last executing test programs: 2.358415286s ago: executing program 1 (id=3864): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000007400), 0x0, 0x2000c844) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000a00)=@newtaction={0xe98, 0x30, 0xb, 0x0, 0x0, {}, [{0xe84, 0x1, [@m_gact={0x30, 0x1, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_pedit={0xe50, 0x2, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x5, 0xa, 0x4, 0x1, 0x2000000}, 0x5, 0x1}, [{0x9, 0x80000001, 0x1, 0x630, 0x8, 0x1}, {0xdf, 0x4, 0x5, 0x5, 0x10, 0xe}, {0x1, 0x85a, 0x5, 0xe6db, 0x3, 0xfffffffc}, {0x6, 0x400, 0x9321, 0x9, 0x6, 0x7}, {0x5, 0x5, 0xffffffc0, 0x80, 0x3}, {0xe, 0xf5, 0x3, 0x9, 0xffffbff8, 0x3}, {0x0, 0x7, 0xfff, 0x2, 0x9163ef6c, 0x40080003}, {0x3, 0x3, 0x80, 0x0, 0xacc4, 0x2}, {0x8001, 0xffb, 0x9, 0xffff, 0xfffffffe, 0x81}, {0x8, 0xfff, 0x6, 0xeb84, 0x8, 0x30c4}, {0x7, 0x9, 0xfffffffc, 0x9, 0x4}, {0x8004, 0x80000001, 0xfffffeff, 0xdf, 0x4, 0x5}, {0x0, 0x80000001, 0x9, 0x7, 0x1000, 0x7}, {0x5, 0x2, 0xfffffffd, 0x9, 0x474, 0x594}, {0x7fffffff, 0x1, 0x8, 0xfffffff9, 0x6, 0xffffffff}, {0x24, 0x5, 0xf, 0x6, 0x6, 0x8000003}, {0xbb, 0x5, 0x2, 0x310, 0xf}, {0x9b7d, 0x52fc, 0x3, 0x3, 0x48, 0x9}, {0xbd, 0x8, 0x10, 0xe4d, 0x7f, 0x3}, {0x8, 0x8, 0x9, 0x27, 0x2, 0x5}, {0x4, 0x1000, 0x5, 0x6, 0x93e, 0x6}, {0x1, 0x7, 0x0, 0x1, 0xff, 0x3}, {0xb, 0x7f, 0xfffff417, 0x1, 0x3ff, 0x9}, {0x4, 0x8, 0x7, 0xb, 0x8, 0x80004d}, {0x34db, 0xffff, 0x0, 0x3ff, 0x1, 0x400}, {0x1, 0xcb1d, 0x8, 0x1, 0x0, 0x4}, {0x5, 0x3, 0x7, 0x8, 0x3, 0x984}, {0x2, 0xffffffff, 0x3, 0x2, 0x9, 0x40}, {0x7, 0x281, 0x7fffffff, 0x381, 0x3, 0x8}, {0x5, 0x4, 0x1, 0x8, 0x4, 0x2f}, {0x6, 0x3, 0x4, 0x5, 0x9, 0x7}, {0x5, 0x3, 0x8, 0x4, 0x16, 0x2}, {0x8001, 0x87, 0x6, 0x1, 0x3, 0x4}, {0x6, 0x9e4, 0x8b7f, 0x11, 0x3, 0x7}, {0x7, 0x1, 0x800, 0x70f, 0x8001, 0x3}, {0x4, 0x10, 0x6, 0x1, 0x4, 0x22ff}, {0x5, 0x10001, 0x9, 0x0, 0x10001, 0x7}, {0xf85, 0x2e, 0x100, 0x3, 0x100, 0xe60c}, {0x2, 0x5, 0x1, 0xe000000}, {0x4e2, 0x6ae, 0x2, 0x100, 0x4, 0xd}, {0x1, 0xcad, 0xa5, 0x2, 0x4d800, 0x33}, {0x20, 0x7f, 0x33, 0x2, 0x400, 0x4}, {0x4, 0x62e, 0xb, 0x219c, 0x0, 0x5}, {0x0, 0x4, 0x0, 0x1, 0x1, 0x1}, {0x7f, 0x945a, 0x0, 0x0, 0x8, 0x3}, {0xda1, 0x893, 0x2, 0x9, 0xfffffa2e, 0x6}, {0x1, 0xfffffff3, 0x7fffffff, 0x8, 0x0, 0x1}, {0x2, 0x8, 0x2, 0xe, 0x2, 0x2}, {0x6, 0x100, 0xe, 0x10000, 0x5, 0x7}, {0x0, 0x6, 0x7, 0x4, 0xc, 0x800}, {0x8, 0x10000, 0x1, 0x1, 0x7}, {0x7d5, 0x2, 0x4, 0x800, 0xf}, {0x1, 0x5, 0x6, 0x2, 0x8, 0xc}, {0x2, 0x1, 0x3, 0xc, 0x1, 0x2c3}, {0x1000, 0x3, 0xbc, 0x8001, 0xfa, 0x8}, {0x2, 0x3, 0x9, 0x50e, 0x55ac, 0xa5e2}, {0x0, 0x196680, 0xffffff91, 0x100, 0x3, 0x7}, {0x4, 0x4, 0x2, 0x1, 0x0, 0xe}, {0xfffffff5, 0x8, 0x7023, 0x8, 0x5, 0x851}, {0x3, 0x78, 0x7, 0xa, 0x5dec4cac, 0x6}, {0x4, 0x9, 0x3a, 0x2, 0x8, 0x602}, {0x4, 0x7fffffff, 0x0, 0x8, 0x8, 0xff}, {0x7, 0xfffffff1, 0x2f2c, 0x400, 0x6, 0x6}, {0x10001, 0x81, 0x40, 0x2, 0x89, 0x2}, {0x2, 0x8550, 0x4c, 0x3, 0xfffffffa, 0x736d}, {0x7f, 0x199, 0x5, 0x6, 0x7, 0x2}, {0x7, 0x1, 0x9, 0x7, 0x2, 0x7}, {0x9, 0x3f1, 0x4, 0x5, 0x5, 0x8}, {0x100, 0x3ff, 0x4, 0x7f53, 0x7, 0x1}, {0x3ff, 0xc, 0x4, 0x1, 0x4, 0x4}, {0x9, 0x381, 0xfff, 0x5d7c, 0x0, 0x8001}, {0x8, 0x0, 0x7, 0xfffffffb, 0x3ee, 0x4}, {0xbfffffe, 0x6, 0x101, 0x5, 0x400, 0x400}, {0x7fff, 0xb3, 0x2, 0x10000, 0x6, 0x14}, {0x0, 0x1, 0x4c90, 0x4, 0x7f, 0x8}, {0x5, 0x25b, 0x0, 0x3, 0x2, 0x2}, {0x29dbdf0, 0xd, 0xfffffffd, 0x7, 0x6, 0x3}, {0x7, 0x1, 0xa, 0x8, 0x5, 0x5}, {0x473, 0x8, 0x2, 0x400, 0x4000000, 0x69b3d6e6}, {0x1, 0xb7bb, 0x22800000, 0x3, 0x10, 0x5}, {0x7f, 0x7, 0x6, 0xffffffff, 0x3, 0x8}, {0xfffffff7, 0x80000000, 0xa, 0x40, 0x863, 0x2}, {0xb, 0x9, 0xc, 0x3c1, 0x6e, 0x40}, {0x6, 0xd, 0x6, 0xfb0000, 0x1, 0x7}, {0xe0, 0x100, 0x1, 0xb, 0x8, 0x7}, {0xfff, 0x1, 0x0, 0x38, 0x0, 0x9}, {0x82, 0x10, 0x401, 0x0, 0x4, 0xef}, {0x7, 0x2, 0x200, 0x8, 0x9, 0x2}, {0x54, 0x5, 0xa33f, 0x101, 0x2, 0x10001}, {0x1, 0x4, 0x800004, 0x10001, 0x2, 0xce}, {0x4, 0x8, 0x8, 0x3, 0xf, 0x9}, {0x6, 0x5, 0x8, 0xffffffff, 0x405b9, 0x6}, {0x9, 0x0, 0x9, 0x2, 0x9}, {0x0, 0x2, 0xb, 0x7fffffff, 0xfc0, 0x7f1b4893}, {0x4, 0xd, 0x10, 0x4, 0x7, 0x4}, {0x4, 0x5, 0xe, 0x3, 0x3dcb, 0x9}, {0x200, 0x0, 0xe8, 0x1, 0x800000d4, 0x1}, {0xc651, 0x5f83, 0x2, 0x1, 0xd, 0x8}, {0xfff, 0x5, 0x1, 0x0, 0x49, 0x5}, {0x5, 0x3, 0x7, 0x97fd, 0xef, 0x202}, {0x2, 0xa, 0x1000, 0x1, 0x6, 0xe0}, {0x800, 0x4c, 0x7, 0x0, 0xfffffff7, 0x9}, {0x6, 0xffff, 0xffff8001, 0xa, 0xae36, 0x8}, {0xcfb7, 0x0, 0x101, 0x2, 0x1, 0xaa82}, {0x6, 0x800, 0xec3d, 0xffffffff, 0xea5, 0x3}, {0x9, 0x5, 0x2, 0x0, 0x0, 0xdd}, {0x6, 0x6, 0x0, 0x1e9, 0x6, 0x1}, {0x3, 0x7, 0x7, 0x3, 0x400, 0x81}, {0x970, 0x100, 0xb2eb, 0x2, 0x3, 0x9}, {0x3, 0x6, 0x8, 0x7, 0xd, 0x474c}, {0xf, 0x101, 0x9a, 0x1000, 0x2, 0xfffffffc}, {0x3, 0x98e, 0x1a5e666b, 0x10, 0x7, 0x9}, {0xfffffffb, 0x3, 0x3, 0x2ee8000, 0x8}, {0x3, 0x2, 0x2, 0x3, 0x3, 0x2}, {0x7, 0x4, 0x1, 0x7, 0x101, 0xef}, {0x709e, 0x9, 0x425b597f, 0x1, 0x2, 0x7}, {0x6, 0xc000000, 0x3ff, 0x4, 0x8, 0x5}, {0x3, 0x6, 0x7, 0xfffffff9, 0x0, 0xffffffff}, {0x7, 0x9, 0x8, 0x0, 0x9, 0xd6}, {0x24, 0x10001, 0x6, 0x1, 0x39d6}, {0x401, 0x7d4, 0x9, 0x8000, 0xffff, 0x7}, {0x6, 0x92e4, 0x130, 0x0, 0x4, 0x9}, {0x1, 0x7fff, 0x7, 0x8001, 0x8, 0x5}, {0x7e, 0x800, 0xfffffff9, 0xa, 0x4b64, 0x80000001}, {0x2ad78a25, 0x2, 0x6, 0x6, 0x4, 0x8}, {0x2, 0x9, 0x0, 0x8a7, 0x129, 0xc}, {0x7, 0x2, 0x8, 0x3, 0xe01, 0xf933271}, {0x4a3, 0x0, 0x3, 0x514c, 0xf8a, 0x19}], [{0x5}, {0x4, 0x1}, {}, {0x1}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x1}, {0x2}, {0x0, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x4}, {}, {0x1, 0x1}, {0x5, 0x1}, {0x5}, {0x3}, {0x5, 0x1}, {}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {0x4}, {0x5}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x1, 0x1}, {0x4}, {0x5}, {0x3, 0x1}, {0x1}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x2}, {0x3, 0x1}, {0x5, 0x1}, {0x1}, {0x1}, {0x3}, {0x5, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x4}, {0x5}, {0x1, 0x1}, {}, {0x3}, {0x2, 0x1}, {0x5}, {0x4}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x5}, {0x9, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x2}, {0x1}, {0x2, 0x1}, {0x6, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3, 0x1}, {0x1}, {0x2}, {0x2}, {0x5}, {0x3, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x2}, {0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x5}, {0x4}, {0x2, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x0, 0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {0x5, 0x1}, {0x3}, {0x4}, {0x5, 0x1}, {0x3, 0x1}, {0x4}, {0x1, 0x1}, {0x4, 0x1}, {0x6, 0x1}, {0x5, 0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(r0, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) 2.171265222s ago: executing program 2 (id=3866): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$xdp(0x2c, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x101401, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) socket(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8ae8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000008200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1.912472945s ago: executing program 2 (id=3871): ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) ioctl(r0, 0x8b2a, &(0x7f0000000040)) 1.697836328s ago: executing program 2 (id=3876): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000021c0)=[{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000000100)="a92e81d0991808e33c2330164cf023df", 0xfffffc81}], 0x1, &(0x7f0000001040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x880}], 0x1, 0x80001) recvmmsg(r1, &(0x7f0000003400)=[{{0x0, 0x0, &(0x7f0000003380)=[{&(0x7f00000000c0)=""/21, 0x15}, {&(0x7f0000002380)=""/4096, 0x1000}], 0x2}, 0x15}], 0x1, 0x40000141, 0x0) 1.409505667s ago: executing program 4 (id=3881): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$xdp(0x2c, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x101401, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) socket(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8ae8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000008200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1.397744242s ago: executing program 1 (id=3882): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4e, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="000086dd00011100"], 0xfdef) 1.262441909s ago: executing program 3 (id=3883): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r1 = socket$packet(0x11, 0x3, 0x300) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x1, 0xb, &(0x7f0000000000)=ANY=[], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r2, 0x4) 1.230180959s ago: executing program 4 (id=3884): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r0, &(0x7f0000000240)={&(0x7f0000000180)={0xa, 0x4e20, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}, 0x388}, 0x1c, &(0x7f0000000b00)=[{&(0x7f0000000400)="80004b77efe55463", 0x8}], 0x1, &(0x7f0000000440)=[@flowinfo={{0x14, 0x29, 0xb, 0x9}}, @flowinfo={{0x14, 0x29, 0xb, 0x20000006}}], 0x30}, 0x4) 1.224706797s ago: executing program 0 (id=3885): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b700000081000000bfa3000000000000070300000cfeffff720af0fff8ffffff71a4f0ff000000002d030000000000001d400500000000004704000001ed00007203feff000000001d44000000000000db0a08fee10000007303000000000000b500f3ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc3"], 0x0}, 0x94) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf25020000000800", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="400104"], 0x14) 1.115328209s ago: executing program 0 (id=3886): ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', 0x0}) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) ioctl(r0, 0x8b2a, &(0x7f0000000040)) 1.051251149s ago: executing program 4 (id=3887): r0 = socket$pppl2tp(0x18, 0x1, 0x1) close(0x3) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f0000000280)=[@in={0x2, 0x4e23, @local}]}, &(0x7f0000000140)=0x10) connect$pppl2tp(r0, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x21, 0x0, 0x0, 0x0, {0xa, 0x0, 0x6, @private0}}}, 0x3a) 943.958948ms ago: executing program 0 (id=3888): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x2, 0xc, 0x1400}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r0, 0x68, &(0x7f0000000200)}, 0x33) 918.825404ms ago: executing program 3 (id=3889): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c"], 0x38}}, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r2, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000240)={0x1c, r3, 0x200, 0x70bd29, 0x25dfdbff, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) socket$packet(0x11, 0x3, 0x300) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCGIFHWADDR(r0, 0x8927, &(0x7f0000000040)={'virt_wifi0\x00'}) 890.138198ms ago: executing program 1 (id=3890): bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$SEG6(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'macvlan1\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[], 0x68}}, 0x8c1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[], 0x68}}, 0x20000880) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x1, 0x2}, {0xd, 0x10}, {0x1, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x84}, 0x0) 749.287014ms ago: executing program 0 (id=3891): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000880)=@newtaction={0x68, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x54, 0x1, [@m_tunnel_key={0x50, 0x1, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0xb, @loopback={0x400000000000000}}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x68}}, 0x0) 747.959318ms ago: executing program 2 (id=3892): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x4084) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c000280050001"], 0x64}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="3c000000180001002cbd7000000000000a100000fc02ff000000000008000400", @ANYRES32=r1, @ANYBLOB="060015000800000010001680"], 0x3c}}, 0x0) 607.86895ms ago: executing program 3 (id=3893): syz_emit_ethernet(0x72, &(0x7f0000000180)={@local, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c, 0x0, @private=0xa010101, @local, {[@cipso={0x86, 0x28, 0x2, [{0x6, 0xb, "5e000000ff000000f5"}, {0x0, 0x5, "0404a6"}, {0x0, 0x12, "960605390006fff5800000b61af93a93"}]}, @rr={0x7, 0x3, 0x57}, @cipso={0x86, 0x6}]}}}}}}}, 0x0) 606.67239ms ago: executing program 0 (id=3894): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x5, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_xfrm(0x10, 0x3, 0x6) socket$xdp(0x2c, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x101401, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) socket(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x10, 0x4, 0x4, 0x2, 0x0, 0x1, 0xfffffffc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x3, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0x100}}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8ae8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002000000850000008200000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 545.234498ms ago: executing program 1 (id=3895): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x770, 0xfffffffd, 0x7}, 0x1c) 528.300784ms ago: executing program 3 (id=3896): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b700000081000000bfa3000000000000070300000cfeffff720af0fff8ffffff71a4f0ff000000002d030000000000001d400500000000004704000001ed00007203feff000000001d44000000000000db0a08fee10000007303000000000000b500f3ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc3"], 0x0}, 0x94) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf25020000000800", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="400104"], 0x14) 495.03342ms ago: executing program 2 (id=3897): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0xffffffffffffff34, &(0x7f0000000080)={0x0, 0xb8}}, 0x0) getsockname$packet(r1, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="34000000100081eee80000040000000010000000", @ANYRES32=r3, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="20000000140001000000000000000000020000ff", @ANYRES32=r3, @ANYBLOB="08000200ac1414aa"], 0x20}}, 0x0) r4 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r4, 0x0, 0x27, &(0x7f0000000040)={@multicast2, @local}, 0xc) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8004}, 0x0) 435.151454ms ago: executing program 4 (id=3898): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$unix(r1, &(0x7f0000007600)=[{{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f00000003c0)="b18a475fbe26449b4d5863d6c14cb918827f", 0x12}, {&(0x7f0000000140)="9ce319", 0x3}, {&(0x7f0000000900)="60369961", 0x4}], 0x3, 0x0, 0x0, 0x4004001}}], 0x1, 0x20040000) 363.488123ms ago: executing program 4 (id=3899): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r3, @ANYBLOB="0000000000000000280012000c0001007665"], 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0xfffc}, 0x4000800) sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000003080)=@delchain={0x50, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x20, 0x2, [@TCA_FLOWER_INDEV={0x14, 0x2, 'bridge_slave_0\x00'}, @TCA_FLOWER_KEY_IPV4_SRC={0x8, 0xa, @initdev={0xac, 0x1e, 0x0, 0x0}}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x10}, 0x0) 334.202836ms ago: executing program 1 (id=3900): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000002900)=r1, 0x4) bind$netlink(r0, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x44b, 0x0, 0x0, {0x7a}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_DEFAULT_PVID={0x6}]}}}]}, 0x3c}}, 0x0) 186.328359ms ago: executing program 1 (id=3901): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='htcp', 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="2800000010000108fdffffff0800000800000000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) sendto$inet(r0, &(0x7f0000000240)="c927", 0x2, 0x4044880, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x19, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e000000"], 0x0, 0xfffffffe, 0x0, 0x0, 0x1f00, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) close(0x3) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="1900000004000000080000000a"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1900000004000000040000000200000000000000", @ANYRES32=0x1, @ANYBLOB="00000000000104000062420b2d1cc2cdf8d13400", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r3}, 0x8) r4 = bpf$ITER_CREATE(0x21, &(0x7f0000000280), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x17, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18020000ffffffff00000000000000001801000011646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000007d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xba03d6b623375271, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8d90, @value=r4}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007008500000073"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r5}, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x14, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r7 = openat$cgroup_procs(r6, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r7, &(0x7f0000000c40), 0x12) r8 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r9 = openat$cgroup_procs(r8, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r4, 0x84, 0x21, 0x0, 0x0) write$cgroup_pid(r9, &(0x7f0000000c40), 0x12) 175.059632ms ago: executing program 3 (id=3902): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f00000004c0)=0x2) 154.948334ms ago: executing program 0 (id=3903): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e2306", 0x12}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='team_slave_1\x00', 0x10) connect$phonet_pipe(r4, &(0x7f0000000400)={0x23, 0x0, 0x7f, 0x8}, 0x10) socket$inet(0x2, 0x2, 0x0) r5 = socket$rxrpc(0x21, 0x2, 0xa) r6 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r6, 0x110, 0x4, &(0x7f0000000040)=0x2, 0x4) connect$rxrpc(r6, &(0x7f0000000080)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast1}}, 