last executing test programs: 5.986843106s ago: executing program 4 (id=3537): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000005400e501000000000000000007000000", @ANYRES32=r2, @ANYBLOB="20000100", @ANYRES32=r0, @ANYBLOB="0100bb08000000000000000000000000f4ffffff008ef2005752a41d22a019dc60a3c49bd5fbe6de10f32c59fee0ad67eb5362029969dd7593b7d2f6f45baad236f20b7fb32a"], 0x38}, 0x1, 0x0, 0x0, 0xa801}, 0x10) 4.996522731s ago: executing program 4 (id=3541): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000000)=0x2, 0x4) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000200)={'wg2\x00'}) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r1 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="39000000140081ae10003c000500018311001f9f660fcf066505acb612f691f3bd3508abca1be6eeb89c44ebb3f66d6361dbb7d553b4e92155", 0x39}], 0x1}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000140)={'virt_wifi0\x00', 0x0}) sendto$packet(r3, &(0x7f0000000080)="9d96914067bf7a3be5510f29b4105063", 0x10, 0x20004081, &(0x7f00000000c0)={0x11, 0x5, r4, 0x1, 0x8, 0x6, @local}, 0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="440000001000030425bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="00050000000000001c0012800e00010069703665727370616e000000680002800400120008000a00", @ANYRES32=0x0, @ANYBLOB="e312226a84badbb85eb3309f6623fb5c723ab6783a8d31c272e3c4c3acfc10a5f9cbe62f25ae09aeea788edb015483c8de2252361def8854a8b44ceb1998d3d3916e75e179a97a8045eefe817f00a0560c8b41148b1b0f7543b582a2b06a75e913d55190a9281df432a7e3ddb2f1ecef648eb883a210194e4cc075e048ed7b8596c19cc9b03225f3b0d09d426176e2a39ae50df56f15b6fb81eb8cfab8fd01f23dfddac12ff36f1b88dd01cab4c0ab3b4e1f9452ddb63fec0c6dbdb6c1b7d720fff0512fda"], 0x44}, 0x1, 0x0, 0x0, 0x20000804}, 0x8000) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, r4, {}, {0x0, 0xc}, {0x0, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0xc015}, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000240)="06000000914fc94c0c79aaf5598e4fbcafb2126be3608491297e00c7b4023418", 0x20) ioctl$sock_inet_SIOCSIFPFLAGS(r5, 0x8934, &(0x7f0000000000)={'vlan0\x00', 0x1}) ioctl$EXT4_IOC_SWAP_BOOT(r5, 0x6611) 4.376468259s ago: executing program 4 (id=3546): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x18, 0xe, &(0x7f0000001880)=ANY=[@ANYRES32], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0xa}, 0x10}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=@ipv4_newrule={0x2c, 0x20, 0x1, 0x0, 0x0, {}, [@FRA_GENERIC_POLICY=@FRA_L3MDEV={0x5, 0x13, 0x1}, @FRA_GENERIC_POLICY=@FRA_TABLE={0x8, 0xf, 0x94}]}, 0x2c}}, 0x0) 4.064202852s ago: executing program 4 (id=3551): r0 = socket(0x10, 0x80002, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, 0x0) (async) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000540)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000e80)={0x5c, r2, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x48, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x44, 0x4, {'gcm(aes)\x00', 0x1c, "2298884fa9c0fc2acf3cc634fcd1440a176f7ff7d22ed100255a3483"}}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000010) (async) r3 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="840000000a0601010000000000000000010000000900020073797a310000000005000100070000000800094000000008540008"], 0x84}}, 0x0) (async) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x3c1, 0x3, 0x368, 0x118, 0x18c, 0x203, 0x118, 0x19030000, 0x298, 0x2e0, 0x2e0, 0x298, 0x2e0, 0x7fffffe, 0x0, {[{{@uncond, 0x300, 0xf0, 0x118, 0x0, {0x1000000}, [@common=@unspec=@limit={{0x48}, {0x7a, 0x7f, 0x40, 0x8, 0xe6, 0x75800a43, 0xfffffffffffffff9}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x2, 0x10, 0x2}}}, {{@uncond, 0x0, 0x138, 0x180, 0x0, {}, [@common=@srh1={{0x90}, {0x0, 0x8, 0x5, 0x9, 0x81, @private0, @mcast2, @loopback, [0x0, 0x0, 0xffffffff, 0xff000000], [0xffffff00, 0xff000000, 0xff000000, 0xff], [0xffffff00, 0x0, 0xffffff00], 0x46}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz0\x00', {0x6cb}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3c8) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=@newlink={0x48, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @dev}]}}}]}, 0x48}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140011"], 0x48}}, 0x0) 3.551326034s ago: executing program 4 (id=3554): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000100)={0x80000000, 0x0, 0xfffffffc}, 0x10) socket$igmp6(0xa, 0x3, 0x2) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) shutdown(0xffffffffffffffff, 0x1) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, 0x0) r1 = socket(0x8, 0x3, 0x3) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x24000144}, 0x400c800) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904001f000000fe0000000000000008000f00fd000000", 0x24) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000791048000000000071041d000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) 3.284177602s ago: executing program 2 (id=3555): ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000640)={0x0, 0x0, "91369108deb8893bcafe9d08cd796cc82a26a1186fb7ac3f7a32379681e4cf8425c0fb571fcf6173a003e9b62ed0f5ae7da935ac3317019274c8f729dacbdc731549fcaa39366cf6a0e453a1cf9269040a4e80548c18eddcfd76b5a98a2ac56bb066a843d62c3c2c94efe5e1f89537e5b3f9dbf1af90b264a2dc6ade67bebf673df723b6c2e632941004150f4759cbac2bf6159cb0471c9c4a06219a05cc4e483e6338dfe62a7bb060612e07a5f37868187d857e47cef01debaa873531b06cd25c2e05872e7f09137890815af1b5836ba17c32f194a4ac5c7dba23b0d3a7ece770c11f8f5265b0e0010682dd54e6c1c7905a8a5e59e3619d3daeb8483fdb131f", "f6c20f40e7b2eb405d335fad442a1404c49a4bee225a5d7622a4d3cfa80c0b90f9af97d3b70238d0c706c75b0b32b5bc6fda9f8cd215efae41f5560dcd1f590596d480432e78713ba3248897fddbe1c0e4756330c988446782232cbe861539a1a5e8cddb7c6b42d4130afeb1b7ad7770bd4f3a8cb401c0e2f3c7b5dd9fdd85c01b53f48216d0d126c210be04b3f1defdc1605f051cc1430daa023ef6207df48baa1e2173a382f576e7959de4dbbdf0d890f5a41b9c096154e755d10b15f1f873495e8423f92752df4849670bfc39506d4779d9460879ce5cbc51e982c1da109b3ffcfa712f376b696a45f548d6e22238b4618afcd949c8119da9519563581856f8341ccc5277a26a25abc24a0accec7b4e14019bc87a277e613960f9bd7ee1acc6c83beaf39613bdce918cc199370301b4266e8238bca2e44aae9c51d01acee38209bc74c66681596227f4d9f592a835efa0738770dd52e3d4ea9f2a29346de99f9dff9efbc8264c34fb8ff5e8acb652115c950d56aea2d956f7d983d678a9cf908cb1ae2db8eb7711c3bc635b491332f4325586f7dec8fa008eed321afded8937f8cc55a50014e5dd3d6b42006efd4818c30cfd7019389e01125b0895426534aebd31d0b08bef434d7c8cb6bf0fccea23da10e9c5d69130470709cf49f35d06302eac6e570c8edea4161d96aeb8f0ad4b871896bb3659056e37943d87391a021edfdd3a5d3b78cfb79022b9aee0de979ec72539b8fdfed79bd51894a638d273a9cd1e141358fb817016bdcb9a39b0d2416b759867adb9c391757e73325b56935319d74f833f3e8039307063e22aa42d3d666b59b2751fca993d3b1380d7d79ff7fee05b3a5c1db0163398e3543d393184eb8b22f9583e48f007cb3801f33daf02a82f4d108f7f69df1d52e4b68c3419aa2f1983c41c672c6d68d18a83b44ea906747683ff681a6b1e8925eb0dfbbed2ff9a2996dee968960809fbf2583a10a231e69e8868b3ee4ba800c313b60db32284e94ae6d2716ee20a025a2c9445cfe83d185c27b996fc5441060bbdc028f01f668f33c82f9a1a39e0e20c3e13a3449acb6dfabc19b1ac409b0b1b6ffa7711abf7c2fa7944bf905f25889c38aba65427f523eb1f600add462003e014cef6a619ec8313268de2b5b8d359997fa6abd5f0ce3bdca4cfd216240986be545654930bf4dd16b0994c50db298ac6d3bcfa819d625933bdd054df44755b8745e06d5325b4f999a9d661db7fea772c556136ea00f9bfd57eb80c160dda7cc9656f04f4f1d5702b680ab374c9187c6f23ff846fb72266a4dfea4676c9546141c71c2cea3e4a7afce761524cef56beb34e207ae55d6fff39245e04369c9297ffe39f0e8d22ffc7f4f5370b8c454382839a8b5fdc43af3597779ebee87fa6c766b575a778c41b939f54068191fde22f3825baadb1271833e5d9c9437ff7764c250dad10ec5d5dd76a6bd55150ae52f714b0b260acc0682993ab043303dddcb13e5b4777917701060cb0f5f23b244d2ad22a072cfcd64898f16a321cc059cef1ef473796582178e7d298db28d8855b9dc3458d7157b1ebd21874eb111c076c4b4474b39a9120658793ebbbcf2b7a1a8ef02e7db2e0fdf2d20dac01d1e34b96a743c78f12082b6b6f583c2b72d0a78358f0fbc0c697480bacc0aea74833adfa88df514ea4b2ad1d8ebf56550a100f078f74c29ff4cbe23c2ad637437f036322eea1088c59ac6948fa21327c9d4d27a35ecf00d7dcbe8fca2e140484b6756b6395663926c0798673c8b95c9406ea55e87751ea6ac4507e3991179ebc20edb086071a46217880b1c241cac3c231da8701723e7d48bdb31d43fc60d31ec49df9ae160acabd668330aab210661c73160ee037ddd3a11760ce8f5e2dc547f2467d2b59e79252f84c63667b6120054c56a13cda2f03ea7c31238e72a3eb4a88697490760dbebc9f1c4f74e64b5c347b7041900884ef1b07c2874350a7f4f698164c7efaa2bf2424cccd8006f99b8fb689b6a53026e9726402d7674814270f4296da2e41ac475053d28c26225d59fbf8245d38c05b9c4ccf411407504c90aa344e866b8fd4542ff2197fdbd5d3ac991fffedda4f44033e7659a6291d79da3f93aa27a46dc33f05cccd94fff5971fb7f8808de8d2b965be96779bec17a8a4a20acf3eb6293f6e1654029af9357878f10910436e3a563bc006d6efb0fb6628c8f9ce6d1f0055dd8cd5e0b2e538f297deab09e07b32b1952a9aa93265412aaf2405f3bcd546ec537a19db7b622eb23347d9f028ac637ea240032064974c542a648444cced61e8dc13d6d98ffbf9de793d9a36bc6ba427c01e696084790791509037594cf2cf64cb67ac7fc48d4f019ce631bc64765125aaec21fb146572712cb74f1058a795775e7fcb867abf3ae1ef50e8c7f277f1863ab8a705bd5e3e97496a170090a97c350f37deefa79c9a3c075fd6ae68145cbd520610ef0c52e982d57e7c6a96951d17d31547a2c515815aa44d0f3a2e80956884069d15d941bfa43e67eba67a15c72407097144952aac6dfdaeb21ad7ce2becde62e1373ec5d06cbcf8f46c32321042e2946d701eead22de3c6152072cbee012dba4a64abe1fa3c764d53176c76e26bd856a3201dfb1e9ebeb50f5adb3427315717cb98140c79cd6f5434897630c7aa9f1ac1b4e2a6610f175c3f0c453f2cdf309ac7f41d8c5cccfd3eda93e4d3756fe426a1990a37896daec3a6453983d0a205e2c77b0e22ba15498f2dafe8bd5ee477a238856190c79376790df04c33d79862dab1ef14ed63252b77ba5c586885b043dad4f679a3aa9bcbc4db5990992d6c5117f96533f7438e329f75222d63b71be276d2dd70134b84118c08320fc6bb078a38181f0a0d29a96ae7e4ea696f2cdcb9d7d82a3bfb9e18a0378c48df3b716370d74b854be6763c1831fc398667a27f1bd17c611214997d05dbf7e1468276138158ee13993c63ad6c76713dc5df8f2e06f988de64a17819f46fcde0ff3f2f472a6ecd3f0d34a3c340c8854e1105749547ac1a66914a85f2be786478f8b186026aa6f0b065de0c89d8112bad2b46950a6b067b7ad9557ef3aaa847bb0e16840b997ecfd4fe4c613992b3b6631b8070231c1fbd42dd3dd5ee5d2280555b4b3c00247bc39d1cade5f2f8fbbddadeae1bb4ac39b340ea0dccdc62c6ad76c8fd8f45cfac3a596f8035fb2b031e274c60fef8d3fe96bdf382f9e075645cd9997e8861070471e743e284783c609d60daa43e198755be93de44ef19fa52aed6615af5679461dc96887a93e783b8381df15c70809a4fc7f222e6227d9ceee0654ee225f5862bc089b3fb966ffb82468e7664994929c9fab3281a9708fa7cb19fbd5a481334a30f611f2345b781e01548f5c66337519bb36369b9a2a171f3e35d1c3cf153f829e3582c62b642eab2e497aa08f46897d7160f9b370cef50ed329d791a47c2c4b66a265bd492f541fdbfb431f1825c613c9fedcf1dea1fefa10d929842b1c83be8b7d14f570a444291abf68623f5db1be630a6437dbdfc4e3807031a0a8e4c4e732dd1cc47dac91a3d5992493e6c746b71454491f9eee3bed24857ab1d0203da9a79a5e0ae984270a2134496f86200044089d3770a76fbf14a51ea93b13da1f43844d38142691a90b4af073fe60b39416958563933165eac5e11c9b61ec8c29794b4faea6575551c11110ec906fe086b5909309cff80a8fb04b55554326b238142e804c152c401efdf661a0ee93601eb0dcd4a5dbe3ce6ef0d28f483662ad40e9d21fe49dff6bad26e2c69c5bebc0c24748bf66cc5dfbc1de2942b19201c75c186ebaf4bfee57965c12bf77c08484ebc4d94cfc7d4ed87640fdebef36138adcb2f7bac2173e02ae875ef1f970cd8f875554e491bd549c9bda70aa4a80c2660820c9795844f07950e79e5334aaf15f952c9ee07264a3a847162f968a9ce4a05f33b454491f2338196753664d71c411f2398dd57e2b69cf564f0f86f90d2f9877bc7dda5805cfc6ef7af252f98af65e9daa8782fe14d1ecce03e2b7704cf2cdae57bc3c8d66e2e4261ca865d29b4179bc02e52a87ce346eab979ebab8c5267060cdd404c132178bc0898648ffa934cf37840d6c749b06bbe539eb5c8750451cb63c8a356c5f0a5bf9e272a1a51f4e7c523d59044e56c5d92a9b3d37b4ceab44238e4fe3ff10334db3f64700b90b36a463fbc3a13cae306dff51660e851c51c7df2cbaeb4f20d8b6e677a57d38457988a497e93e566c414521dccd30c5b895fd12258ae7aabd217347ba23eb5ad9c75bd38981c32cd903f578340175e4d9271daafbdef4adbb83f7c8230172b592b2aac42932815627b122222a408cea788e57c08da6a2cafedfadf8710e77e9286ae156dab6d20233e594ba6feb23f3a26fbb45d08794576bb16390a3ad174b67144974b2bc054c1c552ed14aa21317a2bb8f1363ad333561525b68dcdbd82a4ef526b4695b0b856891d69065a82f8413834412bbd135709b2cbfc7202a5f5af803d9234bb1edd8adb4f521eaff0e13919b67f5ad8cf7baa5ac17aa4bbc19c814bf21f9c41159a3e71ab30dff4b9c53efcd7ec8827c0fb658ee4f6bf5c316fd287c7088ac0160c722ff37a7b906fdb3aaf2ca6286b7ddcc45d7ee7c04a3598cb17958446ad4f1b408a8f351610ce58d6c912364423486731b20aa419ae37946796e02e27448cb71ec940a48b60ee0b8c92d8f6dcbe3f498943a6fa9812c39fdb7f815ad256238601f8b6b88691b48f8ab9e631210440f1702ad368c48b32fcee50204e7e4b0f9f90b13f879c03a27a42007737d2916f5247f546e8634b0ef94ebb4bdb891392b6e9f20a8aa7853c4d559d77cd33233b311552f814182c891ba7a7210ee9a4ecf4a4287fab3a9e7aaac4db5a230ef883f54cb91db01ca40d1a9550b577adac814c5ef0457bf38f664eeee951fffddc8d29bcb72eb4c94383b4588bef502c5eef09acd14d38947424a67423532ad02e16dbfd18ef91a2a6abc0cf2275507cb8af624922ef289b93c682827f5ace6944ec401e7566ce99871c5e0b401051f27e37134b389200bb7a9689598313d2f9d6f97fc4a937a71ee3347362251d22756fa3a60e9e95c4c76b1f1e283b51a3b380d1cf59192c325ac546612c00771fc93d370d82af8257a8dcea7f8e602ad00b6e96eb58cf2dc1b7b32efca56dacb9cbfaa6d1cd5918698d6b1ab581343853b6f34041a3e4d2919a8e03cfd303b2e478a0435e6f6f9d9e13cb6bc342a25c7f1662ea63afba6289e60c13301b0972a54ece4d45ba9ea6325b3ed688464e41ebb281dfd76184a7d248b0110b3d40559795ae95e4b3d920340e4c3cc5ec8ccc1b0d40b6f9bc77cdc03b3a6ad426b1b588e5ee0ba1b7"}) (async, rerun: 64) ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, 0x0) (async, rerun: 64) socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) syz_emit_ethernet(0x5e, &(0x7f00000003c0)={@multicast, @empty, @void, {@ipv6={0x86dd, @generic={0x8, 0x6, "e4177f", 0x28, 0x89, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, {[], "bd4fb9e9cbae6d1c21edd9ff38ebd97386806c27d875482109e2185d6f15c9ee51b342066e552bce"}}}}}, 0x0) (async, rerun: 64) r0 = socket(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f0000000000), 0x400000000000235, 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async, rerun: 32) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) (async) r1 = socket$netlink(0x10, 0x3, 0x4) sendmsg$GTP_CMD_DELPDP(r1, 0x0, 0xc000) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4050000d62b00006110600000000000c6000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x14, 0x4, 0x4, 0x12, 0x110}, 0x48) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)={@map=r3, r2, 0x5}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$xdp(0x2c, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) (async) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/62, 0x328000, 0x800, 0x9, 0x3}, 0x20) (async) setsockopt$XDP_UMEM_COMPLETION_RING(r5, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) (async) setsockopt$XDP_RX_RING(r5, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) (async, rerun: 32) setsockopt$XDP_UMEM_FILL_RING(r5, 0x11b, 0x5, &(0x7f0000000300)=0x2, 0x4) (async, rerun: 32) r7 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r7, &(0x7f0000002a40)={0x0, 0x0, &(0x7f0000002a00)={&(0x7f00000029c0)=ANY=[@ANYBLOB="1c23d0e28cb2e8b4b7b21d8878e94c662a0000"], 0x1c}}, 0x0) bind$xdp(r5, &(0x7f0000000100)={0x2c, 0x0, r6}, 0x10) (async) mmap$xdp(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x100000b, 0x11, r5, 0x180000000) (async, rerun: 32) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000029c0)={0x6, 0xe, &(0x7f0000000100)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12637fab}, {{0x18, 0x1, 0x1, 0x0, r3}}, {}, [@jmp={0x5, 0x1, 0x6, 0x7, 0x5, 0x0, 0x4}, @call={0x85, 0x0, 0x0, 0xb0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, 0x0, 0x63, 0x54, &(0x7f0000002840)=""/84, 0x41000, 0x1, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000002900)={0x0, 0xd, 0x800008, 0x2}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000002940)=[0xffffffffffffffff, r3, 0xffffffffffffffff], 0x0, 0x10, 0x8}, 0x94) (rerun: 32) socket$inet6_tcp(0xa, 0x1, 0x0) 3.040791422s ago: executing program 2 (id=3559): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f00000000c0)={@remote}, 0x14) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth1_virt_wifi\x00', 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="30000000b3f11d0cbd3c5f3da6d2a5b19a6da0e9ef96cfcbd4069591b8eeaffe114e0318f1", @ANYRES16=r7, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r8, @ANYBLOB="08000500060000000c001780040007"], 0x30}}, 0x0) r9 = socket$xdp(0x2c, 0x3, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r5, &(0x7f00000013c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001380)={&(0x7f0000000c00)={0x744, r7, 0x200, 0x70bd2c, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0xfffffffc, 0x1e}}}}, [@NL80211_ATTR_TX_RATES={0x84, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x80, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x18, 0x2, [{0x3, 0x2}, {0x2, 0x4}, {0x5, 0x8}, {0x5, 0x9}, {0x5, 0x9}, {0x7, 0x2}, {0x7, 0x5}, {0x1, 0x1}, {0x2, 0x3}, {0x1, 0x1}, {0x5, 0x1}, {0x6, 0x8}, {0x2, 0x5}, {0x7, 0x3}, {0x1, 0x2}, {0x4, 0x4}, {0x3, 0x9}, {0x4, 0x4}, {0x1, 0x7}, {0x5, 0x3}]}, @NL80211_TXRATE_LEGACY={0x13, 0x1, [0x48, 0x6c, 0x36, 0x7b, 0x9, 0x12, 0x60, 0x48, 0x24, 0x3d, 0x4, 0x24, 0x2, 0xb, 0x5]}, @NL80211_TXRATE_LEGACY={0x7, 0x1, [0x16, 0x16, 0x0]}, @NL80211_TXRATE_LEGACY={0x8, 0x1, [0xc, 0x12, 0x36, 0x60]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HT={0x14, 0x2, [{0x6, 0x6}, {0x2, 0x1}, {0x2, 0x7}, {0x7, 0x8}, {0x0, 0x4}, {0x4, 0x8}, {0x2, 0x7}, {0x0, 0x1}, {0x1}, {0x7, 0x5}, {0x1, 0xa}, {0x1, 0x5}, {0x3, 0x7}, {0x5, 0x6}, {0x6, 0x5}, {0x2, 0x1}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8000, 0x0, 0xfff, 0x3ff, 0x0, 0xe, 0x81, 0xe]}}]}]}, @NL80211_ATTR_TX_RATES={0x70, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x3c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x18]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xc927, 0x4, 0x0, 0x2, 0x4, 0x6, 0x9, 0x101]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x400, 0x9, 0x16, 0x3, 0x4, 0x3, 0x8, 0xa]}}]}, @NL80211_BAND_2GHZ={0x30, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x2, 0x10, 0x2010, 0x8, 0x3, 0x3, 0x40]}}]}]}, @NL80211_ATTR_TX_RATES={0x1b8, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0xf4, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x23, 0x1, [0x55, 0xc, 0x16, 0xc, 0x5, 0x35, 0x6, 0x16, 0x12, 0x18, 0x4, 0x16, 0x5, 0x18, 0x1, 0x74, 0x36, 0x30, 0x30, 0x24, 0x1, 0x9, 0x24, 0xc, 0x60, 0xc, 0x48, 0x6, 0x16, 0x12, 0x4]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x3, 0x0, 0x1, 0x1c14, 0x1, 0xb58, 0xff]}}, @NL80211_TXRATE_HT={0x41, 0x2, [{0x6}, {0x0, 0x3}, {0x2, 0x1}, {0x2, 0x6}, {0x3, 0x4}, {0x0, 0x2}, {0x3, 0x4}, {0x4, 0x2}, {0x6, 0x5}, {0x7, 0xa}, {0x2, 0x4}, {0x4, 0x1}, {0x0, 0xa}, {0x4, 0x4}, {0x1, 0x2}, {0x3, 0x8}, {0x7, 0x2}, {0x7, 0x2}, {0x2}, {0x1, 0x7}, {0x0, 0x4}, {0x6, 0x9}, {0x3, 0x9}, {0x7, 0x7}, {0x1}, {0x4}, {0x5, 0x3}, {0x6, 0x9}, {0x2, 0x5}, {0x3, 0x1}, {0x3, 0x8}, {0x5, 0x3}, {0x7, 0x7}, {0x1}, {0x0, 0x5}, {0x1, 0x3}, {0x3, 0x3}, {0x0, 0x8}, {0x4, 0xa}, {0x4, 0x1}, {0x7, 0xa}, {0x2, 0x2}, {0x5, 0x3}, {0x2, 0x6}, {0x3, 0x9}, {0x4, 0x5}, {0x5, 0x4}, {0x1, 0x2}, {0x6, 0x9}, {0x5, 0x8}, {0x7, 0x6}, {0x3, 0x4}, {0x1, 0x5}, {0x1, 0x2}, {0x6, 0x4}, {0x5, 0x1}, {0x7, 0x1}, {0x0, 0x4}, {0x7, 0x8}, {0x4, 0x2}, {0x2, 0x8}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0xed08, 0x10, 0xfff0, 0x101, 0x9, 0x6, 0xa22f]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0xfad, 0x4, 0x4, 0x6, 0x3ff, 0xd7d, 0x1000]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x7ff, 0x4, 0x7ff, 0xe0, 0x5, 0x9, 0x87f]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x4, 0x3b, 0x6c, 0x5, 0x48, 0x6c, 0xc, 0x1b, 0x12, 0x12, 0x5, 0x36, 0xc, 0x17, 0x5, 0x6c, 0x24, 0x64, 0x42, 0x48, 0xc, 0x60, 0x36, 0x18, 0x5]}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0xb]}]}, @NL80211_BAND_5GHZ={0x5c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x18, 0x6, 0x30, 0x1, 0x1d, 0x12, 0x18, 0x1b, 0x1b, 0x1b, 0x1, 0x3, 0x24, 0x12, 0xc, 0x9, 0x18]}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x6c, 0x60, 0x12, 0x6c, 0x1, 0x36, 0x3, 0x18, 0x48, 0x5, 0x18, 0x16, 0x5]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x8, 0x80, 0x2, 0xce, 0x1, 0x7, 0x1]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x3}, @NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_60GHZ={0x58, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1f, 0x1, [0x60, 0x30, 0x1b, 0x24, 0x6c, 0x16, 0x3, 0xc, 0x48, 0x2, 0x6, 0x9, 0x7, 0x6, 0x60, 0x6, 0x2, 0x12, 0x0, 0x9, 0x1b, 0x0, 0x1, 0x6c, 0x30, 0x5, 0x30]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xd, 0x5, 0x6, 0x7, 0xfd, 0x9, 0x7, 0x7]}}, @NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x5, 0x1b, 0x6c, 0x6, 0x4, 0x6c, 0xbd9dba4abcabf970, 0x9, 0x3, 0x60, 0x12, 0x18, 0x5, 0x0, 0x2, 0x6, 0x9, 0xb, 0x24, 0x6, 0x4, 0x60, 0x6c, 0x60, 0x48, 0x60]}]}, @NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}]}, @NL80211_ATTR_TX_RATES={0x224, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0xa8, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x3e, 0x2, [{0x2, 0x9}, {0x0, 0x4}, {0x1}, {0x5, 0x3}, {0x3, 0x8}, {0x7, 0xa}, {0x7, 0x6}, {0x1, 0x9}, {0x2, 0x2}, {0x1, 0x6}, {0x6, 0x9}, {0x0, 0xa}, {0x4, 0x3}, {0x0, 0x9}, {0x0, 0x9}, {0x2}, {0x0, 0x9}, {0x1, 0x8}, {0x5, 0x5}, {0x3, 0xa}, {0x6, 0x4}, {0x3, 0x8}, {0x0, 0x1}, {0x1, 0x2}, {0x1, 0x1}, {0x1, 0x8}, {0x7, 0x5}, {0x3, 0x3}, {0x0, 0x4}, {0x0, 0x6}, {0x7, 0x9}, {0x1, 0x6}, {0x6, 0x8}, {0x1, 0x6}, {0x6, 0x1}, {0x7, 0x1}, {0x3, 0x2}, {0x1}, {0x1, 0x2}, {0x1, 0x6}, {0x3, 0x4}, {0x0, 0x8}, {0x7, 0x6}, {0x0, 0x7}, {0x5, 0x7}, {0x2, 0x5}, {0x1, 0x6}, {0x5, 0x9}, {0x0, 0x2}, {0x7, 0x2}, {0x6, 0x7}, {0x0, 0x5}, {0x6, 0x2}, {0x6, 0x5}, {0x0, 0x9}, {0x1, 0x7}, {0x1, 0x6}, {0x3, 0x5}]}, @NL80211_TXRATE_LEGACY={0xf, 0x1, [0x9, 0x0, 0x48, 0x16, 0x5, 0x24, 0x48, 0x48, 0x30, 0x36, 0x1]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0xffff, 0x101, 0x8, 0x5, 0x7, 0x0, 0x3dfc]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xa, 0x9, 0x2, 0x5, 0xa, 0xb, 0x7, 0x7]}}, @NL80211_TXRATE_LEGACY={0x1b, 0x1, [0x18, 0x12, 0x3, 0x5, 0x3, 0x1, 0x3, 0x30, 0x16, 0x3, 0xc, 0x3, 0x48, 0x43, 0xb, 0x24, 0xc, 0x36, 0x48, 0x4, 0x30, 0xc, 0x7e]}]}, @NL80211_BAND_60GHZ={0xd8, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x18, 0x12, 0xc, 0x2eab989844690fbc, 0x30, 0x0, 0x12, 0x36, 0x2, 0x48, 0x3, 0x2, 0x6, 0x9, 0x48, 0x60, 0x5, 0x1b, 0x6c, 0x5, 0x1, 0xb, 0x12, 0x2, 0x1b]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2, 0x9c82, 0x0, 0xff, 0x4, 0x8, 0x6, 0x4]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x48, 0x3e, 0x1b, 0x25, 0x38, 0x5, 0x30, 0x6c, 0x18, 0x9, 0x48, 0x18, 0x3, 0x30, 0x24, 0x48, 0x71, 0x20, 0x3f, 0x48, 0x6c, 0xb, 0x24, 0x60, 0x9]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x8000, 0x2, 0xd, 0x1, 0x7, 0x5, 0x3, 0x9]}}, @NL80211_TXRATE_HT={0x51, 0x2, [{0x4, 0x1}, {0x4, 0x2}, {0x7, 0xa}, {0x6, 0x8}, {0x7, 0x2}, {0x6, 0x2}, {0x2, 0x4}, {0x1, 0x7}, {0x1, 0x2}, {0x5}, {0x0, 0x3}, {0x2, 0xa}, {0x4, 0x5}, {0x2, 0x7}, {0x2, 0x4}, {0x1, 0x9}, {0x2, 0xa}, {0x4, 0x1}, {0x1, 0x6}, {0x2, 0x5}, {0x4, 0x2}, {0x6, 0x1}, {0x5, 0x1}, {0x3, 0x5}, {0x4, 0x7}, {0x0, 0x1}, {0x5, 0x2}, {0x7, 0x4}, {0x5, 0x4}, {0x5, 0x9}, {0x3, 0x4}, {0x3, 0x6}, {0x0, 0x1}, {0x0, 0x1}, {0x6, 0x6}, {0x0, 0x8}, {0x0, 0x8}, {0x1, 0xa}, {0x6, 0xa}, {0x0, 0x3}, {0x2, 0xa}, {0x7, 0x2}, {0x4, 0x2}, {0x4, 0x8}, {0x1, 0x1}, {0x2, 0x8}, {0x5, 0x6}, {0x3, 0x7}, {0x0, 0x1}, {0x6, 0x7}, {0x7, 0x9}, {0x6, 0x5}, {0x1, 0x3}, {0x5, 0xa}, {0x1, 0x5}, {0x7, 0x7}, {0x1}, {0x7, 0x4}, {0x7, 0x7}, {0x0, 0x2}, {0x0, 0x1}, {0x6, 0x7}, {0x0, 0x9}, {0x4, 0x1}, {0x1, 0x4}, {0x1, 0x1}, {0x7, 0x2}, {0x1, 0x4}, {0x0, 0x1}, {0x5, 0xa}, {0x7, 0x7}, {0x6, 0xa}, {0x3, 0x7}, {0x3, 0x2}, {0x0, 0x2}, {0x7, 0x1}, {0x0, 0x8}]}]}, @NL80211_BAND_2GHZ={0x20, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0xb3f, 0x0, 0xd, 0xa271, 0x9, 0x2, 0x800, 0x9]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_5GHZ={0x70, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x800, 0x101, 0x7, 0x1d, 0x7, 0x4, 0x3, 0x7f]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x8017, 0x7, 0x0, 0x2, 0x6, 0x0, 0x6]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7ff, 0xfffc, 0x5, 0x7f, 0x1b8, 0x7, 0x3, 0x6]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_5GHZ={0x10, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0xc, 0x2, [{0x7, 0x6}, {0x7}, {0x2, 0x1}, {0x6, 0xa}, {0x6, 0x7}, {0x3, 0x4}, {0x0, 0x5}, {0x2, 0x7}]}]}]}, @NL80211_ATTR_TX_RATES={0xc0, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x50, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HT={0x2e, 0x2, [{0x6, 0x9}, {0x1, 0x9}, {0x3, 0x9}, {0x4, 0x7}, {0x0, 0x2}, {0x6, 0xa}, {0x0, 0xa}, {0x7, 0x7}, {0x1, 0x4}, {0x7, 0x6}, {0x1, 0x2}, {0x0, 0x8}, {0x7, 0x8}, {0x1, 0x6}, {0x1, 0x3}, {}, {0x2, 0x7}, {0x7, 0x8}, {0x1, 0x9}, {0x6}, {0x2, 0x9}, {0x7, 0x2}, {0x2, 0x5}, {0x5}, {0x7, 0x6}, {0x5, 0x7}, {0x0, 0x7}, {0x2, 0xa}, {0x7, 0x3}, {0x1, 0x2}, {0x4, 0x5}, {0x6, 0x5}, {0x7, 0x3}, {0x1, 0x1}, {0x1, 0x4}, {0x2, 0x9}, {0x6, 0x6}, {0x1, 0x2}, {0x4, 0x9}, {0x6, 0x7}, {0x0, 0x1}, {0x5, 0xa}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0xf738, 0x6, 0x0, 0x6, 0x4, 0x6, 0xcc8]}}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x8829, 0x2, 0x2, 0x7ff, 0x11, 0x3, 0x5]}}]}, @NL80211_BAND_6GHZ={0x54, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0x30, 0x2, [{0x5, 0x5}, {0x6}, {0x2, 0x3}, {0x1, 0x6}, {0x5, 0x5}, {0x7, 0x7}, {0x1}, {0x2, 0x4}, {0x6, 0x8}, {0x3, 0x3}, {0x3}, {0x7, 0xa}, {0x6, 0x7}, {0x7, 0x7}, {0x4, 0x2}, {0x0, 0x8}, {0x4, 0x9}, {0x5, 0x8}, {0x1, 0x3}, {0x0, 0x3}, {0x1, 0x8}, {0x2}, {0x7}, {0x4, 0x5}, {0x1, 0x7}, {0x2, 0x1}, {0x4, 