed [ 822.731210][T22920] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4674'. [ 822.985230][T22937] lo speed is unknown, defaulting to 1000 [ 823.288244][T22940] lo speed is unknown, defaulting to 1000 [ 823.288268][T22937] lo speed is unknown, defaulting to 1000 [ 823.567345][T22940] lo speed is unknown, defaulting to 1000 [ 823.938812][T22984] lo speed is unknown, defaulting to 1000 [ 824.263942][T22984] lo speed is unknown, defaulting to 1000 [ 824.376195][T22991] lo speed is unknown, defaulting to 1000 [ 825.305960][T22991] lo speed is unknown, defaulting to 1000 [ 825.781062][T13692] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 825.930821][T13692] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 826.065693][T23046] netlink: 'syz.3.4724': attribute type 2 has an invalid length. [ 826.572657][T23068] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4731'. [ 826.783427][T23081] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 826.810756][T23082] A link change request failed with some changes committed already. Interface wg1 may have been left with an inconsistent configuration, please check. [ 826.877796][T23087] xt_hashlimit: max too large, truncated to 1048576 [ 827.484816][T23112] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4745'. [ 827.758087][T23121] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4747'. [ 827.905941][T23123] lo speed is unknown, defaulting to 1000 [ 828.070883][T23134] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4750'. [ 828.289045][T23123] lo speed is unknown, defaulting to 1000 [ 828.295628][T23124] lo speed is unknown, defaulting to 1000 [ 828.729139][T23124] lo speed is unknown, defaulting to 1000 [ 828.908959][T23173] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4763'. [ 829.100350][T23179] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4764'. [ 829.114795][T23179] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4764'. [ 829.499424][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 829.633285][T23199] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4771'. [ 829.868165][T23206] lo speed is unknown, defaulting to 1000 [ 829.982782][T23219] netlink: 'syz.0.4775': attribute type 1 has an invalid length. [ 830.009331][T23219] netlink: 'syz.0.4775': attribute type 2 has an invalid length. [ 830.330391][T23237] netlink: 56 bytes leftover after parsing attributes in process `syz.0.4779'. [ 830.428383][T23249] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 830.861546][T23266] netlink: 'syz.0.4786': attribute type 2 has an invalid length. [ 830.897829][T23206] lo speed is unknown, defaulting to 1000 [ 830.897837][T23231] lo speed is unknown, defaulting to 1000 [ 831.264865][T23231] lo speed is unknown, defaulting to 1000 [ 831.270454][T23234] lo speed is unknown, defaulting to 1000 [ 831.287103][T23277] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4789'. [ 831.638203][T23291] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 831.780839][T23295] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4796'. [ 831.926138][T23234] lo speed is unknown, defaulting to 1000 [ 832.347677][T23306] netlink: 'syz.2.4799': attribute type 31 has an invalid length. [ 832.373498][T23306] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4799'. [ 832.683959][T23310] vlan4: entered allmulticast mode [ 832.931281][T23323] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 834.248142][T23384] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4823'. [ 834.553242][T23399] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4831'. [ 834.589778][T23399] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4831'. [ 834.828522][T23421] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4840'. [ 834.946871][T23431] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4844'. [ 835.000050][T23431] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4844'. [ 835.184010][T23444] netlink: 'syz.0.4849': attribute type 31 has an invalid length. [ 835.193687][T23444] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4849'. [ 835.260386][T23446] vlan2: entered allmulticast mode [ 835.898183][T23483] lo speed is unknown, defaulting to 1000 [ 836.084012][T23491] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4866'. [ 836.235681][T23483] lo speed is unknown, defaulting to 1000 [ 836.410570][T23495] netlink: 'syz.2.4868': attribute type 31 has an invalid length. [ 836.451316][T23495] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4868'. [ 836.540392][T23495] vlan4: entered allmulticast mode [ 836.967527][T23524] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4877'. [ 837.205289][T23535] TCP: TCP_TX_DELAY enabled [ 837.546308][T23562] netlink: 'syz.4.4892': attribute type 1 has an invalid length. [ 837.951741][T23583] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 838.407990][T23597] netlink: 'syz.3.4903': attribute