0x24) sendmsg$inet(r6, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000"], 0x7c}}, 0x0) ioctl$sock_SIOCGIFBR(r5, 0x8940, &(0x7f0000000140)=@generic={0x3, 0x8, 0x4}) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="400000000203010100000000000000ffffff7f000800034000000000080004400000000008000540000000000900020000000000020000000800010001"], 0x40}}, 0x0) close(r7) 153.671965ms ago: executing program 4 (id=3904): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000d80)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r0, &(0x7f0000000dc0)=ANY=[@ANYBLOB="400104"], 0x14) socket(0x1e, 0x4, 0x0) write$nci(r0, &(0x7f0000000140)=ANY=[], 0x14) 66.45467ms ago: executing program 2 (id=3905): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000540)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=@newqdisc={0x6c, 0x24, 0x4ee4e6a52ff56541, 0x1001, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x40, 0x2, [@TCA_TBF_PRATE64={0xc, 0x5, 0xc2240edb8ac75ac7}, @TCA_TBF_BURST={0x8, 0x6, 0xff}, @TCA_TBF_PARMS={0x28, 0x1, {{0x5a, 0x2, 0x84a, 0x9, 0x1, 0x800}, {0x8c, 0x1, 0xfffc, 0x7fff, 0x4, 0xb}, 0x5, 0x34, 0x91f}}]}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x50) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56561, 0x70bd26, 0x1001, {0x0, 0x0, 0x0, r7, {0x0, 0x6}, {0x3, 0x8}, {0x7, 0x10}}, [@qdisc_kind_options=@q_plug={{0x9}, {0xffffffffffffffe2, 0x2, {0x1, 0x8}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20002000}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, 0x0) bpf$TOKEN_CREATE(0x24, 0x0, 0x0) 0s ago: executing program 3 (id=3906): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3, 0x6, 0x7, 0x200, 0x4, 0x8, 0x8ed, 0x10, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8810) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) r7 = socket$unix(0x1, 0x2, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r9, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0x3, 0x6, 0x1, 0x1, 0xd, 0xfff, 0xfffffffa, 0x8}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56561, 0x70bd2b, 0x1, {0x0, 0x0, 0x0, r11, {0x0, 0x6}, {0xfff2, 0x8}, {0x7, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) kernel console output (not intermixed with test programs): ed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 176.796299][ T7442] tipc: Enabled bearer , priority 0 [ 176.809881][ T7442] syzkaller0: entered promiscuous mode [ 176.809926][ T7442] syzkaller0: entered allmulticast mode [ 176.832996][ T7442] netlink: 12 bytes leftover after parsing attributes in process `syz.1.640'. [ 176.844757][ T7442] tipc: Resetting bearer [ 176.857313][ T7441] tipc: Resetting bearer [ 176.943584][ T7441] tipc: Disabling bearer [ 177.213306][ T7451] netlink: 68 bytes leftover after parsing attributes in process `syz.3.645'. [ 177.392407][ T7456] syz.1.648 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 179.549796][ T7484] netlink: 12 bytes leftover after parsing attributes in process `syz.4.660'. [ 180.988675][ T7507] netlink: 64 bytes leftover after parsing attributes in process `syz.1.667'. [ 181.285438][ T7519] netlink: 12 bytes leftover after parsing attributes in process `syz.1.674'. [ 185.883010][ T7578] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 188.495073][ T7677] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 193.320114][ T7767] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 193.643221][ T7781] netlink: 4 bytes leftover after parsing attributes in process `syz.2.770'. [ 193.826816][ T7781] netlink: 4 bytes leftover after parsing attributes in process `syz.2.770'. [ 194.294221][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.294305][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.511177][ T7805] tipc: Started in network mode [ 194.511238][ T7805] tipc: Node identity ce79be4983ce, cluster identity 4711 [ 194.511662][ T7805] tipc: Enabled bearer , priority 0 [ 194.513283][ T7807] syzkaller0: entered promiscuous mode [ 194.513348][ T7807] syzkaller0: entered allmulticast mode [ 194.650828][ T7805] tipc: Resetting bearer [ 194.668355][ T7804] tipc: Resetting bearer [ 194.743406][ T7804] tipc: Disabling bearer [ 196.716171][ T7859] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 196.831273][ T7870] ipvlan3: entered promiscuous mode [ 197.899713][ T5631] Bluetooth: hci0: command 0x0401 tx timeout [ 198.666336][ T7929] netlink: 4 bytes leftover after parsing attributes in process `syz.2.816'. [ 200.066215][ T7929] bond0: (slave bond_slave_1): Releasing backup interface [ 202.297216][ T7992] process 'syz.0.842' launched './file2' with NULL argv: empty string added [ 202.330722][ T7992] kAFS: No cell specified [ 205.245238][ T8030] netlink: 4 bytes leftover after parsing attributes in process `syz.4.857'. [ 205.277589][ T8030] netlink: 4 bytes leftover after parsing attributes in process `syz.4.857'. [ 205.732633][ T5625] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 205.899754][ T5625] usb 3-1: Using ep0 maxpacket: 32 [ 205.945909][ T8040] netlink: 16 bytes leftover after parsing attributes in process `syz.2.859'. [ 206.014463][ T8040] IPv6: sit1: Disabled Multicast RS [ 206.030240][ T8040] sit1: entered allmulticast mode [ 206.323603][ T8051] netlink: 'syz.0.864': attribute type 8 has an invalid length. [ 206.432479][ T8053] netlink: 24 bytes leftover after parsing attributes in process `syz.4.865'. [ 206.612469][ T5623] Bluetooth: hci0: command 0x0401 tx timeout [ 206.612565][ T5623] Bluetooth: hci2: command 0x0406 tx timeout [ 206.618751][ T5633] Bluetooth: hci1: command 0x0406 tx timeout [ 206.699789][ T5636] Bluetooth: hci3: command 0x0406 tx timeout [ 206.755176][ T8059] netlink: 'syz.0.868': attribute type 30 has an invalid length. [ 206.763233][ T8059] netlink: 8 bytes leftover after parsing attributes in process `syz.0.868'. [ 206.763324][ T8059] bond0: option arp_missed_max: invalid value (0) [ 206.763350][ T8059] bond0: option arp_missed_max: allowed values 1 - 255 [ 208.448596][ T5625] usb 3-1: unable to get BOS descriptor or descriptor too short [ 208.459933][ T5625] usb 3-1: New USB device found, idVendor=1b96, idProduct=0007, bcdDevice= 0.40 [ 208.474893][ T5625] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 208.474963][ T5625] usb 3-1: can't read configurations, error -71 [ 209.039799][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 209.800102][ T8132] netlink: 24 bytes leftover after parsing attributes in process `syz.0.901'. [ 209.813908][ T8132] netlink: 'syz.0.901': attribute type 1 has an invalid length. [ 209.813959][ T8132] netlink: 28 bytes leftover after parsing attributes in process `syz.0.901'. [ 210.029836][ T5625] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 210.199572][ T5625] usb 4-1: Using ep0 maxpacket: 32 [ 211.032071][ T8161] netlink: 24 bytes leftover after parsing attributes in process `syz.1.916'. [ 211.032119][ T8161] netlink: 'syz.1.916': attribute type 1 has an invalid length. [ 211.032162][ T8161] netlink: 28 bytes leftover after parsing attributes in process `syz.1.916'. [ 212.157326][ T8183] kAFS: No cell specified [ 212.972494][ T5625] usb 4-1: unable to get BOS descriptor or descriptor too short [ 212.982788][ T5625] usb 4-1: New USB device found, idVendor=1b96, idProduct=0007, bcdDevice= 0.40 [ 212.992956][ T5625] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 212.993006][ T5625] usb 4-1: can't read configurations, error -71 [ 213.076369][ T8192] netlink: 24 bytes leftover after parsing attributes in process `syz.2.928'. [ 213.076425][ T8192] netlink: 'syz.2.928': attribute type 1 has an invalid length. [ 213.076458][ T8192] netlink: 28 bytes leftover after parsing attributes in process `syz.2.928'. [ 213.835566][ T8217] kAFS: No cell specified [ 215.579125][ T8242] netlink: 20 bytes leftover after parsing attributes in process `syz.1.949'. [ 215.608363][ T8240] syzkaller0: entered promiscuous mode [ 215.608407][ T8240] syzkaller0: entered allmulticast mode [ 215.995548][ T8257] kAFS: No cell specified [ 217.605520][ T100] IPVS: starting estimator thread 0... [ 217.709632][ T8275] IPVS: using max 29 ests per chain, 69600 per kthread [ 218.215879][ T8297] kAFS: No cell specified [ 219.086377][ T8307] netlink: 4 bytes leftover after parsing attributes in process `syz.4.972'. [ 219.164059][ T8307] netlink: 4 bytes leftover after parsing attributes in process `syz.4.972'. [ 219.431583][ T8317] netlink: 20 bytes leftover after parsing attributes in process `syz.2.976'. [ 221.676307][ T8350] kAFS: No cell specified [ 222.524896][ T8356] netlink: 8 bytes leftover after parsing attributes in process `syz.0.988'. [ 222.547532][ T8356] syzkaller0: entered promiscuous mode [ 222.547556][ T8356] syzkaller0: entered allmulticast mode [ 222.596510][ T8356] netlink: 12 bytes leftover after parsing attributes in process `syz.0.988'. [ 222.647422][ T8358] netlink: 20 bytes leftover after parsing attributes in process `syz.4.989'. [ 223.037174][ T8375] netlink: 168 bytes leftover after parsing attributes in process `syz.1.997'. [ 224.152951][ T8392] kAFS: No cell specified [ 226.712991][ T8442] kAFS: No cell specified [ 227.075657][ T8446] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1026'. [ 227.075703][ T8446] netlink: 'syz.3.1026': attribute type 1 has an invalid length. [ 227.075736][ T8446] netlink: 'syz.3.1026': attribute type 2 has an invalid length. [ 227.760494][ T8471] tipc: Enabling of bearer rejected, already enabled [ 227.770862][ T8471] sch_tbf: burst 255 is lower than device syzkaller0 mtu (65589) ! [ 227.885074][ T8471] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1036'. [ 227.896896][ T8471] syzkaller0: mtu less than device minimum [ 228.286335][ T8486] kAFS: No cell specified [ 229.917004][ T8504] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 230.165421][ T8511] tipc: Enabled bearer , priority 0 [ 230.189224][ T8511] syzkaller0: entered promiscuous mode [ 230.195025][ T8511] syzkaller0: entered allmulticast mode [ 230.207790][ T8511] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 230.269889][ T8511] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1050'. [ 230.294438][ T8511] tipc: Resetting bearer [ 230.331259][ T8510] tipc: Resetting bearer [ 230.396144][ T8510] tipc: Disabling bearer [ 230.723588][ T8532] kAFS: No cell specified [ 231.647437][ T8540] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1058'. [ 231.727655][ T8546] UDC core: g1: couldn't find an available UDC or it's busy [ 231.775700][ T8544] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1058'. [ 232.513612][ T8555] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 233.150883][ T8571] kAFS: No cell specified [ 233.981569][ T1181] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 234.149785][ T1181] usb 4-1: Using ep0 maxpacket: 16 [ 234.154465][ T1181] usb 4-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 234.183909][ T1181] usb 4-1: config 0 has an invalid interface number: 107 but max is 0 [ 234.183959][ T1181] usb 4-1: config 0 has no interface number 0 [ 234.184068][ T1181] usb 4-1: config 0 interface 107 altsetting 0 endpoint 0x88 has an invalid bInterval 55, changing to 9 [ 234.184152][ T1181] usb 4-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid maxpacket 8496, setting to 1024 [ 234.232814][ T1181] usb 4-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 234.232890][ T1181] usb 4-1: Product: syz [ 234.232908][ T1181] usb 4-1: Manufacturer: syz [ 234.232924][ T1181] usb 4-1: SerialNumber: syz [ 234.284709][ T1181] usb 4-1: config 0 descriptor?? [ 234.312339][ T1181] keyspan 4-1:0.107: Keyspan 4 port adapter converter detected [ 234.345560][ T1181] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 81 [ 234.395736][ T1181] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 1 [ 234.451391][ T1181] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 234.464957][ T1181] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 2 [ 234.486639][ T1181] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 234.519950][ T1181] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 4 [ 234.555848][ T1181] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 234.568657][ T1181] keyspan 4-1:0.107: found no endpoint descriptor for endpoint 6 [ 234.593973][ T1181] usb 4-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 235.058457][ T8599] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1079'. [ 235.736017][ T8612] kAFS: No cell specified [ 237.094488][ T8629] netlink: 'syz.4.1089': attribute type 8 has an invalid length. [ 237.247731][ T5625] usb 4-1: USB disconnect, device number 4 [ 237.267103][ T8633] syzkaller0: left promiscuous mode [ 237.267152][ T8633] syzkaller0: left allmulticast mode [ 237.302399][ T5625] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 237.317710][ T5625] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 237.338883][ T5625] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 237.362236][ T5625] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 237.372982][ T5625] keyspan 4-1:0.107: device disconnected [ 237.439821][ T8637] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1092'. [ 237.565998][ T8631] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1090'. [ 237.879300][ T8648] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1096'. [ 237.888793][ T8648] netlink: 'syz.1.1096': attribute type 10 has an invalid length. [ 237.888818][ T8648] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1096'. [ 238.163213][ T7318] IPVS: starting estimator thread 0... [ 238.259721][ T8652] IPVS: using max 26 ests per chain, 62400 per kthread [ 238.615092][ T8648] geneve2: entered promiscuous mode [ 238.623137][ T8648] geneve2: entered allmulticast mode [ 239.274689][ T8674] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1104'. [ 240.064001][ T8704] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1108'. [ 241.305685][ T8730] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1119'. [ 241.352375][ T8731] netlink: 'syz.3.1118': attribute type 8 has an invalid length. [ 243.222466][ T8767] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1132'. [ 244.934691][ T8804] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1147'. [ 244.945088][ T8804] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1147'. [ 245.910200][ T8842] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1162'. [ 245.910248][ T8842] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1162'. [ 246.973959][ T8876] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1172'. [ 247.065188][ T8880] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1176'. [ 247.065232][ T8880] netlink: 48 bytes leftover after parsing attributes in process `syz.1.1176'. [ 247.331802][ T8888] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 248.104846][ T8900] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1183'. [ 248.104909][ T8900] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1183'. [ 248.534613][ T8913] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1186'. [ 248.617602][ T8915] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1187'. [ 249.017481][ T8923] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 250.141946][ T31] usb 1-1: new low-speed USB device number 3 using dummy_hcd [ 250.216957][ T8947] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1199'. [ 250.301765][ T31] usb 1-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 250.313448][ T31] usb 1-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 250.313506][ T31] usb 1-1: too many endpoints for config 0 interface 0 altsetting 254: 33, using maximum allowed: 30 [ 250.313550][ T31] usb 1-1: config 0 interface 0 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 33 [ 250.313583][ T31] usb 1-1: config 0 interface 0 has no altsetting 0 [ 250.313621][ T31] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 250.567489][ T31] usb 1-1: config 0 descriptor?? [ 250.691159][ T8963] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 252.424017][ T8990] __nla_validate_parse: 1 callbacks suppressed [ 252.424083][ T8990] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1215'. [ 252.536925][ T8995] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1214'. [ 252.807090][ T31] usb 1-1: string descriptor 0 read error: -71 [ 253.790047][ T31] usb 1-1: USB disconnect, device number 3 [ 255.897769][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.897865][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.668899][ T9082] syzkaller0: left promiscuous mode [ 256.668950][ T9082] syzkaller0: left allmulticast mode [ 257.289204][ T9096] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1248'. [ 257.415858][ T9097] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 259.919020][ T9134] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 260.483762][ T9137] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1263'. [ 261.652233][ T5820] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 261.803967][ T5820] usb 1-1: Using ep0 maxpacket: 32 [ 261.807219][ T5820] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 261.826314][ T5820] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 261.826372][ T5820] usb 1-1: config 0 has no interface number 0 [ 261.826489][ T5820] usb 1-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 255 [ 261.826627][ T5820] usb 1-1: config 0 interface 184 has no altsetting 0 [ 261.865807][ T5820] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 261.865863][ T5820] usb 1-1: Product: syz [ 261.865898][ T5820] usb 1-1: Manufacturer: syz [ 261.865950][ T5820] usb 1-1: SerialNumber: syz [ 261.925823][ T5820] usb 1-1: config 0 descriptor?? [ 261.940328][ T9159] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 262.084449][ T9175] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 262.170229][ T9159] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 262.389237][ T5820] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 262.391053][ T5820] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 262.391115][ T5820] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 262.392654][ T5820] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -61 [ 262.674094][ T9198] warning: `syz.2.1290' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 263.107351][ T9219] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1299'. [ 263.116779][ T9219] netlink: 1 bytes leftover after parsing attributes in process `syz.2.1299'. [ 263.716305][ T9253] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1309'. [ 264.508588][ T1181] usb 1-1: USB disconnect, device number 4 [ 264.630310][ T9286] syzkaller0: entered promiscuous mode [ 264.630358][ T9286] syzkaller0: entered allmulticast mode [ 265.611734][ T5625] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 266.269486][ T5625] usb 2-1: Using ep0 maxpacket: 32 [ 266.275626][ T5625] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 266.286415][ T5625] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 266.286457][ T5625] usb 2-1: config 0 has no interface number 0 [ 266.286516][ T5625] usb 2-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 255 [ 266.286547][ T5625] usb 2-1: config 0 interface 184 has no altsetting 0 [ 266.320766][ T5625] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 266.328855][ T5625] usb 2-1: Product: syz [ 266.328876][ T5625] usb 2-1: Manufacturer: syz [ 266.328893][ T5625] usb 2-1: SerialNumber: syz [ 266.361310][ T5625] usb 2-1: config 0 descriptor?? [ 266.367235][ T9310] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 266.632227][ T9310] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 267.055489][ T5625] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 267.055542][ T5625] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 267.076547][ T5625] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 267.076605][ T5625] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -32 [ 267.076645][ T5625] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 267.076669][ T5625] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 267.076925][ T5625] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -32 [ 268.450368][ T1181] usb 2-1: USB disconnect, device number 3 [ 268.473619][ T4935] Bluetooth: hci4: link tx timeout [ 268.473972][ T4935] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 268.621668][ T9377] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 269.050853][ T9395] IPVS: set_ctl: invalid protocol: 47 224.0.0.1:20003 [ 270.530212][ T4935] Bluetooth: hci4: command 0x0406 tx timeout [ 270.539608][ T9413] syzkaller0: entered promiscuous mode [ 270.539643][ T9413] syzkaller0: entered allmulticast mode [ 270.559016][ T9413] tipc: Enabled bearer , priority 0 [ 270.575702][ T9413] tipc: Resetting bearer [ 270.589121][ T9412] tipc: Resetting bearer [ 270.641434][ T9412] tipc: Disabling bearer [ 272.013445][ T9464] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1391'. [ 274.866361][ T9536] netlink: 148 bytes leftover after parsing attributes in process `syz.4.1413'. [ 274.866891][ T9536] netlink: 116 bytes leftover after parsing attributes in process `syz.4.1413'. [ 274.866940][ T9536] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1413'. [ 275.050890][ T9542] sch_tbf: burst 255 is lower than device syzkaller0 mtu (65589) ! [ 275.106892][ T9542] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1418'. [ 275.119335][ T9542] syzkaller0: mtu less than device minimum [ 276.490811][ T9576] sch_tbf: burst 255 is lower than device syzkaller0 mtu (65589) ! [ 276.612912][ T9579] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1433'. [ 277.488408][ T9583] syzkaller0: mtu less than device minimum [ 277.589997][ T9603] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1443'. [ 278.599965][ T5726] usb 4-1: new low-speed USB device number 5 using dummy_hcd [ 278.712408][ T9625] netlink: 32 bytes leftover after parsing attributes in process `syz.1.1451'. [ 278.803269][ T5726] usb 4-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 278.816741][ T5726] usb 4-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 278.828776][ T5726] usb 4-1: too many endpoints for config 0 interface 0 altsetting 254: 33, using maximum allowed: 30 [ 278.840482][ T5726] usb 4-1: config 0 interface 0 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 33 [ 278.840518][ T5726] usb 4-1: config 0 interface 0 has no altsetting 0 [ 278.840555][ T5726] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 278.874028][ T5726] usb 4-1: config 0 descriptor?? [ 278.956022][ T9632] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1454'. [ 279.371993][ T9643] syzkaller0: entered promiscuous mode [ 279.377668][ T9643] syzkaller0: entered allmulticast mode [ 279.387254][ T9643] sch_tbf: burst 255 is lower than device syzkaller0 mtu (65589) ! [ 279.794504][ T9645] syzkaller0: mtu less than device minimum [ 280.333916][ T9656] Bluetooth: MGMT ver 1.23 [ 280.338984][ T9656] Bluetooth: hci0: invalid length 0, exp 2 for type 2 [ 280.415354][ T9660] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1466'. [ 280.448720][ T9662] netlink: 'syz.1.1465': attribute type 18 has an invalid length. [ 280.448772][ T9662] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1465'. [ 281.163596][ T5726] usb 4-1: string descriptor 0 read error: -71 [ 281.185997][ T5726] usb 4-1: USB disconnect, device number 5 [ 281.216158][ T9676] bridge0: port 3(wlan1) entered blocking state [ 281.216404][ T9676] bridge0: port 3(wlan1) entered disabled state [ 281.820234][ T9689] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 281.822673][ T9676] mac80211_hwsim hwsim8 wlan1: entered allmulticast mode [ 281.825003][ T9676] mac80211_hwsim hwsim8 wlan1: entered promiscuous mode [ 282.066076][ T9698] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1477'. [ 282.078485][ T9696] netlink: 'syz.2.1478': attribute type 18 has an invalid length. [ 282.078522][ T9696] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1478'. [ 282.111847][ T9679] bridge0: port 3(wlan1) entered disabled state [ 282.136725][ T9679] mac80211_hwsim hwsim8 wlan1 (unregistering): left allmulticast mode [ 282.146519][ T9679] mac80211_hwsim hwsim8 wlan1 (unregistering): left promiscuous mode [ 282.146703][ T9679] bridge0: port 3(wlan1) entered disabled state [ 282.479592][ T10] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 282.634442][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 282.743833][ T9701] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1479'. [ 283.274556][ T9701] IPv6: sit1: Disabled Multicast RS [ 283.277542][ T9701] sit1: entered allmulticast mode [ 283.593455][ T9732] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1490'. [ 283.704272][ T9734] netlink: 'syz.3.1491': attribute type 18 has an invalid length. [ 283.712767][ T9734] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1491'. [ 283.789576][ T5726] usb 5-1: new low-speed USB device number 4 using dummy_hcd [ 283.964498][ T5726] usb 5-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 283.977695][ T5726] usb 5-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 283.977789][ T5726] usb 5-1: too many endpoints for config 0 interface 0 altsetting 254: 33, using maximum allowed: 30 [ 283.977882][ T5726] usb 5-1: config 0 interface 0 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 33 [ 283.977952][ T5726] usb 5-1: config 0 interface 0 has no altsetting 0 [ 283.978052][ T5726] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 284.194398][ T5726] usb 5-1: config 0 descriptor?? [ 284.615482][ T9742] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1494'. [ 285.134496][ T10] usb 2-1: unable to get BOS descriptor or descriptor too short [ 285.134564][ T10] usb 2-1: New USB device found, idVendor=1b96, idProduct=0007, bcdDevice= 0.40 [ 285.153260][ T10] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 285.153313][ T10] usb 2-1: can't read configurations, error -71 [ 285.175003][ T9760] netlink: 'syz.3.1502': attribute type 18 has an invalid length. [ 285.175048][ T9760] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1502'. [ 286.481439][ T5726] usb 5-1: string descriptor 0 read error: -71 [ 286.526248][ T5726] usb 5-1: USB disconnect, device number 4 [ 287.533996][ T9805] sch_tbf: burst 255 is lower than device syzkaller0 mtu (65589) ! [ 287.623405][ T9809] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1521'. [ 287.635308][ T9805] syzkaller0: mtu less than device minimum [ 289.109069][ T9847] syzkaller0: entered promiscuous mode [ 289.116811][ T9847] syzkaller0: entered allmulticast mode [ 289.130334][ T9840] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 289.241400][ T9849] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1536'. [ 290.007801][ T9855] netlink: 'syz.4.1541': attribute type 1 has an invalid length. [ 290.018038][ T9855] nbd: error processing sock list [ 290.025018][ T9855] block nbd0: shutting down sockets [ 292.035608][ T9902] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1560'. [ 292.035677][ T9902] bond0: Unable to set peer notification delay as MII monitoring is disabled [ 292.256510][ T9912] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1562'. [ 292.765904][ T9934] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1571'. [ 292.975978][ T9943] SET target dimension over the limit! [ 293.404646][ T9964] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1584'. [ 293.562780][ T9973] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1589'. [ 294.095833][ T9997] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1597'. [ 294.574563][T10007] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1601'. [ 295.433950][T10032] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 295.777496][T10052] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1617'. [ 296.162369][T10067] syzkaller0: entered promiscuous mode [ 296.168218][T10067] syzkaller0: entered allmulticast mode [ 296.178950][T10067] 0: reclassify loop, rule prio 0, protocol 700 [ 296.621540][T10083] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1630'. [ 296.986635][T10100] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1638'. [ 297.451500][T10114] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1643'. [ 297.878766][T10136] Bluetooth: MGMT ver 1.23 [ 297.910753][T10136] pim6reg: entered allmulticast mode [ 297.918822][T10136] pim6reg: left allmulticast mode [ 297.977224][T10143] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1653'. [ 304.643564][T10301] tipc: Enabling of bearer rejected, failed to enable media [ 304.645137][T10301] syzkaller0: entered promiscuous mode [ 304.645186][T10301] syzkaller0: entered allmulticast mode [ 304.664934][T10301] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 304.723567][T10301] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1713'. [ 306.647196][T10361] netlink: 'syz.3.1733': attribute type 8 has an invalid length. [ 307.974543][T10373] tipc: Enabling of bearer rejected, failed to enable media [ 307.975751][T10373] syzkaller0: entered promiscuous mode [ 307.975804][T10373] syzkaller0: entered allmulticast mode [ 308.013460][T10373] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 308.134007][T10373] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1738'. [ 308.826479][T10413] netlink: 'syz.3.1757': attribute type 13 has an invalid length. [ 309.400644][T10435] netlink: 148 bytes leftover after parsing attributes in process `syz.3.1766'. [ 309.732848][T10455] 8021q: VLANs not supported on ip6gre0 [ 309.827646][T10462] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 309.877066][T10462] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 309.953389][T10468] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1778'. [ 310.119817][T10473] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1780'. [ 310.136912][T10473] syz_tun: entered promiscuous mode [ 310.145561][T10473] macvlan2: entered promiscuous mode [ 310.167021][T10473] syz_tun: left promiscuous mode [ 310.196403][T10477] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1781'. [ 310.475354][T10490] 8021q: VLANs not supported on ip6gre0 [ 311.726900][T10516] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1797'. [ 312.828478][T10539] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1805'. [ 313.063566][T10545] tipc: Enabling of bearer rejected, failed to enable media [ 313.075379][T10545] syzkaller0: entered promiscuous mode [ 313.082535][T10545] syzkaller0: entered allmulticast mode [ 313.093754][T10545] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 313.187323][T10545] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1807'. [ 313.622701][T10566] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1818'. [ 314.127251][T10592] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1831'. [ 314.918230][T10621] syzkaller0: entered promiscuous mode [ 314.924251][T10621] syzkaller0: entered allmulticast mode [ 314.932373][T10621] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 314.998943][T10621] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1845'. [ 315.544379][T10641] netlink: 666 bytes leftover after parsing attributes in process `syz.3.1852'. [ 316.820444][T10700] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1876'. [ 317.175384][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.175472][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.195466][T10716] netlink: 'syz.1.1886': attribute type 27 has an invalid length. [ 317.195518][T10716] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1886'. [ 317.195563][T10716] bond0: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 318.141014][ T5625] usb 3-1: new low-speed USB device number 6 using dummy_hcd [ 318.311733][ T5625] usb 3-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 318.321449][ T31] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 318.331355][ T5625] usb 3-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 318.331392][ T5625] usb 3-1: too many endpoints for config 0 interface 0 altsetting 254: 33, using maximum allowed: 30 [ 318.331429][ T5625] usb 3-1: config 0 interface 0 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 33 [ 318.331469][ T5625] usb 3-1: config 0 interface 0 has no altsetting 0 [ 318.331506][ T5625] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 318.385718][ T5625] usb 3-1: config 0 descriptor?? [ 318.469580][ T31] usb 2-1: Using ep0 maxpacket: 32 [ 318.494069][T10760] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1904'. [ 318.603753][T10780] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1916'. [ 319.366311][T10810] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1931'. [ 319.520033][T10814] netlink: 'syz.4.1933': attribute type 13 has an invalid length. [ 319.571936][T10818] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1935'. [ 319.683338][T10818] xfrm0 speed is unknown, defaulting to 1000 [ 319.736817][T10818] xfrm0 speed is unknown, defaulting to 1000 [ 319.746197][T10818] xfrm0 speed is unknown, defaulting to 1000 [ 320.264679][T10832] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1941'. [ 320.394174][ T5820] xfrm0 speed is unknown, defaulting to 1000 [ 320.400603][T10818] infiniband syz0: set active [ 320.400623][T10818] infiniband syz0: added xfrm0 [ 320.454952][T10818] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 320.455007][T10818] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 320.456538][T10818] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 320.602680][T10818] RDS/IB: syz0: added [ 320.621877][T10818] smc: adding ib device syz0 with port count 1 [ 320.622057][T10818] smc: ib device syz0 port 1 has no pnetid [ 320.637374][ T5820] xfrm0 speed is unknown, defaulting to 1000 [ 320.714944][T10818] xfrm0 speed is unknown, defaulting to 1000 [ 320.739281][ T5625] usb 3-1: string descriptor 0 read error: -71 [ 320.784424][ T5625] usb 3-1: USB disconnect, device number 6 [ 320.822992][T10844] netlink: 'syz.4.1945': attribute type 1 has an invalid length. [ 320.911684][ T6218] udevd[6218]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 320.955221][ T5638] udevd[5638]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 321.118332][ T31] usb 2-1: unable to get BOS descriptor or descriptor too short [ 321.118401][ T31] usb 2-1: New USB device found, idVendor=1b96, idProduct=0007, bcdDevice= 0.40 [ 321.137410][ T31] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 321.137466][ T31] usb 2-1: can't read configurations, error -71 [ 321.326276][T10860] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1953'. [ 321.862532][T10818] xfrm0 speed is unknown, defaulting to 1000 [ 322.242260][T10896] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1966'. [ 322.642208][T10818] xfrm0 speed is unknown, defaulting to 1000 [ 322.921756][T10922] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 322.993224][T10925] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1981'. [ 323.063804][T10925] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1981'. [ 323.573552][T10818] xfrm0 speed is unknown, defaulting to 1000 [ 323.634250][T10951] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1992'. [ 323.714798][T10951] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1992'. [ 323.716607][T10955] netlink: 'syz.0.1990': attribute type 13 has an invalid length. [ 324.456208][T10818] xfrm0 speed is unknown, defaulting to 1000 [ 324.666047][T10991] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2005'. [ 324.730916][T10996] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2005'. [ 328.020987][T11117] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2059'. [ 328.116443][T11123] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2059'. [ 328.679653][T11146] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2068'. [ 329.768376][T11202] ip6tnl0: Caught tx_queue_len zero misconfig [ 