0x3}, {0x6, 0x9}, {0x6}, {0x1, 0x9}, {0x2, 0x7}, {0x3, 0x2}, {0x4, 0x3}, {0x1, 0x9}, {0x4, 0x6}, {0x7, 0x6}, {0x3, 0x2}, {0x7, 0x9}, {0x5, 0xa}, {0x2, 0x6}, {0x6, 0x8}, {0x3, 0x2}, {0x0, 0x7}, {0x5}]}]}]}, @NL80211_ATTR_TX_RATES={0x24, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0xc, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}]}, @NL80211_BAND_5GHZ={0x14, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_GI={0x5}]}]}, @NL80211_ATTR_TX_RATES={0x170, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x20, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x43f7, 0x1, 0x80, 0x6, 0xf03, 0x3, 0x6, 0xdc66]}}]}, @NL80211_BAND_2GHZ={0x6c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xfff, 0x1d40, 0x4, 0xc, 0x2, 0x1, 0x5, 0x6eec]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xcf6a, 0xb6, 0x2, 0x8, 0xff, 0x952a, 0x7]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x9, 0xd, 0x8bee, 0x9, 0x6, 0x80, 0xe]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x0, 0x0, 0xff00, 0x3, 0x6, 0x8, 0x2]}}]}, @NL80211_BAND_6GHZ={0x1c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_6GHZ={0xc4, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x8, 0x28be, 0xb3c, 0xf, 0xf, 0x0, 0xb82e]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x15, 0x1, [0x2, 0x24, 0x16, 0x5, 0x12, 0x2, 0x4, 0x18, 0x1, 0x60, 0xb, 0x3, 0x9, 0x6, 0x3, 0x0, 0x16]}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x3, 0x18, 0x5, 0x5c, 0x18, 0x4, 0x3, 0x6, 0x9, 0xb, 0x1, 0xc, 0x2]}, @NL80211_TXRATE_HT={0x4b, 0x2, [{0x4, 0x9}, {0x7, 0x6}, {0x1, 0xa}, {0x5, 0x1}, {0x4, 0x9}, {0x7}, {0x6, 0x8}, {0x3, 0x8}, {0x4, 0x6}, {0x4, 0x3}, {0x4, 0x4}, {0x2, 0xa}, {0x6, 0x7}, {0x2, 0x6}, {0x5, 0x2}, {0x1, 0x4}, {0x0, 0x5}, {0x0, 0x7}, {0x5, 0x7}, {0x5, 0x1}, {0x1}, {0x5, 0x5}, {0x4, 0x1}, {0x1, 0x9}, {0x5, 0x9}, {0x1, 0x4}, {}, {0x4, 0xa}, {0x7, 0x8}, {0x7, 0x5}, {0x6, 0x4}, {}, {0x6, 0x8}, {0x5, 0x7}, {0x5, 0x8}, {0x7, 0x2}, {0x1, 0x8}, {0x7, 0x9}, {}, {0x4, 0x3}, {0x2, 0x4}, {0x6, 0x7}, {0x0, 0x6}, {0x4, 0x1}, {0x3}, {0x0, 0x7}, {0x0, 0x9}, {0x1, 0x8}, {0x4, 0x5}, {0x0, 0x9}, {0x5, 0x4}, {0x0, 0x4}, {0x3, 0xa}, {0x2, 0x8}, {0x7}, {0x7, 0x4}, {0x7, 0x8}, {0x5, 0x1}, {0x6, 0x2}, {0x7, 0x1}, {0x0, 0x3}, {0x7, 0x9}, {0x2, 0x7}, {0x0, 0x3}, {0x1, 0xa}, {0x2, 0xa}, {0x1, 0x4}, {0x7, 0x6}, {0x5, 0x4}, {0x6, 0x9}, {0x1, 0x6}]}, @NL80211_TXRATE_HT={0x12, 0x2, [{0x7, 0x6}, {0x0, 0x3}, {0x7, 0x9}, {0x5, 0x1}, {0x5, 0x9}, {0x5}, {0x7, 0x8}, {0x6, 0x6}, {0x2, 0x2}, {0x0, 0x5}, {0x4, 0x3}, {0x0, 0x1}, {0x2, 0x7}, {0x0, 0xa}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}]}]}, 0x744}, 0x1, 0x0, 0x0, 0x1}, 0x40040c1) bind$tipc(0xffffffffffffffff, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x1, {0x43, 0x1, 0x4}}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000001600), 0xffffffffffffffff) setsockopt$XDP_TX_RING(r9, 0x11b, 0x3, &(0x7f0000000040), 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000004900010000000000000000000a006000", @ANYRES32=0x0, @ANYBLOB="000000000800020000000000140001"], 0x38}}, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000000)={@remote, r4}, 0x14) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000004c0)=@newtfilter={0x24, 0x11, 0xd27, 0x2000, 0x0, {0x0, 0x0, 0x74, r4, {0x0, 0xfff2}, {0xafabc05531515610, 0xfff3}, {0x8, 0x5}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x1c005}, 0x24048004) 2.709374501s ago: executing program 1 (id=3562): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0900000007000000040000000c00000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000001000"/28], 0x48) syz_emit_ethernet(0x46, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60f91e2e000b7300fc040000000000000000000000000000ff020000000000000000000000000001"], 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r2, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000092870000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70200001400a400b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000020000008500000084000000b70000000000000095"], &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x3a, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r3, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000005c0)={r4, 0xffffffffffffffff, 0x3a, 0x0, @val=@tcx}, 0x1c) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@newtaction={0x68, 0x30, 0xb, 0x0, 0x0, {}, [{0x54, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PRIORITY={0x8}, @TCA_SKBEDIT_PARMS={0x18}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x9}}}]}]}, 0x68}}, 0x0) r6 = socket$kcm(0x10, 0x2, 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, &(0x7f0000000080)=""/248, 0x1a, 0xf8, 0x1}, 0x20) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r7, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) write$bt_hci(r7, &(0x7f00000000c0)=ANY=[@ANYBLOB="000000003201"], 0x138) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2, 0x2}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x0, 0x1}]}]}}, 0x0, 0x5a}, 0x20) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast5-avx\x00'}, 0x58) accept$alg(r8, 0x0, 0x0) bind$alg(r8, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'seqiv(rfc4106(gcm(aes)))\x00'}, 0x58) sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="89000000120081ae08060cdc030ec0007f03e3f70000000000e2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec08120c000200040001400400446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x13, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="8500000011000000350000000000020085000000230000009500073d000000003c8ea5932cf6fec5eade4bb02aa4f152b8bdfdf8ffffffffffeeff547930a8abf35fd3908aa4e150e020a1a45f8d6700ff00000000f669011b4504090bc057a5cdb706ceac9856bad67505a783d6f5d0542b83f636ab45c12311d14da9bf"], 0x0, 0x4}, 0x94) ioctl$EXT4_IOC_GROUP_EXTEND(r5, 0x40086607, &(0x7f0000000180)=0x10000) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000600)={r0, 0x58, &(0x7f0000000580)}, 0x10) 2.507692349s ago: executing program 0 (id=3564): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000180)=@newlink={0x3c, 0x10, 0x403, 0x4, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20101, 0x382}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GENEVE_UDP_ZERO_CSUM6_TX={0x5}]}}}]}, 0x3c}, 0x1, 0xba01}, 0x810) (async) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0xa2f01, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) (async) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) (async) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x16, 0x0, 0x290) write$tun(r2, 0x0, 0x7e) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1}, 0x8060) (async) r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r3, 0x0, 0xca, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2213, @vifc_lcl_addr=@dev={0xac, 0x14, 0x14, 0x2b}, @multicast1}, 0x10) (async) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f00000002c0)={r7}, &(0x7f0000000300)=0x8) (async) getsockopt$inet_sctp6_SCTP_MAXSEG(r4, 0x84, 0xd, &(0x7f0000000040)=@assoc_id=r7, &(0x7f0000000080)=0x4) 2.437649557s ago: executing program 1 (id=3565): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x2) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r2) setsockopt$MRT6_TABLE(r2, 0x29, 0xcf, &(0x7f0000000080), 0x4) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r4, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) r5 = socket(0x1, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYRESDEC=r3, @ANYRES32=0x0, @ANYBLOB="46060900000000002800128009000100766c616e00000000180002800c0002001f0000001f000000060001000100000008000500", @ANYRES32=r6], 0x50}, 0x1, 0x0, 0x0, 0x600}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c00000010000104000000000000000000000400", @ANYRES32=0x0, @ANYBLOB="00000000183e00001400350065727370616e3000000000000000000008000a00", @ANYRES32=r9], 0x3c}, 0x1, 0x0, 0x0, 0x70}, 0x0) 2.388118933s ago: executing program 2 (id=3566): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x560, 0x0, 0xc8, 0x8, 0x0, 0x5803, 0x490, 0x2e8, 0x2e8, 0x490, 0x2e8, 0x3, 0x0, {[{{@ipv6={@remote, @mcast1, [], [], 'erspan0\x00', 'geneve1\x00', {0xff}}, 0x0, 0x2c0, 0x2f0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'kmp\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5cf11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f34a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x3, 0x2}}, @common=@inet=@policy={{0x158}, {[{@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', [0x0, 0xffffffff, 0xff000000, 0xffffff00], @ipv4=@rand_addr=0x64010102, [0x0, 0xffffffff, 0xffffffff, 0xff000000], 0x4d4, 0x3503, 0x3c, 0x0, 0x1, 0x4}, {@ipv4=@dev={0xac, 0x14, 0x14, 0x38}, [0x0, 0xffffff00, 0xffffff00, 0xff000000], @ipv6=@loopback, [0xffffff00, 0xff, 0xff000000, 0xff000000], 0x4d5, 0x0, 0x0, 0x0, 0x2, 0x2}, {@ipv6=@private1, [0x0, 0xff, 0xff, 0xff], @ipv6=@mcast2, [0xff, 0x0, 0xffffff00, 0xffffff00], 0x4d4, 0x3504, 0x2, 0x0, 0x14, 0x9}, {@ipv6=@local, [0xff, 0xffffffff, 0xffffffff], @ipv4=@empty, [0xffffff00, 0xff], 0x4d3, 0x3505, 0x62, 0x0, 0x7, 0x8}], 0xd9884bcd73343275, 0x1}}]}, @common=@unspec=@CONNMARK={0x30}}, {{@ipv6={@mcast1, @loopback, [0xff, 0xffffff00, 0xffffff00, 0xffffff00], [0x0, 0x0, 0xff000000, 0xff], 'sit0\x00', 'caif0\x00', {}, {}, 0x67, 0x3, 0x0, 0x20}, 0x0, 0x138, 0x1a0, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'bond0\x00', 'veth1_virt_wifi\x00', 0x0, 0x1}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5c0) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000005c0)='./cgroup/syz0\x00', 0x1ff) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000740)={0x1b, 0x0, 0x0, 0x773, 0x0, 0x1, 0x80, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x2}, 0x50) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x12, 0x3, 0x8, 0x2}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={r2, &(0x7f0000000700), 0x0}, 0x20) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[], 0x32600) (async) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000002040)={r1, &(0x7f00000021c0)="9044bd1906c4bf6d27e80279af9d37fab6c5f522e06e9fa0875817cc57dedbc6ffeb7a90ca8617868454c1c2f672e02da97125f18e66", &(0x7f0000002000)}, 0x20) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001c40)={0xffffffffffffffff, 0xe0, &(0x7f0000001b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000001980)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x5, &(0x7f00000019c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001a00)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x5b, &(0x7f0000001a40)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000001a80), &(0x7f0000001ac0), 0x8, 0x25, 0x8, 0x8, &(0x7f0000001b00)}}, 0x10) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000180)={r6, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000002c0)='./cgroup/cgroup.procs\x00', &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x1}}, 0x40) (async) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001c80)={0xffffffffffffffff, 0x2, 0x8}, 0xc) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000001cc0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r9 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001d00)={0xffffffffffffffff, 0x8000, 0x10}, 0xc) (async) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r10, 0x0) (async) r11 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000001d40)={0x1b, 0x0, 0x0, 0xa55, 0x0, 0x1, 0xe4f, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5}, 0x50) (async) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000022c0)={r6, r10, 0x14, 0x0, @val=@kprobe_multi=@syms={0x0, 0x3, &(0x7f0000002280)=[&(0x7f0000001fc0)='/-\x00', &(0x7f0000002200)=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', &(0x7f0000002240)='memory.events\x00'], 0x0, 0x5}}, 0x30) (async) r12 = syz_genetlink_get_family_id$mptcp(&(0x7f0000002080), r10) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000001000)={0x6, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="bf16000000000000b7020000ff8500007b2af8ff000000007b2af0ff000000007b2ae8ff000000007b2ae0ff000000007b2ad8ff000000007b2ad0ff000000007b2ac8ff000000007b2ac0ff00000000b702000002000000732ac0ff00000000b702000001000000632ac4ff00000000180200000a0000010000000000000000632accff00000000180200000a0000020000000000000000632ac0ff00000000bf61000000000000bfa200000000000007020000c0ffffffb703000040000000b7040000000000008500000045000000b70000000200000095"], &(0x7f00000011c0)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002200)={r13, 0x0, 0xe, 0x0, &(0x7f0000000080)="0000000000002d9d8aaf5dc79048", 0x0, 0x8ce3, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) sendmsg$MPTCP_PM_CMD_REMOVE(r10, &(0x7f0000002180)={&(0x7f0000002000), 0xc, &(0x7f0000002140)={&(0x7f00000020c0)={0x74, r12, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x6c}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xef}, @MPTCP_PM_ATTR_ADDR={0x20, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x10}]}, @MPTCP_PM_ATTR_ADDR={0x28, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1={0xfc, 0x1, '\x00', 0x1}}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x4}]}, 0x74}, 0x1, 0x0, 0x0, 0x4040000}, 0x20044814) (async) r14 = bpf$MAP_CREATE(0x0, &(0x7f0000001dc0)=@base={0x1d, 0x6, 0x2, 0xe, 0x23210, 0xffffffffffffffff, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000001f00)={0xe, 0x1f, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x3}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @alu={0x4, 0x0, 0x6, 0x0, 0x2, 0xc, 0xffffffffffffffff}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f00000008c0)='GPL\x00', 0x1c80, 0x1000, &(0x7f0000000900)=""/4096, 0x41100, 0x57, '\x00', 0x0, @fallback=0x2d, r3, 0x8, &(0x7f0000001900)={0x2, 0x3}, 0x8, 0x10, &(0x7f0000001940)={0x4, 0x1, 0xd, 0x6}, 0x10, r5, r6, 0x7, &(0x7f0000001e40)=[r7, r8, r9, r10, r11, r14], &(0x7f0000001e80)=[{0x0, 0x4, 0xa, 0xb}, {0x2, 0x5, 0x7}, {0x5, 0x1, 0x2, 0xc}, {0x4, 0x4}, {0x3, 0x1, 0x1, 0xd}, {0x4, 0x3, 0xf, 0x4}, {0x7, 0x1, 0x7, 0x6}], 0x10, 0x6}, 0x94) ioctl$BTRFS_IOC_INO_PATHS(r0, 0xc0389423, &(0x7f0000000700)={0xfffffffffffffffb, 0x18, [0x2, 0x3ff, 0xfffffffffffffffb, 0x642], &(0x7f00000006c0)=[0x0, 0x0, 0x0]}) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="620ac4ff000000007110be000000000095"], &(0x7f0000000480)='GPL\x00'}, 0x90) 2.288104849s ago: executing program 3 (id=3567): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) r2 = socket(0x28, 0x5, 0x0) listen(r2, 0x3) r3 = accept4$unix(r2, 0x0, 0x0, 0x0) accept4(r2, 0x0, 0x0, 0x80800) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES8=r3, @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x11, 0x5, &(0x7f0000000480)=ANY=[], 0x0, 0x1, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000200)=ANY=[@ANYRES64=r1, @ANYRES16], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x59, '\x00', 0x0, @fallback=0x3, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r6, 0x2000000, 0xe, 0xffffffffffffff94, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) ioctl$sock_inet6_SIOCADDRT(r0, 0x890b, &(0x7f00000002c0)={@mcast2, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, 0x1, 0x6, 0x0, 0x100, 0x4, 0x200000, r1}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000005000100070000000900020073797a30000000001400078008001240000000000500150004000000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_kcm_SIOCKCMUNATTACH(r10, 0x8901, &(0x7f0000000040)) sendmsg$inet(r9, &(0x7f0000002740)={0x0, 0x0, &(0x7f00000022c0)=[{&(0x7f0000000080)="90", 0x1}], 0x1}, 0x24004011) ioctl$sock_inet6_SIOCADDRT(r8, 0x890b, &(0x7f00000003c0)={@mcast2, @rand_addr=' \x01\x00', @initdev={0xfe, 0x88, '\x00', 0x80, 0x0}, 0x401, 0x6, 0x0, 0x80, 0x4, 0x4000200}) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000800)={@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @remote, 0x0, 0x6, 0x0, 0x100, 0x6, 0x4180107, r11}) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r12, 0x8933, &(0x7f0000000280)={'batadv_slave_0\x00'}) r13 = socket$alg(0x26, 0x5, 0x0) bind$alg(r13, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) 2.069160805s ago: executing program 0 (id=3568): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x89b0, &(0x7f0000000080)={'ip_vti0\x00', 0x100}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f00000000c0)="b1ef675d280b8f49402551ec048c0cab6be9688f8711137d70f2ba7447c752af23ee790733257e5232e37a09c739aea55347418d9a1eb3ea1d602b641e75a502a322deeb63c6039db2dbc10fc7cf87f91afc1568a1d26b9a66333cf4e2bd33b25cc3444f226b91dcbf0a8666abff32967fb1ea345c30eb361f55805c947c0d2970a510c06602b7ecec74484ede5e8e39733492e02d49a8a715dff4714147929cc0f98f91e1f730414570d7ced40f5ce99eda6798564d30ee32391feca78e61065d3ba2f5b14886cea4bb8070ebfc49d08d7510b571653d1baee213572a70859263", 0xe1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x8, 0x3, 0x240, 0x0, 0x43, 0xa0, 0x0, 0x98, 0x1a8, 0x178, 0x178, 0x1a8, 0x178, 0x49, 0x0, {[{{@ip={@loopback, @local, 0x0, 0x0, 'veth0_to_bond\x00', 'ip6erspan0\x00', {}, {0x7f}, 0x0, 0x1}, 0x12a, 0x70, 0x90, 0x0, {0x0, 0x7a010000}}, @unspec=@TRACE={0x20}}, {{@ip={@loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x0, 0xff, 'veth1_to_batadv\x00', 'ip_vti0\x00', {}, {}, 0x6, 0x2, 0x14}, 0x0, 0xd8, 0x118, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x1, 0x1}}, @common=@set={{0x40}, {{0x0, [0x0, 0x4, 0x4, 0x3, 0x4, 0x5], 0x4, 0x6}}}]}, @common=@unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "f1c098b60204ed02d82cf440fef5497b80c29d381d41116000"}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2a0) r2 = socket(0x10, 0x3, 0x0) bind$netlink(r2, 0x0, 0x0) write(r2, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001700000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r3, 0x18000000000002a0, 0x12, 0x0, &(0x7f00000004c0)="b9fe030768045c8c989a14f088a865f986dd", 0x0, 0x9e, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x4c) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0xe, 0x4, 0x370, 0xffffffff, 0x0, 0xd0, 0x1a0, 0xffffffff, 0xffffffff, 0x0, 0xd0, 0x2a0, 0xffffffff, 0x4, &(0x7f0000000400), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ipv6={@empty, @empty}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@ah={{0x30}}]}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3d0) sendto$inet6(r4, &(0x7f0000000100)='hello', 0x5, 0x0, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="2400b6f7030801030000000000000000050000040600024022f000000600024000160000"], 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x40800) r5 = socket$kcm(0x29, 0xd, 0x0) r6 = accept$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000280)=0x14) sendmsg$kcm(r5, &(0x7f0000000a00)={&(0x7f0000000580)=@pppol2tpv3in6={0x18, 0x1, {0x0, r6, 0x0, 0x2, 0x2, 0x1, {0xa, 0x4e24, 0x80, @empty, 0x1}}}, 0x80, &(0x7f00000008c0)=[{&(0x7f0000000600)="1c8ece6f055d44f9ce4402ac0573c990ded248ec046b1a54934401a9b72f90557f4b5d7a3745daa95995981245a0e829581e1195b9f7a3a2d05b4c38eca5", 0x3e}, {&(0x7f0000000640)="c6161290cd634e26f1ca0ecc8533fc51ef2c434926b1f03c41303d9c0eef36fb35bd10aa28411a35b5d148272ab028870aaecc5bc4968b69ccb0d4dfe6a35192d5acc7070f533fa721a41a36f1b8b20c911afe96248ff4ab31e3fa1d3eaaae27ed42e3eb30436b8aa5fdfe6a0bcad3d33fe74129bc33239022b6e545c15b211a24d552907481ee8e1ba8a9b6b9c3", 0x8e}, {&(0x7f0000000700)="a5ce8b5f8e4efa742322e0d0c0632220f5b3fdef8efd0a870ee84e964141b0495cc0105c31c0fb86bbdf718c2cbb992653f588b9f938a3f7ed9552286f5b1d08f19472a31020badd0cd134ff8dc6a647731a579ed14e908826bedd698b5499cf6ec80b1304e42fbf409844dc1f9a148c7a4180ef16f9222cf0c946161534944f2c18c97cbad79774d0299d06f8688f311d75ecf03b91e4ae8378cf38cee9c58d17b541ec6eb2f2038ae1a410c98a8f1f61fbfc4af7d0ab55733f36e543def38887f44ed6b30ec0180ca064077f2dc2c102803bb2d37207025b537fb0a25f5567ddec4a", 0xe3}, {&(0x7f0000000800)="55b702eed344eed544ec408d664747ffb6cc489b8e60fa255ff8bd0356c29bc371a5bc43b5c6649a46f40a3a7be048a4ff8ae9d1a4b0b861740bdae326abb90aaf6bf7350d53e0e711edfb3f928561b7fb80f89f9bf65cb677a20064e5799695d9fdcbc4a7073df4d8e00507e29b4c993f50b13027aeb91d344831e53862efe415b1840edc30a0", 0x87}], 0x4, &(0x7f0000000900)=[{0xc8, 0x6, 0x62, "34b854eb614a1d5867aac742d916947e5432c263be32760e76891c9921d69c6697d73ad71d21e00745cfd6e5583aa7608d4e3523074efa1b96c7488b16d0818d3a22a9a1b41af3a0ecc72cf88d60e4c569d1a50a9a17c2b124da008a27d9269804d11dee044ba6eda210b43840f7616fe69e95137888148c50c83d27ff2a19846c75e0f3b89c52fdd3b1cc67a1288131b28dfb0cc0c513a90242e515c0f3356e78702b61f3a15f0bd4f3d5e28506104e5ee04fb6efc61469"}], 0xc8}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r8, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r8, 0x0) r9 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r9, 0x84, 0x1c, 0x0, &(0x7f00000000c0)) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000a80), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_GET(r10, &(0x7f0000000b80)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000ac0)={0x58, r11, 0x4, 0x70bd29, 0x25dfdbfb, {}, [@HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x58}, 0x1, 0x0, 0x0, 0xecd3fd26b0dda242}, 0x8050) 1.973031435s ago: executing program 3 (id=3569): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f0000000240)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x4, [@fwd={0x2, 0x0, 0x0, 0x12}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x0, [{0x0, 0x1}]}]}, {0x0, [0x0, 0x61]}}, 0x0, 0x40}, 0x20) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) r3 = socket(0x10, 0x803, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'team_slave_0\x00', 0x0}) (async) r7 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@newqdisc={0x14c, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x11c, 0x2, {{0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x0, [0x4, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5c4, 0x0, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}, [@TCA_MQPRIO_MIN_RATE64={0xc4, 0x3, 0x0, 0x1, [{0xc, 0x3, 0x1}, {0xc, 0x3, 0x9}, {0xc, 0x3, 0x88}, {0xc, 0x3, 0x6}, {0xc, 0x3, 0x293}, {0xc, 0x3, 0x4}, {0xc, 0x3, 0x9}, {0xc, 0x3, 0x9}, {0xc, 0x3, 0x7}, {0xc, 0x3, 0x7}, {0xc, 0x3, 0x6}, {0xc, 0x3, 0x7}, {0xc, 0x3, 0x2}, {0xc, 0x3, 0x1}, {0xc}, {0xc, 0x3, 0x7}]}]}}}]}, 0x14c}}, 0x20000024) (async) r9 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000800)=0xffffffffffffffff, 0x4) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x8, &(0x7f00000000c0)=ANY=[@ANYBLOB="0400000000000000000000000900000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500000000000000"], &(0x7f0000000980)='GPL\x00', 0xdba, 0x0, &(0x7f0000000140), 0x41000, 0x0, '\x00', r6, 0x25, r9, 0x8, &(0x7f0000000180)={0x9, 0x3}, 0x8, 0x10, &(0x7f00000001c0)={0x4, 0xb, 0x9, 0x1}, 0xa, 0x0, 0x0, 0x0, &(0x7f0000000200)=[0xffffffffffffffff, 0x1, 0x1, 0x1]}, 0x94) (async, rerun: 32) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={r4, 0xe0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1, &(0x7f0000000300)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000340)=[0x0], 0x0, 0x3f, &(0x7f00000004c0)=[{}, {}], 0x10, 0x10, &(0x7f0000000600), &(0x7f0000000640), 0x8, 0x4c, 0x8, 0x8, &(0x7f0000000680)}}, 0x10) (async, rerun: 32) ioctl$sock_SIOCGPGRP(r3, 0x8904, &(0x7f0000000900)=0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000c40)=@bloom_filter={0x1e, 0x5350, 0x0, 0xf53, 0x30040, 0xffffffffffffffff, 0x1ff, '\x00', r11, 0xffffffffffffffff, 0x3, 0x5, 0x0, 0x5}, 0x50) (async) r13 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000940)={r10, r11, 0x25, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000840)=[0x2, 0x5, 0x9d, 0x101, 0xc1c, 0x9, 0xffffffffffffffff, 0x8e, 0xffffffffffffffff, 0x401], &(0x7f00000008c0)=[0x5, 0x2, 0x1], 0x3, 0xa, 0x0, r12}}, 0x40) (async) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x3, 0x1, 0x2}}) bpf$LINK_DETACH(0x22, &(0x7f0000000080)=r13, 0x4) (async) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r2, @ANYBLOB="0c00990000000200000000000800a000940900000800260094090000080027"], 0x48}, 0x1, 0x0, 0x0, 0x81}, 0x0) r14 = syz_genetlink_get_family_id$team(&(0x7f0000000380), r5) (async) r15 = socket(0x10, 0x3, 0x0) (async) r16 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r16, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r15, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r17, {0x0, 0x8}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x10001}]}}]}, 0x3c}}, 0xc0d0) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000000bc0)={'sit0\x00', &(0x7f0000000b40)={'sit0\x00', 0x0, 0x8010, 0x20, 0x9, 0x6, {{0x15, 0x4, 0x2, 0x14, 0x54, 0x64, 0x0, 0x8, 0x4, 0x0, @dev={0xac, 0x14, 0x14, 0x12}, @broadcast, {[@lsrr={0x83, 0x17, 0xd6, [@rand_addr=0x64010100, @multicast2, @remote, @private=0xa010102, @loopback]}, @noop, @ssrr={0x89, 0xf, 0x74, [@remote, @loopback, @dev={0xac, 0x14, 0x14, 0x36}]}, @timestamp={0x44, 0x18, 0xfa, 0x0, 0xd, [0x81, 0x8, 0xba, 0xe4, 0xc3b3ee33]}]}}}}}) (async, rerun: 64) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000c00)={'team0\x00', 0x0}) (rerun: 