type 11 has an invalid length. [ 838.444698][T23594] lo speed is unknown, defaulting to 1000 [ 839.015421][T23623] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 839.185173][T23600] lo speed is unknown, defaulting to 1000 [ 839.217557][T23594] lo speed is unknown, defaulting to 1000 [ 839.294848][T23634] __nla_validate_parse: 10 callbacks suppressed [ 839.294866][T23634] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4911'. [ 839.432651][T23638] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4912'. [ 839.808939][T23643] IPVS: Unknown mcast interface: hsr0 [ 840.081941][T23600] lo speed is unknown, defaulting to 1000 [ 840.395268][T23670] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4922'. [ 840.446700][T23674] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4922'. [ 840.544379][T23675] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4923'. [ 840.813546][T23681] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4924'. [ 841.632808][T23726] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4940'. [ 841.807400][T23733] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4942'. [ 842.175946][T23747] netlink: 'syz.2.4948': attribute type 31 has an invalid length. [ 842.184195][T23747] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4948'. [ 842.218296][T23747] vlan4: entered allmulticast mode [ 842.472432][T23764] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4950'. [ 842.554653][T23768] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 844.696202][T23865] lo speed is unknown, defaulting to 1000 [ 844.780067][T23866] __nla_validate_parse: 4 callbacks suppressed [ 844.780086][T23866] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4988'. [ 845.176391][T23868] lo speed is unknown, defaulting to 1000 [ 845.177532][T23865] lo speed is unknown, defaulting to 1000 [ 845.598239][T23895] lo speed is unknown, defaulting to 1000 [ 845.599153][T23868] lo speed is unknown, defaulting to 1000 [ 846.755542][T23904] lo speed is unknown, defaulting to 1000 [ 847.037783][T23947] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5011'. [ 847.101384][T23949] netlink: 96 bytes leftover after parsing attributes in process `syz.2.5012'. [ 847.160459][T23904] lo speed is unknown, defaulting to 1000 [ 847.220959][T23895] lo speed is unknown, defaulting to 1000 [ 847.381600][T23962] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 848.338690][T23977] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5021'. [ 848.457362][T23982] lo speed is unknown, defaulting to 1000 [ 848.568494][T23990] netlink: 96 bytes leftover after parsing attributes in process `syz.2.5024'. [ 848.820330][T23984] lo speed is unknown, defaulting to 1000 [ 848.830136][T23982] lo speed is unknown, defaulting to 1000 [ 849.713848][T23984] lo speed is unknown, defaulting to 1000 [ 850.042324][T24023] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5033'. [ 850.133774][T24025] syzkaller1: entered promiscuous mode [ 850.152588][T24025] syzkaller1: entered allmulticast mode [ 850.508212][T24045] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5041'. [ 850.533458][T24047] lo speed is unknown, defaulting to 1000 [ 850.619386][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 850.774064][T24047] lo speed is unknown, defaulting to 1000 [ 850.774135][T24048] lo speed is unknown, defaulting to 1000 [ 851.017693][T24048] lo speed is unknown, defaulting to 1000 [ 851.162233][T24063] lo speed is unknown, defaulting to 1000 [ 851.313832][T24076] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5050'. [ 851.352556][T24076] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5050'. [ 851.621549][T24068] lo speed is unknown, defaulting to 1000 [ 851.621729][T24063] lo speed is unknown, defaulting to 1000 [ 851.702933][T24091] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 852.119720][T24107] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5059'. [ 852.600600][T24068] lo speed is unknown, defaulting to 1000 [ 853.375520][T24137] lo speed is unknown, defaulting to 1000 [ 853.740291][T24139] lo speed is unknown, defaulting to 1000 [ 853.993197][T24137] lo speed is unknown, defaulting to 1000 [ 854.061978][T24139] lo speed is unknown, defaulting to 1000 [ 854.293926][T24172] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5079'. [ 855.050945][T24194] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5086'. [ 855.419049][T24210] lo speed is unknown, defaulting to 1000 [ 855.441198][T24212] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5092'. [ 855.464088][T24214] netlink: 220 bytes leftover after parsing attributes in process `syz.2.5093'. [ 855.473761][T24212] netlink: 'syz.3.5092': attribute type 20 has an invalid length. [ 855.481966][T24214] netlink: 220 bytes leftover after parsing attributes in process `syz.2.5093'. [ 855.491282][T24214] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5093'. [ 