330.962313][T11265] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2114'. [ 331.078019][T11270] tunl0: Caught tx_queue_len zero misconfig [ 331.438509][ T32] audit: type=1800 audit(1787344196.634:2): pid=11284 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2127" name="memory.events" dev="tmpfs" ino=2309 res=0 errno=0 [ 331.465476][ T32] audit: type=1804 audit(1787344196.664:3): pid=11284 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.2127" name="/newroot/449/memory.events" dev="tmpfs" ino=2309 res=1 errno=0 [ 332.395571][T11331] syzkaller0: Caught tx_queue_len zero misconfig [ 332.395629][T11331] sch_tbf: burst 255 is lower than device syzkaller0 mtu (65589) ! [ 332.449012][T11331] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2147'. [ 332.462826][T11331] syzkaller0: mtu less than device minimum [ 332.703818][T11339] syzkaller0: entered promiscuous mode [ 332.703862][T11339] syzkaller0: entered allmulticast mode [ 333.039199][T11353] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2158'. [ 333.267851][T11366] sch_tbf: burst 255 is lower than device syzkaller0 mtu (65589) ! [ 333.297218][T11366] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2162'. [ 333.310849][T11366] syzkaller0: mtu less than device minimum [ 333.388687][T11371] netdevsim netdevsim0 netdevsim0: entered allmulticast mode [ 333.687292][T11382] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2169'. [ 333.967100][T11397] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2173'. [ 334.127893][T11406] syzkaller0: entered promiscuous mode [ 334.134349][T11406] syzkaller0: entered allmulticast mode [ 334.144976][T11406] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 334.198658][T11406] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2176'. [ 336.287955][T11439] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2185'. [ 337.090247][T11470] netlink: 'syz.2.2196': attribute type 8 has an invalid length. [ 338.369770][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 338.577697][T11475] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 338.803618][T11481] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2200'. [ 338.952616][T11485] nbd2: detected capacity change from 0 to 63 [ 338.972967][T11485] block nbd2: NBD_DISCONNECT [ 338.984789][T11485] block nbd2: Disconnected due to user request. [ 338.985667][T11485] block nbd2: shutting down sockets [ 338.996469][ T6472] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 338.996744][ T6472] Buffer I/O error on dev nbd2, logical block 1, async page read [ 338.996989][ T6472] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 2 prio class 2 [ 338.997050][ T6472] Buffer I/O error on dev nbd2, logical block 2, async page read [ 338.997097][ T6472] Buffer I/O error on dev nbd2, logical block 3, async page read [ 339.075680][ C1] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 339.076000][ C1] Buffer I/O error on dev nbd2, logical block 0, async page read [ 339.128211][ T6472] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 339.128282][ T6472] Buffer I/O error on dev nbd2, logical block 0, async page read [ 339.128303][ T6472] Buffer I/O error on dev nbd2, logical block 1, async page read [ 339.138918][ T6472] Buffer I/O error on dev nbd2, logical block 2, async page read [ 339.138947][ T6472] Buffer I/O error on dev nbd2, logical block 3, async page read [ 339.141332][ T6472] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 339.141403][ T6472] Buffer I/O error on dev nbd2, logical block 0, async page read [ 339.141454][ T6472] Buffer I/O error on dev nbd2, logical block 1, async page read [ 339.141880][ T6472] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 339.147027][ T6472] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 339.147541][ T6472] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 339.147968][ T6472] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 339.148251][ T6472] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 339.152797][ T5638] ldm_validate_partition_table(): Disk read failed. [ 339.174484][ T5638] Dev nbd2: unable to read RDB block 0 [ 339.187705][ T5638] nbd2: unable to read partition table [ 339.295335][ T5638] ldm_validate_partition_table(): Disk read failed. [ 339.298671][ T5638] Dev nbd2: unable to read RDB block 0 [ 339.308230][ T5638] nbd2: unable to read partition table [ 339.397066][T11492] netlink: 'syz.3.2205': attribute type 1 has an invalid length. [ 341.144028][T11507] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 342.011820][T11532] netlink: 18 bytes leftover after parsing attributes in process `syz.1.2218'. [ 342.284826][T11537] tipc: Enabled bearer , priority 0 [ 342.300636][T11537] syzkaller0: entered promiscuous mode [ 342.300684][T11537] syzkaller0: entered allmulticast mode [ 342.400340][T11544] tipc: Resetting bearer [ 342.435893][T11536] tipc: Resetting bearer [ 342.493999][T11536] tipc: Disabling bearer [ 342.585749][T11551] netlink: 'syz.0.2226': attribute type 13 has an invalid length. [ 344.217268][T11627] netlink: 'syz.3.2254': attribute type 13 has an invalid length. [ 344.330209][ T1181] xfrm0 speed is unknown, defaulting to 1000 [ 345.635495][T11701] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 346.157968][T11729] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 347.233346][T11782] smc: removing ib device syz0 [ 347.530819][T11782] smbdirect: ib_dev[syz0] removed [ 348.829775][T11846] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2332'. [ 348.973641][T11846] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2332'. [ 349.767521][T11878] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2344'. [ 350.181078][T11895] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2353'. [ 350.518936][T11906] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2357'. [ 351.068520][T11922] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2365'. [ 351.442219][T11935] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2371'. [ 352.168898][T11961] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2383'. [ 352.386153][T11968] tipc: Enabled bearer , priority 0 [ 352.395390][T11968] syzkaller0: entered promiscuous mode [ 352.402081][T11968] syzkaller0: entered allmulticast mode [ 352.423151][T11967] tipc: Resetting bearer [ 352.461198][T11967] tipc: Disabling bearer [ 353.071470][T11993] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2397'. [ 353.859900][T12032] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2413'. [ 354.603996][T12060] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2425'. [ 355.699746][T12095] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2441'. [ 356.143535][T12110] tipc: New replicast peer: 127.0.0.2 [ 356.149262][T12110] tipc: Enabled bearer , priority 10 [ 356.173443][T12110] tipc: Disabling bearer [ 356.279254][T12120] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2453'. [ 357.310068][T12163] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2472'. [ 357.387568][T12167] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2474'. [ 357.421262][T12163] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2472'. [ 357.629707][ T67] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 357.633454][ T7320] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 357.633816][ T7320] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 357.634148][ T7320] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 357.946535][T12186] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2480'. [ 358.160625][T12200] syzkaller0: entered promiscuous mode [ 358.160668][T12200] syzkaller0: entered allmulticast mode [ 358.196221][T12200] tipc: Enabled bearer , priority 0 [ 358.247319][T12200] tipc: Resetting bearer [ 358.293463][T12199] tipc: Resetting bearer [ 358.369089][T12199] tipc: Disabling bearer [ 358.381894][T12211] netlink: 'syz.1.2489': attribute type 27 has an invalid length. [ 358.381946][T12211] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2489'. [ 358.404562][T12211] bond0: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-rr(0) [ 358.635436][T12223] netlink: 'syz.3.2496': attribute type 13 has an invalid length. [ 358.718318][T12227] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2498'. [ 358.908044][T12236] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2495'. [ 359.504555][T12258] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2510'. [ 359.753929][T12274] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2516'. [ 360.303765][T12294] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2525'. [ 360.579051][T12313] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2532'. [ 360.687811][T12317] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2535'. [ 361.087606][T12333] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2541'. [ 361.571487][T12353] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2549'. [ 361.704763][T12355] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2550'. [ 361.734008][T12359] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2553'. [ 361.825650][T12357] tipc: Enabling of bearer rejected, already enabled [ 361.874578][T12357] syzkaller0: mtu less than device minimum [ 362.033047][T12372] netlink: 'syz.4.2559': attribute type 13 has an invalid length. [ 362.298365][ T4935] block nbd0: Receive control failed (result -32) [ 362.309538][ T5636] block nbd0: Receive control failed (result -32) [ 362.643513][T12400] tipc: Enabling of bearer rejected, already enabled [ 362.703083][T12400] syzkaller0: mtu less than device minimum [ 363.338108][T12424] tipc: Enabled bearer , priority 0 [ 363.642619][T12436] tipc: Enabling of bearer rejected, already enabled [ 363.681489][T12436] syzkaller0: mtu less than device minimum [ 363.765218][T12441] netlink: 'syz.0.2584': attribute type 8 has an invalid length. [ 364.119581][T12451] __nla_validate_parse: 5 callbacks suppressed [ 364.119638][T12451] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2587'. [ 364.307452][T12460] vcan0: tx drop: invalid sa for name 0xfffffffffffffffd [ 364.450134][ T31] tipc: Node number set to 1303887433 [ 364.556236][T12465] syzkaller0: entered promiscuous mode [ 364.556286][T12465] syzkaller0: entered allmulticast mode [ 364.582797][T12465] tipc: Enabled bearer , priority 0 [ 364.610202][T12470] netlink: 'syz.2.2597': attribute type 8 has an invalid length. [ 364.611400][T12465] tipc: Resetting bearer [ 364.655918][T12464] tipc: Resetting bearer [ 364.703532][T12464] tipc: Disabling bearer [ 364.822764][T12478] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2601'. [ 365.060488][T12486] netlink: 'syz.3.2603': attribute type 13 has an invalid length. [ 365.122412][T12493] vcan0: tx drop: invalid sa for name 0xfffffffffffffffd [ 365.227344][T12494] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2604'. [ 365.333570][T12500] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2609'. [ 365.492714][T12500] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2609'. [ 365.603864][T12511] netlink: 'syz.2.2611': attribute type 8 has an invalid length. [ 365.846470][T12520] syzkaller0: Caught tx_queue_len zero misconfig [ 365.872402][T12520] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2614'. [ 365.967337][T12523] vcan0: tx drop: invalid sa for name 0xfffffffffffffffd [ 366.059398][T12503] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2610'. [ 366.298548][T12533] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2621'. [ 366.661376][T12549] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2629'. [ 366.702238][T12555] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2631'. [ 367.701328][T12601] syzkaller0: mtu less than device minimum [ 369.166242][T12661] __nla_validate_parse: 6 callbacks suppressed [ 369.166308][T12661] netlink: 136 bytes leftover after parsing attributes in process `syz.1.2671'. [ 369.166332][T12661] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 370.278403][T12582] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 370.587155][T12689] syzkaller0: entered promiscuous mode [ 370.587200][T12689] syzkaller0: entered allmulticast mode [ 370.635133][T12689] tipc: Enabled bearer , priority 0 [ 370.670151][T12689] tipc: Resetting bearer [ 370.697412][T12686] tipc: Resetting bearer [ 370.775801][T12686] tipc: Disabling bearer [ 370.817000][T12701] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2688'. [ 371.020060][T12720] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 371.045525][T12709] xt_CT: You must specify a L4 protocol and not use inversions on it [ 371.072653][T12722] syzkaller0: mtu less than device minimum [ 371.553436][T12740] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2703'. [ 373.838906][T12796] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2728'. [ 373.891356][T12710] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 375.101878][T12818] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 375.566491][T12828] tipc: Enabling of bearer rejected, already enabled [ 375.871348][T12828] syzkaller0: mtu less than device minimum [ 375.881898][T12854] syzkaller0: entered promiscuous mode [ 375.881934][T12854] syzkaller0: entered allmulticast mode [ 375.904736][T12844] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2745'. [ 376.178857][T12866] syzkaller0: entered promiscuous mode [ 376.178895][T12866] syzkaller0: entered allmulticast mode [ 378.614909][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.620722][T12835] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 378.630249][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.881068][T12873] tipc: Enabled bearer , priority 0 [ 378.903212][T12874] netlink: 'syz.2.2754': attribute type 8 has an invalid length. [ 378.938472][T12873] tipc: Resetting bearer [ 378.982282][T12872] tipc: Disabling bearer [ 379.767223][T12922] ip6gre1: entered promiscuous mode [ 379.772610][T12922] ip6gre1: entered allmulticast mode [ 380.672006][T12957] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2790'. [ 381.987777][T12974] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2797'. [ 382.439192][T12905] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 383.004786][T13008] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2808'. [ 383.317647][T13028] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2816'. [ 383.854603][ T4935] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 383.872637][ T4935] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 383.882074][ T4935] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 383.891141][ T4935] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 383.898836][ T4935] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 384.106172][T13063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2827'. [ 384.828088][T13052] bridge0: port 1(bridge_slave_0) entered blocking state [ 384.828316][T13052] bridge0: port 1(bridge_slave_0) entered disabled state [ 384.829302][T13052] bridge_slave_0: entered allmulticast mode [ 384.835380][T13052] bridge_slave_0: entered promiscuous mode [ 384.844027][T13052] bridge0: port 2(bridge_slave_1) entered blocking state [ 384.846461][T13052] bridge0: port 2(bridge_slave_1) entered disabled state [ 384.847125][T13052] bridge_slave_1: entered allmulticast mode [ 384.859969][T13052] bridge_slave_1: entered promiscuous mode [ 384.906531][T13052] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 384.916318][T13052] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 384.948897][T13052] team0: Port device team_slave_0 added [ 384.956150][T13052] team0: Port device team_slave_1 added [ 384.984636][T13052] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 384.984680][T13052] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 384.984708][T13052] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 384.992381][T13052] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 384.992415][T13052] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 384.992485][T13052] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 385.099894][T13052] hsr_slave_0: entered promiscuous mode [ 385.102601][T13052] hsr_slave_1: entered promiscuous mode [ 385.104527][T13052] debugfs: 'hsr0' already exists in 'hsr' [ 385.104610][T13052] Cannot create hsr debugfs directory [ 385.272526][T13052] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 385.272591][T13052] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.357308][T13052] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 385.357373][T13052] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.459056][T13052] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 385.459206][T13052] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.525735][T13052] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 385.525795][T13052] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.969494][ T4935] Bluetooth: hci5: command tx timeout [ 386.272255][T13029] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 386.311841][T13052] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 386.376167][T13052] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 386.385995][T13052] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 386.407135][T13052] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 386.415374][T13052] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 386.426654][T13052] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 386.436097][T13052] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 386.472492][T13052] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 386.651313][T13052] 8021q: adding VLAN 0 to HW filter on device bond0 [ 386.711119][T13106] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2832'. [ 386.759188][T13052] 8021q: adding VLAN 0 to HW filter on device team0 [ 386.803118][ T1393] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.803374][ T1393] bridge0: port 1(bridge_slave_0) entered forwarding state [ 386.851559][ T7321] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.851688][ T7321] bridge0: port 2(bridge_slave_1) entered forwarding state [ 387.049928][T13115] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2837'. [ 387.336634][T13134] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2843'. [ 387.630206][T13146] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2845'. [ 387.718847][T13150] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2848'. [ 387.743795][T13150] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2848'. [ 387.902964][T13157] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2853'. [ 388.050215][ T4935] Bluetooth: hci5: command tx timeout [ 388.704996][T13191] netlink: 'syz.3.2862': attribute type 8 has an invalid length. [ 388.717119][T13052] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 388.814912][T13194] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2864'. [ 388.929295][T13052] veth0_vlan: entered promiscuous mode [ 388.955372][T13052] veth1_vlan: entered promiscuous mode [ 389.034892][T13052] veth0_macvtap: entered promiscuous mode [ 389.072553][T13052] veth1_macvtap: entered promiscuous mode [ 389.188676][T13052] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 389.225770][T13052] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 389.260756][ T7314] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.261668][ T7314] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.262212][ T7314] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.270227][ T31] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 389.270456][ T7319] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 389.430602][ T31] usb 5-1: Using ep0 maxpacket: 32 [ 389.433925][ T31] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 389.438627][ T31] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 389.438695][ T31] usb 5-1: config 0 has no interface number 0 [ 389.438818][ T31] usb 5-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 255 [ 389.438900][ T31] usb 5-1: config 0 interface 184 has no altsetting 0 [ 389.456816][ T31] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 389.456884][ T31] usb 5-1: Product: syz [ 389.456928][ T31] usb 5-1: Manufacturer: syz [ 389.456971][ T31] usb 5-1: SerialNumber: syz [ 389.505141][ T31] usb 5-1: config 0 descriptor?? [ 389.513980][T13206] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 389.745711][T13206] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 389.839813][T13226] netlink: 'syz.2.2876': attribute type 8 has an invalid length. [ 389.844162][ T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 389.844296][ T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 390.102054][T13233] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2878'. [ 390.129559][ T5636] Bluetooth: hci5: command tx timeout [ 390.155581][ T31] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 390.166857][ T31] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 390.627764][ T31] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 390.627873][ T31] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 390.628049][ T31] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 390.745417][ T31] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -61 [ 390.929590][ T5636] Bluetooth: hci4: command 0x0406 tx timeout [ 391.227889][ T7320] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 391.227927][ T7320] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 391.384519][T13242] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2822'. [ 391.923759][T13260] syzkaller0: entered promiscuous mode [ 391.930195][T13260] syzkaller0: entered allmulticast mode [ 392.029444][ T31] usb 5-1: USB disconnect, device number 5 [ 392.181433][T13271] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2891'. [ 392.210352][ T4935] Bluetooth: hci5: command tx timeout [ 392.302277][T13280] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2892'. [ 392.355068][T13264] syzkaller0: mtu less than device minimum [ 392.377692][ T27] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 392.380666][ T27] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 392.382505][ T27] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 392.383111][ T27] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 392.981514][ T5726] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 393.146513][ T5726] usb 5-1: Using ep0 maxpacket: 32 [ 393.183065][ T5726] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 393.215900][ T5726] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 393.216085][ T5726] usb 5-1: config 0 has no interface number 0 [ 393.217019][ T5726] usb 5-1: config 0 interface 184 altsetting 7 bulk endpoint 0x82 has invalid maxpacket 255 [ 393.217097][ T5726] usb 5-1: config 0 interface 184 has no altsetting 0 [ 393.397220][ T5726] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.397741][ T5726] usb 5-1: Product: syz [ 393.401329][ T5726] usb 5-1: Manufacturer: syz [ 393.401464][ T5726] usb 5-1: SerialNumber: syz [ 393.517982][ T5726] usb 5-1: config 0 descriptor?? [ 393.559333][T13295] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 394.064939][T13295] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 394.483997][ T5726] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 394.484048][ T5726] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 394.625979][T13313] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2906'. [ 394.659961][T13316] syzkaller0: entered promiscuous mode [ 394.660009][T13316] syzkaller0: entered allmulticast mode [ 394.679313][T13323] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2908'. [ 394.709013][ T5726] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 394.720716][ T5726] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 394.731102][ T5726] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 394.741425][ T5726] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -61 [ 395.358456][T13352] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2922'. [ 395.755046][T13368] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2928'. [ 395.779319][T13367] syzkaller0: entered promiscuous mode [ 395.786189][T13367] syzkaller0: entered allmulticast mode [ 395.964078][ T5819] usb 5-1: USB disconnect, device number 6 [ 396.056591][T13378] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2934'. [ 396.551732][T13401] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2944'. [ 398.140673][T13466] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2969'. [ 398.444785][T13477] netlink: 'syz.1.2977': attribute type 13 has an invalid length. [ 398.486887][T13474] 8021q: adding VLAN 0 to HW filter on device bond1 [ 398.670169][T13489] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2980'. [ 400.282027][ T5636] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 400.295330][ T5636] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 400.303351][ T5636] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 400.316486][ T5636] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 400.326798][ T5636] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 400.639481][T13559] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3008'. [ 400.772124][T13566] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3010'. [ 401.627740][T13590] netlink: 'syz.2.3018': attribute type 1 has an invalid length. [ 401.661302][ T1393] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 401.809262][T13590] 8021q: adding VLAN 0 to HW filter on device bond1 [ 401.852595][T13592] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 401.866952][T13600] netlink: 'syz.0.3017': attribute type 8 has an invalid length. [ 402.002758][ T1393] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.151138][T13608] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3020'. [ 402.215119][ T1393] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.370830][ T5636] Bluetooth: hci0: command tx timeout [ 402.382323][T13616] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3026'. [ 402.470774][ T1393] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 402.530308][T13624] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3029'. [ 403.538117][T13650] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3040'. [ 403.921294][T13546] bridge0: port 1(bridge_slave_0) entered blocking state [ 403.928786][T13546] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.928996][T13546] bridge_slave_0: entered allmulticast mode [ 403.949889][T13546] bridge_slave_0: entered promiscuous mode [ 403.976377][T13546] bridge0: port 2(bridge_slave_1) entered blocking state [ 403.976608][T13546] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.977095][T13546] bridge_slave_1: entered allmulticast mode [ 403.996190][T13546] bridge_slave_1: entered promiscuous mode [ 404.459655][ T5636] Bluetooth: hci0: command tx timeout [ 404.565720][ T1393] bridge_slave_1: left allmulticast mode [ 404.577745][ T1393] bridge_slave_1: left promiscuous mode [ 404.587067][ T1393] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.608657][ T1393] bridge_slave_0: left allmulticast mode [ 404.620256][ T1393] bridge_slave_0: left promiscuous mode [ 404.620943][ T1393] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.663449][T13696] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3052'. [ 405.615690][T13713] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3057'. [ 405.926460][ T1393] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 405.937886][ T1393] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 405.944276][ T1393] bond0 (unregistering): Released all slaves [ 406.173645][T13546] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 406.546644][ T5636] Bluetooth: hci0: command tx timeout [ 406.610878][ T5281] 8021q: adding VLAN 0 to HW filter on device eth1 [ 406.621181][T13546] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 406.644556][ T1393] tipc: Left network mode [ 406.694056][T13546] team0: Port device team_slave_0 added [ 406.703464][T13546] team0: Port device team_slave_1 added [ 406.741285][T13546] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 406.748761][T13546] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 406.779191][T13546] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 406.793156][T13546] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 406.800549][T13546] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 406.828216][T13546] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 407.038692][T13546] hsr_slave_0: entered promiscuous mode [ 407.046016][T13546] hsr_slave_1: entered promiscuous mode [ 407.052901][T13546] debugfs: 'hsr0' already exists in 'hsr' [ 407.058812][T13546] Cannot create hsr debugfs directory [ 407.559005][T13747] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3067'. [ 407.630054][T13752] netlink: 'syz.1.3066': attribute type 8 has an invalid length. [ 408.150933][T13762] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3069'. [ 408.619684][ T5636] Bluetooth: hci0: command tx timeout [ 409.853143][ T5281] 8021q: adding VLAN 0 to HW filter on device eth2 [ 410.005415][T13767] tipc: Enabling of bearer rejected, already enabled [ 410.247623][ T1393] hsr_slave_0: left promiscuous mode [ 410.258970][ T1393] hsr_slave_1: left promiscuous mode [ 410.273812][ T1393] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 410.273936][ T1393] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 410.296252][ T1393] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 410.296294][ T1393] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 410.355612][ T1393] veth1_macvtap: left promiscuous mode [ 410.355978][ T1393] veth0_macvtap: left promiscuous mode [ 413.645182][T13807] netlink: 'syz.2.3083': attribute type 13 has an invalid length. [ 413.741916][ T1393] team0 (unregistering): Port device team_slave_1 removed [ 413.772899][ T1393] team0 (unregistering): Port device team_slave_0 removed [ 414.334488][T13821] syzkaller0: Caught tx_queue_len zero misconfig [ 414.356010][T13821] tipc: Enabling of bearer rejected, already enabled [ 414.551985][T13821] syzkaller0: mtu less than device minimum [ 414.560244][T13829] tipc: Enabling of bearer rejected, failed to enable media [ 414.687765][T13836] tipc: Enabled bearer , priority 0 [ 415.152621][T13854] vxcan0: tx drop: invalid da for name 0x00000000000000c8 [ 415.576316][T13835] tipc: Disabling bearer [ 415.593543][ T1393] IPVS: stop unused estimator thread 0... [ 416.617995][T13871] tipc: Started in network mode [ 416.618056][T13871] tipc: Node identity aa85b45994b1, cluster identity 4711 [ 416.642387][T13871] tipc: Enabled bearer , priority 0 [ 416.656568][T13871] tipc: Resetting bearer [ 416.759169][T13870] tipc: Disabling bearer [ 417.185889][T13898] tipc: Enabling of bearer rejected, already enabled [ 417.293969][T13546] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 417.388814][T13546] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 417.401363][T13546] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 417.434544][T13546] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 417.439177][T13546] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 417.498841][T13546] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 417.508719][T13546] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 417.644228][T13546] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 418.512010][T13927] netlink: 136 bytes leftover after parsing attributes in process `syz.1.3121'. [ 418.522682][T13927] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 418.699300][T13546] 8021q: adding VLAN 0 to HW filter on device bond0 [ 418.791614][T13546] 8021q: adding VLAN 0 to HW filter on device team0 [ 418.823732][ T7314] bridge0: port 1(bridge_slave_0) entered blocking state [ 418.823911][ T7314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 418.856815][ T27] bridge0: port 2(bridge_slave_1) entered blocking state [ 418.856941][ T27] bridge0: port 2(bridge_slave_1) entered forwarding state [ 419.104922][T13955] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3125'. [ 421.084318][T13546] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 421.252478][T13546] veth0_vlan: entered promiscuous mode [ 421.322329][T13546] veth1_vlan: entered promiscuous mode [ 421.478478][T13546] veth0_macvtap: entered promiscuous mode [ 421.521840][T13546] veth1_macvtap: entered promiscuous mode [ 421.681433][T13546] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 422.520357][T13546] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 422.563013][ T27] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.563829][ T27] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.563934][ T27] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 422.564027][ T27] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 423.511398][ T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 423.511436][ T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 423.702968][ T67] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 423.703006][ T67] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 423.859846][T14048] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3149'. [ 424.803466][T14077] tipc: Enabling of bearer rejected, already enabled [ 424.876110][ T4935] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 424.893636][ T4935] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 424.903589][ T4935] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 424.917429][ T4935] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 424.943490][ T4935] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 425.526826][T14083] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3158'. [ 426.018557][T14095] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3162'. [ 426.610509][T14114] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3168'. [ 426.615154][T14114] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3168'. [ 427.347997][T14135] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3173'. [ 427.472057][T14139] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3174'. [ 427.569523][ T4935] Bluetooth: hci2: command tx timeout [ 429.358875][T14175] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3185'. [ 429.548505][T14181] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3187'. [ 429.649750][ T4935] Bluetooth: hci2: command tx timeout [ 429.848454][T14079] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.857491][T14079] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.865909][T14079] bridge_slave_0: entered allmulticast mode [ 429.882659][T14079] bridge_slave_0: entered promiscuous mode [ 429.896693][T14079] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.904612][T14079] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.912550][T14079] bridge_slave_1: entered allmulticast mode [ 429.925879][T14079] bridge_slave_1: entered promiscuous mode [ 430.003279][T14206] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3197'. [ 430.087660][T14079] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 430.109167][T14079] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 430.222256][T14079] team0: Port device team_slave_0 added [ 430.235633][T14212] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3199'. [ 430.246396][T14079] team0: Port device team_slave_1 added [ 430.322258][T14079] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 430.329890][T14079] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 430.329923][T14079] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 430.372951][T14079] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 430.380479][T14079] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 430.406963][T14079] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 430.571328][T14079] hsr_slave_0: entered promiscuous mode [ 430.583576][T14079] hsr_slave_1: entered promiscuous mode [ 430.584422][T14079] debugfs: 'hsr0' already