64) sendmsg$TEAM_CMD_OPTIONS_GET(r3, &(0x7f0000001500)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000014c0)={&(0x7f0000001540)=ANY=[@ANYBLOB="90040000", @ANYRES16=r14, @ANYBLOB="04002cbd7000fddbdf250200000008000100", @ANYRES32=r8, @ANYBLOB="7800028038000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000050003000300000008000400ffff00003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="24020280400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000700000008000600", @ANYRES32=r11, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000050003000b000000080004000500000008000600", @ANYRES32=r17, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000500030003000000080004007f0000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r18, @ANYBLOB="40000100240001006d6f64650000000000000000000000000000000000000000000000000000000005000300050000000e00040062726f61646361737400000040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000100004006c6f616462616c616e63650038000100240001006e6f746966795f70656572735f696e74657276616c0000000000000000000000050003000300000008000400080000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000005000300060000000400040008000600", @ANYRES32=r6, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000500030003000000080004000000000008000100", @ANYRES32=r6, @ANYBLOB="4400028040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=r11, @ANYBLOB="080007000000000008000100", @ANYRES32=r19, @ANYBLOB="0001028040000100240001006c625f74785f686173685f746f5f706f72805f6d617070696e67000000000000050003000300000008000400353f939a56a3df86962d644990c159483e28421faca78b664a74fb153d157399cc3a0f76fceeb62fcb215ac44644d0910a20e889242d104797bef2b60d3a089448a4af2999224a60b423d81198aa0ede8d66f312d0c68004d089e76de9586620ad7e3bbcaf2180e4f2ecedba9ffa9bc13773ac82f27ad4d93db7b231d18cc7366fdbef1e0944805ee6624e49943a5cd4cfc3d89531f774a3afa7b351acef5143e17269ca43eb3a27dc28ca8c7162f971deb637c897541a92f488a14c3ab21b4951e2a2030c3952b21402e2a469cf2b231b2b7f43e45afada94e8dbf3ed1d403858297c4c95900b36bb5a86ce3337c5be1678022cfe7ed6d085ac66dc023027e9d0bcce41896572419fab1b2d7952759ddaef46f878448c568134bee486d1e0acc50f16b76662f3b25dd675107186674e444ead92c6e0485309ae7a87de8e18d9ce50006372f4f06abd046b8cc101c1e7995e7df50d08c6171fb1a90a8f16f94e00"/426, @ANYRES32=r8, @ANYBLOB="0800070000000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000500030003000000080004000200000008000600", @ANYRES32=r11, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000050003000300000008000400", @ANYRES32=r11, @ANYBLOB="08000700000000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000005000300060000000400040008000600", @ANYRES32=r8, @ANYBLOB="08000100", @ANYRES32=r11, @ANYBLOB="7400028038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000500030003000000080004000100000038000100240001006e6f746966795f70656572735f636f756e74000000000000000000000000000005000300030000000800040005000000"], 0x490}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) (async) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f0000000100)=0x2, 0x4) 1.926600211s ago: executing program 2 (id=3570): r0 = socket(0x10, 0x3, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB="953a04"], 0x24}}, 0x0) recvmmsg$unix(r0, &(0x7f0000002a40)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000001100)=""/263, 0x107}, {&(0x7f0000004480)=""/4098, 0x1002}, {&(0x7f0000000740)=""/13, 0xd}, {&(0x7f00000003c0)=""/97, 0x61}, {&(0x7f00000004c0)=""/113, 0x71}, {&(0x7f0000000540)=""/130, 0x82}, {&(0x7f00000009c0)=""/123, 0x7b}], 0x7}}], 0x1, 0x40, 0x0) write(r0, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xa, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000006301a2000000000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) socket(0x10, 0x3, 0x0) (async) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000a80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYBLOB="953a04"], 0x24}}, 0x0) (async) recvmmsg$unix(r0, &(0x7f0000002a40)=[{{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000001100)=""/263, 0x107}, {&(0x7f0000004480)=""/4098, 0x1002}, {&(0x7f0000000740)=""/13, 0xd}, {&(0x7f00000003c0)=""/97, 0x61}, {&(0x7f00000004c0)=""/113, 0x71}, {&(0x7f0000000540)=""/130, 0x82}, {&(0x7f00000009c0)=""/123, 0x7b}], 0x7}}], 0x1, 0x40, 0x0) (async) write(r0, &(0x7f0000000100)="1400000052004f7fb3e4bf80a000080000000000", 0x14) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0xa, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000006301a2000000000095"], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) (async) 1.820323385s ago: executing program 1 (id=3571): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18020000fdffffee0000000000000000850000002c00000095"], &(0x7f0000000040)='GPL\x00'}, 0x94) (async, rerun: 32) r3 = socket$inet_sctp(0x2, 0x5, 0x84) (rerun: 32) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'veth1_to_hsr\x00', 0x0}) (async, rerun: 32) r5 = socket$key(0xf, 0x3, 0x2) (rerun: 32) sendmsg$key(r5, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000001200)=ANY=[@ANYBLOB="02180000180000000000000000000000030005000000000002000000e000000200000000000000000800120000000000000000000000000010000000000000000000000000000000ff010000000000000000000000000001fe8000000000000000000000000000aa030006000000000002004374ffffffff000000000000000008001900000000000a00000000000000ff020000000000000000000000000001000000000a"], 0xc0}}, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r2, r4}, 0x40) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x14080, 0x10000}, [@IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}]}, @IFLA_GROUP={0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000040}, 0x0) (async) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x2c, 0x2, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0xa}, [@IPSET_ATTR_REVISION={0x5, 0x4, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x2c}}, 0x4000010) (async) pipe(&(0x7f00000001c0)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000440)=[{&(0x7f0000000140)="df", 0x1}], 0x1, 0x0) (async) bind$inet6(r7, &(0x7f0000000000)={0xa, 0x4e24, 0x6, @mcast1, 0x1}, 0x1c) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="1400000010007c0000000000006000000500000a50000000090a010400000000000000000a0000040900010073797a310000000008000540000000010900020073797a310000000008000a40fffffffc140011800c000100636f756e7465720004000280400000000c0a010100000000000000000a0000020900020073797a31000000000900010073797a310000000014000380100000800c00018005000100d1000000140000001100010000000000000000000100000a997a26e5008dd25e22caa1713c52f1ff309b01e516d7a7ac1ea56eb80701d8080eb3a894c0cbb7a8f94052814a07654def971ba608ba29f553f93b6f4c9dc2b9e7eb9c001bf9b8f9b88eec7059567840fa12b5a1afdcef762541b3a5d7e2b03b82e5d8b4735ba9272b9fc6f75c73853f1bd387f83a8367ec0d20d946a0699912178b82ee5fc6e00e58c5e77ba51ddaaf2fad95a33e0ba8ed697711"], 0xb8}}, 0x40) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f00000002c0)) 1.641779734s ago: executing program 2 (id=3572): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'wp512-generic\x00'}, 0x58) (async) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg(r1, &(0x7f00000004c0)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000200)="b896", 0x2}], 0x1}}], 0x1, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_SET(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0}}, 0x401c010) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f00000004c0)=ANY=[@ANYBLOB="180000000600000000000000fd07000018010000756c6c2500000000002020207a0bf8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300008100000085000000b500000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)={0x18, 0x2f, 0x9, 0x70bd28, 0x1, {0x4}, [@nested={0x4, 0xe}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) 1.629728024s ago: executing program 3 (id=3573): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001100)=@dellink={0x28, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_NET_NS_PID={0x8}]}, 0x28}}, 0x40000) (async, rerun: 32) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x10, @dev={0xfe, 0x80, '\x00', 0x41}}, 0x1c) (async, rerun: 32) setsockopt$inet6_IPV6_ADDRFORM(0xffffffffffffffff, 0x29, 0x1, &(0x7f00000001c0), 0x4) 1.435836731s ago: executing program 0 (id=3574): socket$kcm(0xa, 0x2, 0x0) (async) socket$nl_crypto(0x10, 0x3, 0x15) (async, rerun: 32) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) (async, rerun: 32) r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$kcm(0x10, 0x2, 0x4) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x11, 0x4, 0x4, 0x9}, 0x50) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000007c0)=@base={0xd, 0x2, 0x4, 0x3, 0x0, r2, 0xfffffffe}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r4}, &(0x7f0000000840), &(0x7f0000000880)=r3}, 0x20) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)="89000000120081ae08060cdc030000007f03e3f7000000016ee2ffca1b1f0000000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c00014002080c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1}, 0x4040) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="020300030c0000002abd7000fbcbdf2502000900080000000000000000000000030006000000000002004e22e0000002000000000000000002000100000000000000070300000000030005000000000002"], 0x60}, 0x1, 0x7}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async, rerun: 64) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000100)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x70, '\x00', 0x0, @fallback=0x27, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) (rerun: 64) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000740)={r5, 0x0, 0x30, 0x0, @void}, 0x10) 1.382511535s ago: executing program 3 (id=3575): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd21, 0xfbffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x4000000) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=@newtfilter={0x3c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0xfff2, 0x5}, {0xfff2}, {0xc, 0xe}}, [@filter_kind_options=@f_u32={{0x8}, {0x10, 0x2, [@TCA_U32_HASH={0x8, 0x2, 0x80}, @TCA_U32_ACT={0x4}]}}]}, 0x3c}}, 0x4800) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$inet6(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r5 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x6, 0x4, 0x8, 0xc}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000bf080000000000007b8af8ff00000000bfa200000000000007020000fcffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\r', 0x1}], 0x1}, 0x4) 1.235162829s ago: executing program 0 (id=3576): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r6, 0x2e}, 0x80, &(0x7f0000000700)=[{&(0x7f0000000280)="55ee", 0x2}], 0x1}, 0x8810) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r7, &(0x7f0000000040)={0x1f, 0x2, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}}, 0xe) bind$bt_l2cap(r7, &(0x7f0000002080)={0x1f, 0x0, @any, 0x0, 0x1}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r7, 0x112, 0xf, &(0x7f0000000080)=0x4, 0x4) getsockopt$bt_BT_CHANNEL_POLICY(r7, 0x112, 0xf, 0x0, &(0x7f0000000080)=0x4c) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="200000001000010700000000200000000a0000000c0002006e6c3830323131"], 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r8) recvmmsg(r8, &(0x7f0000008ac0)=[{{0x0, 0x0, 0x0}, 0xa}, {{0x0, 0x0, &(0x7f0000007340)=[{&(0x7f0000005ec0)=""/112, 0x70}, {&(0x7f0000005f40)=""/130, 0x82}, {&(0x7f0000006000)=""/4096, 0x1000}, {&(0x7f0000007000)=""/7, 0x7}, {&(0x7f0000007080)=""/129, 0x81}, {&(0x7f0000007140)=""/93, 0x5d}, {&(0x7f00000071c0)=""/165, 0xa5}, {&(0x7f0000000480)=""/111, 0x6f}, {&(0x7f0000007300)=""/34, 0x22}], 0x9}}], 0x2, 0x40, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) socket$tipc(0x1e, 0x5, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@gettaction={0x20, 0x32, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1, 0x1}}]}, 0x20}, 0x1, 0x0, 0x0, 0x80}, 0x0) 1.072470892s ago: executing program 1 (id=3577): r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x85, &(0x7f0000000000)={r3, @in={{0x2, 0x4e24, @empty}}, 0x27c0}, 0x90) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000000c0)={r3, 0x2, 0xfffff5da, 0x100}, &(0x7f0000000140)=0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x28, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x71, 0x11, 0xba}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0x85, 0x0, 0x0, 0x76}, @exit], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) connect$vsock_stream(r5, &(0x7f0000000080), 0x10) ioctl$sock_inet6_tcp_SIOCINQ(r5, 0x541b, &(0x7f0000000300)) r6 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_j1939(r6, &(0x7f0000000340)={0x1d, r7, 0x0, {0x2, 0xff, 0x6}, 0xfe}, 0x18) setsockopt$sock_int(r6, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) sendmmsg(r6, &(0x7f000000a540)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000005c0)='\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x9}], 0x1}}], 0x1, 0x41) setsockopt$SO_J1939_FILTER(r6, 0x6b, 0x1, &(0x7f0000000480)=[{0x3, 0x2, {0x2}, {0x0, 0xf0, 0x3}, 0xff, 0x2}], 0x20) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newtfilter={0x24, 0x11, 0x1, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x74, r7, {0x0, 0xc}, {0xfff1, 0xffff}, {0x2, 0x8}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4012}, 0x4008050) 911.515955ms ago: executing program 2 (id=3578): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000002738de234960e2f39a77a049e00c016818eba75951a1cdd4755db3cd2ad25a5ac8cc2c45f52a989951c6020f87dcff78", @ANYRES16=r5, @ANYBLOB="0100000000000000000002000000"], 0x14}}, 0x0) writev(r3, &(0x7f0000000040)=[{&(0x7f0000000000)='a', 0x1}, {0x0, 0x10}], 0x2) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r4) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x4c, 0x2c, 0xc3f, 0x70bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r6, {0x3, 0x2}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x1c, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8100}, @TCA_FLOWER_KEY_VLAN_ETH_TYPE={0x6, 0x19, 0x88a8}, @TCA_FLOWER_KEY_CVLAN_ETH_TYPE={0x6, 0x4f, 0x86dd}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000810}, 0x20084084) 770.530094ms ago: executing program 4 (id=3579): r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000000)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="440000001000030400"/20, @ANYRES32=r1, @ANYBLOB="56060800000000002400128009000100626f6e640000000014000280050022"], 0x44}}, 0x40) 408.9381ms ago: executing program 1 (id=3580): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) (async, rerun: 64) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a000000090002007f797a31d20000000800044000000002200003801c0000800c00018006000100000000000c0004400000000000000007140000001100010500000a"], 0x70}, 0x1, 0x0, 0x0, 0x240081d0}, 0x40) (rerun: 64) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$RDMA_NLDEV_CMD_PORT_GET(r2, &(0x7f00000004c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f00000005c0)=ANY=[@ANYBLOB="800000000514e9812cbd7000250800010000000000080003000000000008000100010000000800030004000000080000000800030004000000085a41cc0a8abc1f5cb1e22d08000000030001ed000008000100020000000800030002000000080001000200000008000300040000004eeaaa37dc2a2413fbd7221e8c23c889a4b7e1e3ebb501002ef8c9c0d6a2782cfbccb2917bfdc6fe21a56890a008e798cd00241cedf1c4b074b37d442b8d1f7c04015f5e6962f3f660a34b2d619dbea7f487950cabbe3891dfa5c2a24337915e000000000000000000"], 0x80}, 0x1, 0x0, 0x0, 0x8010}, 0x800) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000080)=ANY=[], 0x10448) (async) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r4, 0x0, 0x8008000000010, &(0x7f0000000100)="17000000020001000003d68c5ee1768812003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dbffffffffffffffff1f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e00000000000070000000051c9844dc9031379b67a885813c8c9", 0xb8) (async) r5 = socket$can_raw(0x1d, 0x3, 0x1) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x1b, &(0x7f00000000c0)={@remote={0xfe, 0x80, '\x00', 0xffffffffffffffff}}, 0x20) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r7, 0x29, 0x1b, &(0x7f0000000000)={@dev}, 0x14) r8 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r8, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) (async) setsockopt$inet6_mreq(r8, 0x29, 0x1c, &(0x7f00000001c0)={@remote}, 0x14) (async) setsockopt$CAN_RAW_FD_FRAMES(r5, 0x65, 0x5, &(0x7f0000000040)=0x1, 0x4) (async) r9 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8955, &(0x7f0000000000)={{0x2, 0x4e2a, @broadcast}, {0x0, @multicast}, 0x68, {0x2, 0xce23, @empty}}) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00', 0x0}) sendmsg$can_raw(r5, &(0x7f0000000000)={&(0x7f0000000580)={0x1d, r10}, 0x10, &(0x7f00000003c0)={&(0x7f0000000140)=@canfd={{0x1, 0x1, 0x0, 0x1}, 0x19, 0x0, 0x0, 0x0, "fa77068e9ba7f60291c0c2883b46271c1679c3c0cf5101a328bb3fbd261e7eba5594caf70eec1c694f644e13312db4bda5b524b6e151c1deaf3e9edb7a56adcb"}, 0x48}, 0x2, 0x0, 0x0, 0x8840}, 0x10048808) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0xefff, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x20000880) close(0x3) (async) ioctl$F2FS_IOC_START_ATOMIC_WRITE(r2, 0xf501, 0x0) 407.342385ms ago: executing program 3 (id=3581): r0 = socket(0x2, 0x6, 0x4) (async) r1 = socket(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000177ff4)={0x10, 0x0, 0x1}, 0xc) write(r1, &(0x7f0000000140)="2600000022004701050000070000000000000020002b1f000a4a51f1ee839cd53400b017ca5b", 0x26) setsockopt$sock_int(r1, 0x1, 0x21, &(0x7f0000b4bffc)=0x8, 0x4) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x4, [@datasec={0x2, 0x1, 0x0, 0xf, 0x3, [{}], "00ba00"}, @datasec={0x0, 0x0, 0x0, 0xf, 0x1, [], 'k'}]}, {0x0, [0x0, 0x5f]}}, &(0x7f0000000400)=""/188, 0x44, 0xbc, 0x1}, 0x28) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000001400)=@nat={'nat\x00', 0x62, 0x5, 0x338, 0xa8, 0x150, 0xffffffff, 0xa8, 0x0, 0x2a0, 0x2a0, 0xffffffff, 0x2a0, 0x2a0, 0x5, 0x0, {[{{@uncond, 0x0, 0x70, 0xa8, 0x0, {0x22e}}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x25, {0x3, @local, @broadcast, @port, @port=0x2}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x8, @remote, @empty, @gre_key, @gre_key}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 'batadv0\x00', 'bond0\x00', {0xff}}, 0x0, 0x70, 0xa8}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @multicast1, @multicast2, @icmp_id=0x65, @gre_key}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x17, @local, @remote, @icmp_id, @icmp_id=0x64}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x398) (async) sendmmsg(r1, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f00000000c0)='x', 0x1}], 0x1}}], 0x1, 0x20040020) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0xe0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x6, 0x4, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0], 0x0, 0xfc, &(0x7f0000000140)=[{}], 0x8, 0x10, &(0x7f0000000180), &(0x7f00000001c0), 0x8, 0x15, 0x8, 0x8, &(0x7f0000000200)}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000400)={'tunl0\x00', &(0x7f0000000380)={'gretap0\x00', r6, 0x40, 0x1, 0x846e, 0x9, {{0x14, 0x4, 0x1, 0x8, 0x50, 0x64, 0x0, 0xff, 0x6, 0x0, @multicast2, @broadcast, {[@noop, @generic={0x94, 0xd, "d7b179a10d5be65ae61e1c"}, @cipso={0x86, 0x22, 0x0, [{0x5, 0xc, "c1e9a01f1d00cd6ddbb9"}, {0x5, 0x8, "61d72537a4f1"}, {0x5, 0x8, "5f3d848979f3"}]}, @end, @end, @generic={0xd2, 0x7, "46fc6b02b7"}]}}}}}) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="9feb01005ffc000000000000000000000000000002000000000045f14e0178ad34f181dc865caebf75dc7b5c519a2229b99bd743ead8dbeb2b6124e48d085baf56b2be9dc17e72716add95d15a"], 0x0, 0xfc5f}, 0x20) ioctl$EXT4_IOC_GETSTATE(r7, 0x40046629, &(0x7f0000000000)) 341.697046ms ago: executing program 3 (id=3582): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x275a, 0x0) ioctl$BTRFS_IOC_SYNC(r0, 0x9408, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) pwritev(r1, &(0x7f0000000100)=[{&(0x7f0000000040)="8e", 0x1}], 0x1, 0x4008001, 0x80) sendfile(r1, r0, 0x0, 0xf03a0005) ioctl$XFS_IOC_FD_TO_HANDLE(r1, 0xc038586a, &(0x7f0000006500)={r1, &(0x7f00000065c0)='Cr\x9d\xbdD\x80\t\xf8\xe3i\x8b\xce\x8f\xc4S]\xb0\xf1]\xf6\x18\x88\x90\x1c\x8a\xe5\xa2`a\n\xe5R\xefX\xec\x96\xf24d\xd7\x88\xcc\xda\xb6\x90\xa8\x0f\xb2\xe8q\xd7\r\x15\xa7\xec\xa0\xd3\xceH\xb2\xafJ`\x8d;\r\x17\x16\xbd%\v\x06\xe6vD\xfb\x93\n\x96`\xa8\xac\xc2\x00\x00\x00\x00\x00\x00\x00\x00', 0x40200, &(0x7f0000006440)={@_ha_fsid={[0x1, 0xfffffff8]}, {0x12, 0x4, 0x101, 0xef}}, 0x0, &(0x7f0000006480)={@_ha_fsid}, &(0x7f00000064c0)=0x200}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f00000005c0)=@mangle={'mangle\x00', 0x2, 0x6, 0x580, 0x0, 0x310, 0x0, 0x0, 0x1d8, 0x4b0, 0x4b0, 0x4b0, 0x4b0, 0x4b0, 0x6, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @remote}, [0x0, 0xff, 0xff000000, 0xff000000], [0x0, 0xffffff00, 0xffffff00, 0xffffffff], 'gretap0\x00', 'batadv_slave_0\x00', {}, {0xff}, 0x2b, 0x5, 0x1, 0x18}, 0x0, 0xd0, 0xf8, 0x0, {0x7a00000010000000}, [@inet=@rpfilter={{0x28}, {0x1}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xe0}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0xfc, 0x6}}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0xb4}, @initdev={0xfe, 0x88, '\x00', 0xfd, 0x0}, [0xff], [0xffffff00], '\x00', 'bond_slave_0\x00', {}, {0xff}}, 0x0, 0xf0, 0x138, 0x48000000, {}, [@common=@dst={{0x48}, {0xff, 0x4, 0x0, [0x1, 0x7a, 0xfffd, 0x3f4, 0x0, 0x3, 0x5, 0x0, 0x8, 0x30, 0xe5, 0x4, 0x1, 0x6, 0x0, 0x1], 0x6}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, 'ip6gre0\x00', {0x4}}}}, {{@ipv6={@remote, @dev={0xfe, 0x80, '\x00', 0xd}, [0x0, 0xffff00, 0xffffffff], [0xffffff00, 0xffffff00, 0xffffff00, 0xff000000], 'nr0\x00', 'vxcan1\x00', {}, {}, 0x62, 0x5, 0x3, 0x20}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x2, 0xf}}}, {{@ipv6={@mcast1, @private0, [0xff000000, 0xffffff, 0x0, 0xffffff00], [0xffffff00, 0xffffff00, 0xff, 0xff000000], 'pim6reg1\x00', 'hsr0\x00', {}, {}, 0x6c, 0x80, 0x5, 0x61}, 0x0, 0xa8, 0xd0}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5e0) bpf$PROG_LOAD(0x5, &(0x7f0000006340)={0x18, 0xc, &(0x7f0000006540)=ANY=[@ANYBLOB="180000000000000000000000000000008500000008000000187b1af8ff004af800bfa100000000000b0300"/53, @ANYRESHEX=r2], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x34, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x14, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa2"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xae, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x12, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000791838000000000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x94) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r4, 0x0) recvmmsg(r4, &(0x7f00000004c0), 0xf02, 0xf0, 0x0) recvmmsg(r4, &(0x7f0000006080)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000000)=""/15, 0x38}, {&(0x7f0000000040)=""/149, 0x95}, {&(0x7f0000000100)=""/185, 0xb9}, {&(0x7f00000001c0)=""/170, 0xaa}], 0x4, &(0x7f00000002c0)=""/73, 0x49}, 0x18000}, {{0x0, 0x0, &(0x7f00000035c0)=[{&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/160, 0xa0}, {&(0x7f0000001400)=""/4096, 0x1000}, {&(0x7f0000002400)=""/4096, 0x1000}, {&(0x7f0000003400)=""/167, 0xa7}, {&(0x7f00000034c0)=""/9, 0x9}, {&(0x7f0000003500)=""/138, 0xfffffffffffffe9b}], 0x7}, 0x7b8}, {{&(0x7f0000003640)=@alg, 0x80, &(0x7f00000039c0)=[{&(0x7f00000036c0)=""/213, 0xd5}, {&(0x7f00000037c0)=""/10, 0xa}, {&(0x7f0000003800)=""/199, 0xc7}, {&(0x7f0000003900)=""/183, 0xb7}], 0x4}, 0x4}, {{&(0x7f0000003a00)=@hci, 0x80, &(0x7f0000003c80)=[{&(0x7f0000003a80)=""/150, 0x96}, {&(0x7f0000003b40)=""/99, 0x63}, {&(0x7f0000003bc0)=""/142, 0x8e}], 0x3, &(0x7f0000003cc0)=""/251, 0xfb}, 0x5710925a}, {{&(0x7f0000003dc0)=@nl=@proc, 0x80, &(0x7f0000004f00), 0x2, &(0x7f0000004f40)=""/98, 0x62}, 0x3}, {{&(0x7f0000004fc0)=@ax25={{}, [@netrom, @null, @null, @null, @rose, @null, @netrom]}, 0x80, &(0x7f0000006040)=[{&(0x7f0000003e40)=""/4096, 0x1000}], 0x1}, 0x400}], 0x6, 0x10142, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000006200)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000062c0)={'erspan0\x00', &(0x7f0000006240)={'syztnl1\x00', r5, 0x10, 0x10, 0x5, 0x9d, {{0x16, 0x4, 0x1, 0x5, 0x58, 0x67, 0x0, 0x2, 0x2f, 0x0, @empty, @rand_addr=0x64010100, {[@ra={0x94, 0x4, 0x1}, @timestamp_addr={0x44, 0xc, 0x87, 0x1, 0x3, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}]}, @timestamp_prespec={0x44, 0xc, 0x6d, 0x3, 0x8, [{@broadcast, 0x6}]}, @rr={0x7, 0x7, 0xb8, [@private=0xa010102]}, @rr={0x7, 0x1f, 0x63, [@loopback, @empty, @loopback, @multicast2, @empty, @remote, @private=0xa010101]}]}}}}}) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x7, 0x4, 0x8, 0x2}, 0x48) bpf$MAP_LOOKUP_ELEM(0x4, &(0x7f0000000080)={r6, &(0x7f0000000300), 0x0}, 0x20) bpf$PROG_BIND_MAP(0x23, &(0x7f0000006300)={r3, r6}, 0xc) 286.911507ms ago: executing program 0 (id=3583): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@ipv6_newroute={0x44, 0x18, 0x1, 0x70bd31, 0x25dfdbfc, {0xa, 0x0, 0x0, 0x0, 0xff, 0x2, 0xff, 0x0, 0x100}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x8}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @SEG6_IPTUNNEL_SRH={0x14, 0x1, {{0x2, {0x60, 0x0, 0x4, 0x0, 0x2, 0x58, 0x7}}}}}]}, 0x44}}, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x24, r5, 0x11, 0x0, 0x3, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r4}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x24}}, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x2c, r5, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x94}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc4}, 0x4800) 522.414µs ago: executing program 0 (id=3584): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25GFACILITIES(r0, 0x89e2, &(0x7f0000000000)) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f00000009c0)=ANY=[@ANYRES64=r1], 0x34}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) (async) ioctl$OCFS2_IOC_UNRESVSP(r0, 0x40305829, &(0x7f0000000040)={0x0, 0x1, 0x6, 0xfffffffffffffc00, 0xea0, 0x6}) socket$kcm(0x29, 0x5, 0x0) 0s ago: executing program 1 (id=3585): bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[], 0x37) syz_init_net_socket$x25(0x9, 0x5, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x840) unshare(0x2c020400) write$nci(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="6006020a"], 0x6) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NFQNL_MSG_VERDICT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x28, 0x3, 0x3, 0x3, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFQA_MARK={0x8, 0x3, 0x1, 0x0, 0x80000001}, @NFQA_VERDICT_HDR={0xc, 0x2, {0xfffffffffffffffe, 0x8}}]}, 0x28}, 0x1, 0x0, 0x0, 0x40008c0}, 0x40) sendmsg$nl_route(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c00000010003df600"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001c0012800b0001676500000c00028008000300580200000000000000db20163ecf41e273890c9473fb482d2211c82ee190e0f1d4f45b22f2cd94248702130eb88bc95ea06d45da4cc057f17bcb05ebd2e21bf156f262ccfaea0afe565e038384838a461bf90e15ddc44e4ac2f88b4979c71fb8ef051bc7243c852f00a335d5cf97ff3d98f4d03fe7952e9e41cfa628ff5ec556"], 0x3c}}, 0x0) kernel console output (not intermixed with test programs): aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa [ 324.256119][T12976] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1942'. [ 324.410382][T12976] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1942'. [ 324.439839][T12979] netlink: 'syz.2.1943': attribute type 32 has an invalid length. [ 324.454170][T12981] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1944'. [ 324.555094][T12981] 8021q: adding VLAN 0 to HW filter on device bond9 [ 324.618606][T12984] geneve6: entered promiscuous mode [ 324.656845][T12984] geneve6: entered allmulticast mode [ 324.673444][ T1105] netdevsim netdevsim3 netdevsim3: set [1, 2] type 2 family 0 port 63226 - 0 [ 324.733304][ T1105] netdevsim netdevsim3 netdevsim2: set [1, 2] type 2 family 0 port 63226 - 0 [ 324.763518][ T1105] netdevsim netdevsim3 netdevsim1: set [1, 2] type 2 family 0 port 63226 - 0 [ 324.796195][ T1105] netdevsim netdevsim3 netdevsim0: set [1, 2] type 2 family 0 port 63226 - 0 [ 324.923898][T13000] tipc: Enabling of bearer rejected, failed to enable media [ 324.988443][T12999] netlink: 'syz.3.1949': attribute type 11 has an invalid length. [ 325.120337][T13008] tipc: Failed to remove unknown binding: 66,1,1/2078600711:219303253/219303255 [ 325.177147][T13010] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 325.253871][T13010] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 325.300126][T13010] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 325.332332][T13010] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 325.370887][T13018] ipvlan2: entered promiscuous mode [ 325.375066][T13010] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 325.417847][T13010] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 325.456037][T13010] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 325.484248][T13010] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 325.536172][T13010] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 325.555830][T13010] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 325.884241][ T808] IPVS: starting estimator thread 0... [ 325.983004][T13042] IPVS: using max 25 ests per chain, 60000 per kthread [ 326.168266][T10206] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 326.177176][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 326.576605][T13067] netlink: 'syz.1.1971': attribute type 2 has an invalid length. [ 327.003737][T13086] x_tables: duplicate underflow at hook 2 [ 327.536650][T13113] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 327.788313][T13118] netlink: 'syz.2.1986': attribute type 1 has an invalid length. [ 327.835686][T13122] __nla_validate_parse: 11 callbacks suppressed [ 327.835706][T13122] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1987'. [ 327.891130][T13122] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1987'. [ 328.085997][T10186] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 328.095493][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 328.296476][T13141] sctp: [Deprecated]: syz.2.1992 (pid 13141) Use of int in maxseg socket option. [ 328.296476][T13141] Use struct sctp_assoc_value instead [ 328.429574][T13141] netlink: 'syz.2.1992': attribute type 21 has an invalid length. [ 328.448551][T13141] netlink: 'syz.2.1992': attribute type 22 has an invalid length. [ 328.473113][T13141] netlink: 'syz.2.1992': attribute type 23 has an invalid length. [ 328.492340][T13141] netlink: 'syz.2.1992': attribute type 25 has an invalid length. [ 328.520332][T13141] netlink: 'syz.2.1992': attribute type 26 has an invalid length. [ 328.539083][T13141] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1992'. [ 328.702677][T13154] netlink: 'syz.0.1997': attribute type 2 has an invalid length. [ 328.729747][T13163] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1999'. [ 329.191934][T13185] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 329.337706][T10208] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x6 [ 329.363185][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 329.665217][T13202] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2009'. [ 330.299502][T13229] openvswitch: netlink: VXLAN extension 317 out of range max 1 [ 330.623566][T13211] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 330.659280][T13211] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 330.723989][ T5629] Bluetooth: hci4: command 0x0405 tx timeout [ 330.819890][T13211] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 330.837496][T13211] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 330.911240][T13211] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 330.944994][T13211] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 330.999608][T13211] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 331.038392][T13211] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 331.102760][T13211] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 331.131326][T13211] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 331.925427][T10182] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 331.934289][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 332.230781][T13269] netlink: 1344 bytes leftover after parsing attributes in process `syz.1.2032'. [ 332.339215][T13289] tipc: Trying to set illegal importance in message [ 333.843738][T10186] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 333.852559][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 334.319316][T13338] xt_hashlimit: size too large, truncated to 1048576 [ 334.352605][T13338] xt_hashlimit: size too large, truncated to 1048576 [ 334.425160][T13346] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2061'. [ 334.441664][T13346] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2061'. [ 334.492591][T13344] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 334.508699][T13346] netlink: 'syz.4.2061': attribute type 14 has an invalid length. [ 334.563730][T13346] netlink: 'syz.4.2061': attribute type 13 has an invalid length. [ 334.595931][T13344] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 335.156712][T13372] netlink: 'syz.4.2069': attribute type 30 has an invalid length. [ 335.280410][T13377] netlink: 'syz.0.2071': attribute type 21 has an invalid length. [ 335.368753][T13372] bond10: option arp_missed_max: invalid value (0) [ 335.386586][T13372] bond10: option arp_missed_max: allowed values 1 - 255 [ 335.401134][T13372] bond10 (unregistering): Released all slaves [ 335.445955][T13377] netlink: 132 bytes leftover after parsing attributes in process `syz.0.2071'. [ 335.549738][T13385] gretap0: entered promiscuous mode [ 335.572029][T13385] vlan4: entered promiscuous mode [ 335.736014][T13398] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2074'. [ 336.119804][T13408] syzkaller0: entered promiscuous mode [ 336.145943][T13408] syzkaller0: entered allmulticast mode [ 336.241595][T13408] tipc: Can't bind to reserved service type 1 [ 336.959170][T13447] ksmbd: Unknown IPC event: 1, ignore. [ 337.641040][T13465] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 337.699853][T13467] xt_hashlimit: size too large, truncated to 1048576 [ 337.726354][T13465] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 340.256382][T13463] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2091'. [ 340.265706][T13463] netlink: 80 bytes leftover after parsing attributes in process `syz.0.2091'. [ 340.448144][T13499] tipc: Enabled bearer , priority 0 [ 340.515381][T13509] nbd: must specify a device to reconfigure [ 340.695660][T13521] netlink: 'syz.3.2106': attribute type 11 has an invalid length. [ 340.708886][T13499] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 340.787313][T13499] syzkaller0: entered promiscuous mode [ 340.807957][T13499] syzkaller0: entered allmulticast mode [ 340.827238][T13499] tipc: Resetting bearer [ 340.850888][T13512] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2103'. [ 340.906648][T13522] syzkaller1: entered promiscuous mode [ 340.921946][T13522] syzkaller1: entered allmulticast mode [ 340.948926][T13514] tipc: Resetting bearer [ 341.021921][T13514] tipc: Disabling bearer [ 341.474088][T13541] IPVS: Unknown mcast interface: vcan0 [ 341.515048][T13541] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2111'. [ 341.651331][T13551] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2114'. [ 341.877803][T13561] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2115'. [ 341.985376][T13567] netlink: 'syz.2.2119': attribute type 12 has an invalid length. [ 341.998886][T13571] Bluetooth: MGMT ver 1.23 [ 342.184469][T13579] netlink: 232 bytes leftover after parsing attributes in process `syz.3.2123'. [ 342.196498][T13579] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2123'. [ 342.198184][T13581] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2124'. [ 342.218340][T13581] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2124'. [ 342.221101][T13579] veth1_to_bond: entered allmulticast mode [ 342.291117][T13581] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 342.316818][T13579] veth1_to_bond: entered promiscuous mode [ 342.332661][T13579] veth1_to_bond (unregistering): left allmulticast mode [ 342.355364][T13579] veth1_to_bond (unregistering): left promiscuous mode [ 342.416738][T10182] smc: removing ib device syz2 [ 342.689285][T10182] smbdirect: ib_dev[syz2] removed [ 342.751586][T13596] netlink: 'syz.1.2129': attribute type 64 has an invalid length. [ 343.260366][T13606] syzkaller0: entered promiscuous mode [ 343.270420][T13615] xt_ipcomp: unknown flags 1D [ 343.287271][T13615] SET target dimension over the limit! [ 343.304162][T13606] syzkaller0: entered allmulticast mode [ 343.508395][T13625] netlink: 'syz.2.2139': attribute type 11 has an invalid length. [ 343.529487][T13625] netlink: 'syz.2.2139': attribute type 4 has an invalid length. [ 343.818463][T13634] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 343.826609][T13634] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 344.040036][T13640] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 344.051429][T13640] openvswitch: netlink: Duplicate or invalid key (type 0). [ 344.059221][T13640] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 344.083865][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 344.337811][T13643] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 344.423157][T13643] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 344.545598][T13650] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 345.688161][T13688] IPVS: set_ctl: invalid protocol: 20551 172.20.20.10:0 [ 346.016837][T13701] xt_l2tp: v2 tid > 0xffff: 1114244 [ 346.106116][T13704] IPVS: set_ctl: invalid protocol: 0 127.0.0.1:20003 [ 346.184993][T13701] __nla_validate_parse: 6 callbacks suppressed [ 346.185037][T13701] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2163'. [ 346.246665][T13708] netlink: 'syz.0.2165': attribute type 62 has an invalid length. [ 346.249793][T13701] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2163'. [ 346.290472][T13711] netlink: 1 bytes leftover after parsing attributes in process `syz.4.2166'. [ 346.364960][T13711] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2166'. [ 346.386655][T13711] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2166'. [ 346.425628][T13715] nbd: couldn't find a device at index -1503458156 [ 346.715350][T13735] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2172'. [ 346.744888][T13733] netlink: 'syz.2.2171': attribute type 21 has an invalid length. [ 346.758120][T13735] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 346.760392][T13736] No such timeout policy "syz0" [ 346.860343][T13739] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2174'. [ 347.188870][T13759] netlink: 'syz.0.2180': attribute type 1 has an invalid length. [ 347.278261][ T29] audit: type=1804 audit(1785553794.527:5): pid=13765 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2182" name="/newroot/466/cgroup.controllers" dev="tmpfs" ino=2399 res=1 errno=0 [ 347.292672][T13759] 8021q: adding VLAN 0 to HW filter on device bond8 [ 347.332828][ T29] audit: type=1800 audit(1785553794.557:6): pid=13765 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2182" name="cgroup.controllers" dev="tmpfs" ino=2399 res=0 errno=0 [ 347.591552][T13773] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2185'. [ 347.690075][T13778] netlink: 244 bytes leftover after parsing attributes in process `syz.2.2188'. [ 347.879522][T13794] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2190'. [ 348.009422][T13799] netlink: 'syz.1.2192': attribute type 33 has an invalid length. [ 348.159324][T13799] bond7: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 348.197216][T13799] bond7 (unregistering): Released all slaves [ 348.298410][T13807] hsr_slave_0: left promiscuous mode [ 348.321231][T13807] hsr_slave_1: left promiscuous mode [ 348.529370][T13821] netlink: 'syz.2.2196': attribute type 3 has an invalid length. [ 348.925907][T13835] netlink: zone id is out of range [ 348.952020][T13835] netlink: zone id is out of range [ 348.982152][T13835] netlink: zone id is out of range [ 348.999824][T13835] netlink: zone id is out of range [ 349.010924][T13835] netlink: zone id is out of range [ 349.035493][T13835] netlink: zone id is out of range [ 349.067316][T13835] netlink: zone id is out of range [ 349.074090][T13835] netlink: zone id is out of range [ 349.096635][T13835] netlink: zone id is out of range [ 349.105307][T13835] netlink: zone id is out of range [ 349.198163][T13847] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 349.211442][T13851] netlink: 'syz.2.2206': attribute type 11 has an invalid length. [ 349.231014][T13852] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 349.431989][T13865] syzkaller0: entered promiscuous mode [ 349.455687][T13865] syzkaller0: entered allmulticast mode [ 350.402182][T13886] veth0: entered allmulticast mode [ 350.652594][T13896] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 350.660750][T13901] openvswitch: netlink: IP tunnel dst address not specified [ 350.701031][T13896] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 350.741250][T13896] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 351.078821][T13917] netlink: 'syz.3.2224': attribute type 1 has an invalid length. [ 351.087346][T13914] syzkaller0: entered promiscuous mode [ 351.094505][T13914] syzkaller0: entered allmulticast mode [ 351.100155][T13917] netlink: 'syz.3.2224': attribute type 7 has an invalid length. [ 351.111628][T13917] netlink: 'syz.3.2224': attribute type 8 has an invalid length. [ 351.119882][T13917] NCSI netlink: No device for ifindex 65584 [ 351.176727][T13917] netlink: 'syz.3.2224': attribute type 15 has an invalid length. [ 351.210297][T13920] __nla_validate_parse: 10 callbacks suppressed [ 351.210318][T13920] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2225'. [ 351.228931][T13917] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2224'. [ 351.300601][T13917] netlink: 'syz.3.2224': attribute type 15 has an invalid length. [ 351.333222][T10184] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 351.345561][T13917] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2224'. [ 351.351127][T10184] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 351.384601][T10184] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 351.398277][T13926] netlink: 216 bytes leftover after parsing attributes in process `syz.1.2226'. [ 351.433441][T10203] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 351.702081][T13938] sctp: [Deprecated]: syz.4.2228 (pid 13938) Use of int in max_burst socket option deprecated. [ 351.702081][T13938] Use struct sctp_assoc_value instead [ 352.431412][T13966] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2238'. [ 353.244638][T14001] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2251'. [ 353.730100][T14028] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2256'. [ 353.775509][T14029] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2256'. [ 353.784982][T14036] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 353.815570][T14029] dummy0: Caught tx_queue_len zero misconfig [ 354.420322][T14063] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2266'. [ 354.719996][T14079] xt_hashlimit: size too large, truncated to 1048576 [ 354.861852][T14088] IPVS: length: 209 != 24 [ 355.310356][T14107] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2277'. [ 355.327380][T14107] netlink: 'syz.3.2277': attribute type 10 has an invalid length. [ 355.372044][T14101] syzkaller0: mtu less than device minimum [ 355.710701][T14118] netlink: 'syz.1.2280': attribute type 9 has an invalid length. [ 356.067234][T14131] sit0: Caught tx_queue_len zero misconfig [ 356.380816][T14107] infiniband syz1: set active [ 356.387889][T14107] infiniband syz1: added bridge_slave_1 [ 356.415870][T14107] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 356.431284][T14107] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 356.450369][T14107] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 356.514119][T14107] RDS/IB: syz1: added [ 356.520695][T14107] smc: adding ib device syz1 with port count 1 [ 356.527881][T14107] smc: ib device syz1 port 1 has no pnetid [ 356.590004][T14149] netlink: 'syz.2.2287': attribute type 2 has an invalid length. [ 357.674684][T14182] __nla_validate_parse: 1 callbacks suppressed [ 357.674705][T14182] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2296'. [ 357.821860][T14184] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2296'. [ 357.939816][T14185] IPVS: set_ctl: invalid protocol: 11608 255.255.255.255:20001 [ 358.025268][T14191] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2298'. [ 358.074259][T14191] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2298'. [ 358.135605][T14199] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2301'. [ 358.290350][T14198] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2300'. [ 358.346741][T14202] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2302'. [ 358.479190][T14202] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2302'. [ 358.772648][T14220] netlink: 1196 bytes leftover after parsing attributes in process `syz.2.2307'. [ 358.836691][T14222] netlink: 'syz.4.2308': attribute type 1 has an invalid length. [ 358.981457][T14231] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2310'. [ 359.795694][T14254] syzkaller1: entered promiscuous mode [ 359.804116][T14254] syzkaller1: entered allmulticast mode [ 359.979496][T14257] xt_hashlimit: size too large, truncated to 1048576 [ 360.036451][T14259] bridge_slave_0 (unregistering): left allmulticast mode [ 360.063028][T14259] bridge_slave_0 (unregistering): left promiscuous mode [ 360.082318][T14259] bridge0: port 1(bridge_slave_0) entered disabled state [ 361.800644][T14232] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 362.228165][T14278] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 362.695072][T14301] netlink: 'syz.0.2326': attribute type 2 has an invalid length. [ 362.789788][T14309] __nla_validate_parse: 2 callbacks suppressed [ 362.789810][T14309] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2327'. [ 363.043520][T14322] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2332'. [ 363.085940][T14322] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 363.741659][T14349] openvswitch: netlink: VXLAN extension 149 out of range max 1 [ 364.118615][ T5287] veth1_vlan: left promiscuous mode [ 364.344893][T14357] geneve2: entered promiscuous mode [ 364.423682][T10184] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 54241 - 0 [ 364.454793][T10184] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 54241 - 0 [ 364.471082][T14379] xt_hashlimit: max too large, truncated to 1048576 [ 364.489896][T14378] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2345'. [ 364.507795][T10184] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 54241 - 0 [ 364.521653][T14379] No such timeout policy "syz1" [ 364.535453][T10184] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 54241 - 0 [ 364.551725][T14378] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2345'. [ 364.625624][T14378] netlink: 'syz.2.2345': attribute type 178 has an invalid length. [ 364.628423][T14383] sch_fq: defrate 32768 ignored. [ 364.689812][T14383] xt_hashlimit: overflow, try lower: 18446744073709551613/4 [ 364.771353][T14388] netlink: 'syz.0.2347': attribute type 9 has an invalid length. [ 364.840030][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056e4a400: rx timeout, send abort [ 365.049977][T14406] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2351'. [ 365.351545][ C0] vcan0: j1939_tp_rxtimer: 0xffff888056e4a400: abort rx timeout. Force session deactivation [ 365.482097][T14423] netlink: 'syz.2.2356': attribute type 4 has an invalid length. [ 365.525553][T14423] netlink: 17 bytes leftover after parsing attributes in process `syz.2.2356'. [ 366.244257][T14458] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2366'. [ 366.561717][T14475] IPVS: set_ctl: invalid protocol: 60 224.0.0.2:20001 [ 367.078158][T14501] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2374'. [ 367.134173][T14501] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2374'. [ 367.172202][T14504] netlink: 100 bytes leftover after parsing attributes in process `syz.1.2376'. [ 367.424963][T14506] sit0: left promiscuous mode [ 367.466750][T14506] ip6gretap0: left allmulticast mode [ 367.661437][T14506] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 367.687984][T14506] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 367.708856][T14513] tipc: Enabled bearer , priority 10 [ 367.771512][T14506] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 367.801000][T14506] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 367.878187][T14506] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 368.307069][T14550] netlink: 'syz.1.2387': attribute type 10 has an invalid length. [ 368.841776][T14571] tipc: Enabling of bearer rejected, failed to enable media [ 368.884061][T14571] openvswitch: netlink: IP tunnel attribute has 1 unknown bytes. [ 369.282399][T14593] __nla_validate_parse: 1 callbacks suppressed [ 369.282420][T14593] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2399'. [ 369.558855][T14601] netlink: 'syz.3.2401': attribute type 1 has an invalid length. [ 369.741583][T14601] 8021q: adding VLAN 0 to HW filter on device bond8 [ 369.966537][T14612] bond8: (slave veth5): Enslaving as an active interface with a down link [ 369.979009][T14627] netlink: 'syz.3.2401': attribute type 10 has an invalid length. [ 370.022472][T14627] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2401'. [ 370.305697][T14642] netlink: 'syz.1.2407': attribute type 1 has an invalid length. [ 370.325462][T14642] netlink: 200 bytes leftover after parsing attributes in process `syz.1.2407'. [ 370.521198][T14646] netlink: 'syz.3.2410': attribute type 8 has an invalid length. [ 370.642811][T14650] pim6reg: entered allmulticast mode [ 370.775548][T14658] xt_NFQUEUE: number of total queues is 0 [ 370.809954][T14659] syzkaller1: left promiscuous mode [ 370.839919][T14659] syzkaller1: left allmulticast mode [ 370.882178][T14653] team0: Caught tx_queue_len zero misconfig [ 370.918611][T14654] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 371.205030][T14673] netlink: 'syz.3.2417': attribute type 1 has an invalid length. [ 371.229455][T14673] netlink: 224 bytes leftover after parsing attributes in process `syz.3.2417'. [ 371.277651][T14673] nbd: couldn't find a device at index 513 [ 371.304842][T14679] netlink: 'syz.0.2418': attribute type 23 has an invalid length. [ 372.073420][T14719] IPVS: sync thread started: state = MASTER, mcast_ifn = veth0_to_hsr, syncid = 1, id = 0 [ 372.120720][T14723] netlink: 'syz.2.2430': attribute type 1 has an invalid length. [ 372.791355][T14755] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2439'. [ 372.839868][T14757] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2439'. [ 372.875219][T14757] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2439'. [ 372.917474][T14757] netlink: 'syz.1.2439': attribute type 12 has an invalid length. [ 372.955542][T14757] netlink: 'syz.1.2439': attribute type 11 has an invalid length. [ 373.319821][T14782] syzkaller0: entered promiscuous mode [ 373.345570][T14782] syzkaller0: entered allmulticast mode [ 