855.503821][T24212] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5092'. [ 855.514948][T24212] netlink: 'syz.3.5092': attribute type 20 has an invalid length. [ 855.858858][T24210] lo speed is unknown, defaulting to 1000 [ 855.860354][T24217] lo speed is unknown, defaulting to 1000 [ 855.920842][T24229] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5098'. [ 855.930405][T24229] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5098'. [ 855.939319][T24229] netlink: 156 bytes leftover after parsing attributes in process `syz.3.5098'. [ 856.254849][T24237] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5101'. [ 856.781222][T24217] lo speed is unknown, defaulting to 1000 [ 857.849425][T24279] lo speed is unknown, defaulting to 1000 [ 857.900002][T24284] : renamed from bond_slave_0 [ 858.228570][T24284] lo speed is unknown, defaulting to 1000 [ 858.235902][T24279] lo speed is unknown, defaulting to 1000 [ 858.423646][T24312] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 858.562972][T24284] lo speed is unknown, defaulting to 1000 [ 859.330319][T24332] bond0: entered promiscuous mode [ 859.343871][T24332] bond0: entered allmulticast mode [ 859.604844][T24341] lo speed is unknown, defaulting to 1000 [ 860.036523][T24341] lo speed is unknown, defaulting to 1000 [ 860.066427][T24353] lo speed is unknown, defaulting to 1000 [ 860.088884][T24367] __nla_validate_parse: 6 callbacks suppressed [ 860.088925][T24367] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5139'. [ 860.328977][T24370] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5141'. [ 860.620285][T24353] lo speed is unknown, defaulting to 1000 [ 861.276508][T24390] lo speed is unknown, defaulting to 1000 [ 861.590813][T24391] lo speed is unknown, defaulting to 1000 [ 861.592485][T24390] lo speed is unknown, defaulting to 1000 [ 861.820873][T24412] netlink: 'syz.1.5155': attribute type 31 has an invalid length. [ 861.834908][T24412] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5155'. [ 861.893007][T24412] vlan4: entered allmulticast mode [ 861.956683][T24391] lo speed is unknown, defaulting to 1000 [ 861.963992][T24400] lo speed is unknown, defaulting to 1000 [ 862.405340][T24405] lo speed is unknown, defaulting to 1000 [ 862.608458][T24416] lo speed is unknown, defaulting to 1000 [ 862.831436][T24418] lo speed is unknown, defaulting to 1000 [ 863.094073][T24400] lo speed is unknown, defaulting to 1000 [ 863.114886][T24405] lo speed is unknown, defaulting to 1000 [ 863.165713][T24416] lo speed is unknown, defaulting to 1000 [ 863.413238][T24418] lo speed is unknown, defaulting to 1000 [ 863.495124][T24464] netlink: 'syz.1.5168': attribute type 31 has an invalid length. [ 863.503637][T24464] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5168'. [ 863.595805][T24464] vlan4: entered allmulticast mode [ 864.418517][T24479] lo speed is unknown, defaulting to 1000 [ 865.063182][T24488] lo speed is unknown, defaulting to 1000 [ 865.063182][T24479] lo speed is unknown, defaulting to 1000 [ 865.105260][T24503] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5179'. [ 865.339424][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 865.558787][T24491] lo speed is unknown, defaulting to 1000 [ 865.566715][T24488] lo speed is unknown, defaulting to 1000 [ 865.995999][T24505] lo speed is unknown, defaulting to 1000 [ 866.160577][T24505] lo speed is unknown, defaulting to 1000 [ 866.168467][T24491] lo speed is unknown, defaulting to 1000 [ 866.696321][T24543] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5191'. [ 866.777967][T24536] lo speed is unknown, defaulting to 1000 [ 867.015472][T24537] lo speed is unknown, defaulting to 1000 [ 867.178296][T24534] lo speed is unknown, defaulting to 1000 [ 867.299963][T24538] lo speed is unknown, defaulting to 1000 [ 867.433983][T24538] lo speed is unknown, defaulting to 1000 [ 867.488908][T24536] lo speed is unknown, defaulting to 1000 [ 867.488925][T24548] lo speed is unknown, defaulting to 1000 [ 867.538239][T24537] lo speed is unknown, defaulting to 1000 [ 867.684618][T24534] lo speed is unknown, defaulting to 1000 [ 867.866403][T24549] lo speed is unknown, defaulting to 1000 [ 868.050483][T24548] lo speed is unknown, defaulting to 1000 [ 868.145776][T24549] lo speed is unknown, defaulting to 1000 [ 868.272732][T24554] syzkaller0: entered promiscuous mode [ 868.278431][T24554] syzkaller0: entered allmulticast mode [ 870.348895][T24559] netlink: 'syz.2.5196': attribute type 4 has an invalid length. [ 870.375814][T24559] netlink: 'syz.2.5196': attribute type 4 has an invalid length. [ 870.412153][T13692] lo speed is unknown, defaulting to 1000 [ 870.417923][T13692] syz1: Port: 1 Link ACTIVE [ 870.430075][T24559] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5196'. [ 870.532102][T24563] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5198'. [ 870.567490][T13692] lo