exists in 'hsr' [ 430.584469][T14079] Cannot create hsr debugfs directory [ 430.689192][T14233] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3204'. [ 430.696153][T14230] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3206'. [ 431.113207][T14079] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 431.133343][T14079] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 431.183410][T14249] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3214'. [ 431.421457][T14079] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 431.433555][T14079] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 431.637201][T14079] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 431.637267][T14079] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 431.663887][T14263] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3219'. [ 431.730334][ T4935] Bluetooth: hci2: command tx timeout [ 431.815500][T14267] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3220'. [ 431.831021][T14079] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 431.843391][T14079] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 432.119247][T14079] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 432.134172][T14079] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 432.142438][T14079] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 432.162085][T14079] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 432.170701][T14079] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 432.181570][T14079] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 432.189852][T14079] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 432.203238][T14079] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 432.409398][T14079] 8021q: adding VLAN 0 to HW filter on device bond0 [ 432.441815][T14079] 8021q: adding VLAN 0 to HW filter on device team0 [ 432.472290][ T3340] bridge0: port 1(bridge_slave_0) entered blocking state [ 432.472550][ T3340] bridge0: port 1(bridge_slave_0) entered forwarding state [ 432.513324][ T7317] bridge0: port 2(bridge_slave_1) entered blocking state [ 432.513458][ T7317] bridge0: port 2(bridge_slave_1) entered forwarding state [ 432.910561][T14315] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3233'. [ 433.041259][ T7314] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 433.051437][ T7314] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 433.070366][ T7314] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 433.070439][ T7314] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 433.788046][T14338] tipc: Enabled bearer , priority 0 [ 433.799187][T14338] tipc: Resetting bearer [ 433.810198][ T4935] Bluetooth: hci2: command tx timeout [ 433.816592][T14336] tipc: Disabling bearer [ 434.320067][T14079] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 434.526261][T14373] __nla_validate_parse: 2 callbacks suppressed [ 434.526534][T14373] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3247'. [ 435.052947][T14079] veth0_vlan: entered promiscuous mode [ 435.093831][T14079] veth1_vlan: entered promiscuous mode [ 435.127178][T14390] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3252'. [ 435.211668][T14390] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3252'. [ 435.339246][T14079] veth0_macvtap: entered promiscuous mode [ 435.350675][T14397] tipc: Enabling of bearer rejected, already enabled [ 435.366950][T14079] veth1_macvtap: entered promiscuous mode [ 435.377252][T14397] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3253'. [ 435.387016][T14397] syzkaller0: mtu less than device minimum [ 435.448049][T14079] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 435.509260][T14079] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 435.560536][ T1393] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.561919][ T1393] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.586600][ T1393] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.602554][ T1393] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 435.749075][ T150] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 435.749129][ T150] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 435.803495][ T1393] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 435.803544][ T1393] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.268687][ T5636] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 436.277474][ T5636] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 436.288292][ T5636] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 436.301415][ T5636] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 436.304042][ T5636] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 436.991225][ T7317] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.006597][ T7317] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 437.052493][T14441] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3268'. [ 437.069259][T14446] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3270'. [ 437.285796][ T7317] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.285865][ T7317] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 437.864429][ T7317] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 437.864495][ T7317] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 437.989899][T14474] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3280'. [ 438.140031][ T7317] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 438.150642][ T7317] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 438.371889][ T4935] Bluetooth: hci3: command tx timeout [ 438.483120][T14492] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3287'. [ 438.671713][T14497] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3288'. [ 438.995517][T14516] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3294'. [ 439.083933][ T7317] bridge_slave_1: left allmulticast mode [ 439.098054][ T7317] bridge_slave_1: left promiscuous mode [ 439.104318][ T7317] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.125534][ T7317] bridge_slave_0: left allmulticast mode [ 439.125579][ T7317] bridge_slave_0: left promiscuous mode [ 439.125844][ T7317] bridge0: port 1(bridge_slave_0) entered disabled state [ 439.840555][ T7317] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 439.862433][ T7317] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 439.872705][ T7317] bond0 (unregistering): Released all slaves [ 439.915523][T14524] __nla_validate_parse: 1 callbacks suppressed [ 439.915574][T14524] netlink: 136 bytes leftover after parsing attributes in process `syz.2.3297'. [ 439.915595][T14524] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 440.058227][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.058319][ T1310] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.162315][T14529] syzkaller0: entered promiscuous mode [ 440.168066][T14529] syzkaller0: entered allmulticast mode [ 440.355297][T14556] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3301'. [ 440.450068][ T4935] Bluetooth: hci3: command tx timeout [ 440.548183][T14563] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3304'. [ 440.845380][T14566] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3305'. [ 442.174467][ T7317] tipc: Disabling bearer [ 442.180351][ T7317] tipc: Left network mode [ 442.186709][ T5281] 8021q: adding VLAN 0 to HW filter on device eth1 [ 442.362734][T14576] netlink: 156 bytes leftover after parsing attributes in process `syz.4.3307'. [ 442.529479][ T4935] Bluetooth: hci3: command tx timeout [ 442.596733][T14588] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3313'. [ 442.630523][T14589] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3312'. [ 442.647870][T14582] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3308'. [ 442.830441][T14597] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3314'. [ 442.906818][T14601] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3318'. [ 443.221249][ T7317] hsr_slave_0: left promiscuous mode [ 443.228602][ T7317] hsr_slave_1: left promiscuous mode [ 443.235763][ T7317] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 443.235802][ T7317] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 443.254039][ T7317] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 443.262048][ T7317] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 443.294266][ T7317] veth1_macvtap: left promiscuous mode [ 443.294333][ T7317] veth0_macvtap: left promiscuous mode [ 443.294592][ T7317] veth1_vlan: left promiscuous mode [ 443.295024][ T7317] veth0_vlan: left promiscuous mode [ 443.408468][T14624] netlink: 'syz.3.3326': attribute type 1 has an invalid length. [ 443.736553][ T7317] team0 (unregistering): Port device team_slave_1 removed [ 443.762577][ T7317] team0 (unregistering): Port device team_slave_0 removed [ 443.904881][T14421] bridge0: port 1(bridge_slave_0) entered blocking state [ 443.913445][T14421] bridge0: port 1(bridge_slave_0) entered disabled state [ 443.913596][T14421] bridge_slave_0: entered allmulticast mode [ 443.929067][T14421] bridge_slave_0: entered promiscuous mode [ 443.942488][T14421] bridge0: port 2(bridge_slave_1) entered blocking state [ 443.950167][T14421] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.958625][T14421] bridge_slave_1: entered allmulticast mode [ 443.968578][T14421] bridge_slave_1: entered promiscuous mode [ 444.016621][T14625] syzkaller1: entered promiscuous mode [ 444.016663][T14625] syzkaller1: entered allmulticast mode [ 444.233430][T14421] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 444.359035][T14421] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 444.368199][T14647] 8021q: VLANs not supported on xfrm0 [ 444.610754][ T4935] Bluetooth: hci3: command tx timeout [ 444.668566][T14421] team0: Port device team_slave_0 added [ 444.688319][T14421] team0: Port device team_slave_1 added [ 444.857236][T14421] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 444.857271][T14421] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 444.857510][T14421] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 444.867453][ T5281] 8021q: adding VLAN 0 to HW filter on device eth2 [ 444.914262][T14421] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 444.914302][T14421] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 444.914333][T14421] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 445.016637][ T7317] IPVS: stop unused estimator thread 0... [ 445.262886][T14421] hsr_slave_0: entered promiscuous mode [ 445.265879][T14421] hsr_slave_1: entered promiscuous mode [ 445.281281][T14421] debugfs: 'hsr0' already exists in 'hsr' [ 445.281322][T14421] Cannot create hsr debugfs directory [ 445.649953][T14692] __nla_validate_parse: 6 callbacks suppressed [ 445.650006][T14692] netlink: 156 bytes leftover after parsing attributes in process `syz.1.3345'. [ 446.115783][T14711] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3350'. [ 446.222301][T14715] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3350'. [ 446.306328][T14713] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3351'. [ 446.330578][T14713] netlink: 56 bytes leftover after parsing attributes in process `syz.2.3351'. [ 446.493982][T14713] team_slave_1: Caught tx_queue_len zero misconfig [ 446.504637][ T5281] 8021q: adding VLAN 0 to HW filter on device eth3 [ 447.199456][ T5755] usb 4-1: new low-speed USB device number 6 using dummy_hcd [ 447.353061][ T5755] usb 4-1: New USB device found, idVendor=28bd, idProduct=0074, bcdDevice= 0.00 [ 447.355946][ T5755] usb 4-1: config 0 has an invalid descriptor of length 34, skipping remainder of the config [ 447.356046][ T5755] usb 4-1: too many endpoints for config 0 interface 0 altsetting 254: 33, using maximum allowed: 30 [ 447.356168][ T5755] usb 4-1: config 0 interface 0 altsetting 254 has 0 endpoint descriptors, different from the interface descriptor's value: 33 [ 447.356237][ T5755] usb 4-1: config 0 interface 0 has no altsetting 0 [ 447.356320][ T5755] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.400581][ T5755] usb 4-1: config 0 descriptor?? [ 447.959496][T14421] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 447.986426][T14421] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 448.003833][T14421] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 448.039256][T14421] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 448.048465][T14421] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 448.084103][T14421] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 448.098620][T14421] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 448.131312][T14421] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 448.167116][T14772] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3366'. [ 448.189724][T14772] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3366'. [ 448.239565][T14772] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3366'. [ 448.532329][T14421] 8021q: adding VLAN 0 to HW filter on device bond0 [ 448.634107][T14421] 8021q: adding VLAN 0 to HW filter on device team0 [ 448.676043][ T7317] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.676169][ T7317] bridge0: port 1(bridge_slave_0) entered forwarding state [ 448.738630][ T7314] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.738991][ T7314] bridge0: port 2(bridge_slave_1) entered forwarding state [ 449.462798][T14817] syzkaller1: entered promiscuous mode [ 449.470780][T14817] syzkaller1: entered allmulticast mode [ 449.867693][ T5755] usb 4-1: string descriptor 0 read error: -71 [ 449.890080][ T5755] usb 4-1: USB disconnect, device number 6 [ 450.256061][T14847] netlink: 'syz.3.3385': attribute type 13 has an invalid length. [ 450.256106][T14847] netlink: 'syz.3.3385': attribute type 27 has an invalid length. [ 450.664984][T14421] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 450.705235][T14868] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3390'. [ 450.820995][T14873] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3392'. [ 450.840459][T14421] veth0_vlan: entered promiscuous mode [ 450.877497][T14421] veth1_vlan: entered promiscuous mode [ 450.881144][T14873] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3392'. [ 451.082967][T14421] veth0_macvtap: entered promiscuous mode [ 451.107045][T14421] veth1_macvtap: entered promiscuous mode [ 451.212803][T14421] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 451.294178][T14421] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 451.312009][T14886] ip6gre1: entered promiscuous mode [ 451.317628][T14886] ip6gre1: entered allmulticast mode [ 451.337371][T14884] syzkaller0: entered promiscuous mode [ 451.343385][T14884] syzkaller0: entered allmulticast mode [ 451.539519][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.559044][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.696220][T14898] netlink: 'syz.1.3399': attribute type 1 has an invalid length. [ 451.721788][ T1393] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.731364][ T67] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 451.787968][T14906] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3401'. [ 451.926868][T14898] 8021q: adding VLAN 0 to HW filter on device bond1 [ 452.152770][ T150] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 452.152812][ T150] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 452.292802][T14923] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3405'. [ 452.325980][ T150] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 452.326029][ T150] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 452.838669][T14942] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3260'. [ 453.116614][T14951] netlink: 'syz.1.3413': attribute type 8 has an invalid length. [ 453.349104][ T5636] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 453.359617][ T5636] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 453.368613][ T5636] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 453.392962][ T5636] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 453.395765][ T5636] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 453.911020][ T67] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 453.938678][T14973] netlink: 'syz.3.3421': attribute type 13 has an invalid length. [ 453.939110][T14973] netlink: 'syz.3.3421': attribute type 27 has an invalid length. [ 454.249282][ T67] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.396960][T14990] netlink: 'syz.4.3426': attribute type 8 has an invalid length. [ 454.553775][ T67] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.741763][ T67] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 454.814138][T15009] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3433'. [ 454.848445][T15009] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3433'. [ 454.865860][T15009] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3433'. [ 455.160375][T15015] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3434'. [ 455.324729][ T67] bridge_slave_1: left allmulticast mode [ 455.324777][ T67] bridge_slave_1: left promiscuous mode [ 455.325277][ T67] bridge0: port 2(bridge_slave_1) entered disabled state [ 455.357904][ T67] bridge_slave_0: left allmulticast mode [ 455.357958][ T67] bridge_slave_0: left promiscuous mode [ 455.364112][ T67] bridge0: port 1(bridge_slave_0) entered disabled state [ 455.489697][ T4935] Bluetooth: hci1: command tx timeout [ 456.402695][ T67] bond1 (unregistering): (slave geneve2): Releasing backup interface [ 456.514636][ T67] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 456.527587][ T67] bond0 (unregistering): Released all slaves [ 456.542924][ T67] bond1 (unregistering): Released all slaves [ 456.572411][T15021] ip6gre1: entered promiscuous mode [ 456.572503][T15021] ip6gre1: entered allmulticast mode [ 456.721174][T15042] syzkaller0: entered promiscuous mode [ 456.721217][T15042] syzkaller0: entered allmulticast mode [ 456.748788][ T5281] 8021q: adding VLAN 0 to HW filter on device eth1 [ 456.789131][ T67] tipc: Disabling bearer [ 456.816787][ T67] tipc: Left network mode [ 457.414256][T15080] ip6gre1: entered promiscuous mode [ 457.419873][T15080] ip6gre1: entered allmulticast mode [ 457.569529][ T4935] Bluetooth: hci1: command tx timeout [ 457.659245][ T67] hsr_slave_0: left promiscuous mode [ 457.677507][ T67] hsr_slave_1: left promiscuous mode [ 457.684618][ T67] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 457.684645][ T67] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 457.702358][ T67] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 457.702408][ T67] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 457.735445][ T67] veth1_macvtap: left promiscuous mode [ 457.735518][ T67] veth0_macvtap: left promiscuous mode [ 457.738522][ T67] veth1_vlan: left promiscuous mode [ 457.741796][ T67] veth0_vlan: left promiscuous mode [ 457.772629][T15087] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3453'. [ 458.773682][T15121] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3461'. [ 458.792476][ T67] team0 (unregistering): Port device team_slave_1 removed [ 458.821561][ T67] team0 (unregistering): Port device team_slave_0 removed [ 459.019086][T15104] bridge_slave_0: left allmulticast mode [ 459.019142][T15104] bridge_slave_0: left promiscuous mode [ 459.024121][T15104] bridge0: port 1(bridge_slave_0) entered disabled state [ 459.048038][T15104] bridge_slave_1: left allmulticast mode [ 459.048087][T15104] bridge_slave_1: left promiscuous mode [ 459.053962][T15104] bridge0: port 2(bridge_slave_1) entered disabled state [ 459.074799][T15104] bond0: (slave bond_slave_0): Releasing backup interface [ 459.094394][T15104] bond0: (slave bond_slave_1): Releasing backup interface [ 459.116993][T15104] team0: Port device team_slave_0 removed [ 459.129624][T15104] team0: Port device team_slave_1 removed [ 459.131140][T15104] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 459.131200][T15104] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 459.144190][T15104] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 459.144212][T15104] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 459.149030][T15104] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 459.158823][ T5281] 8021q: adding VLAN 0 to HW filter on device eth2 [ 459.235579][T15123] ip6gre1: entered promiscuous mode [ 459.241084][T15123] ip6gre1: entered allmulticast mode [ 459.327463][T15128] netlink: 104 bytes leftover after parsing attributes in process `syz.0.3463'. [ 459.652789][ T4935] Bluetooth: hci1: command tx timeout [ 459.792278][ T67] IPVS: stop unused estimator thread 0... [ 460.246995][T14954] bridge0: port 1(bridge_slave_0) entered blocking state [ 460.247404][T14954] bridge0: port 1(bridge_slave_0) entered disabled state [ 460.247830][T14954] bridge_slave_0: entered allmulticast mode [ 460.271650][T14954] bridge_slave_0: entered promiscuous mode [ 460.283681][T15168] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3476'. [ 460.310008][T14954] bridge0: port 2(bridge_slave_1) entered blocking state [ 460.312021][T14954] bridge0: port 2(bridge_slave_1) entered disabled state [ 460.312488][T14954] bridge_slave_1: entered allmulticast mode [ 460.342507][T14954] bridge_slave_1: entered promiscuous mode [ 460.561276][T14954] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 460.589102][T14954] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 460.887687][T14954] team0: Port device team_slave_0 added [ 460.905633][ T5281] 8021q: adding VLAN 0 to HW filter on device eth3 [ 460.922705][T14954] team0: Port device team_slave_1 added [ 461.070896][T14954] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 461.078060][T14954] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 461.113427][T14954] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 461.135293][T14954] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 461.135339][T14954] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 461.135385][T14954] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 461.259421][T15202] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3486'. [ 461.494252][T14954] hsr_slave_0: entered promiscuous mode [ 461.502064][T14954] hsr_slave_1: entered promiscuous mode [ 461.505651][T14954] debugfs: 'hsr0' already exists in 'hsr' [ 461.505703][T14954] Cannot create hsr debugfs directory [ 461.730216][ T4935] Bluetooth: hci1: command tx timeout [ 461.870585][T15228] netlink: 'syz.4.3494': attribute type 1 has an invalid length. [ 461.997657][T15228] 8021q: adding VLAN 0 to HW filter on device bond1 [ 462.062550][T15236] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3497'. [ 462.789062][T15268] netlink: 'syz.3.3507': attribute type 1 has an invalid length. [ 462.885023][T15268] 8021q: adding VLAN 0 to HW filter on device bond1 [ 462.996792][T15274] netlink: 104 bytes leftover after parsing attributes in process `syz.3.3508'. [ 463.434808][T15287] syzkaller0: entered promiscuous mode [ 463.434853][T15287] syzkaller0: entered allmulticast mode [ 463.449509][T15289] tipc: Started in network mode [ 463.451007][T15289] tipc: Node identity e26740fd81ed, cluster identity 4711 [ 463.453907][T15289] tipc: Enabled bearer , priority 0 [ 463.553613][T15297] netlink: 'syz.1.3517': attribute type 1 has an invalid length. [ 463.622093][T15297] 8021q: adding VLAN 0 to HW filter on device bond2 [ 463.647226][T15287] tipc: Resetting bearer [ 463.653785][T14954] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 463.676705][T14954] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 463.685075][T15286] tipc: Resetting bearer [ 463.716765][T15286] tipc: Disabling bearer [ 463.724910][T15305] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3518'. [ 463.752957][T14954] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 463.763139][T14954] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 463.774649][T14954] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 463.797446][T14954] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 463.805972][T14954] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 463.833413][T14954] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 463.977949][T14954] 8021q: adding VLAN 0 to HW filter on device bond0 [ 464.005135][T15316] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3521'. [ 464.124270][T14954] 8021q: adding VLAN 0 to HW filter on device team0 [ 464.144823][ T150] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.145116][ T150] bridge0: port 1(bridge_slave_0) entered forwarding state [ 464.193699][ T7317] bridge0: port 2(bridge_slave_1) entered blocking state [ 464.193867][ T7317] bridge0: port 2(bridge_slave_1) entered forwarding state [ 464.881747][T15343] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3528'. [ 464.966402][T15353] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3531'. [ 465.171664][T15354] syzkaller0: entered promiscuous mode [ 465.171713][T15354] syzkaller0: entered allmulticast mode [ 465.212192][T15351] tipc: Started in network mode [ 465.212254][T15351] tipc: Node identity 7668bec45e94, cluster identity 4711 [ 465.212773][T15351] tipc: Enabled bearer , priority 0 [ 465.308727][T15365] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3533'. [ 465.326458][T15351] tipc: Resetting bearer [ 465.364589][T15349] tipc: Resetting bearer [ 465.475331][T15349] tipc: Disabling bearer [ 466.095614][T14954] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 466.248223][T15398] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3541'. [ 466.429106][T14954] veth0_vlan: entered promiscuous mode [ 466.456312][T14954] veth1_vlan: entered promiscuous mode [ 466.626851][T14954] veth0_macvtap: entered promiscuous mode [ 466.661306][T14954] veth1_macvtap: entered promiscuous mode [ 466.750457][T14954] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 466.794610][T14954] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 466.910643][T15418] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3549'. [ 466.980047][ T67] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.020787][ T1393] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.021541][ T1393] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.021642][ T1393] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 467.251232][ T7314] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.251277][ T7314] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.378111][ T7314] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.378166][ T7314] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.480213][T15432] netlink: 136 bytes leftover after parsing attributes in process `syz.0.3551'. [ 467.490554][T15432] A link change request failed with some changes committed already. Interface gre0 may have been left with an inconsistent configuration, please check. [ 467.790881][T15443] tipc: Started in network mode [ 467.796512][T15443] tipc: Node identity 62dd0f0cdffc, cluster identity 4711 [ 467.806614][T15443] tipc: Enabled bearer , priority 0 [ 467.849162][T15443] tipc: Resetting bearer [ 467.925109][T15439] tipc: Disabling bearer [ 468.411340][T15463] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3558'. [ 468.596739][T15469] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3559'. [ 469.025899][T15484] IPv6: NLM_F_CREATE should be specified when creating new route [ 469.340208][T15492] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3565'. [ 469.577955][T15505] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3570'. [ 470.111798][T15519] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3574'. [ 470.676712][T15544] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3583'. [ 470.715477][T15547] Bluetooth: MGMT ver 1.23 [ 470.948547][T15556] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3588'. [ 471.014506][T15556] netlink: 'syz.0.3588': attribute type 8 has an invalid length. [ 471.212412][T15568] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3594'. [ 471.548627][T15584] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3600'. [ 472.039215][T15600] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3607'. [ 472.068504][T15600] netlink: 'syz.3.3607': attribute type 8 has an invalid length. [ 472.240037][T15606] ieee802154 phy0 wpan0: encryption failed: -22 [ 472.863957][T15634] tipc: Enabled bearer , priority 0 [ 472.891839][T15634] syzkaller0: entered promiscuous mode [ 472.891881][T15634] syzkaller0: entered allmulticast mode [ 472.919072][T15634] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 473.012825][T15634] tipc: Resetting bearer [ 473.037167][T15632] tipc: Resetting bearer [ 473.096579][T15632] tipc: Disabling bearer [ 474.754427][T15728] netlink: 'syz.1.3658': attribute type 2 has an invalid length. [ 474.754478][T15728] __nla_validate_parse: 2 callbacks suppressed [ 474.756134][T15728] netlink: 11575 bytes leftover after parsing attributes in process `syz.1.3658'. [ 474.756237][T15728] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3658'. [ 475.109179][T15747] IPv6: NLM_F_CREATE should be specified when creating new route [ 475.193263][T15748] batadv_slave_1: entered promiscuous mode [ 475.411284][T15744] batadv_slave_1: left promiscuous mode [ 475.443331][T15750] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3667'. [ 475.708288][T15772] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3673'. [ 475.757098][T15777] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3676'. [ 475.982006][T15787] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3678'. [ 476.657583][T15810] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3689'. [ 476.867907][T15825] tipc: Enabling of bearer rejected, failed to enable media [ 477.907244][T15854] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3705'. [ 478.245250][T15872] tipc: Enabling of bearer rejected, failed to enable media [ 478.267180][T15875] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3713'. [ 478.419101][T15878] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3712'. [ 479.365930][T15905] batman_adv: batadv0: Adding interface: veth0 [ 479.373220][T15905] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 479.401764][T15905] batman_adv: batadv0: Interface activated: veth0 [ 479.410490][T15908] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 479.418325][T15908] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 479.431938][T15908] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 479.439686][T15908] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 479.461835][T15908] batman_adv: batadv0: Interface deactivated: veth0 [ 479.469443][T15908] batman_adv: batadv0: Removing interface: veth0 [ 479.641296][T15915] syzkaller1: entered promiscuous mode [ 479.641343][T15915] syzkaller1: entered allmulticast mode [ 480.074291][T15940] __nla_validate_parse: 3 callbacks suppressed [ 480.074338][T15940] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3733'. [ 480.898509][T15960] syzkaller1: entered promiscuous mode [ 480.898559][T15960] syzkaller1: entered allmulticast mode [ 481.742344][T15999] syzkaller1: entered promiscuous mode [ 481.742400][T15999] syzkaller1: entered allmulticast mode [ 481.876970][T15997] tipc: Enabled bearer , priority 0 [ 481.888684][T16001] syzkaller0: entered promiscuous mode [ 481.896254][T16001] syzkaller0: entered allmulticast mode [ 481.903878][T16003] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 482.014973][T15997] tipc: Resetting bearer [ 482.043858][T15996] tipc: Resetting bearer [ 482.117521][T15996] tipc: Disabling bearer [ 482.685188][T16036] syzkaller1: entered promiscuous mode [ 482.685237][T16036] syzkaller1: entered allmulticast mode [ 483.380065][T16049] tipc: Enabled bearer , priority 0 [ 483.386196][T16052] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3777'. [ 483.388479][T16049] syzkaller0: entered promiscuous mode [ 483.388540][T16049] syzkaller0: entered allmulticast mode [ 483.429036][T16049] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 483.541756][T16049] tipc: Resetting bearer [ 483.553563][T16048] tipc: Resetting bearer [ 483.831417][T16048] tipc: Disabling bearer [ 484.091465][T16079] syz.0.3788: vmalloc error: size 8589938688, exceeds total pages, mode:0x400dc0(GFP_KERNEL_ACCOUNT|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 484.091828][T16079] CPU: 0 UID: 0 PID: 16079 Comm: syz.0.3788 Not tainted syzkaller #0 PREEMPT(full) [ 484.091856][T16079] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 484.091875][T16079] Call Trace: [ 484.091888][T16079] [ 484.091898][T16079] dump_stack_lvl+0xe8/0x150 [ 484.092082][T16079] warn_alloc+0x24d/0x270 [ 484.092130][T16079] ? kasan_save_track+0x4f/0x80 [ 484.092166][T16079] ? kasan_save_track+0x3e/0x80 [ 484.092192][T16079] ? __pfx_warn_alloc+0x10/0x10 [ 484.092226][T16079] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 484.092328][T16079] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.092387][T16079] __vmalloc_node_range_noprof+0x127/0x1540 [ 484.092450][T16079] ? rcu_is_watching+0x16/0xb0 [ 484.092507][T16079] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 484.092550][T16079] ? __kmalloc_cache_noprof+0x321/0x600 [ 484.092574][T16079] ? __kmalloc_cache_noprof+0x14d/0x600 [ 484.092596][T16079] ? xskq_create+0x56/0x220 [ 484.092714][T16079] xskq_create+0x148/0x220 [ 484.092746][T16079] ? xsk_init_queue+0x8a/0xe0 [ 484.092779][T16079] xsk_init_queue+0x8a/0xe0 [ 484.092811][T16079] xsk_setsockopt+0x52a/0x960 [ 484.092843][T16079] ? __pfx_xsk_setsockopt+0x10/0x10 [ 484.092873][T16079] ? __pfx_aa_sk_perm+0x10/0x10 [ 484.092986][T16079] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 484.093035][T16079] ? __pfx_xsk_setsockopt+0x10/0x10 [ 484.093067][T16079] do_sock_setsockopt+0x17c/0x1b0 [ 484.093096][T16079] __x64_sys_setsockopt+0x13d/0x1b0 [ 484.093196][T16079] do_syscall_64+0x166/0x520 [ 484.093364][T16079] ? trace_irq_disable+0x3b/0x140 [ 484.093445][T16079] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.093500][T16079] ? clear_bhb_loop+0x70/0xc0 [ 484.093583][T16079] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 484.093637][T16079] RIP: 0033:0x7f167f99e0d9 [ 484.093697][T16079] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 484.093751][T16079] RSP: 002b:00007f16808df028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 484.093814][T16079] RAX: ffffffffffffffda RBX: 00007f167fc25fa0 RCX: 00007f167f99e0d9 [ 484.093857][T16079] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000006 [ 484.093890][T16079] RBP: 00007f167fa35024 R08: 0000000000000004 R09: 0000000000000000 [ 484.093929][T16079] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 484.093970][T16079] R13: 00007f167fc26038 R14: 00007f167fc25fa0 R15: 00007ffdeeebb938 [ 484.094042][T16079] [ 484.110633][T16079] Mem-Info: [ 484.110674][T16079] active_anon:5751 inactive_anon:0 isolated_anon:0 [ 484.110674][T16079] active_file:0 inactive_file:59835 isolated_file:0 [ 484.110674][T16079] unevictable:0 dirty:185 writeback:0 [ 484.110674][T16079] slab_reclaimable:10723 slab_unreclaimable:103001 [ 484.110674][T16079] mapped:29852 shmem:520 pagetables:1241 [ 484.110674][T16079] sec_pagetables:0 bounce:0 [ 484.110674][T16079] kernel_misc_reclaimable:0 [ 484.110674][T16079] free:1296439 free_pcp:7552 free_cma:0 [ 484.110835][T16079] Node 0 active_anon:23004kB inactive_anon:0kB active_file:0kB inactive_file:239140kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:119408kB dirty:736kB writeback:0kB shmem:2080kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13484kB pagetables:4836kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 484.110999][T16079] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:128kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 484.111137][T16079] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 484.111310][T16079] lowmem_reserve[]: 0 2487 2487 2487 2487 [ 484.111439][T16079] Node 0 DMA32 free:1227624kB boost:0kB