373.436108][T14787] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2446'. [ 373.844727][T14808] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2446'. [ 373.972170][T14808] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2446'. [ 373.987254][T10174] netdevsim netdevsim3 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 374.017797][T10174] netdevsim netdevsim3 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 374.105012][T10179] netdevsim netdevsim3 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0 [ 374.136283][T10179] netdevsim netdevsim3 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 374.163220][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 374.469751][T14836] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2454'. [ 374.604546][T14843] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2457'. [ 374.658914][T14845] netlink: 'syz.3.2455': attribute type 10 has an invalid length. [ 374.704795][T14845] netlink: 'syz.3.2455': attribute type 1 has an invalid length. [ 374.845125][T14854] netlink: 'syz.3.2455': attribute type 10 has an invalid length. [ 374.865983][T14853] netlink: 'syz.1.2460': attribute type 2 has an invalid length. [ 375.007972][T14862] IPVS: Error connecting to the multicast addr [ 375.681076][T14891] netlink: 'syz.3.2469': attribute type 30 has an invalid length. [ 375.706491][T14895] netlink: 'syz.0.2471': attribute type 39 has an invalid length. [ 375.856695][T14903] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2474'. [ 375.962511][T14891] bond9: option arp_missed_max: invalid value (0) [ 375.972285][T14891] bond9: option arp_missed_max: allowed values 1 - 255 [ 375.994608][T14891] bond9 (unregistering): Released all slaves [ 376.106472][T14918] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2476'. [ 376.309035][T14924] bridge: RTM_NEWNEIGH with unconfigured vlan 1 on bridge0 [ 377.183635][T14951] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2483'. [ 377.416728][T14963] x_tables: duplicate entry at hook 3 [ 377.441184][T14963] netlink: 'syz.2.2486': attribute type 4 has an invalid length. [ 377.688585][T14972] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2488'. [ 378.314513][T15011] ip6gre1: entered promiscuous mode [ 378.355962][T15011] ip6gre1: entered allmulticast mode [ 378.768844][T15027] netlink: 'syz.3.2502': attribute type 1 has an invalid length. [ 378.803145][T15027] netlink: 232 bytes leftover after parsing attributes in process `syz.3.2502'. [ 378.823470][T15027] netlink: 'syz.3.2502': attribute type 1 has an invalid length. [ 378.863051][T15029] netlink: 'syz.4.2503': attribute type 4 has an invalid length. [ 379.359967][T15053] vlan0: entered allmulticast mode [ 379.606098][T15064] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2508'. [ 379.631736][T15064] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2508'. [ 379.718318][T15064] erspan0: entered promiscuous mode [ 379.757074][T15064] syzkaller0: entered allmulticast mode [ 379.780214][T15068] sch_tbf: peakrate 4 is lower than or equals to rate 24576 ! [ 379.965306][T15079] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2513'. [ 380.250074][T15092] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2516'. [ 380.532053][T15108] tipc: Enabled bearer , priority 11 [ 380.562003][T15108] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2519'. [ 380.596499][T15113] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2520'. [ 380.683801][T15113] openvswitch: netlink: IP tunnel dst address not specified [ 380.720739][T15113] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 380.797007][T15120] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2523'. [ 381.108281][T15141] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 381.167632][T15138] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 381.222475][T15149] nbd: nbd1 already in use [ 381.353616][T15156] block nbd1: NBD_DISCONNECT [ 381.407315][T15156] block nbd1: Send disconnect failed -32 [ 381.424901][T15156] block nbd1: Send disconnect failed -32 [ 381.448071][T15156] block nbd1: shutting down sockets [ 381.516464][T15143] nbd: must specify a size in bytes for the device [ 381.919051][T15178] netlink: 240 bytes leftover after parsing attributes in process `syz.0.2536'. [ 381.948632][T15178] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 381.981985][T15180] validate_nla: 1 callbacks suppressed [ 381.982062][T15180] netlink: 'syz.2.2537': attribute type 1 has an invalid length. [ 382.076554][T15180] 8021q: adding VLAN 0 to HW filter on device bond11 [ 382.080142][T15185] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2539'. [ 382.147741][T15180] netlink: 'syz.2.2537': attribute type 10 has an invalid length. [ 382.193514][T15180] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2537'. [ 382.439190][T15202] netlink: 'syz.3.2542': attribute type 12 has an invalid length. [ 383.507865][T15248] xfrm1: entered promiscuous mode [ 383.544347][T15248] xfrm1: entered allmulticast mode [ 383.631876][T15254] RDS: rds_bind could not find a transport for fe80::bb, load rds_tcp or rds_rdma? [ 383.727515][T15272] netlink: 'syz.2.2563': attribute type 1 has an invalid length. [ 383.925726][T15272] 8021q: adding VLAN 0 to HW filter on device bond12 [ 383.964368][T15277] bond12: (slave geneve4): making interface the new active one [ 383.979903][T15277] bond12: (slave geneve4): Enslaving as an active interface with an up link [ 384.302727][T15299] netlink: 'syz.0.2568': attribute type 1 has an invalid length. [ 384.715370][T15317] __nla_validate_parse: 4 callbacks suppressed [ 384.715392][T15317] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2571'. [ 385.232787][T15340] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2576'. [ 385.288796][T15343] netlink: 'syz.1.2578': attribute type 4 has an invalid length. [ 385.314125][T15346] IPv6: NLM_F_CREATE should be specified when creating new route [ 385.317534][T15343] netlink: 17 bytes leftover after parsing attributes in process `syz.1.2578'. [ 385.375381][T15350] netlink: 14601 bytes leftover after parsing attributes in process `syz.1.2578'. [ 385.816631][T15363] netlink: 'syz.1.2584': attribute type 9 has an invalid length. [ 385.891633][T15367] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2586'. [ 386.409811][T15386] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2592'. [ 386.677398][T15395] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2596'. [ 386.904447][T15402] netlink: 'syz.3.2599': attribute type 2 has an invalid length. [ 386.918082][T15402] netlink: 92 bytes leftover after parsing attributes in process `syz.3.2599'. [ 386.921604][T15399] Cannot find add_set index 65532 as target [ 387.222562][T15419] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2605'. [ 387.278173][T15421] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2606'. [ 387.290298][T15421] pim6reg1: entered promiscuous mode [ 387.305535][T15421] pim6reg1: entered allmulticast mode [ 387.529291][T15429] netlink: 'syz.2.2610': attribute type 1 has an invalid length. [ 387.548315][T15433] netlink: 'syz.4.2611': attribute type 61 has an invalid length. [ 387.582792][T15431] netlink: 'syz.2.2610': attribute type 10 has an invalid length. [ 387.665919][T15429] 8021q: adding VLAN 0 to HW filter on device bond13 [ 387.703619][T15430] bond13: (slave veth7): Enslaving as an active interface with a down link [ 387.751451][T15430] bond13: (slave veth9): Enslaving as an active interface with a down link [ 387.794750][T15430] bond13: (slave veth11): Enslaving as an active interface with a down link [ 387.866852][T15430] bond13: (slave veth13): Enslaving as an active interface with a down link [ 387.961835][T15447] netlink: 'syz.4.2614': attribute type 1 has an invalid length. [ 387.975069][T15430] bond13: (slave veth15): Enslaving as an active interface with a down link [ 388.024300][T15447] bond12: entered promiscuous mode [ 388.030208][T15447] 8021q: adding VLAN 0 to HW filter on device bond12 [ 388.100126][T15430] bond13: (slave veth17): Enslaving as an active interface with a down link [ 388.120413][T15447] ipvlan2: entered allmulticast mode [ 388.125922][T15447] bond12: entered allmulticast mode [ 388.250122][T15430] bond13: (slave veth19): Enslaving as an active interface with a down link [ 388.369132][T15430] bond13: (slave veth21): Enslaving as an active interface with a down link [ 388.555057][T15475] netlink: 'syz.2.2621': attribute type 2 has an invalid length. [ 388.721051][T15483] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 389.596956][T15523] bridge0: port 3(dummy0) entered blocking state [ 389.607647][T15523] bridge0: port 3(dummy0) entered disabled state [ 389.626803][T15523] dummy0: entered allmulticast mode [ 389.668313][T15523] dummy0: entered promiscuous mode [ 389.835450][T15530] __nla_validate_parse: 11 callbacks suppressed [ 389.835472][T15530] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2635'. [ 389.878651][T15533] tls_set_device_offload_rx: netdev not found [ 389.916562][T15539] IPv6: Can't replace route, no match found [ 389.956934][T15530] 8021q: adding VLAN 0 to HW filter on device bond13 [ 390.078331][T15544] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2636'. [ 390.225410][T15548] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2637'. [ 390.236594][T15553] netlink: 'syz.3.2638': attribute type 1 has an invalid length. [ 390.328535][T15553] 8021q: adding VLAN 0 to HW filter on device bond9 [ 390.428120][T15564] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2640'. [ 390.428404][T15554] veth0: entered promiscuous mode [ 390.554742][T15551] veth0: left promiscuous mode [ 414.854012][T15589] netlink: 144 bytes leftover after parsing attributes in process `syz.4.2647'. [ 414.887870][T15581] netlink: 'syz.1.2644': attribute type 2 has an invalid length. [ 414.901731][T15586] netlink: 144 bytes leftover after parsing attributes in process `syz.4.2647'. [ 414.914904][T15587] netlink: 'syz.1.2644': attribute type 2 has an invalid length. [ 415.031991][T15587] : entered promiscuous mode [ 415.146791][T15600] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2650'. [ 415.338787][T15608] team0: Device ipvlan0 failed to register rx_handler [ 415.348209][T15612] netlink: 168 bytes leftover after parsing attributes in process `syz.4.2655'. [ 415.691812][T15634] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2660'. [ 415.713512][T15640] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2661'. [ 415.915704][T15646] IPv6: Can't replace route, no match found [ 415.933921][T15648] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2665'. [ 416.577908][T15680] netlink: 'syz.2.2675': attribute type 5 has an invalid length. [ 416.674615][T15679] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 416.936151][T15696] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2680'. [ 417.254672][T15710] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2685'. [ 417.436483][T15716] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2687'. [ 417.885058][T15731] vlan3: entered promiscuous mode [ 417.894807][T15731] vlan3: entered allmulticast mode [ 417.904394][T15731] bridge0: entered allmulticast mode [ 417.950294][T15733] veth0: entered promiscuous mode [ 417.979143][T15732] veth0: left promiscuous mode [ 418.253335][T15752] netlink: 'syz.3.2696': attribute type 18 has an invalid length. [ 418.836162][T15765] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 420.009207][T15842] __nla_validate_parse: 6 callbacks suppressed [ 420.009232][T15842] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2721'. [ 420.038340][T15842] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2721'. [ 420.190140][T15851] veth1_to_bond: entered allmulticast mode [ 420.398919][T15859] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2726'. [ 420.406010][T15858] team0: No ports can be present during mode change [ 420.503331][T15865] netlink: 60 bytes leftover after parsing attributes in process `syz.1.2727'. [ 420.543517][T15867] lo: entered allmulticast mode [ 420.561450][T15867] tunl0: entered allmulticast mode [ 420.616641][T15867] gre0: entered allmulticast mode [ 420.674739][T15867] gretap0: entered allmulticast mode [ 420.702098][T15867] erspan0: entered allmulticast mode [ 420.744194][T15867] ip_vti0: entered allmulticast mode [ 420.776456][T15867] ip6_vti0: entered allmulticast mode [ 420.797589][T15874] netlink: 'syz.1.2731': attribute type 1 has an invalid length. [ 420.797781][T15878] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2731'. [ 420.814082][T15879] netlink: 277 bytes leftover after parsing attributes in process `syz.2.2732'. [ 420.816782][T15867] sit0: entered allmulticast mode [ 420.830694][T15880] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2729'. [ 420.857099][T15867] ip6tnl0: entered allmulticast mode [ 420.867298][T15867] ip6gre0: entered allmulticast mode [ 420.879387][T15867] syz_tun: entered allmulticast mode [ 420.890412][T15840] veth1_to_bond: left allmulticast mode [ 420.897874][T15879] tc_dump_action: action bad kind [ 420.908766][T15874] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 421.111889][T15891] netlink: 'syz.1.2735': attribute type 2 has an invalid length. [ 421.143417][T15897] netlink: 'syz.4.2738': attribute type 8 has an invalid length. [ 421.619514][T15927] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2744'. [ 421.889972][T15938] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2746'. [ 422.221586][T15958] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2750'. [ 422.389795][T15947] tipc: Cannot configure node identity twice [ 422.443090][T15947] tipc: Enabled bearer , priority 0 [ 422.481536][T15971] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 422.725563][T15947] syzkaller0: entered promiscuous mode [ 422.731309][T15947] syzkaller0: entered allmulticast mode [ 422.738660][T15947] tipc: Resetting bearer [ 422.794304][T15946] tipc: Resetting bearer [ 425.222035][T15946] tipc: Disabling bearer [ 425.305094][T15999] __nla_validate_parse: 4 callbacks suppressed [ 425.305115][T15999] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2763'. [ 425.324932][ T5627] tipc: Node number set to 251658240 [ 425.510842][T16004] tipc: Resetting bearer [ 425.543468][T16004] tipc: Resetting bearer [ 425.610286][T10184] tipc: Resetting bearer [ 425.961009][T16031] netlink: 'syz.2.2772': attribute type 1 has an invalid length. [ 426.021834][T16031] netlink: 232 bytes leftover after parsing attributes in process `syz.2.2772'. [ 426.070172][T16035] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2772'. [ 426.086265][T16031] netlink: 'syz.2.2772': attribute type 1 has an invalid length. [ 426.110282][T16035] bond0: ARP target 8.4.0.0 is already present [ 426.131458][T16035] bond0: option arp_ip_target: invalid value (1032) [ 426.312207][T16045] IPv6: NLM_F_CREATE should be specified when creating new route [ 426.792015][T16063] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2780'. [ 426.828245][T16049] vlan1 (unregistering): left allmulticast mode [ 427.045842][T10181] netdevsim netdevsim2 netdevsim0: set [0, 1] type 1 family 0 port 8472 - 0 [ 427.149471][T16074] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2782'. [ 427.192213][T16074] gtp3: entered promiscuous mode [ 427.204042][T16074] gtp3: entered allmulticast mode [ 427.253065][ T69] netdevsim netdevsim2 netdevsim1: set [0, 1] type 1 family 0 port 8472 - 0 [ 427.354426][ T69] netdevsim netdevsim2 netdevsim2: set [0, 1] type 1 family 0 port 8472 - 0 [ 427.374694][ T69] netdevsim netdevsim2 netdevsim3: set [0, 1] type 1 family 0 port 8472 - 0 [ 427.402031][T16088] syzkaller0: entered promiscuous mode [ 427.417831][T16088] syzkaller0: entered allmulticast mode [ 430.092022][T16069] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 430.378306][T16109] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 430.424830][T16103] netlink: 'syz.4.2790': attribute type 2 has an invalid length. [ 430.880046][ T5629] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 430.895851][ T5629] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 430.904142][ T5629] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 430.918496][ T5629] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 430.927870][ T5629] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 431.483485][T16137] syzkaller0: entered promiscuous mode [ 431.498169][T16137] syzkaller0: entered allmulticast mode [ 431.900051][T16167] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2807'. [ 431.912622][T16168] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2807'. [ 432.968702][ T5629] Bluetooth: hci5: command tx timeout [ 434.417113][T16178] netlink: 64 bytes leftover after parsing attributes in process `syz.0.2810'. [ 434.428932][T16175] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2809'. [ 434.801402][T16199] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2815'. [ 434.837130][T16199] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2815'. [ 434.871377][T16206] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2816'. [ 434.872348][T16199] netlink: 'syz.3.2815': attribute type 12 has an invalid length. [ 434.964211][ C1] ip6_tunnel: ip6gre2 xmit: Local address not yet configured! [ 434.978550][T16199] netlink: 'syz.3.2815': attribute type 11 has an invalid length. [ 435.043309][ T5629] Bluetooth: hci5: command tx timeout [ 435.066879][T16212] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2818'. [ 435.274581][T16216] netlink: zone id is out of range [ 435.301806][T16216] netlink: del zone limit has 4 unknown bytes [ 435.444639][T16224] gre0: left promiscuous mode [ 435.482694][T16224] tipc: Resetting bearer [ 435.506892][T16224] tipc: Resetting bearer [ 435.539116][T16224] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 435.674010][T16237] netlink: 1 bytes leftover after parsing attributes in process `syz.0.2824'. [ 435.697572][T10184] bond2: (slave veth0_to_bond): link status definitely up, 10000 Mbps full duplex [ 435.720544][T10184] bond2: (slave veth0_to_bond): making interface the new active one [ 435.790065][T10184] bond2: active interface up! [ 436.226520][T16263] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2830'. [ 436.248446][T16263] netlink: 'syz.0.2830': attribute type 7 has an invalid length. [ 436.286878][T16263] netlink: 'syz.0.2830': attribute type 8 has an invalid length. [ 436.520625][T16120] bridge0: port 1(bridge_slave_0) entered blocking state [ 436.528154][T16120] bridge0: port 1(bridge_slave_0) entered disabled state [ 436.552758][T16120] bridge_slave_0: entered allmulticast mode [ 436.572575][T16120] bridge_slave_0: entered promiscuous mode [ 436.604865][T16120] bridge0: port 2(bridge_slave_1) entered blocking state [ 436.624841][T16120] bridge0: port 2(bridge_slave_1) entered disabled state [ 436.648190][T16120] bridge_slave_1: entered allmulticast mode [ 436.664715][T16120] bridge_slave_1: entered promiscuous mode [ 436.964599][T16120] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 437.035129][T16120] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 437.040047][T16303] netlink: 'syz.3.2840': attribute type 21 has an invalid length. [ 437.116757][T16303] netlink: 'syz.3.2840': attribute type 6 has an invalid length. [ 437.125660][ T5629] Bluetooth: hci5: command tx timeout [ 437.143201][T16303] __nla_validate_parse: 2 callbacks suppressed [ 437.143245][T16303] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2840'. [ 437.252608][T16310] tunl0: entered promiscuous mode [ 437.267927][T16310] netlink: 'syz.1.2843': attribute type 4 has an invalid length. [ 437.287465][T16310] netlink: 9 bytes leftover after parsing attributes in process `syz.1.2843'. [ 437.318909][T16120] team0: Port device team_slave_0 added [ 437.339903][T16311] netlink: 'syz.1.2843': attribute type 4 has an invalid length. [ 437.360992][T16311] netlink: 9 bytes leftover after parsing attributes in process `syz.1.2843'. [ 437.386396][T16120] team0: Port device team_slave_1 added [ 437.524445][T16120] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 437.532025][T16327] nbd: nbd0 already in use [ 437.550686][T16328] nbd: nbd0 already in use [ 437.555314][T16120] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 437.583269][T16328] block nbd0: NBD_DISCONNECT [ 437.588593][T16328] block nbd0: Send disconnect failed -104 [ 437.598030][T16328] block nbd0: shutting down sockets [ 437.605543][T16120] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 437.659532][T16120] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 437.672886][T16120] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 437.737590][T16120] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 437.868001][T16336] sctp: [Deprecated]: syz.1.2849 (pid 16336) Use of struct sctp_assoc_value in delayed_ack socket option. [ 437.868001][T16336] Use struct sctp_sack_info instead [ 438.069703][T16120] hsr_slave_0: entered promiscuous mode [ 438.087955][T16120] hsr_slave_1: entered promiscuous mode [ 438.104756][T16120] debugfs: 'hsr0' already exists in 'hsr' [ 438.115320][T16120] Cannot create hsr debugfs directory [ 438.725800][T16368] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2858'. [ 438.768787][T16370] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2859'. [ 438.825766][T16374] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 439.041578][T16378] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2860'. [ 439.059711][T16120] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 439.078124][T16120] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 439.092377][T16381] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 439.114740][T16120] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.125780][T16374] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2860'. [ 439.181107][T16384] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2862'. [ 439.197739][T16384] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2862'. [ 439.216731][ T5629] Bluetooth: hci5: command tx timeout [ 439.224187][T16381] xt_hashlimit: size too large, truncated to 1048576 [ 439.390325][T16120] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 439.401230][T16120] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 439.419462][T16120] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.596462][T16120] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 439.609223][T16120] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 439.621499][T16120] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.951910][T16120] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 439.968843][T16120] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 439.981488][T16120] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 440.066682][T16424] xt_socket: unknown flags 0x50 [ 440.098814][T16424] netlink: 'syz.1.2873': attribute type 83 has an invalid length. [ 440.650893][T16448] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2878'. [ 440.908005][T16456] macsec1: entered promiscuous mode [ 440.924426][T16456] macsec1: entered allmulticast mode [ 440.940723][T16456] bridge0: port 3(macsec1) entered blocking state [ 440.956462][T16456] bridge0: port 3(macsec1) entered disabled state [ 441.020886][T16458] A link change request failed with some changes committed already. Interface batadv0 may have been left with an inconsistent configuration, please check. [ 441.096859][T16463] team0: Device xfrm0 is of different type [ 441.185698][T16464] syzkaller0: entered promiscuous mode [ 441.214881][T16464] syzkaller0: entered allmulticast mode [ 441.410865][T16120] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 441.494783][T16120] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 441.518070][T16120] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 441.600457][T16120] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 441.672304][T16120] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 441.708407][T16120] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 441.720310][T16120] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 441.737274][T16120] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 441.763480][T16488] netlink: 'syz.1.2888': attribute type 12 has an invalid length. [ 442.174030][T16510] syzkaller0: create flow: hash 2086056795 index 2 [ 442.563776][T10184] syzkaller0: tun_net_xmit 76 [ 442.582809][T10184] syzkaller0: tun_net_xmit 48 [ 442.593141][ T5736] syzkaller0: tun_net_xmit 76 [ 442.616336][T16507] syzkaller0: delete flow: hash 2086056795 index 2 [ 442.645431][T16516] __nla_validate_parse: 9 callbacks suppressed [ 442.645452][T16516] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2894'. [ 442.665409][ T5829] syzkaller0: tun_net_xmit 76 [ 442.679328][T16519] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2894'. [ 443.323364][T16537] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2898'. [ 443.333910][T16537] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2898'. [ 445.581329][T16547] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2899'. [ 445.590531][T16547] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2899'. [ 445.600146][T16547] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2899'. [ 445.671902][T16120] 8021q: adding VLAN 0 to HW filter on device bond0 [ 445.838634][T16555] netlink: 'syz.4.2902': attribute type 33 has an invalid length. [ 445.899098][T16120] 8021q: adding