speed is unknown, defaulting to 1000 [ 870.579429][T13692] syz1: Port: 1 Link DOWN [ 870.958005][T24582] lo speed is unknown, defaulting to 1000 [ 871.009752][T24587] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 871.286507][T24598] veth1_to_bond: entered allmulticast mode [ 871.303581][T24598] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5209'. [ 871.438331][T24600] openvswitch: netlink: Message has 4 unknown bytes. [ 871.451025][T24598] veth1_to_bond (unregistering): left allmulticast mode [ 871.517376][T24586] lo speed is unknown, defaulting to 1000 [ 871.525028][T24582] lo speed is unknown, defaulting to 1000 [ 872.321445][T24618] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5216'. [ 872.380095][T24617] netlink: 60 bytes leftover after parsing attributes in process `syz.1.5216'. [ 872.391772][T24586] lo speed is unknown, defaulting to 1000 [ 872.703600][T24625] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5217'. [ 872.877306][T24625] 8021q: adding VLAN 0 to HW filter on device bond8 [ 872.893001][T24625] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5217'. [ 872.975132][T24625] macsec0: entered promiscuous mode [ 872.982498][T24625] bond8: entered promiscuous mode [ 873.024745][T24625] macsec0: entered allmulticast mode [ 873.039243][T24625] bond8: entered allmulticast mode [ 873.061071][T24625] bond8: left allmulticast mode [ 873.065987][T24625] bond8: left promiscuous mode [ 873.323448][T24639] netlink: 'syz.4.5223': attribute type 1 has an invalid length. [ 873.478486][T24643] netlink: 'syz.1.5224': attribute type 31 has an invalid length. [ 873.496526][T24643] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5224'. [ 873.577797][T24643] vlan4: entered allmulticast mode [ 873.614759][T24649] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5225'. [ 873.704959][T24654] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5228'. [ 873.790910][T24654] block nbd0: not configured, cannot reconfigure [ 874.018258][T24656] tipc: Enabled bearer , priority 0 [ 874.073393][T24659] syzkaller0: entered promiscuous mode [ 874.084471][T24659] syzkaller0: entered allmulticast mode [ 874.093042][T24659] tipc: Resetting bearer [ 874.104926][T24650] tipc: Resetting bearer [ 875.688942][T24650] tipc: Disabling bearer [ 875.971634][T24693] lo speed is unknown, defaulting to 1000 [ 875.993363][T24697] netlink: 'syz.0.5238': attribute type 31 has an invalid length. [ 876.009359][T24697] __nla_validate_parse: 1 callbacks suppressed [ 876.009375][T24697] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5238'. [ 876.065098][T24697] vlan2: entered allmulticast mode [ 876.130668][T24705] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5240'. [ 876.314773][T24700] lo speed is unknown, defaulting to 1000 [ 876.434241][T24693] lo speed is unknown, defaulting to 1000 [ 876.526749][T24700] lo speed is unknown, defaulting to 1000 [ 876.526889][T24694] lo speed is unknown, defaulting to 1000 [ 876.828023][T24727] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5246'. [ 876.942780][T24701] lo speed is unknown, defaulting to 1000 [ 877.034571][T24729] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5247'. [ 877.134415][T24733] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5249'. [ 877.254198][T24701] lo speed is unknown, defaulting to 1000 [ 877.281552][T24694] lo speed is unknown, defaulting to 1000 [ 878.551554][T24782] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5263'. [ 880.653422][T24812] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5274'. [ 880.689402][T24812] netlink: 72 bytes leftover after parsing attributes in process `syz.4.5274'. [ 880.807811][T24823] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5276'. [ 880.918270][T24828] lo speed is unknown, defaulting to 1000 [ 880.945018][T24832] tipc: Enabled bearer , priority 0 [ 881.520164][T24828] lo speed is unknown, defaulting to 1000 [ 881.706864][T24857] sch_tbf: burst 21990 is lower than device lo mtu (61420) ! [ 881.775757][T24859] netlink: 'syz.2.5290': attribute type 1 has an invalid length. [ 881.948230][T24861] bond0: entered promiscuous mode [ 881.955760][T24861] bond0: entered allmulticast mode [ 881.962069][T24861] 8021q: adding VLAN 0 to HW filter on device bond0 [ 882.025727][T24862] bridge0: entered promiscuous mode [ 882.032095][T24862] bridge0: entered allmulticast mode [ 882.038471][T24862] bond0: (slave bridge0): Enslaving as a backup interface with an up link [ 882.050273][ T1137] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 882.191050][ T49] bond0: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 882.235600][T24867] lo speed is unknown, defaulting to 1000 [ 882.277373][T24871] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5293'. [ 882.573788][T24883] syzkaller1: entered promiscuous mode [ 882.579647][T24883] syzkaller1: entered allmulticast mode [ 