min:34140kB low:42672kB high:51204kB reserved_highatomic:0kB free_highatomic:0kB active_anon:23004kB inactive_anon:0kB active_file:0kB inactive_file:239140kB unevictable:0kB writepending:736kB zspages:0kB present:3129332kB managed:2546720kB mlocked:0kB bounce:0kB free_pcp:30208kB local_pcp:21068kB free_cma:0kB [ 484.111621][T16079] lowmem_reserve[]: 0 0 0 0 0 [ 484.111715][T16079] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:0kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 484.111874][T16079] lowmem_reserve[]: 0 0 0 0 0 [ 484.111975][T16079] Node 1 Normal free:3942772kB boost:0kB min:55760kB low:69700kB high:83640kB reserved_highatomic:0kB free_highatomic:0kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:0kB writepending:4kB zspages:0kB present:4194300kB managed:4111104kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 484.112435][T16079] lowmem_reserve[]: 0 0 0 0 0 [ 484.112554][T16079] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 484.112985][T16079] Node 0 DMA32: 125*4kB (UME) 179*8kB (UE) 46*16kB (M) 370*32kB (UME) 368*64kB (UME) 264*128kB (UME) 139*256kB (UM) 30*512kB (ME) 17*1024kB (UM) 9*2048kB (UM) 261*4096kB (UM) = 1227692kB [ 484.113457][T16079] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 484.113755][T16079] Node 1 Normal: 1*4kB (M) 10*8kB (UM) 12*16kB (UM) 9*32kB (UM) 5*64kB (UM) 6*128kB (UM) 3*256kB (UM) 4*512kB (UM) 2*1024kB (UM) 2*2048kB (U) 960*4096kB (M) = 3942772kB [ 484.114286][T16079] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 484.114334][T16079] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 484.114384][T16079] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 484.114431][T16079] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 484.114474][T16079] 60351 total pagecache pages [ 484.114519][T16079] 0 pages in swap cache [ 484.114541][T16079] Free swap = 124996kB [ 484.114562][T16079] Total swap = 124996kB [ 484.114583][T16079] 2097051 pages RAM [ 484.114609][T16079] 0 pages HighMem/MovableOnly [ 484.114623][T16079] 428755 pages reserved [ 484.114643][T16079] 0 pages cma reserved [ 484.794729][T16093] tipc: Enabling of bearer rejected, failed to enable media [ 484.807608][T16079] llcp: llcp_sock_recvmsg: Recv datagram failed state 3 -6 0 [ 485.585737][T16130] syzkaller1: entered promiscuous mode [ 485.599114][T16130] syzkaller1: entered allmulticast mode [ 485.895282][T16139] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3806'. [ 486.113832][T16152] tipc: Enabling of bearer rejected, failed to enable media [ 486.498991][T16168] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3814'. [ 486.997812][T16185] syzkaller1: entered promiscuous mode [ 486.997854][T16185] syzkaller1: entered allmulticast mode [ 487.592892][T16217] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3832'. [ 487.597824][T16211] syzkaller0: entered promiscuous mode [ 487.597884][T16211] syzkaller0: entered allmulticast mode [ 489.510831][T16223] syzkaller0: entered promiscuous mode [ 489.510887][T16223] syzkaller0: entered allmulticast mode [ 489.647195][T16236] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3839'. [ 489.820422][T16241] syzkaller1: entered promiscuous mode [ 489.820465][T16241] syzkaller1: entered allmulticast mode [ 489.976963][T16253] netlink: 'syz.3.3844': attribute type 2 has an invalid length. [ 490.219152][T16261] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 490.279129][T16265] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3850'. [ 490.335173][T16269] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3851'. [ 490.407690][T16267] block nbd0: reconnected socket [ 490.420293][ T4935] block nbd0: Receive control failed (result -32) [ 490.480604][T16274] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3854'. [ 490.565655][T16276] syzkaller0: entered promiscuous mode [ 490.565710][T16276] syzkaller0: entered allmulticast mode [ 491.014086][T16297] syzkaller0: entered promiscuous mode [ 491.014137][T16297] syzkaller0: entered allmulticast mode [ 491.031798][T16302] IPv6: NLM_F_CREATE should be specified when creating new route [ 491.031915][T16302] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3865'. [ 491.210739][T16307] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3867'. [ 491.466814][T16314] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3869'. [ 491.564676][T16321] syzkaller0: entered promiscuous mode [ 491.564725][T16321] syzkaller0: entered allmulticast mode [ 491.803910][T16336] IPv6: NLM_F_CREATE should be specified when creating new route [ 491.804180][T16336] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3878'. [ 491.866121][T16338] syzkaller0: entered promiscuous mode [ 491.872578][T16338] syzkaller0: entered allmulticast mode [ 492.482655][T16363] syzkaller0: entered promiscuous mode [ 492.488470][T16363] syzkaller0: entered allmulticast mode [ 492.582586][T16367] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3890'. [ 492.694916][T16372] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3892'. [ 492.904225][T16383] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3897'. [ 492.965206][T16389] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3899'. [ 493.327924][T16399] bridge0: port 2(bridge_slave_1) entered disabled state [ 493.331379][T16399] bridge0: port 1(bridge_slave_0) entered disabled state [ 493.376011][T16408] [ 493.378397][T16408] ====================================================== [ 493.385432][T16408] WARNING: possible circular locking dependency detected [ 493.392464][T16408] syzkaller #0 Not tainted [ 493.396882][T16408] ------------------------------------------------------ [ 493.403908][T16408] syz.1.3901/16408 is trying to acquire lock: [ 493.410079][T16408] ffff88801c2f7a10 (&root->kernfs_iattr_rwsem){++++}-{4:4}, at: kernfs_iop_permission+0x7f/0x430 [ 493.420676][T16408] [ 493.420676][T16408] but task is already holding lock: [ 493.428060][T16408] ffffffff8ebe98f0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x539/0x900 [ 493.438237][T16408] [ 493.438237][T16408] which lock already depends on the new lock. [ 493.438237][T16408] [ 493.448666][T16408] [ 493.448666][T16408] the existing dependency chain (in reverse order) is: [ 493.457703][T16408] [ 493.457703][T16408] -> #7 (cpu_hotplug_lock){++++}-{0:0}: [ 493.465480][T16408] cpus_read_lock+0x42/0x160 [ 493.470673][T16408] static_key_slow_inc+0x12/0x30 [ 493.476198][T16408] nbd_genl_reconnect_sock_cb+0x69a/0xbb0 [ 493.482568][T16408] nbd_genl_foreach_sock+0x265/0x450 [ 493.488467][T16408] nbd_genl_reconfigure+0xbbb/0x1040 [ 493.494307][T16408] genl_family_rcv_msg_doit+0x233/0x340 [ 493.500513][T16408] genl_rcv_msg+0x614/0x7a0 [ 493.505565][T16408] netlink_rcv_skb+0x226/0x4a0 [ 493.510879][T16408] genl_rcv+0x28/0x40 [ 493.515419][T16408] netlink_unicast+0x7bd/0x940 [ 493.520731][T16408] netlink_sendmsg+0x813/0xb40 [ 493.526044][T16408] sock_sendmsg_nosec+0x13a/0x180 [ 493.531632][T16408] ____sys_sendmsg+0x54e/0x850 [ 493.536950][T16408] ___sys_sendmsg+0x2a5/0x360 [ 493.542185][T16408] __x64_sys_sendmsg+0x1b1/0x290 [ 493.547691][T16408] do_syscall_64+0x166/0x520 [ 493.552834][T16408] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.559312][T16408] [ 493.559312][T16408] -> #6 (&nsock->tx_lock){+.+.}-{4:4}: [ 493.566986][T16408] __mutex_lock+0x19d/0x1550 [ 493.572234][T16408] nbd_queue_rq+0x373/0xff0 [ 493.577311][T16408] blk_mq_dispatch_rq_list+0x499/0x1990 [ 493.583505][T16408] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 493.590447][T16408] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 493.596987][T16408] blk_mq_run_work_fn+0x16c/0x300 [ 493.602611][T16408] process_scheduled_works+0xc3d/0x1630 [ 493.608706][T16408] worker_thread+0xa47/0xfb0 [ 493.613855][T16408] kthread+0x38b/0x480 [ 493.618504][T16408] ret_from_fork+0x514/0xb70 [ 493.623676][T16408] ret_from_fork_asm+0x1a/0x30 [ 493.628979][T16408] [ 493.628979][T16408] -> #5 (&cmd->lock){+.+.}-{4:4}: [ 493.636217][T16408] __mutex_lock+0x19d/0x1550 [ 493.641364][T16408] nbd_queue_rq+0xc1/0xff0 [ 493.646333][T16408] blk_mq_dispatch_rq_list+0x499/0x1990 [ 493.652429][T16408] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 493.659306][T16408] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 493.665830][T16408] blk_mq_run_work_fn+0x16c/0x300 [ 493.671410][T16408] process_scheduled_works+0xc3d/0x1630 [ 493.677501][T16408] worker_thread+0xa47/0xfb0 [ 493.682675][T16408] kthread+0x38b/0x480 [ 493.687296][T16408] ret_from_fork+0x514/0xb70 [ 493.692441][T16408] ret_from_fork_asm+0x1a/0x30 [ 493.697741][T16408] [ 493.697741][T16408] -> #4 (set->srcu){.+.+}-{0:0}: [ 493.704907][T16408] __synchronize_srcu+0xc9/0x2f0 [ 493.710477][T16408] elevator_switch+0x1e8/0x7b0 [ 493.715888][T16408] elevator_change+0x2fa/0x480 [ 493.721212][T16408] elevator_set_default+0x375/0x440 [ 493.726966][T16408] blk_register_queue+0x3f3/0x4e0 [ 493.732636][T16408] __add_disk+0x6cb/0xe30 [ 493.737556][T16408] add_disk_fwnode+0x100/0x3a0 [ 493.742880][T16408] nbd_dev_add+0x733/0xb60 [ 493.747977][T16408] nbd_init+0x168/0x1f0 [ 493.752743][T16408] do_one_initcall+0x250/0x870 [ 493.758086][T16408] do_initcall_level+0x10a/0x1a0 [ 493.763645][T16408] do_initcalls+0x59/0xa0 [ 493.768523][T16408] kernel_init_freeable+0x29d/0x3e0 [ 493.774273][T16408] kernel_init+0x22/0x1d0 [ 493.779157][T16408] ret_from_fork+0x514/0xb70 [ 493.784296][T16408] ret_from_fork_asm+0x1a/0x30 [ 493.789605][T16408] [ 493.789605][T16408] -> #3 (&q->elevator_lock){+.+.}-{4:4}: [ 493.797453][T16408] __mutex_lock+0x19d/0x1550 [ 493.802600][T16408] elevator_change+0x1af/0x480 [ 493.808022][T16408] elevator_set_none+0xb5/0x140 [ 493.813443][T16408] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 493.819805][T16408] nbd_start_device+0x189/0xb30 [ 493.825218][T16408] nbd_genl_connect+0x167d/0x1cd0 [ 493.830808][T16408] genl_family_rcv_msg_doit+0x233/0x340 [ 493.836938][T16408] genl_rcv_msg+0x614/0x7a0 [ 493.841999][T16408] netlink_rcv_skb+0x226/0x4a0 [ 493.847308][T16408] genl_rcv+0x28/0x40 [ 493.851851][T16408] netlink_unicast+0x7bd/0x940 [ 493.857159][T16408] netlink_sendmsg+0x813/0xb40 [ 493.862473][T16408] sock_sendmsg_nosec+0x13a/0x180 [ 493.868056][T16408] ____sys_sendmsg+0x54e/0x850 [ 493.873369][T16408] ___sys_sendmsg+0x2a5/0x360 [ 493.878590][T16408] __x64_sys_sendmsg+0x1b1/0x290 [ 493.884078][T16408] do_syscall_64+0x166/0x520 [ 493.889246][T16408] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 493.895688][T16408] [ 493.895688][T16408] -> #2 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 493.904327][T16408] blk_alloc_queue+0x544/0x690 [ 493.909651][T16408] __blk_mq_alloc_disk+0x194/0x390 [ 493.915330][T16408] nbd_dev_add+0x494/0xb60 [ 493.920305][T16408] nbd_init+0x168/0x1f0 [ 493.925016][T16408] do_one_initcall+0x250/0x870 [ 493.930336][T16408] do_initcall_level+0x10a/0x1a0 [ 493.935844][T16408] do_initcalls+0x59/0xa0 [ 493.940726][T16408] kernel_init_freeable+0x29d/0x3e0 [ 493.946649][T16408] kernel_init+0x22/0x1d0 [ 493.951525][T16408] ret_from_fork+0x514/0xb70 [ 493.956653][T16408] ret_from_fork_asm+0x1a/0x30 [ 493.961960][T16408] [ 493.961960][T16408] -> #1 (fs_reclaim){+.+.}-{0:0}: [ 493.969223][T16408] fs_reclaim_acquire+0x71/0x100 [ 493.974717][T16408] kmem_cache_alloc_noprof+0x5f/0x600 [ 493.980648][T16408] __kernfs_iattrs+0xdd/0x380 [ 493.985882][T16408] kernfs_iop_setattr+0xe6/0x3f0 [ 493.991380][T16408] notify_change+0xbba/0xea0 [ 493.996554][T16408] do_truncate+0x1c2/0x250 [ 494.001542][T16408] path_openat+0x15b5/0x1d60 [ 494.006691][T16408] do_file_open+0x23e/0x4a0 [ 494.011737][T16408] do_sys_openat2+0x115/0x200 [ 494.016959][T16408] __x64_sys_openat+0x138/0x170 [ 494.022379][T16408] do_syscall_64+0x166/0x520 [ 494.027524][T16408] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.033972][T16408] [ 494.033972][T16408] -> #0 (&root->kernfs_iattr_rwsem){++++}-{4:4}: [ 494.042514][T16408] __lock_acquire+0x15ff/0x2e50 [ 494.047941][T16408] lock_acquire+0x115/0x350 [ 494.053027][T16408] down_read+0x4a/0x330 [ 494.057725][T16408] kernfs_iop_permission+0x7f/0x430 [ 494.063476][T16408] inode_permission+0x3de/0x5f0 [ 494.068875][T16408] cgroup_attach_permissions+0x28e/0x9f0 [ 494.075056][T16408] __cgroup_procs_write+0x24b/0x320 [ 494.080811][T16408] cgroup_threads_write+0x24/0x50 [ 494.086404][T16408] cgroup_file_write+0x331/0x8f0 [ 494.091892][T16408] kernfs_fop_write_iter+0x3a4/0x540 [ 494.097730][T16408] vfs_write+0x612/0xba0 [ 494.102522][T16408] ksys_write+0x150/0x270 [ 494.107409][T16408] do_syscall_64+0x166/0x520 [ 494.112562][T16408] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.119002][T16408] [ 494.119002][T16408] other info that might help us debug this: [ 494.119002][T16408] [ 494.129249][T16408] Chain exists of: [ 494.129249][T16408] &root->kernfs_iattr_rwsem --> &nsock->tx_lock --> cpu_hotplug_lock [ 494.129249][T16408] [ 494.143277][T16408] Possible unsafe locking scenario: [ 494.143277][T16408] [ 494.150743][T16408] CPU0 CPU1 [ 494.156127][T16408] ---- ---- [ 494.161510][T16408] rlock(cpu_hotplug_lock); [ 494.166127][T16408] lock(&nsock->tx_lock); [ 494.173088][T16408] lock(cpu_hotplug_lock); [ 494.180149][T16408] rlock(&root->kernfs_iattr_rwsem); [ 494.185556][T16408] [ 494.185556][T16408] *** DEADLOCK *** [ 494.185556][T16408] [ 494.193719][T16408] locks held by syz.1.3901/16408: 5, last CPU#0: [ 494.200076][T16408] #0: ffff88807b6d97b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 [ 494.209170][T16408] #1: ffff88807af1a460 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 [ 494.218094][T16408] #2: ffff8880328c4c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 [ 494.227881][T16408] #3: ffffffff8ed9c8e0 (cgroup_mutex){+.+.}-{4:4}, at: cgroup_kn_lock_live+0x13c/0x230 [ 494.237692][T16408] #4: ffffffff8ebe98f0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x539/0x900 [ 494.248258][T16408] [ 494.248258][T16408] stack backtrace: [ 494.254176][T16408] CPU: 0 UID: 0 PID: 16408 Comm: syz.1.3901 Not tainted syzkaller #0 PREEMPT(full) [ 494.263575][T16408] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 494.273647][T16408] Call Trace: [ 494.276951][T16408] [ 494.279909][T16408] dump_stack_lvl+0xe8/0x150 [ 494.284545][T16408] print_circular_bug+0x2e2/0x300 [ 494.289596][T16408] check_noncircular+0x12f/0x150 [ 494.294561][T16408] __lock_acquire+0x15ff/0x2e50 [ 494.299445][T16408] ? __bfs+0x153/0x290 [ 494.303540][T16408] ? __pfx_hlock_conflict+0x10/0x10 [ 494.308773][T16408] lock_acquire+0x115/0x350 [ 494.313323][T16408] ? kernfs_iop_permission+0x7f/0x430 [ 494.318748][T16408] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 494.324603][T16408] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 494.330467][T16408] down_read+0x4a/0x330 [ 494.334657][T16408] ? kernfs_iop_permission+0x7f/0x430 [ 494.340085][T16408] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 494.345932][T16408] kernfs_iop_permission+0x7f/0x430 [ 494.351185][T16408] ? __pfx_kernfs_iop_permission+0x10/0x10 [ 494.357019][T16408] inode_permission+0x3de/0x5f0 [ 494.361912][T16408] cgroup_attach_permissions+0x28e/0x9f0 [ 494.367574][T16408] __cgroup_procs_write+0x24b/0x320 [ 494.372801][T16408] cgroup_threads_write+0x24/0x50 [ 494.377854][T16408] ? __pfx_cgroup_threads_write+0x10/0x10 [ 494.383642][T16408] cgroup_file_write+0x331/0x8f0 [ 494.388618][T16408] ? __pfx_cgroup_file_write+0x10/0x10 [ 494.394112][T16408] ? __kmalloc_noprof+0x38c/0x720 [ 494.399175][T16408] ? __pfx_cgroup_file_write+0x10/0x10 [ 494.404651][T16408] kernfs_fop_write_iter+0x3a4/0x540 [ 494.409961][T16408] vfs_write+0x612/0xba0 [ 494.414238][T16408] ? __pfx_vfs_write+0x10/0x10 [ 494.419035][T16408] ? __fget_files+0x2a/0x420 [ 494.423659][T16408] ksys_write+0x150/0x270 [ 494.428035][T16408] ? __pfx_ksys_write+0x10/0x10 [ 494.432936][T16408] do_syscall_64+0x166/0x520 [ 494.437557][T16408] ? trace_irq_disable+0x3b/0x140 [ 494.442598][T16408] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.448699][T16408] ? clear_bhb_loop+0x70/0xc0 [ 494.453397][T16408] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 494.459308][T16408] RIP: 0033:0x7f991939e0d9 [ 494.463753][T16408] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 494.483378][T16408] RSP: 002b:00007f991a1ea028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 494.491839][T16408] RAX: ffffffffffffffda RBX: 00007f9919626090 RCX: 00007f991939e0d9 [ 494.499832][T16408] RDX: 0000000000000012 RSI: 0000200000000c40 RDI: 0000000000000008 [ 494.507830][T16408] RBP: 00007f9919435024 R08: 0000000000000000 R09: 0000000000000000 [ 494.515813][T16408] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 494.523812][T16408] R13: 00007f9919626128 R14: 00007f9919626090 R15: 00007fff0a4ebff8 [ 494.531835][T16408] [ 494.602529][T16399] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 494.615263][T16399] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 494.811118][T16423] syzkaller0: entered promiscuous mode [ 494.811165][T16423] syzkaller0: entered allmulticast mode [ 494.822810][ T150] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.822853][ T150] netdevsim netdevsim1 netdevsim3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 494.822890][ T150] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.822917][ T150] netdevsim netdevsim1 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 494.822983][ T150] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.823009][ T150] netdevsim netdevsim1 netdevsim1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 494.823043][ T150] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 494.823071][ T150] netdevsim netdevsim1 netdevsim2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 494.848503][T16409] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3905'. [ 496.258127][T16403] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 501.500133][ T1310] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.506592][ T1310] ieee802154 phy1 wpan1: encryption failed: -22