VLAN 0 to HW filter on device team0 [ 446.010573][T16555] bond14: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 446.032566][T16555] bond14 (unregistering): Released all slaves [ 446.102026][T16567] netlink: 'syz.3.2904': attribute type 1 has an invalid length. [ 446.121788][T16569] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2902'. [ 446.258524][T16571] geneve3: entered promiscuous mode [ 446.266141][T16571] geneve3: entered allmulticast mode [ 446.330334][T16567] 8021q: adding VLAN 0 to HW filter on device bond11 [ 446.345407][T16581] netlink: 59 bytes leftover after parsing attributes in process `syz.0.2907'. [ 446.470682][T16577] bond11: (slave geneve7): making interface the new active one [ 446.525782][T16577] bond11: (slave geneve7): Enslaving as an active interface with an up link [ 446.559053][T10184] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.566299][T10184] bridge0: port 1(bridge_slave_0) entered forwarding state [ 446.711832][T10200] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.719139][T10200] bridge0: port 2(bridge_slave_1) entered forwarding state [ 446.894957][T16600] syzkaller0: entered promiscuous mode [ 446.911125][T16600] syzkaller0: entered allmulticast mode [ 446.937335][T16600] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2910'. [ 446.958373][T16602] lo: left allmulticast mode [ 446.981670][T16602] tunl0: left allmulticast mode [ 447.005043][T16602] gre0: left allmulticast mode [ 447.011545][T16602] gretap0: left allmulticast mode [ 447.017726][T16602] erspan0: left allmulticast mode [ 447.023881][T16602] ip_vti0: left allmulticast mode [ 447.029627][T16602] ip6_vti0: left allmulticast mode [ 447.036460][T16602] sit0: left allmulticast mode [ 447.059011][T16602] ip6tnl0: left allmulticast mode [ 447.080316][T16602] ip6gre0: left allmulticast mode [ 447.100629][T16602] syz_tun: left allmulticast mode [ 447.144915][T16602] bond0: left promiscuous mode [ 447.160031][T16602] bond_slave_0: left promiscuous mode [ 447.230466][T16602] 0·: left allmulticast mode [ 447.235365][T16602] hsr_slave_0: left allmulticast mode [ 447.256865][T16602] vlan0: left promiscuous mode [ 447.277587][T16602] veth0_macvtap: left allmulticast mode [ 447.290564][T16602] macsec0: left allmulticast mode [ 447.344448][T16602] bond12: left promiscuous mode [ 447.350059][T16602] ipvlan2: left allmulticast mode [ 447.355951][T16602] bond12: left allmulticast mode [ 447.403608][T10177] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.555027][T10200] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.592076][T10200] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.664590][T10200] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 447.789277][T16619] xt_hashlimit: size too large, truncated to 1048576 [ 448.219773][T16640] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2920'. [ 449.785062][T16120] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 450.509475][T16120] veth0_vlan: entered promiscuous mode [ 450.712753][T16120] veth1_vlan: entered promiscuous mode [ 450.900934][T16729] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2933'. [ 450.949598][T16727] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2933'. [ 450.975175][T16727] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2933'. [ 451.241564][T16738] netlink: 'syz.3.2936': attribute type 1 has an invalid length. [ 451.311696][T16744] netlink: 'syz.1.2938': attribute type 1 has an invalid length. [ 451.581131][T16756] netlink: 'syz.0.2939': attribute type 1 has an invalid length. [ 451.635856][T16738] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 451.638203][T16744] workqueue: Failed to create a rescuer kthread for wq "bond7": -EINTR [ 452.384271][T16120] veth0_macvtap: entered promiscuous mode [ 452.460072][T16120] veth1_macvtap: entered promiscuous mode [ 452.599894][T16120] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 452.621880][T16781] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2944'. [ 452.790948][T16120] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 452.884097][T10183] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.897403][T16789] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2944'. [ 453.276804][T10200] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.373303][T10200] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.512351][T16813] netlink: 'syz.4.2952': attribute type 9 has an invalid length. [ 453.617412][T16817] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2953'. [ 453.632085][T10174] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.719846][T10200] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 453.771171][T10200] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 453.906137][T16823] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2955'. [ 453.931933][T10174] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 453.956500][T10174] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 454.477710][T16839] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 454.537955][T16839] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2792'. [ 455.859244][ T5634] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 455.880320][ T5634] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 455.893359][ T5634] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 455.916583][ T5634] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 455.936811][ T5634] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 456.303856][T16877] netlink: 'syz.3.2968': attribute type 1 has an invalid length. [ 456.518936][T16870] can: request_module (can-proto-5) failed. [ 456.836640][T16881] macvtap1: entered allmulticast mode [ 456.947792][T16883] macvtap2: entered allmulticast mode [ 457.014547][T16886] bond12: (slave bridge6): making interface the new active one [ 457.041133][T16886] bond12: (slave bridge6): Enslaving as an active interface with an up link [ 457.659082][T16907] netlink: 'syz.0.2971': attribute type 1 has an invalid length. [ 457.708350][T16907] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2971'. [ 458.003182][ T5629] Bluetooth: hci2: command tx timeout [ 458.046680][T16915] sctp: [Deprecated]: syz.0.2973 (pid 16915) Use of struct sctp_assoc_value in delayed_ack socket option. [ 458.046680][T16915] Use struct sctp_sack_info instead [ 459.993220][ T858] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.067404][ T858] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.085126][ T5634] Bluetooth: hci2: command tx timeout [ 460.109347][T16967] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2985'. [ 460.143725][T16972] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2988'. [ 460.196146][T16974] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2986'. [ 460.236519][ T858] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 460.325251][T16975] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2988'. [ 460.909254][T16997] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 460.936161][T10200] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 461.190917][T17008] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2995'. [ 461.240744][T17008] bridge0: port 3(dummy0) entered disabled state [ 461.280055][T17020] openvswitch: netlink: IPv4 tun info is not correct [ 461.458288][T16864] bridge0: port 1(bridge_slave_0) entered blocking state [ 461.465782][T16864] bridge0: port 1(bridge_slave_0) entered disabled state [ 461.474045][T16864] bridge_slave_0: entered allmulticast mode [ 461.482313][T16864] bridge_slave_0: entered promiscuous mode [ 461.493495][T16864] bridge0: port 2(bridge_slave_1) entered blocking state [ 461.500780][T16864] bridge0: port 2(bridge_slave_1) entered disabled state [ 461.509632][T16864] bridge_slave_1: entered allmulticast mode [ 461.518734][T16864] bridge_slave_1: entered promiscuous mode [ 461.566200][T16864] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 461.579454][T16864] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 461.686839][T16864] team0: Port device team_slave_0 added [ 461.720832][T16864] team0: Port device team_slave_1 added [ 461.821398][T16864] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 461.829423][T16864] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 461.867525][T16864] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 461.885473][T16864] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 461.893027][T16864] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 461.921297][T16864] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 462.021186][T16864] hsr_slave_0: entered promiscuous mode [ 462.028688][T16864] hsr_slave_1: entered promiscuous mode [ 462.035505][T16864] debugfs: 'hsr0' already exists in 'hsr' [ 462.041425][T16864] Cannot create hsr debugfs directory [ 462.163454][ T5634] Bluetooth: hci2: command tx timeout [ 463.860857][T16997] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 463.879467][T17022] netlink: 256 bytes leftover after parsing attributes in process `syz.0.2996'. [ 463.962766][T16864] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 464.131956][T16864] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 464.168189][T16864] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 464.243474][ T5634] Bluetooth: hci2: command tx timeout [ 464.262418][T16864] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 464.274812][T17041] bond0: (slave ip6gre0): Error: Device can not be enslaved while up [ 464.299164][T16864] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 464.349425][T16864] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 464.444943][T17055] netlink: 'syz.2.3001': attribute type 7 has an invalid length. [ 464.470356][T16864] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 464.529643][T16864] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 464.537787][T17060] netlink: 'syz.0.3003': attribute type 1 has an invalid length. [ 464.573219][T17060] netlink: 228 bytes leftover after parsing attributes in process `syz.0.3003'. [ 464.825647][T17069] netlink: 'syz.1.3005': attribute type 1 has an invalid length. [ 464.852429][T17069] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3005'. [ 464.898946][T17065] syzkaller0: entered promiscuous mode [ 464.906707][T17069] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3005'. [ 464.937880][T17065] syzkaller0: entered allmulticast mode [ 465.326944][T17090] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3008'. [ 465.371779][T17090] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3008'. [ 465.416459][T17090] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3008'. [ 465.452349][T17090] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3008'. [ 465.710484][T16864] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.738676][T17101] netlink: 1196 bytes leftover after parsing attributes in process `syz.1.3011'. [ 465.807564][T16864] 8021q: adding VLAN 0 to HW filter on device team0 [ 465.845928][T10200] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.853153][T10200] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.977277][T10182] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.985834][T10182] bridge0: port 2(bridge_slave_1) entered forwarding state [ 466.182162][T17111] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3015'. [ 466.265748][T17111] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3015'. [ 466.397374][T17127] netdevsim netdevsim2: Firmware load for './file0/file0/../file0' refused, path contains '..' component [ 466.480338][T17126] netdevsim netdevsim2: Firmware load for './file0/file0/../file0' refused, path contains '..' component [ 466.701961][T17133] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3019'. [ 467.483069][T17154] netlink: 'syz.0.3024': attribute type 2 has an invalid length. [ 467.492486][T17154] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3024'. [ 468.633127][T16864] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 468.935350][T17198] netlink: 'syz.3.3033': attribute type 2 has an invalid length. [ 468.990078][T17198] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3033'. [ 470.874629][T17245] __nla_validate_parse: 1 callbacks suppressed [ 470.874650][T17245] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3039'. [ 470.983253][T17244] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3039'. [ 471.087874][T16864] veth0_vlan: entered promiscuous mode [ 471.210996][T16864] veth1_vlan: entered promiscuous mode [ 471.304749][T17250] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 471.498151][T16864] veth0_macvtap: entered promiscuous mode [ 471.645532][T16864] veth1_macvtap: entered promiscuous mode [ 471.768014][T17257] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 471.816606][T17261] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 471.869657][T16864] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 472.052251][T16864] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 472.696683][T17272] syzkaller0: entered promiscuous mode [ 472.715895][T17272] syzkaller0: entered allmulticast mode [ 472.726011][T10182] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 472.959482][T17305] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3048'. [ 473.189037][T17311] netlink: 'syz.3.3051': attribute type 142 has an invalid length. [ 476.505046][T10174] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.564470][T17304] bridge4: entered promiscuous mode [ 476.572140][T17304] bridge4: entered allmulticast mode [ 476.590140][T17304] team0: Port device bridge4 added [ 476.811598][ T69] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 476.825408][ T69] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 477.062741][T17323] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3054'. [ 477.096392][T17323] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3054'. [ 477.539712][T10184] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 477.612074][T10184] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 477.756463][T10184] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 477.781246][T10184] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 477.871525][ T29] audit: type=1804 audit(1785553925.117:7): pid=17343 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.3060" name="/newroot/27/cgroup.controllers" dev="tmpfs" ino=156 res=1 errno=0 [ 477.913622][T17344] sctp: [Deprecated]: syz.1.3059 (pid 17344) Use of struct sctp_assoc_value in delayed_ack socket option. [ 477.913622][T17344] Use struct sctp_sack_info instead [ 477.943160][ T29] audit: type=1800 audit(1785553925.117:8): pid=17343 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3060" name="cgroup.controllers" dev="tmpfs" ino=156 res=0 errno=0 [ 478.352305][T17358] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3063'. [ 478.368416][T17358] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3063'. [ 478.710508][T17366] Cannot find set identified by id 0 to match [ 478.980466][T17366] block nbd4: NBD_DISCONNECT [ 479.185629][ T5629] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 479.209344][ T5629] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 479.222009][ T5629] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 479.241454][ T5629] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 479.259961][ T5629] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 479.524749][T17386] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3071'. [ 479.631559][T17390] xt_socket: unknown flags 0x50 [ 479.790362][T17394] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 480.418746][T17409] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 480.527663][T17417] netlink: 'syz.3.3078': attribute type 1 has an invalid length. [ 480.655493][T17423] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3078'. [ 480.759050][T17421] ip6erspan0: entered allmulticast mode [ 481.117157][T17441] IPVS: set_ctl: invalid protocol: 12 10.1.1.2:20001 [ 481.138110][ T5736] IPVS: starting estimator thread 0... [ 481.184250][T17434] netlink: 48 bytes leftover after parsing attributes in process `syz.0.3081'. [ 481.254451][T17443] IPVS: using max 25 ests per chain, 60000 per kthread [ 481.365141][ T5629] Bluetooth: hci3: command tx timeout [ 481.471994][T17450] syzkaller0: entered promiscuous mode [ 481.504105][T17450] syzkaller0: entered allmulticast mode [ 481.605868][T17428] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 482.429862][T17479] openvswitch: netlink: IPv4 tunnel dst address is zero [ 482.472049][T17479] xt_socket: unknown flags 0x8 [ 482.493949][T17477] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3094'. [ 482.744252][T17487] netlink: 'syz.0.3096': attribute type 11 has an invalid length. [ 482.800782][T17487] vxcan1: entered promiscuous mode [ 482.838393][T17487] vxcan1: entered allmulticast mode [ 483.115022][T17493] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 483.278440][T17500] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3100'. [ 483.453843][ T5629] Bluetooth: hci3: command tx timeout [ 483.534528][T17507] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3102'. [ 483.545491][T17507] netlink: 84 bytes leftover after parsing attributes in process `syz.4.3102'. [ 483.587877][T17376] bridge0: port 1(bridge_slave_0) entered blocking state [ 483.609851][T17376] bridge0: port 1(bridge_slave_0) entered disabled state [ 483.652249][T17376] bridge_slave_0: entered allmulticast mode [ 483.682168][T17376] bridge_slave_0: entered promiscuous mode [ 483.718766][T17376] bridge0: port 2(bridge_slave_1) entered blocking state [ 483.756421][T17376] bridge0: port 2(bridge_slave_1) entered disabled state [ 483.792656][T17376] bridge_slave_1: entered allmulticast mode [ 483.830536][T17376] bridge_slave_1: entered promiscuous mode [ 484.041627][T17376] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 484.115692][T17376] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 484.269330][T17536] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3109'. [ 484.380001][T17376] team0: Port device team_slave_0 added [ 484.430077][T17376] team0: Port device team_slave_1 added [ 484.739418][T17376] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 484.770200][T17376] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 484.843093][T17376] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 484.942330][T17548] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 485.006497][T17376] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 485.037790][T17376] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 485.067364][T17376] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 485.304232][T17520] netlink: 'syz.2.3106': attribute type 19 has an invalid length. [ 485.326778][T17520] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3106'. [ 485.470550][T17570] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 485.522590][T17570] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3116'. [ 485.527867][T17520] netlink: 'syz.2.3106': attribute type 19 has an invalid length. [ 485.551680][ T5629] Bluetooth: hci3: command tx timeout [ 485.576271][T17520] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3106'. [ 485.590505][T17376] hsr_slave_0: entered promiscuous mode [ 485.598337][T17376] hsr_slave_1: entered promiscuous mode [ 485.605519][T17376] debugfs: 'hsr0' already exists in 'hsr' [ 485.611473][T17376] Cannot create hsr debugfs directory [ 485.658360][T17573] netlink: 'syz.3.3117': attribute type 32 has an invalid length. [ 485.977974][T17583] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3119'. [ 486.501251][T17376] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 486.514605][T17376] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 486.570807][T17597] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3122'. [ 486.617519][T17596] mac80211_hwsim hwsim34 wlan0: entered promiscuous mode [ 486.912608][T17376] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.012141][T17376] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.085436][T17611] netlink: 'syz.2.3127': attribute type 11 has an invalid length. [ 487.104354][T17611] netlink: 'syz.2.3127': attribute type 4 has an invalid length. [ 487.271568][T17376] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.315791][T17376] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 487.384820][T17618] macsec1: entered promiscuous mode [ 487.395099][T17618] bridge0: entered promiscuous mode [ 487.411626][T17618] macsec1: entered allmulticast mode [ 487.428016][T17618] bridge0: entered allmulticast mode [ 487.439915][T17618] bridge0: port 3(macsec1) entered blocking state [ 487.467874][T17618] bridge0: port 3(macsec1) entered disabled state [ 487.508417][T17618] bridge0: left allmulticast mode [ 487.530493][T17619] __nla_validate_parse: 2 callbacks suppressed [ 487.530512][T17619] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3128'. [ 487.552643][T17619] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3128'. [ 487.565534][ T5818] bridge0: left promiscuous mode [ 487.579522][T17376] tipc: Resetting bearer [ 487.603858][ T5629] Bluetooth: hci3: command tx timeout [ 487.757145][T17376] tipc: Disabling bearer [ 487.818695][T17376] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 487.834544][T17376] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 488.775013][T17665] netlink: 'syz.2.3139': attribute type 4 has an invalid length. [ 489.213556][T17660] netlink: 76 bytes leftover after parsing attributes in process `syz.4.3140'. [ 490.175534][T17376] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 490.230115][T17376] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 490.250759][T17376] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 490.366587][T17376] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 490.401485][T17376] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 490.435303][T17376] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 490.450879][T17376] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 490.502331][T17376] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 490.915696][T17376] 8021q: adding VLAN 0 to HW filter on device bond0 [ 490.971330][T17376] 8021q: adding VLAN 0 to HW filter on device team0 [ 490.998825][T10182] bridge0: port 1(bridge_slave_0) entered blocking state [ 491.006126][T10182] bridge0: port 1(bridge_slave_0) entered forwarding state [ 491.028659][T10182] bridge0: port 2(bridge_slave_1) entered blocking state [ 491.036013][T10182] bridge0: port 2(bridge_slave_1) entered forwarding state [ 491.801640][T17708] netlink: 'syz.0.3147': attribute type 5 has an invalid length. [ 491.832137][T17710] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3148'. [ 491.893661][T17712] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3147'. [ 491.966347][T17712] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3147'. [ 492.014598][T17712] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3147'. [ 493.505507][T17376] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 493.569246][T17754] syzkaller0: entered promiscuous mode [ 493.580505][T17754] syzkaller0: entered allmulticast mode [ 493.939983][T17376] veth0_vlan: entered promiscuous mode [ 493.978799][T17376] veth1_vlan: entered promiscuous mode [ 494.239102][T17376] veth0_macvtap: entered promiscuous mode [ 494.396628][T17768] netlink: 'syz.4.3162': attribute type 7 has an invalid length. [ 494.443660][T17768] netlink: 140 bytes leftover after parsing attributes in process `syz.4.3162'. [ 494.632467][T17775] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 494.668209][T17775] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 494.687319][T17775] gretap1: entered promiscuous mode [ 494.703818][T17775] gretap1: entered allmulticast mode [ 494.731179][T17376] veth1_macvtap: entered promiscuous mode [ 495.092751][T17783] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 495.410853][T17790] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 496.018456][T17793] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3169'. [ 496.029867][T17793] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3169'. [ 499.420077][T17376] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 499.486267][T17376] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 499.624867][T10181] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.738973][T10195] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.788675][T10182] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 499.793736][T17822] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3175'. [ 499.832171][T17826] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3175'. [ 499.875271][T17819] bond0: entered promiscuous mode [ 499.900791][T17819] bond_slave_0: entered promiscuous mode [ 499.911681][T17819] bond_slave_1: entered promiscuous mode [ 499.921482][T17828] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3177'. [ 499.922975][T17819] batadv0: entered promiscuous mode [ 499.937534][T17819] debugfs: 'hsr1' already exists in 'hsr' [ 499.943943][T17819] Cannot create hsr debugfs directory [ 499.949793][T17819] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 499.959940][T17819] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 499.975661][T17819] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 500.015051][T10183] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 500.199434][T10183] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 