882.688027][T24867] lo speed is unknown, defaulting to 1000 [ 882.826255][T24899] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 882.922432][T24902] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5305'. [ 883.134396][T24909] lo speed is unknown, defaulting to 1000 [ 883.208796][T24917] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 883.517215][T24909] lo speed is unknown, defaulting to 1000 [ 884.046278][T24934] syzkaller0: entered promiscuous mode [ 884.056116][T24934] syzkaller0: entered allmulticast mode [ 886.006222][T24936] lo speed is unknown, defaulting to 1000 [ 886.132884][T24952] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5314'. [ 886.212390][T24954] netlink: 'syz.1.5315': attribute type 13 has an invalid length. [ 886.245406][T24958] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5317'. [ 886.400397][T24936] lo speed is unknown, defaulting to 1000 [ 886.480412][T24969] netlink: 'syz.2.5320': attribute type 31 has an invalid length. [ 886.488267][T24969] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5320'. [ 886.547927][T24969] vlan4: entered allmulticast mode [ 886.572054][T24974] syzkaller0: Caught tx_queue_len zero misconfig [ 886.758326][T24984] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 887.597537][T25003] syzkaller1: entered promiscuous mode [ 887.607543][T25003] syzkaller1: entered allmulticast mode [ 888.022468][T25016] syzkaller1: entered promiscuous mode [ 888.035753][T25016] syzkaller1: entered allmulticast mode [ 888.433988][T25024] lo speed is unknown, defaulting to 1000 [ 888.691096][T25037] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5336'. [ 888.700871][T25024] lo speed is unknown, defaulting to 1000 [ 888.701377][T25029] lo speed is unknown, defaulting to 1000 [ 888.714261][T25037] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5336'. [ 888.787526][T25042] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 889.064725][T25029] lo speed is unknown, defaulting to 1000 [ 889.175298][T25054] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5345'. [ 889.356810][T25054] bond0: (slave bridge0): Removing an active aggregator [ 889.365532][T25054] bond0: (slave bridge0): Releasing backup interface [ 889.373676][T25054] bridge0 (unregistering): left promiscuous mode [ 889.380844][T25054] bridge0 (unregistering): left allmulticast mode [ 889.708811][T25063] netlink: 140 bytes leftover after parsing attributes in process `syz.1.5348'. [ 889.936870][T25077] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5352'. [ 890.308347][T25083] lo speed is unknown, defaulting to 1000 [ 890.328590][T25089] syzkaller1: entered promiscuous mode [ 890.334692][T25089] syzkaller1: entered allmulticast mode [ 890.550263][T25095] netdevsim netdevsim1 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 890.574623][T25095] netdevsim netdevsim1 eth3 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 890.593183][T25095] netdevsim netdevsim1 eth3 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 890.739454][T25095] netdevsim netdevsim1 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 890.750431][T25095] netdevsim netdevsim1 eth2 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 890.781190][T25095] netdevsim netdevsim1 eth2 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 890.843490][T25076] lo speed is unknown, defaulting to 1000 [ 890.843504][T25083] lo speed is unknown, defaulting to 1000 [ 890.911468][T25095] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 890.942774][T25095] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 890.954468][T25095] netdevsim netdevsim1 eth1 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 891.036959][T25115] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5360'. [ 891.046565][T25115] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5360'. [ 891.063400][T25095] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 891.077203][T25095] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 891.091118][T25095] netdevsim netdevsim1 eth0 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 891.159536][T25076] lo speed is unknown, defaulting to 1000 [ 891.327603][ T1155] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 256 - 0 [ 891.376782][ T1155] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 54406 - 0 [ 891.399474][ T1155] netdevsim netdevsim1 eth0: set [1, 2] type 2 family 0 port 44162 - 0 [ 891.572352][ T1155] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 256 - 0 [ 891.586467][ T1155] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 54406 - 0 [ 891.606499][ T1155] netdevsim netdevsim1 eth1: set [1, 2] type 2 family 0 port 44162 - 0 [ 891.630481][T25095] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 891.643491][T25095] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 54406 - 0 [ 891.657826][T25095] netdevsim netdevsim1 eth1 (unregistering): unset [1, 2] type 