last executing test programs: 2.740228915s ago: executing program 1 (id=5236): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000180)='team0\x00', 0x10) syz_emit_ethernet(0x32, &(0x7f0000000280)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x100, 0x0, 0x0, 0x11, 0x0, @empty, @multicast1}, {0x0, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x1, 0x1, 0xc0, 0x100}}}}}}}, 0x0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)={0x38, r1, 0x1, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x4}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLST={0x10, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4ee0f409}]}]}]}, 0x38}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x6b, 0x11, 0x3b}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call, @exit={0x95, 0x0, 0x33}], {0x95, 0x0, 0x5a5}}, &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xb8000000}, 0x70) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000071123e000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) 1.964056338s ago: executing program 1 (id=5246): syz_extract_tcp_res$synack(&(0x7f0000000080)={0x41424344}, 0x1, 0x0) syz_extract_tcp_res(&(0x7f0000000100)={0x41424344}, 0x2, 0x6) syz_emit_ethernet(0x56, &(0x7f0000000200)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @multicast, @void, {@canfd={0xd, {{0x3, 0x1, 0x0, 0x1}, 0x1a, 0x2, 0x0, 0x0, "47377439c37a74df15974903d310cf15e95f4604a493e73a9b41392885131881c1337303c98c1f66e256da6e762f25b91b5b133c95f2a47af5dd0195cd147942"}}}}, &(0x7f0000000280)={0x1, 0x4, [0x686, 0x728, 0x263, 0x5b0]}) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@broadcast, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa0100ff, @local}, {{0xfffd, 0x0, 0x41424344, r1, 0x0, 0x6, 0xa, 0x10, 0x0, 0x0, 0x0, {[@md5sig={0x13, 0x12, "b3e480a7613088fd714100027d003b11"}]}}}}}}}, 0x0) syz_emit_ethernet(0x116, &(0x7f00000000c0)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x20, 0x4, 0x0, 0x7, 0x108, 0x66, 0x0, 0x0, 0x6, 0x0, @private=0xa010101, @local, {[@timestamp_addr={0x44, 0x24, 0x19, 0x1, 0x7, [{@private=0xa010102, 0x4}, {@multicast2, 0x1ff}, {@multicast2, 0x40}, {@empty, 0x1}]}, @ssrr={0x89, 0xb, 0xac, [@loopback, @empty]}, @noop, @ra={0x94, 0x4}, @rr={0x7, 0xb, 0xdd, [@remote, @multicast1]}, @ssrr={0x89, 0x2b, 0x1f, [@empty, @multicast2, @rand_addr=0x64010100, @empty, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010101, @multicast2, @dev={0xac, 0x14, 0x14, 0x2d}, @multicast2]}]}}, {{0x4e24, 0x4e23, r0, r1, 0x0, 0x0, 0xc, 0x80, 0x6, 0x0, 0x5, {[@window={0x3, 0x3, 0xb}, @mss={0x2, 0x4, 0x3ff}, @sack_perm={0x4, 0x2}, @md5sig={0x13, 0x12, "1d32b3fcdf6af5475486ba7f62040d1f"}]}}, {"e27bd679c37531fd8f4cd080e79b51bf50d342329e5a10ea9b2eab3e088b943686cea028cd0f5c769bacd1d877f7a5d00d5814b9593ff8fb8aad493eae237b893119097ed68bb1db0d0eb6c12cd9313dce08a1fac895d9a8"}}}}}}, 