500.256439][T10183] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 500.482786][T10182] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 500.519574][T10182] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 500.544790][T17841] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3181'. [ 500.682043][T17845] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3182'. [ 500.720824][T17845] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.729961][T17845] bridge0: port 1(bridge_slave_0) entered disabled state [ 501.197959][T17860] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3186'. [ 501.394479][T17865] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3188'. [ 501.399719][T17853] syzkaller0: entered promiscuous mode [ 501.453442][T17853] syzkaller0: entered allmulticast mode [ 501.609564][T17870] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3187'. [ 501.963127][T17863] syzkaller1: entered promiscuous mode [ 501.989151][T17863] syzkaller1: entered allmulticast mode [ 502.019648][ T5634] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 502.036096][ T5634] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 502.046604][ T5634] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 502.058497][ T5634] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 502.071214][ T5634] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 502.718532][T17898] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3193'. [ 502.768005][T17899] netlink: 'syz.3.3194': attribute type 25 has an invalid length. [ 502.867036][T17905] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3195'. [ 503.508044][ T5765] IPVS: starting estimator thread 0... [ 503.653639][T17945] IPVS: using max 24 ests per chain, 57600 per kthread [ 504.167462][ T5634] Bluetooth: hci1: command tx timeout [ 504.904286][T17972] netlink: 'syz.3.3207': attribute type 1 has an invalid length. [ 505.034338][T17980] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 505.072080][T17980] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 505.090584][T17980] gretap2: entered promiscuous mode [ 505.097276][T17980] gretap2: entered allmulticast mode [ 505.318910][T17994] __nla_validate_parse: 3 callbacks suppressed [ 505.318932][T17994] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3212'. [ 505.364835][T17994] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3212'. [ 505.784815][T17880] bridge0: port 1(bridge_slave_0) entered blocking state [ 505.792624][T17880] bridge0: port 1(bridge_slave_0) entered disabled state [ 505.801279][T17880] bridge_slave_0: entered allmulticast mode [ 505.809994][T17880] bridge_slave_0: entered promiscuous mode [ 505.821009][T17880] bridge0: port 2(bridge_slave_1) entered blocking state [ 505.855424][T17880] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.879769][T17880] bridge_slave_1: entered allmulticast mode [ 505.908139][T17880] bridge_slave_1: entered promiscuous mode [ 505.953748][T17880] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 505.979620][T17880] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 506.039518][T18010] netlink: 'syz.1.3214': attribute type 21 has an invalid length. [ 506.086335][T17916] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 506.095258][T18010] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3214'. [ 506.109802][T18010] netlink: 'syz.1.3214': attribute type 5 has an invalid length. [ 506.142753][T18010] netlink: 'syz.1.3214': attribute type 6 has an invalid length. [ 506.151931][T18010] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3214'. [ 506.256834][ T5634] Bluetooth: hci1: command tx timeout [ 506.297800][T17880] team0: Port device team_slave_0 added [ 506.315721][T17880] team0: Port device team_slave_1 added [ 506.500464][T17880] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 506.508563][T18014] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3215'. [ 506.562410][T17880] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 506.600439][T17880] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 506.625759][T18016] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3216'. [ 506.639376][T17880] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 506.648983][T17880] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 506.734353][T17880] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 506.753738][T18016] netlink: 184 bytes leftover after parsing attributes in process `syz.2.3216'. [ 507.157523][T17880] hsr_slave_0: entered promiscuous mode [ 507.179098][T17880] hsr_slave_1: entered promiscuous mode [ 507.201376][T17880] debugfs: 'hsr0' already exists in 'hsr' [ 507.219729][T17880] Cannot create hsr debugfs directory [ 508.334264][ T5634] Bluetooth: hci1: command tx timeout [ 508.413508][T18082] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3233'. [ 508.479984][T18082] openvswitch: netlink: Missing key (keys=c0, expected=1100) [ 508.652503][T17880] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 508.670341][T17880] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 54241 - 0 [ 508.792199][T18103] netlink: 'syz.1.3238': attribute type 1 has an invalid length. [ 508.800760][T18082] 8021q: VLANs not supported on ipvlan1 [ 508.842746][T18080] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3233'. [ 509.006651][T17880] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.030472][T17880] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 54241 - 0 [ 509.254744][T18106] syzkaller0: entered promiscuous mode [ 509.260525][T18106] syzkaller0: entered allmulticast mode [ 509.282041][T18115] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3242'. [ 509.299715][T17880] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.318202][T17880] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 54241 - 0 [ 510.405311][ T5634] Bluetooth: hci1: command tx timeout [ 513.317712][T17880] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 513.351679][T17880] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 54241 - 0 [ 513.558832][T18140] Unknown options in mask 4 [ 514.073686][T18157] netlink: 'syz.4.3255': attribute type 1 has an invalid length. [ 514.092779][T18157] __nla_validate_parse: 1 callbacks suppressed [ 514.103677][T18152] bridge_slave_0: left allmulticast mode [ 514.110216][T18152] bridge_slave_0: left promiscuous mode [ 514.119470][T18157] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3255'. [ 514.142098][T18152] bridge0: port 1(bridge_slave_0) entered disabled state [ 514.215891][T18152] bridge_slave_1: left promiscuous mode [ 514.241689][T18152] bridge0: port 2(bridge_slave_1) entered disabled state [ 514.308190][T18152] bond0: (slave bond_slave_0): Releasing backup interface [ 514.351884][T18152] bond0: (slave bond_slave_1): Releasing backup interface [ 514.423172][T18152] team0: Port device team_slave_0 removed [ 514.500688][T18152] team0: Port device team_slave_1 removed [ 514.541240][T18152] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 514.592591][T18152] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 514.664654][T18152] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 514.703813][T18152] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 514.736669][T18152] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 514.921142][T18162] team0: Port device xfrm0 added [ 519.397490][T18211] netlink: 'syz.1.3268': attribute type 4 has an invalid length. [ 519.686533][T17880] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 519.691445][T18216] netlink: 'syz.1.3270': attribute type 3 has an invalid length. [ 519.771564][T17880] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 519.814755][T17880] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 519.887315][T17880] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 519.928514][T17880] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 519.958006][T17880] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 519.992301][T17880] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 520.029894][T17880] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 520.061693][T18222] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3272'. [ 520.133618][T18222] netlink: 'syz.4.3272': attribute type 7 has an invalid length. [ 520.156926][T18222] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3272'. [ 520.350637][T18243] sctp: [Deprecated]: syz.3.3277 (pid 18243) Use of struct sctp_assoc_value in delayed_ack socket option. [ 520.350637][T18243] Use struct sctp_sack_info instead [ 520.599984][T18250] bond2: option resend_igmp: invalid value (32767) [ 520.607899][T18250] bond2: option resend_igmp: allowed values 0 - 255 [ 520.629396][T18250] bond2 (unregistering): Released all slaves [ 521.007117][T17880] 8021q: adding VLAN 0 to HW filter on device bond0 [ 521.009180][T18260] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3281'. [ 521.166206][T17880] 8021q: adding VLAN 0 to HW filter on device team0 [ 521.239935][T10206] bridge0: port 1(bridge_slave_0) entered blocking state [ 521.247180][T10206] bridge0: port 1(bridge_slave_0) entered forwarding state [ 521.320436][T10182] bridge0: port 2(bridge_slave_1) entered blocking state [ 521.327667][T10182] bridge0: port 2(bridge_slave_1) entered forwarding state [ 521.383899][T18268] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3284'. [ 522.060200][T18288] openvswitch: netlink: EtherType 50a is less than min 600 [ 522.321649][T18299] team0 (unregistering): Port device team_slave_1 removed [ 522.434332][T18304] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3295'. [ 522.480614][T18304] openvswitch: netlink: Missing key (keys=c0, expected=1100) [ 522.499908][T18306] sctp: [Deprecated]: syz.1.3294 (pid 18306) Use of int in max_burst socket option deprecated. [ 522.499908][T18306] Use struct sctp_assoc_value instead [ 522.555984][T18304] netlink: 'syz.2.3295': attribute type 30 has an invalid length. [ 522.725696][T18311] netlink: 'syz.4.3296': attribute type 22 has an invalid length. [ 522.773003][T18311] netlink: 'syz.4.3296': attribute type 23 has an invalid length. [ 522.841502][T18311] netlink: 'syz.4.3296': attribute type 25 has an invalid length. [ 522.882065][T18311] netlink: 'syz.4.3296': attribute type 26 has an invalid length. [ 522.927918][T18311] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3296'. [ 523.462558][T18326] netlink: 420 bytes leftover after parsing attributes in process `syz.1.3300'. [ 523.537744][T18333] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 523.851475][T18349] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3303'. [ 524.294326][T18359] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3305'. [ 524.548080][T18362] netlink: 'syz.1.3306': attribute type 1 has an invalid length. [ 524.600235][T18362] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3306'. [ 525.088347][T17880] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 525.161083][T18380] syzkaller1: entered allmulticast mode [ 525.251226][T18383] xt_nfacct: accounting object `syz1' does not exist [ 525.458381][T18388] netlink: 'syz.3.3314': attribute type 1 has an invalid length. [ 525.468592][T18388] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3314'. [ 525.507814][T18388] netlink: 'syz.3.3314': attribute type 8 has an invalid length. [ 525.532757][T18388] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3314'. [ 525.636065][T17880] veth0_vlan: entered promiscuous mode [ 525.717028][T18394] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3315'. [ 525.730931][T17880] veth1_vlan: entered promiscuous mode [ 525.903935][T17880] veth0_macvtap: entered promiscuous mode [ 525.997866][T17880] veth1_macvtap: entered promiscuous mode [ 526.179075][T18399] IPv6: sit1: Disabled Multicast RS [ 526.251576][ T5287] veth0_vlan: left promiscuous mode [ 526.290779][T18410] xt_hashlimit: overflow, try lower: 3/0 [ 526.312713][ T5736] veth0_vlan: entered promiscuous mode [ 526.342117][T18412] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 526.450058][T17880] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 526.521476][T17880] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 526.663632][ T69] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 526.785568][T18425] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3325'. [ 526.816727][T18425] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3325'. [ 526.860911][T18420] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 526.911396][T18428] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3328'. [ 526.922944][T10183] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.323493][T10208] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.515684][T10183] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 527.571377][T10183] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 527.595606][T10183] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 527.875775][ T69] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 527.902026][ T69] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 528.276881][T18466] netlink: 'syz.3.3337': attribute type 21 has an invalid length. [ 528.375761][T18461] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 528.509175][T18474] syzkaller0: entered promiscuous mode [ 528.517530][T18461] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 528.547694][T18474] syzkaller0: entered allmulticast mode [ 528.647977][T18461] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 528.939947][T18453] netlink: 'syz.1.3333': attribute type 2 has an invalid length. [ 529.015598][T18479] netlink: 'syz.1.3333': attribute type 2 has an invalid length. [ 529.023509][T18479] netlink: 67 bytes leftover after parsing attributes in process `syz.1.3333'. [ 529.196664][ T5629] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 529.221121][ T5629] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 529.244075][ T5629] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 529.263898][ T5629] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 529.288578][ T5629] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 529.503868][T18483] syzkaller1: entered promiscuous mode [ 529.546826][T18483] syzkaller1: entered allmulticast mode [ 530.241680][T18508] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3345'. [ 530.280132][T18511] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3344'. [ 530.495839][T10206] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 530.508760][T10206] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 530.521136][T10206] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 530.542553][T10206] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 530.556691][T10206] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 2] type 2 family 0 port 63226 - 0 [ 530.666526][T18512] vlan2: entered promiscuous mode [ 530.682621][T18512] bridge0: entered promiscuous mode [ 530.690364][T18512] vlan2: entered allmulticast mode [ 530.698309][T18512] bridge0: entered allmulticast mode [ 530.721413][T18519] netlink: 144 bytes leftover after parsing attributes in process `syz.1.3348'. [ 530.754237][T18511] team0 (unregistering): Port device xfrm0 removed [ 531.277537][T18526] xt_connbytes: Forcing CT accounting to be enabled [ 531.291181][T10206] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 531.308402][T18526] xt_CT: You must specify a L4 protocol and not use inversions on it [ 531.324303][T10206] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 531.350729][T10206] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 531.368873][ T5629] Bluetooth: hci0: command tx timeout [ 531.383038][T10206] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 531.409437][T10206] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 2] type 2 family 0 port 63226 - 0 [ 531.872663][T10206] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 531.916320][T10206] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 531.961872][T10206] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 531.994396][T10206] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 532.058853][T10206] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 2] type 2 family 0 port 63226 - 0 [ 532.367856][T10206] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 532.415970][T10206] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 1] type 1 family 0 port 8472 - 0 [ 532.469512][T10206] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 532.517061][T10206] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20004 - 0 [ 532.588672][T18566] Bluetooth: MGMT ver 1.23 [ 532.588839][T10206] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 2] type 2 family 0 port 63226 - 0 [ 532.955468][T18580] netlink: 'syz.2.3357': attribute type 1 has an invalid length. [ 533.177894][T18588] netlink: 'syz.2.3357': attribute type 16 has an invalid length. [ 533.245167][T18588] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3357'. [ 533.444331][ T5629] Bluetooth: hci0: command tx timeout [ 533.477444][T18580] bond1: entered promiscuous mode [ 533.485902][T18580] 8021q: adding VLAN 0 to HW filter on device bond1 [ 533.610852][T18586] 8021q: adding VLAN 0 to HW filter on device bond1 [ 533.634197][T18586] bond1: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 533.649691][T18598] netlink: 'syz.4.3362': attribute type 10 has an invalid length. [ 533.669642][T18598] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3362'. [ 533.680802][T18586] bond1: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 533.708902][T18586] bond1: (slave ip6gre1): making interface the new active one [ 533.729785][T18586] ip6gre1: entered promiscuous mode [ 533.750045][T18586] bond1: (slave ip6gre1): Enslaving as an active interface with an up link [ 534.744382][T18621] netlink: 'syz.4.3368': attribute type 1 has an invalid length. [ 534.842608][T18621] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 535.068368][T18636] sctp: [Deprecated]: syz.0.3371 (pid 18636) Use of int in max_burst socket option deprecated. [ 535.068368][T18636] Use struct sctp_assoc_value instead [ 535.520923][T10206] bridge_slave_1: left allmulticast mode [ 535.534777][ T5629] Bluetooth: hci0: command tx timeout [ 535.559145][T10206] bridge_slave_1: left promiscuous mode [ 535.570448][T10206] bridge0: port 2(bridge_slave_1) entered disabled state [ 535.625570][T10206] bridge_slave_0: left allmulticast mode [ 535.649609][T10206] bridge_slave_0: left promiscuous mode [ 535.662753][T10206] bridge0: port 1(bridge_slave_0) entered disabled state [ 535.845293][T10206] dvmrp8: left allmulticast mode [ 536.540041][T10206] bond7 (unregistering): (slave ip6gre1): Releasing backup interface [ 536.600933][T10206] ip6gre1 (unregistering): left promiscuous mode [ 536.854389][T10206] bond11 (unregistering): (slave geneve7): Releasing active interface [ 536.911214][T10206] bond3 (unregistering): (slave geneve4): Releasing active interface [ 536.943313][T10206] bond1 (unregistering): (slave geneve2): Releasing active interface [ 537.091666][T10206] bond12 (unregistering): (slave bridge6): Releasing active interface [ 537.151653][T10206] bond1 (unregistering): Released all slaves [ 537.176708][T10206] bond2 (unregistering): Released all slaves [ 537.204048][T10206] bond3 (unregistering): Released all slaves [ 537.230765][T10206] bond4 (unregistering): Released all slaves [ 537.261016][T10206] bond5 (unregistering): Released all slaves [ 537.289012][T10206] bond6 (unregistering): Released all slaves [ 537.318530][T10206] bond0 (unregistering): Released all slaves [ 537.344240][T10206] bond7 (unregistering): Released all slaves [ 537.379461][T10206] bond8 (unregistering): (slave veth5): Releasing active interface [ 537.390441][T10206] bond8 (unregistering): Released all slaves [ 537.417449][T10206] bond9 (unregistering): Released all slaves [ 537.439508][T10206] bond10 (unregistering): Released all slaves [ 537.486451][T10206] bond11 (unregistering): Released all slaves [ 537.557403][T10206] bond12 (unregistering): Released all slaves [ 537.580820][T10206] bond13 (unregistering): Released all slaves [ 537.603546][ T5629] Bluetooth: hci0: command tx timeout [ 537.694919][ T5287] 8021q: adding VLAN 0 to HW filter on device eth1 [ 537.886944][T10206] tipc: Left network mode [ 538.143633][T18682] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3381'. [ 538.775438][T18702] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3384'. [ 538.827753][T18716] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3386'. [ 539.237098][T18723] openvswitch: netlink: Missing key (keys=c0, expected=20100) [ 539.617359][T18734] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3390'. [ 539.626596][T18734] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3390'. [ 539.708734][T18716] syzkaller1: entered promiscuous mode [ 539.719176][T18716] syzkaller1: entered allmulticast mode [ 539.759016][T18736] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3389'. [ 540.121880][T18745] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3392'. [ 540.215113][T10183] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 540.577585][T18745] ip6gretap0: entered promiscuous mode [ 540.840143][T18486] bridge0: port 1(bridge_slave_0) entered blocking state [ 540.859228][T18486] bridge0: port 1(bridge_slave_0) entered disabled state [ 540.867996][T18486] bridge_slave_0: entered allmulticast mode [ 540.879850][T18486] bridge_slave_0: entered promiscuous mode [ 540.896548][ T5287] 8021q: adding VLAN 0 to HW filter on device eth2 [ 540.905388][T18760] netlink: 'syz.1.3396': attribute type 12 has an invalid length. [ 540.940170][T18760] netlink: 'syz.1.3396': attribute type 29 has an invalid length. [ 540.975717][T18760] netlink: 148 bytes leftover after parsing attributes in process `syz.1.3396'. [ 541.006090][T18760] netlink: 59 bytes leftover after parsing attributes in process `syz.1.3396'. [ 541.055753][T18486] bridge0: port 2(bridge_slave_1) entered blocking state [ 541.078795][T18486] bridge0: port 2(bridge_slave_1) entered disabled state [ 541.089543][T18486] bridge_slave_1: entered allmulticast mode [ 541.124529][T18486] bridge_slave_1: entered promiscuous mode [ 541.333616][T10204] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 541.473152][T10182] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 541.599484][T18486] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 541.753763][T18486] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 541.808005][T18791] openvswitch: netlink: Message has 1 unknown bytes. [ 541.994979][T18794] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3404'. [ 542.320531][T18486] team0: Port device team_slave_0 added [ 542.398443][T18486] team0: Port device team_slave_1 added [ 542.793876][T18486] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 542.833307][T18486] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 542.921293][T18486] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 543.189728][T18486] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 543.244767][T18486] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 543.377864][T18486] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 543.500372][T10183] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 544.160006][T18486] hsr_slave_0: entered promiscuous mode [ 544.230514][T18486] hsr_slave_1: entered promiscuous mode [ 544.289670][T18486] debugfs: 'hsr0' already exists in 'hsr' [ 544.327050][T18486] Cannot create hsr debugfs directory [ 545.061881][T10206] batadv0: left promiscuous mode [ 545.140565][T10206] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 545.176469][T10206] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 545.224861][T10206] veth1_macvtap: left promiscuous mode [ 545.250281][T10206] veth0_macvtap: left promiscuous mode [ 545.263698][T10206] veth1_vlan: left promiscuous mode [ 545.275036][T10206] veth0_vlan: left promiscuous mode [ 545.300647][T18870] netlink: 'syz.1.3417': attribute type 3 has an invalid length. [ 545.311160][T18870] netlink: 'syz.1.3417': attribute type 1 has an invalid length. [ 545.563412][T18878] xt_CT: You must specify a L4 protocol and not use inversions on it [ 545.567108][T18878] __nla_validate_parse: 1 callbacks suppressed [ 545.567153][T18878] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3420'. [ 545.638912][T18879] netlink: 'syz.0.3420': attribute type 9 has an invalid length. [ 545.978067][T10200] smc: removing ib device syz1 [ 546.268207][T18863] 8021q: adding VLAN 0 to HW filter on device bond1 [ 546.395486][ T5287] 8021q: adding VLAN 0 to HW filter on device eth3 [ 546.455976][ T5627] syz1: Port: 1 Link DOWN [ 546.801893][T10200] smbdirect: ib_dev[syz1] removed [ 546.969558][T18894] netlink: 'syz.2.3425': attribute type 1 has an invalid length. [ 547.354888][T18894] 8021q: adding VLAN 0 to HW filter on device bond2 [ 548.637696][T18926] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3434'. [ 548.759311][T18929] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3435'. [ 549.069038][T18926] netlink: 'syz.2.3434': attribute type 1 has an invalid length. [ 549.136912][ T29] audit: type=1800 audit(1785553996.377:9): pid=18941 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3436" name=F439FD58863ABC71E3B186E7998B8E60ABA2A4BCC76EB07D365AFC639FD8B115A0A94F8518F2E7D417DE2318F9700D66104C6A93DA76B8FCAA99404227F34808D6AE2A7990B2C3981AA8906070117B653EDA123EC46475D65CA8B7792E6DA36191F93DA265E6EC803BE1248A4164A7335D78A67992BD88F1A0E3B7F48636AC498BA5F4F8B47248AF