2 family 0 port 44162 - 0 [ 891.731037][ T1155] ================================================================== [ 891.739147][ T1155] BUG: KASAN: slab-use-after-free in __mutex_lock+0x147/0x1350 [ 891.746704][ T1155] Read of size 8 at addr ffff888024a38cb0 by task kworker/u8:6/1155 [ 891.754687][ T1155] [ 891.757024][ T1155] CPU: 0 UID: 0 PID: 1155 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT(full) [ 891.757047][ T1155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 891.757060][ T1155] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 891.757093][ T1155] Call Trace: [ 891.757101][ T1155] [ 891.757109][ T1155] dump_stack_lvl+0x189/0x250 [ 891.757128][ T1155] ? __kasan_check_byte+0x12/0x40 [ 891.757149][ T1155] ? __pfx_dump_stack_lvl+0x10/0x10 [ 891.757166][ T1155] ? lock_release+0x4b/0x3e0 [ 891.757190][ T1155] ? __virt_addr_valid+0x4a5/0x5c0 [ 891.757209][ T1155] print_report+0xca/0x240 [ 891.757230][ T1155] ? __mutex_lock+0x147/0x1350 [ 891.757246][ T1155] kasan_report+0x118/0x150 [ 891.757265][ T1155] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 891.757290][ T1155] ? __mutex_lock+0x147/0x1350 [ 891.757312][ T1155] __mutex_lock+0x147/0x1350 [ 891.757331][ T1155] ? __mutex_lock+0x5bb/0x1350 [ 891.757351][ T1155] ? udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 891.757378][ T1155] ? __pfx___mutex_lock+0x10/0x10 [ 891.757399][ T1155] ? __lock_acquire+0xab9/0xd20 [ 891.757425][ T1155] udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 891.757454][ T1155] ? process_scheduled_works+0x9ef/0x17b0 [ 891.757476][ T1155] ? process_scheduled_works+0x9ef/0x17b0 [ 891.757499][ T1155] process_scheduled_works+0xae1/0x17b0 [ 891.757535][ T1155] ? __pfx_process_scheduled_works+0x10/0x10 [ 891.757565][ T1155] worker_thread+0x8a0/0xda0 [ 891.757589][ T1155] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 891.757616][ T1155] ? __kthread_parkme+0x7b/0x200 [ 891.757644][ T1155] kthread+0x711/0x8a0 [ 891.757662][ T1155] ? __pfx_worker_thread+0x10/0x10 [ 891.757685][ T1155] ? __pfx_kthread+0x10/0x10 [ 891.757702][ T1155] ? _raw_spin_unlock_irq+0x23/0x50 [ 891.757723][ T1155] ? lockdep_hardirqs_on+0x9c/0x150 [ 891.757739][ T1155] ? __pfx_kthread+0x10/0x10 [ 891.757755][ T1155] ret_from_fork+0x4bc/0x870 [ 891.757779][ T1155] ? __pfx_ret_from_fork+0x10/0x10 [ 891.757809][ T1155] ? __switch_to_asm+0x39/0x70 [ 891.757827][ T1155] ? __switch_to_asm+0x33/0x70 [ 891.757845][ T1155] ? __pfx_kthread+0x10/0x10 [ 891.757862][ T1155] ret_from_fork_asm+0x1a/0x30 [ 891.757890][ T1155] [ 891.757896][ T1155] [ 891.972100][ T1155] Allocated by task 25095: [ 891.976508][ T1155] kasan_save_track+0x3e/0x80 [ 891.981177][ T1155] __kasan_kmalloc+0x93/0xb0 [ 891.985765][ T1155] __kmalloc_noprof+0x411/0x7f0 [ 891.990606][ T1155] udp_tunnel_nic_netdevice_event+0x4c3/0x1810 [ 891.996751][ T1155] notifier_call_chain+0x1b6/0x3e0 [ 892.001852][ T1155] register_netdevice+0x1608/0x1ae0 [ 892.007041][ T1155] nsim_create+0xae8/0xf10 [ 892.011444][ T1155] __nsim_dev_port_add+0x6b6/0xb10 [ 892.016540][ T1155] nsim_dev_port_add_all+0x37/0xf0 [ 892.021641][ T1155] nsim_dev_reload_up+0x451/0x780 [ 892.026746][ T1155] devlink_reload+0x4ec/0x8d0 [ 892.031413][ T1155] devlink_nl_reload_doit+0x9c2/0xd50 [ 892.036771][ T1155] genl_family_rcv_msg_doit+0x215/0x300 [ 892.042311][ T1155] genl_rcv_msg+0x60e/0x790 [ 892.046803][ T1155] netlink_rcv_skb+0x208/0x470 [ 892.051568][ T1155] genl_rcv+0x28/0x40 [ 892.055542][ T1155] netlink_unicast+0x82f/0x9e0 [ 892.060377][ T1155] netlink_sendmsg+0x805/0xb30 [ 892.065130][ T1155] __sock_sendmsg+0x21c/0x270 [ 892.069794][ T1155] ____sys_sendmsg+0x505/0x830 [ 892.074548][ T1155] ___sys_sendmsg+0x21f/0x2a0 [ 892.079207][ T1155] __x64_sys_sendmsg+0x19b/0x260 [ 892.084127][ T1155] do_syscall_64+0xfa/0xfa0 [ 892.088614][ T1155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.094492][ T1155] [ 892.096800][ T1155] Freed by task 25095: [ 892.100845][ T1155] kasan_save_track+0x3e/0x80 [ 892.105508][ T1155] __kasan_save_free_info+0x46/0x50 [ 892.110695][ T1155] __kasan_slab_free+0x5c/0x80 [ 892.115447][ T1155] kfree+0x19a/0x6d0 [ 892.119325][ T1155] udp_tunnel_nic_netdevice_event+0x11ab/0x1810 [ 892.125565][ T1155] notifier_call_chain+0x1b6/0x3e0 [ 892.130664][ T1155] unregister_netdevice_many_notify+0x1860/0x2390 [ 892.137063][ T1155] unregister_netdevice_queue+0x33c/0x380 [ 892.142765][ T1155] nsim_destroy+0x1dd/0x670 [ 892.147256][ T1155] __nsim_dev_port_del+0x14d/0x1b0 [ 892.152352][ T1155] nsim_dev_port_add_all+0xae/0xf0 [ 892.157449][ T1155] nsim_dev_reload_up+0x451/0x780 [ 892.162457][ T1155] devlink_reload+0x4ec/0x8d0 [ 892.167127][ T1155] devlink_nl_reload_doit+0x9c2/0xd50 [ 892.172489][ T1155] genl_family_rcv_msg_doit+0x215/0x300 [ 892.178023][ T1155] genl_rcv_msg+0x60e/0x790 [ 892.182510][ T1155] netlink_rcv_skb+0x208/0x470 [ 892.187262][ T1155] genl_rcv+0x28/0x40 [ 892.191223][ T1155] netlink_unicast+0x82f/0x9e0 [ 892.195974][ T1155] netlink_sendmsg+0x805/0xb30 [ 892.200730][ T1155] __sock_sendmsg+0x21c/0x270 [ 892.205393][ T1155] ____sys_sendmsg+0x505/0x830 [ 892.210144][ T1155] ___sys_sendmsg+0x21f/0x2a0 [ 892.214802][ T1155] __x64_sys_sendmsg+0x19b/0x260 [ 892.219723][ T1155] do_syscall_64+0xfa/0xfa0 [ 892.224208][ T1155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.230085][ T1155] [ 892.232394][ T1155] Last potentially related work creation: [ 892.238088][ T1155] kasan_save_stack+0x3e/0x60 [ 892.242751][ T1155] kasan_record_aux_stack+0xbd/0xd0 [ 892.247944][ T1155] insert_work+0x3d/0x330 [ 892.252263][ T1155] __queue_work+0xbaf/0xfb0 [ 892.256754][ T1155] queue_work_on+0x181/0x270 [ 892.261330][ T1155] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 892.266956][ T1155] udp_tunnel_push_rx_port+0x180/0x200 [ 892.272405][ T1155] geneve_offload_rx_ports+0xd7/0x160 [ 892.277760][ T1155] geneve_netdevice_event+0x6a/0x80 [ 892.282941][ T1155] notifier_call_chain+0x1b6/0x3e0 [ 892.288043][ T1155] call_netdevice_notifiers+0x88/0xc0 [ 892.293402][ T1155] udp_tunnel_nic_netdevice_event+0xdff/0x1810 [ 892.299545][ T1155] notifier_call_chain+0x1b6/0x3e0 [ 892.304643][ T1155] register_netdevice+0x1608/0x1ae0 [ 892.309826][ T1155] nsim_create+0xae8/0xf10 [ 892.314231][ T1155] __nsim_dev_port_add+0x6b6/0xb10 [ 892.319326][ T1155] nsim_dev_port_add_all+0x37/0xf0 [ 892.324433][ T1155] nsim_dev_reload_up+0x451/0x780 [ 892.329443][ T1155] devlink_reload+0x4ec/0x8d0 [ 892.334110][ T1155] devlink_nl_reload_doit+0x9c2/0xd50 [ 892.339478][ T1155] genl_family_rcv_msg_doit+0x215/0x300 [ 892.345017][ T1155] genl_rcv_msg+0x60e/0x790 [ 892.349504][ T1155] netlink_rcv_skb+0x208/0x470 [ 892.354254][ T1155] genl_rcv+0x28/0x40 [ 892.358219][ T1155] netlink_unicast+0x82f/0x9e0 [ 892.362973][ T1155] netlink_sendmsg+0x805/0xb30 [ 892.367725][ T1155] __sock_sendmsg+0x21c/0x270 [ 892.372386][ T1155] ____sys_sendmsg+0x505/0x830 [ 892.377139][ T1155] ___sys_sendmsg+0x21f/0x2a0 [ 892.381799][ T1155] __x64_sys_sendmsg+0x19b/0x260 [ 892.386719][ T1155] do_syscall_64+0xfa/0xfa0 [ 892.391204][ T1155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.397081][ T1155] [ 892.399386][ T1155] Second to last potentially related work creation: [ 892.405947][ T1155] kasan_save_stack+0x3e/0x60 [ 892.410610][ T1155] kasan_record_aux_stack+0xbd/0xd0 [ 892.415799][ T1155] insert_work+0x3d/0x330 [ 892.420116][ T1155] __queue_work+0xcd2/0xfb0 [ 892.424609][ T1155] queue_work_on+0x181/0x270 [ 892.429186][ T1155] __udp_tunnel_nic_add_port+0xb71/0xd60 [ 892.434808][ T1155] udp_tunnel_push_rx_port+0x180/0x200 [ 892.440252][ T1155] geneve_offload_rx_ports+0xd7/0x160 [ 892.445606][ T1155] geneve_netdevice_event+0x6a/0x80 [ 892.450788][ T1155] notifier_call_chain+0x1b6/0x3e0 [ 892.455890][ T1155] call_netdevice_notifiers+0x88/0xc0 [ 892.461248][ T1155] udp_tunnel_nic_netdevice_event+0xdff/0x1810 [ 892.467390][ T1155] notifier_call_chain+0x1b6/0x3e0 [ 892.472491][ T1155] register_netdevice+0x1608/0x1ae0 [ 892.477672][ T1155] nsim_create+0xae8/0xf10 [ 892.482077][ T1155] __nsim_dev_port_add+0x6b6/0xb10 [ 892.487170][ T1155] nsim_dev_port_add_all+0x37/0xf0 [ 892.492261][ T1155] nsim_dev_reload_up+0x451/0x780 [ 892.497268][ T1155] devlink_reload+0x4ec/0x8d0 [ 892.501930][ T1155] devlink_nl_reload_doit+0x9c2/0xd50 [ 892.507289][ T1155] genl_family_rcv_msg_doit+0x215/0x300 [ 892.512818][ T1155] genl_rcv_msg+0x60e/0x790 [ 892.517303][ T1155] netlink_rcv_skb+0x208/0x470 [ 892.522056][ T1155] genl_rcv+0x28/0x40 [ 892.526023][ T1155] netlink_unicast+0x82f/0x9e0 [ 892.530773][ T1155] netlink_sendmsg+0x805/0xb30 [ 892.535526][ T1155] __sock_sendmsg+0x21c/0x270 [ 892.540188][ T1155] ____sys_sendmsg+0x505/0x830 [ 892.544943][ T1155] ___sys_sendmsg+0x21f/0x2a0 [ 892.549604][ T1155] __x64_sys_sendmsg+0x19b/0x260 [ 892.554522][ T1155] do_syscall_64+0xfa/0xfa0 [ 892.559006][ T1155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 892.564886][ T1155] [ 892.567721][ T1155] The buggy address belongs to the object at ffff888024a38c00 [ 892.567721][ T1155] which belongs to the cache kmalloc-256 of size 256 [ 892.581769][ T1155] The buggy address is located 176 bytes inside of [ 892.581769][ T1155] freed 256-byte region [ffff888024a38c00, ffff888024a38d00) [ 892.595570][ T1155] [ 892.597889][ T1155] The buggy address belongs to the physical page: [ 892.604306][ T1155] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x24a38 [ 892.613068][ T1155] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 892.621560][ T1155] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 892.629100][ T1155] page_type: f5(slab) [ 892.633081][ T1155] raw: 00fff00000000040 ffff88813ffa6b40 ffffea0001e65c00 dead000000000004 [ 892.641664][ T1155] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 892.650241][ T1155] head: 00fff00000000040 ffff88813ffa6b40 ffffea0001e65c00 