dev="tmpfs" ino=362 res=0 errno=0 [ 549.139461][T18926] netlink: 'syz.2.3434': attribute type 2 has an invalid length. [ 549.396225][T18943] netlink: 'syz.0.3437': attribute type 2 has an invalid length. [ 549.842006][T18943] : entered promiscuous mode [ 550.221412][T18962] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3440'. [ 550.273410][T18962] openvswitch: netlink: Missing key (keys=40, expected=80) [ 550.582471][T18968] netlink: 'syz.1.3443': attribute type 6 has an invalid length. [ 550.624032][T18968] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3443'. [ 550.655218][T18968] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3443'. [ 554.493468][T10204] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 554.515396][T10204] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.729644][T10204] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 554.765921][T10204] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.804690][ T5634] Bluetooth: hci5: command 0x0406 tx timeout [ 555.225759][T10200] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 555.278357][T10200] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 555.323435][T19037] netlink: 'syz.0.3452': attribute type 22 has an invalid length. [ 555.333339][T10208] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 555.361390][T19040] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3454'. [ 555.361464][T19037] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3452'. [ 555.383419][T10208] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 555.392688][T19040] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 555.422223][T19040] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 555.439025][T19040] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3454'. [ 555.548619][T10206] IPVS: stop unused estimator thread 0... [ 555.873435][T10184] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 555.993015][T10200] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 556.048029][T19049] syzkaller0: entered promiscuous mode [ 556.062506][T19049] syzkaller0: entered allmulticast mode [ 556.121248][T18486] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 556.187359][T18486] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 556.207111][T18486] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 556.265739][T18486] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 556.441324][T18486] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 556.509866][T18486] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 556.549542][T18486] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 556.661002][T18486] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 556.760261][T19056] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 556.855243][ T5629] block nbd1: Receive control failed (result -32) [ 556.905375][T19064] nbd1: detected capacity change from 0 to 63 [ 556.947158][T19075] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3459'. [ 556.961462][T10208] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 557.001599][ T25] block nbd1: Dead connection, failed to find a fallback [ 557.010322][ T25] block nbd1: shutting down sockets [ 557.023291][ T25] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 557.036907][ T25] Buffer I/O error on dev nbd1, logical block 0, async page read [ 557.049824][ T25] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 557.060477][ T25] Buffer I/O error on dev nbd1, logical block 1, async page read [ 557.069623][ T25] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 557.080833][ T25] Buffer I/O error on dev nbd1, logical block 2, async page read [ 557.091099][ T25] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 557.102025][ T25] Buffer I/O error on dev nbd1, logical block 3, async page read [ 557.111944][ T25] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 557.122718][ T25] Buffer I/O error on dev nbd1, logical block 0, async page read [ 557.131943][ T25] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 557.143394][ T25] Buffer I/O error on dev nbd1, logical block 1, async page read [ 557.152688][ T25] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 557.166392][ T25] Buffer I/O error on dev nbd1, logical block 2, async page read [ 557.175340][ T25] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 557.186187][ T25] Buffer I/O error on dev nbd1, logical block 3, async page read [ 557.201793][ T25] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 4 prio class 2 [ 557.218185][ T25] Buffer I/O error on dev nbd1, logical block 0, async page read [ 557.227482][ T25] Buffer I/O error on dev nbd1, logical block 1, async page read [ 557.238639][ T25] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 557.247692][T19090] netlink: 'syz.1.3462': attribute type 1 has an invalid length. [ 557.256926][T19030] ldm_validate_partition_table(): Disk read failed. [ 557.278264][T19030] Dev nbd1: unable to read RDB block 0 [ 557.284808][T19089] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3463'. [ 557.284834][T19089] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3463'. [ 557.311812][T19030] nbd1: unable to read partition table [ 557.333289][T19030] ldm_validate_partition_table(): Disk read failed. [ 557.347175][T19030] Dev nbd1: unable to read RDB block 0 [ 557.356637][T19030] nbd1: unable to read partition table [ 557.607659][T19105] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3464'. [ 557.651412][T19090] 8021q: adding VLAN 0 to HW filter on device bond1 [ 557.684647][T19105] netlink: 'syz.4.3464': attribute type 5 has an invalid length. [ 557.717992][T19105] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3464'. [ 557.725881][T19111] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 557.784142][T10206] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 557.991754][T19105] geneve2: entered promiscuous mode [ 558.005564][ T5629] Bluetooth: hci0: command 0x080f tx timeout [ 558.024149][T19105] geneve2: entered allmulticast mode [ 558.149060][T19124] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 558.273351][T19124] netlink: 108 bytes leftover after parsing attributes in process `syz.1.3468'. [ 558.369752][T10177] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 256 - 0 [ 558.614778][T10203] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 256 - 0 [ 558.872077][T19142] openvswitch: netlink: Message has 8 unknown bytes. [ 558.923020][T10203] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 256 - 0 [ 559.153134][T10204] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 256 - 0 [ 559.321843][T18486] 8021q: adding VLAN 0 to HW filter on device bond0 [ 559.442463][T18486] 8021q: adding VLAN 0 to HW filter on device team0 [ 559.534784][T10200] bridge0: port 1(bridge_slave_0) entered blocking state [ 559.542962][T10200] bridge0: port 1(bridge_slave_0) entered forwarding state [ 559.665960][T10206] bridge0: port 2(bridge_slave_1) entered blocking state [ 559.673968][T10206] bridge0: port 2(bridge_slave_1) entered forwarding state [ 561.229280][T19201] Bluetooth: MGMT ver 1.23 [ 562.230994][T19224] IPv6: NLM_F_REPLACE set, but no existing node found! [ 562.680684][T19197] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3481'. [ 562.741657][T19197] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3481'. [ 563.142424][T19246] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3489'. [ 563.284636][ T5629] Bluetooth: hci0: command 0x080f tx timeout [ 563.850620][T18486] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 564.322629][T18486] veth0_vlan: entered promiscuous mode [ 564.411568][T18486] veth1_vlan: entered promiscuous mode [ 564.540037][T19284] ipvlan3: entered promiscuous mode [ 564.559451][T19291] netlink: 'syz.1.3498': attribute type 1 has an invalid length. [ 564.936968][T19291] 8021q: adding VLAN 0 to HW filter on device bond2 [ 564.979217][T19292] bond2: entered promiscuous mode [ 564.997476][T19292] bond2: entered allmulticast mode [ 565.057763][T19302] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3500'. [ 565.289822][T18486] veth0_macvtap: entered promiscuous mode [ 565.380772][T18486] veth1_macvtap: entered promiscuous mode [ 565.505380][T18486] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 565.558968][T18486] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 565.769804][T19314] bond3: entered promiscuous mode [ 565.865868][T19319] macvlan2: entered promiscuous mode [ 565.877266][T19319] macvlan2: entered allmulticast mode [ 566.125985][T10193] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.269092][ T69] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.309742][ T69] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.411886][T10193] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 566.857285][T10177] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 566.912130][T10177] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 567.201014][T10183] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 567.293361][T10183] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 567.483385][T19361] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3508'. [ 567.967637][T19383] netlink: 'syz.1.3513': attribute type 1 has an invalid length. [ 567.989338][T19374] 8021q: adding VLAN 0 to HW filter on device bond1 [ 568.018056][T19384] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3338'. [ 568.406990][T19391] netlink: 156 bytes leftover after parsing attributes in process `syz.1.3514'. [ 568.501642][T19391] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3514'. [ 568.788754][T19402] syzkaller1: entered promiscuous mode [ 568.851979][T19402] syzkaller1: entered allmulticast mode [ 570.291240][T19448] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 570.500769][T19459] netlink: 'syz.2.3533': attribute type 11 has an invalid length. [ 570.775316][T19467] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3535'. [ 570.781207][T19470] bridge0: port 3(syz_tun) entered blocking state [ 570.814753][T19470] bridge0: port 3(syz_tun) entered disabled state [ 570.832502][T19470] syz_tun: entered allmulticast mode [ 570.944381][T19470] syz_tun: entered promiscuous mode [ 571.012367][T19470] bridge0: port 3(syz_tun) entered blocking state [ 571.021170][T19470] bridge0: port 3(syz_tun) entered forwarding state [ 571.159227][T19489] xt_hashlimit: size too large, truncated to 1048576 [ 571.627767][T19504] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3541'. [ 571.692425][T19509] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3541'. [ 571.714020][T19477] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 571.969915][T19513] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3543'. [ 572.135851][T19522] xt_socket: unknown flags 0xe4 [ 572.191212][T19516] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3544'. [ 572.704207][T19534] xt_cgroup: path and classid specified [ 572.737048][T19534] netlink: 76 bytes leftover after parsing attributes in process `syz.1.3549'. [ 572.817443][T19543] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3550'. [ 572.835861][T19543] openvswitch: netlink: Flow actions attr not present in new flow. [ 572.963104][ T5629] Bluetooth: hci0: command 0x080f tx timeout [ 573.095731][T19548] x_tables: duplicate underflow at hook 3 [ 573.595348][T19570] netlink: 'syz.1.3556': attribute type 49 has an invalid length. [ 573.912699][T19576] __nla_validate_parse: 1 callbacks suppressed [ 573.937654][T19576] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3559'. [ 574.379398][T19589] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3565'. [ 574.488430][T19590] geneve2: entered promiscuous mode [ 574.555545][T19591] bridge2: port 1(erspan0) entered blocking state [ 574.588859][T19591] bridge2: port 1(erspan0) entered disabled state [ 574.621724][T19591] erspan0: entered allmulticast mode [ 574.657281][T19591] erspan0: entered promiscuous mode [ 574.676496][T19591] bridge2: port 1(erspan0) entered blocking state [ 574.683148][T19591] bridge2: port 1(erspan0) entered forwarding state [ 574.709514][T19603] Cannot find set identified by id 0 to match [ 575.736477][T19636] syzkaller0: entered promiscuous mode [ 575.807681][T19636] syzkaller0: entered allmulticast mode [ 575.882061][T19645] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3577'. [ 576.156217][T19651] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3579'. [ 576.546915][T19651] bond2: option lacp_strict: mode dependency failed, not supported in mode balance-rr(0) [ 576.620629][T19651] bond2 (unregistering): Released all slaves [ 576.660380][T19670] SET target dimension over the limit! [ 576.826672][T19674] [ 576.829062][T19674] ====================================================== [ 576.836125][T19674] WARNING: possible circular locking dependency detected [ 576.843243][T19674] syzkaller #0 Not tainted [ 576.847678][T19674] ------------------------------------------------------ [ 576.854753][T19674] syz.0.3584/19674 is trying to acquire lock: [ 576.860843][T19674] ffffffff8ec848e0 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x15b/0x650 [ 576.870189][T19674] [ 576.870189][T19674] but task is already holding lock: [ 576.877576][T19674] ffff888034efb6b8 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 576.887190][T19674] [ 576.887190][T19674] which lock already depends on the new lock. [ 576.887190][T19674] [ 576.897618][T19674] [ 576.897618][T19674] the existing dependency chain (in reverse order) is: [ 576.906746][T19674] [ 576.906746][T19674] -> #7 (&mm->mmap_lock){++++}-{4:4}: [ 576.914474][T19674] __might_fault+0xcb/0x130 [ 576.919630][T19674] _copy_from_user+0x28/0xb0 [ 576.924905][T19674] csum_and_copy_from_iter_full+0x210/0x1fb0 [ 576.931567][T19674] ip_generic_getfrag+0x149/0x2d0 [ 576.937186][T19674] __ip6_append_data+0x3b26/0x40c0 [ 576.942901][T19674] ip6_append_data+0x108/0x270 [ 576.948213][T19674] rawv6_sendmsg+0x1298/0x18c0 [ 576.953532][T19674] sock_sendmsg_nosec+0x10e/0x180 [ 576.959149][T19674] ____sys_sendmsg+0x54e/0x850 [ 576.964461][T19674] ___sys_sendmsg+0x2a5/0x360 [ 576.969678][T19674] __x64_sys_sendmsg+0x1b1/0x290 [ 576.975152][T19674] do_syscall_64+0x174/0x580 [ 576.980389][T19674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 576.986848][T19674] [ 576.986848][T19674] -> #6 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 576.994600][T19674] lock_sock_nested+0x41/0x100 [ 576.999895][T19674] inet_shutdown+0x6a/0x390 [ 577.004973][T19674] nbd_mark_nsock_dead+0x2cb/0x550 [ 577.010674][T19674] recv_work+0x1cee/0x1e10 [ 577.015621][T19674] process_scheduled_works+0xa8e/0x14e0 [ 577.021732][T19674] worker_thread+0xa47/0xfb0 [ 577.026880][T19674] kthread+0x388/0x470 [ 577.031480][T19674] ret_from_fork+0x514/0xb70 [ 577.036635][T19674] ret_from_fork_asm+0x1a/0x30 [ 577.041948][T19674] [ 577.041948][T19674] -> #5 (&nsock->tx_lock){+.+.}-{4:4}: [ 577.049611][T19674] __mutex_lock+0x19d/0x1550 [ 577.054795][T19674] nbd_queue_rq+0x373/0x1150 [ 577.059916][T19674] blk_mq_dispatch_rq_list+0x499/0x1990 [ 577.066069][T19674] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 577.072971][T19674] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 577.079489][T19674] blk_mq_run_work_fn+0x16c/0x300 [ 577.085055][T19674] process_scheduled_works+0xa8e/0x14e0 [ 577.091136][T19674] worker_thread+0xa47/0xfb0 [ 577.096248][T19674] kthread+0x388/0x470 [ 577.100850][T19674] ret_from_fork+0x514/0xb70 [ 577.105976][T19674] ret_from_fork_asm+0x1a/0x30 [ 577.111263][T19674] [ 577.111263][T19674] -> #4 (&cmd->lock){+.+.}-{4:4}: [ 577.118483][T19674] __mutex_lock+0x19d/0x1550 [ 577.123612][T19674] nbd_queue_rq+0xc1/0x1150 [ 577.128664][T19674] blk_mq_dispatch_rq_list+0x499/0x1990 [ 577.134777][T19674] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 577.141652][T19674] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 577.148173][T19674] blk_mq_run_work_fn+0x16c/0x300 [ 577.153732][T19674] process_scheduled_works+0xa8e/0x14e0 [ 577.159814][T19674] worker_thread+0xa47/0xfb0 [ 577.164972][T19674] kthread+0x388/0x470 [ 577.169578][T19674] ret_from_fork+0x514/0xb70 [ 577.174704][T19674] ret_from_fork_asm+0x1a/0x30 [ 577.180082][T19674] [ 577.180082][T19674] -> #3 (set->srcu){.+.+}-{0:0}: [ 577.187216][T19674] __synchronize_srcu+0xc9/0x2f0 [ 577.192725][T19674] elevator_switch+0x1e8/0x7b0 [ 577.198091][T19674] elevator_change+0x2fa/0x480 [ 577.203390][T19674] elevator_set_default+0x375/0x440 [ 577.209124][T19674] blk_register_queue+0x3f3/0x4e0 [ 577.214706][T19674] __add_disk+0x6cb/0xe30 [ 577.219598][T19674] add_disk_fwnode+0x100/0x3a0 [ 577.224922][T19674] nbd_dev_add+0x733/0xb60 [ 577.229876][T19674] nbd_init+0x15f/0x1e0 [ 577.234638][T19674] do_one_initcall+0x250/0x870 [ 577.239938][T19674] do_initcall_level+0x10a/0x1a0 [ 577.245508][T19674] do_initcalls+0x59/0xa0 [ 577.250370][T19674] kernel_init_freeable+0x29d/0x3e0 [ 577.256150][T19674] kernel_init+0x1d/0x1d0 [ 577.261035][T19674] ret_from_fork+0x514/0xb70 [ 577.266166][T19674] ret_from_fork_asm+0x1a/0x30 [ 577.271466][T19674] [ 577.271466][T19674] -> #2 (&q->elevator_lock){+.+.}-{4:4}: [ 577.279298][T19674] __mutex_lock+0x19d/0x1550 [ 577.284436][T19674] elevator_change+0x1af/0x480 [ 577.289738][T19674] elevator_set_none+0xb5/0x140 [ 577.295118][T19674] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 577.301453][T19674] nbd_start_device+0x189/0xb30 [ 577.306834][T19674] nbd_genl_connect+0x1597/0x1c10 [ 577.312392][T19674] genl_family_rcv_msg_doit+0x233/0x340 [ 577.318620][T19674] genl_rcv_msg+0x614/0x7a0 [ 577.323658][T19674] netlink_rcv_skb+0x226/0x4a0 [ 577.328950][T19674] genl_rcv+0x28/0x40 [ 577.333465][T19674] netlink_unicast+0x7bb/0x940 [ 577.338755][T19674] netlink_sendmsg+0x813/0xb40 [ 577.344049][T19674] sock_sendmsg_nosec+0x13a/0x180 [ 577.349606][T19674] ____sys_sendmsg+0x54e/0x850 [ 577.354897][T19674] ___sys_sendmsg+0x2a5/0x360 [ 577.360096][T19674] __x64_sys_sendmsg+0x1b1/0x290 [ 577.365559][T19674] do_syscall_64+0x174/0x580 [ 577.370679][T19674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.377096][T19674] [ 577.377096][T19674] -> #1 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 577.385732][T19674] blk_alloc_queue+0x544/0x690 [ 577.391025][T19674] __blk_mq_alloc_disk+0x194/0x390 [ 577.396660][T19674] nbd_dev_add+0x494/0xb60 [ 577.401608][T19674] nbd_init+0x15f/0x1e0 [ 577.406307][T19674] do_one_initcall+0x250/0x870 [ 577.411600][T19674] do_initcall_level+0x10a/0x1a0 [ 577.417063][T19674] do_initcalls+0x59/0xa0 [ 577.421912][T19674] kernel_init_freeable+0x29d/0x3e0 [ 577.427642][T19674] kernel_init+0x1d/0x1d0 [ 577.432503][T19674] ret_from_fork+0x514/0xb70 [ 577.437627][T19674] ret_from_fork_asm+0x1a/0x30 [ 577.442913][T19674] [ 577.442913][T19674] -> #0 (fs_reclaim){+.+.}-{0:0}: [ 577.450135][T19674] __lock_acquire+0x1520/0x2cf0 [ 577.455541][T19674] lock_acquire+0x106/0x350 [ 577.460575][T19674] fs_reclaim_acquire+0x71/0x100 [ 577.466048][T19674] prepare_alloc_pages+0x15b/0x650 [ 577.471691][T19674] __alloc_frozen_pages_noprof+0x12f/0x380 [ 577.478121][T19674] alloc_pages_mpol+0x212/0x380 [ 577.483519][T19674] alloc_pages_noprof+0xac/0x2a0 [ 577.488981][T19674] __pud_alloc+0x3a/0x460 [ 577.493838][T19674] handle_mm_fault+0x1f85/0x3080 [ 577.499322][T19674] do_user_addr_fault+0x744/0x1340 [ 577.505010][T19674] exc_page_fault+0x6a/0xc0 [ 577.510056][T19674] asm_exc_page_fault+0x26/0x30 [ 577.515438][T19674] rep_movs_alternative+0x33/0xa0 [ 577.520999][T19674] _copy_to_user+0x8a/0xb0 [ 577.525946][T19674] x25_ioctl+0x8a5/0xff0 [ 577.530814][T19674] sock_do_ioctl+0x101/0x320 [ 577.535936][T19674] sock_ioctl+0x57a/0x7e0 [ 577.540808][T19674] __se_sys_ioctl+0xfc/0x170 [ 577.545978][T19674] do_syscall_64+0x174/0x580 [ 577.551110][T19674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.557541][T19674] [ 577.557541][T19674] other info that might help us debug this: [ 577.557541][T19674] [ 577.567774][T19674] Chain exists of: [ 577.567774][T19674] fs_reclaim --> sk_lock-AF_INET6 --> &mm->mmap_lock [ 577.567774][T19674] [ 577.580447][T19674] Possible unsafe locking scenario: [ 577.580447][T19674] [ 577.587954][T19674] CPU0 CPU1 [ 577.593356][T19674] ---- ---- [ 577.598749][T19674] rlock(&mm->mmap_lock); [ 577.603263][T19674] lock(sk_lock-AF_INET6); [ 577.610293][T19674] lock(&mm->mmap_lock); [ 577.617153][T19674] lock(fs_reclaim); [ 577.621141][T19674] [ 577.621141][T19674] *** DEADLOCK *** [ 577.621141][T19674] [ 577.629340][T19674] 2 locks held by syz.0.3584/19674: [ 577.634562][T19674] #0: ffff888055722260 (sk_lock-AF_X25){+.+.}-{0:0}, at: x25_ioctl+0x654/0xff0 [ 577.643696][T19674] #1: ffff888034efb6b8 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 [ 577.653642][T19674] [ 577.653642][T19674] stack backtrace: [ 577.659626][T19674] CPU: 0 UID: 0 PID: 19674 Comm: syz.0.3584 Not tainted syzkaller #0 PREEMPT(full) [ 577.659648][T19674] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 577.659659][T19674] Call Trace: [ 577.659669][T19674] [ 577.659746][T19674] dump_stack_lvl+0xe8/0x150 [ 577.659821][T19674] print_circular_bug+0x2e1/0x300 [ 577.659839][T19674] check_noncircular+0x12e/0x150 [ 577.659858][T19674] __lock_acquire+0x1520/0x2cf0 [ 577.659884][T19674] ? __lock_acquire+0x683/0x2cf0 [ 577.659928][T19674] ? kernel_text_address+0xa5/0xe0 [ 577.659945][T19674] ? __kernel_text_address+0xd/0x30 [ 577.659960][T19674] ? unwind_get_return_address+0x4d/0x90 [ 577.659980][T19674] ? prepare_alloc_pages+0x15b/0x650 [ 577.660001][T19674] lock_acquire+0x106/0x350 [ 577.660021][T19674] ? prepare_alloc_pages+0x15b/0x650 [ 577.660045][T19674] ? ktime_get+0x45/0x220 [ 577.660065][T19674] ? lock_acquire+0x106/0x350 [ 577.660086][T19674] fs_reclaim_acquire+0x71/0x100 [ 577.660107][T19674] ? prepare_alloc_pages+0x15b/0x650 [ 577.660127][T19674] prepare_alloc_pages+0x15b/0x650 [ 577.660152][T19674] __alloc_frozen_pages_noprof+0x12f/0x380 [ 577.660176][T19674] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 577.660201][T19674] ? __pfx_policy_nodemask+0x10/0x10 [ 577.660228][T19674] ? __lock_acquire+0x683/0x2cf0 [ 577.660250][T19674] alloc_pages_mpol+0x212/0x380 [ 577.660277][T19674] alloc_pages_noprof+0xac/0x2a0 [ 577.660292][T19674] __pud_alloc+0x3a/0x460 [ 577.660312][T19674] handle_mm_fault+0x1f85/0x3080 [ 577.660332][T19674] ? __pfx_mt_find+0x10/0x10 [ 577.660420][T19674] ? handle_mm_fault+0xec/0x3080 [ 577.660441][T19674] ? __pfx_handle_mm_fault+0x10/0x10 [ 577.660465][T19674] ? lock_mm_and_find_vma+0xa7/0x340 [ 577.660488][T19674] do_user_addr_fault+0x744/0x1340 [ 577.660516][T19674] exc_page_fault+0x6a/0xc0 [ 577.660536][T19674] asm_exc_page_fault+0x26/0x30 [ 577.660552][T19674] RIP: 0010:rep_movs_alternative+0x33/0xa0 [ 577.660578][T19674] Code: 73 25 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 4d 63 04 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb [ 577.660591][T19674] RSP: 0018:ffffc9000cd27a48 EFLAGS: 00050202 [ 577.660627][T19674] RAX: 0000000200000002 RBX: 0000000000000018 RCX: 0000000000000018 [ 577.660639][T19674] RDX: 0000000000000000 RSI: ffff88805572279c RDI: 0000200000000000 [ 577.660651][T19674] RBP: ffffc9000cd27cb0 R08: ffff8880557227b3 R09: 1ffff1100aae44f6 [ 577.660662][T19674] R10: dffffc0000000000 R11: ffffed100aae44f7 R12: 0000200000000018 [ 577.660673][T19674] R13: 00007ffffffff000 R14: ffff88805572279c R15: 0000200000000000 [ 577.660694][T19674] _copy_to_user+0x8a/0xb0 [ 577.660711][T19674] x25_ioctl+0x8a5/0xff0 [ 577.660737][T19674] ? __pfx_x25_ioctl+0x10/0x10 [ 577.660761][T19674] ? kasan_quarantine_put+0xbb/0x1f0 [ 577.660793][T19674] ? tomoyo_path_number_perm+0x219/0x5f0 [ 577.660880][T19674] ? tomoyo_path_number_perm+0x219/0x5f0 [ 577.660907][T19674] ? do_vfs_ioctl+0x116f/0x1530 [ 577.660924][T19674] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 577.660944][T19674] sock_do_ioctl+0x101/0x320 [ 577.660967][T19674] ? __pfx_sock_do_ioctl+0x10/0x10 [ 577.660988][T19674] ? hook_file_ioctl+0x1f0/0x5f0 [ 577.661035][T19674] sock_ioctl+0x57a/0x7e0 [ 577.661057][T19674] ? __pfx_sock_ioctl+0x10/0x10 [ 577.661076][T19674] ? __fget_files+0x2a/0x420 [ 577.661096][T19674] ? __fget_files+0x3a2/0x420 [ 577.661117][T19674] ? __fget_files+0x2a/0x420 [ 577.661139][T19674] ? bpf_lsm_file_ioctl+0x9/0x20 [ 577.661180][T19674] ? __pfx_sock_ioctl+0x10/0x10 [ 577.661201][T19674] __se_sys_ioctl+0xfc/0x170 [ 577.661217][T19674] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.661235][T19674] do_syscall_64+0x174/0x580 [ 577.661252][T19674] ? trace_irq_disable+0x3b/0x140 [ 577.661290][T19674] ? clear_bhb_loop+0x40/0x90 [ 577.661309][T19674] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 577.661325][T19674] RIP: 0033:0x7f0405b9e019 [ 577.661338][T19674] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 577.661353][T19674] RSP: 002b:00007f0406a6a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 577.661369][T19674] RAX: ffffffffffffffda RBX: 00007f0405e25fa0 RCX: 00007f0405b9e019 [ 577.661388][T19674] RDX: 0000200000000000 RSI: 00000000000089e2 RDI: 0000000000000004 [ 577.661399][T19674] RBP: 00007f0405c3500c R08: 0000000000000000 R09: 0000000000000000 [ 577.661408][T19674] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 577.661417][T19674] R13: 00007f0405e26038 R14: 00007f0405e25fa0 R15: 00007ffd31929e68 [ 577.661436][T19674] [ 578.179113][T19679] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3585'. [ 580.402968][ T5634] Bluetooth: hci2: command 0x0406 tx timeout