dead000000000004 [ 892.658899][ T1155] head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 892.667563][ T1155] head: 00fff00000000001 ffffea0000928e01 00000000ffffffff 00000000ffffffff [ 892.676234][ T1155] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 892.684901][ T1155] page dumped because: kasan: bad access detected [ 892.691320][ T1155] page_owner tracks the page as allocated [ 892.697028][ T1155] page last allocated via order 1, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 1, tgid 1 (swapper/0), ts 10741661853, free_ts 0 [ 892.714928][ T1155] post_alloc_hook+0x240/0x2a0 [ 892.719698][ T1155] get_page_from_freelist+0x2365/0x2440 [ 892.725238][ T1155] __alloc_frozen_pages_noprof+0x181/0x370 [ 892.731042][ T1155] allocate_slab+0x71/0x3a0 [ 892.735547][ T1155] ___slab_alloc+0xe94/0x18a0 [ 892.740213][ T1155] __slab_alloc+0x65/0x100 [ 892.744668][ T1155] __kmalloc_cache_node_noprof+0x4af/0x6f0 [ 892.750471][ T1155] blk_mq_init_tags+0x83/0x2d0 [ 892.755325][ T1155] blk_mq_alloc_map_and_rqs+0xbb/0x9c0 [ 892.760773][ T1155] blk_mq_alloc_set_map_and_rqs+0x1a2/0x810 [ 892.766665][ T1155] blk_mq_alloc_tag_set+0x89d/0xfc0 [ 892.771847][ T1155] scsi_add_host_with_dma+0x29a/0xbc0 [ 892.777205][ T1155] virtscsi_probe+0x7e7/0xd90 [ 892.781869][ T1155] virtio_dev_probe+0xcb0/0xfe0 [ 892.786792][ T1155] really_probe+0x26d/0x9e0 [ 892.791289][ T1155] __driver_probe_device+0x18c/0x2f0 [ 892.796574][ T1155] page_owner free stack trace missing [ 892.801923][ T1155] [ 892.804232][ T1155] Memory state around the buggy address: [ 892.809844][ T1155] ffff888024a38b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 892.817901][ T1155] ffff888024a38c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 892.825958][ T1155] >ffff888024a38c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 892.834004][ T1155] ^ [ 892.839631][ T1155] ffff888024a38d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 892.847689][ T1155] ffff888024a38d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 892.855736][ T1155] ================================================================== [ 892.871804][ T1155] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 892.879036][ T1155] CPU: 1 UID: 0 PID: 1155 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT(full) [ 892.888499][ T1155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 892.898556][ T1155] Workqueue: udp_tunnel_nic udp_tunnel_nic_device_sync_work [ 892.905857][ T1155] Call Trace: [ 892.909130][ T1155] [ 892.912054][ T1155] dump_stack_lvl+0x99/0x250 [ 892.916634][ T1155] ? __asan_memcpy+0x40/0x70 [ 892.921212][ T1155] ? __pfx_dump_stack_lvl+0x10/0x10 [ 892.926406][ T1155] ? __pfx__printk+0x10/0x10 [ 892.930993][ T1155] vpanic+0x237/0x6d0 [ 892.934966][ T1155] ? __pfx_vpanic+0x10/0x10 [ 892.939457][ T1155] ? preempt_schedule+0xae/0xc0 [ 892.944307][ T1155] ? __pfx_preempt_schedule+0x10/0x10 [ 892.949674][ T1155] panic+0xb9/0xc0 [ 892.953393][ T1155] ? __pfx_panic+0x10/0x10 [ 892.957801][ T1155] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 892.963692][ T1155] ? __mutex_lock+0x147/0x1350 [ 892.968448][ T1155] check_panic_on_warn+0x89/0xb0 [ 892.973377][ T1155] ? __mutex_lock+0x147/0x1350 [ 892.978128][ T1155] end_report+0x78/0x160 [ 892.982362][ T1155] kasan_report+0x129/0x150 [ 892.986857][ T1155] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 892.992741][ T1155] ? __mutex_lock+0x147/0x1350 [ 892.997497][ T1155] __mutex_lock+0x147/0x1350 [ 893.002077][ T1155] ? __mutex_lock+0x5bb/0x1350 [ 893.006826][ T1155] ? udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 893.013065][ T1155] ? __pfx___mutex_lock+0x10/0x10 [ 893.018079][ T1155] ? __lock_acquire+0xab9/0xd20 [ 893.022927][ T1155] udp_tunnel_nic_device_sync_work+0x39/0xa50 [ 893.028991][ T1155] ? process_scheduled_works+0x9ef/0x17b0 [ 893.034699][ T1155] ? process_scheduled_works+0x9ef/0x17b0 [ 893.040417][ T1155] process_scheduled_works+0xae1/0x17b0 [ 893.045970][ T1155] ? __pfx_process_scheduled_works+0x10/0x10 [ 893.051946][ T1155] worker_thread+0x8a0/0xda0 [ 893.056529][ T1155] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 893.062852][ T1155] ? __kthread_parkme+0x7b/0x200 [ 893.067784][ T1155] kthread+0x711/0x8a0 [ 893.071839][ T1155] ? __pfx_worker_thread+0x10/0x10 [ 893.076939][ T1155] ? __pfx_kthread+0x10/0x10 [ 893.081517][ T1155] ? _raw_spin_unlock_irq+0x23/0x50 [ 893.086716][ T1155] ? lockdep_hardirqs_on+0x9c/0x150 [ 893.091899][ T1155] ? __pfx_kthread+0x10/0x10 [ 893.096479][ T1155] ret_from_fork+0x4bc/0x870 [ 893.101062][ T1155] ? __pfx_ret_from_fork+0x10/0x10 [ 893.106168][ T1155] ? __switch_to_asm+0x39/0x70 [ 893.110919][ T1155] ? __switch_to_asm+0x33/0x70 [ 893.115673][ T1155] ? __pfx_kthread+0x10/0x10 [ 893.120259][ T1155] ret_from_fork_asm+0x1a/0x30 [ 893.125018][ T1155] [ 893.128287][ T1155] Kernel Offset: disabled [ 893.132594][ T1155] Rebooting in 86400 seconds..