0x0) 1.888984418s ago: executing program 1 (id=5249): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0xf, 0x3, 0x9, 0x7fffffff, 0x6, 0xa0, 0x40004}, 0x19) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000300)=@nameseq={0x1e, 0x1, 0x3, {0x2, 0x2, 0xfffffffe}}, 0x10, &(0x7f00000008c0)=[{&(0x7f0000000440)="acbabf5511959d868313fcf7244e69", 0xf}, {&(0x7f0000000380)="31a1dcfcd8f901ba4649ff725246dcd1b541f30714305e9ed3353e34af84b40c8da1366a14b151d28b48fc956920dac396d7eedcd53269c338b88ef410136570f0f35915a8a39b1fdacbd75689877c670b50efa44d", 0x55}, {&(0x7f0000000400)="003c63e18327b1ff1d8d3b15563d35e758a86e4c098501d5d23eb35d706cd7fd949d8f565424", 0x26}, {&(0x7f0000000940)="c4144f99539d73ce2f7be34af02f0beca72e1ed92d4163e94ad47e0e4271295ee4af161f2daa354703d0ec46a1f5c3b6fb48d9ffa75e9c581c05bf2dc6f97e42eff4b6312ffc38ba78f670d3bd44dd851719084e5eac59ac3255a0e3405ac3cf18cf16b0085fcf45bfa21b9db13dc9cfe0e25c29bba231d50189679d24969d21246cd2f5f132cc43c9ddf0ee71ae4891f6c8a6c16bed3225fb505d3ef1542d67942963dd1d8ec723ed960eccac3157790f0ba6842c8c4a301965827571f2ba5344da21a2c92b79bdca214a16cccb191619cd5d2e970e548ef0b602e93543fa84dc9842a1e3d9aae7538fe27cb9a39f73a0e993f5d14ee6c08d48761eb1134105db702902f9efd3fef90553ee0f", 0x10d}, {&(0x7f0000000680)="377920dea317132c70f86a82ccc8505a5ce836accd8069f02f7aa36c", 0x1c}, {&(0x7f00000006c0)="5994caf2ce717b2c4bd5b8515f90b0772a3ee6f597e69f194085cab5ff282234b50654198cab7f6fe426397ef4a0fa4f814c87e0e257d264072bd2b6023441e47ff496bc38774ad0c0837c76f9528449d8517f5cd0b14e5ea181dd77f02ab4434d1c278021c35ae375daed979d3d0b30410fa638f72a01ef4590e381c71f30892fdb04646cf4637be4f3a5432b5797b557ad38d705318629fa7ac5ddbf875557e3ae2e7f7009fe53ac32c1f7b65e6c042ce70f7a86bc99db9cfbf9b78a78", 0xbe}, {&(0x7f0000000780)="a5e866dd5409508500529f20a632cb48dc21052272b940e3ba2d81332941f296f80f9186798259bfaf54d7e5056dddeb98d6f46df54663bc6a4ebd3bc6d240010000003cfc0b2c0a5450f72b58e30087503828dfec80647d5ec54af596fc031dff347e5a504db57215bef075495f82297e95fcd180c961567c3dc17f26c3552b0a580eefc011c9742f92cf8794947a9d4c2643ce97df049c7fd9b80ea2c676314276b1d00edda753c16af421fd09f6d7694384620a62f051210e83382b0800"/200, 0xc8}, {&(0x7f0000000880)="605a59484e36d188a72984885987b8b992c5ab342825ddb3", 0x18}], 0x8, &(0x7f0000000480)="197e3debbd30e8a995ace80d02b790dccba2b36169b47dfb395fd656a954c25994c852720cfaf03d609b312a0bdd6c8b29241bcd5b266f51dc09c3527b9f7a4d17a24ba93dddc5d1440678cc5e6df406503daba063217d87ecb982c9f6a35eed1e0ee85012f091a3376b53a5d4f59864b9661658d43825c048375ff5c98fa7b7f31de2e69717870131225adb890b860fddbaf7102766fcd0916039b9cd31ad125f67b9cb027ae0cd1db47d0f2632007ce75c5467d4b064ffc1a6599a593799e9d25da22581fd7c", 0xc7, 0x14}, 0x40) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x270, 0x120, 0xffffffff, 0xffffffff, 0x120, 0xffffffff, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x7fffffe, 0x0, {[{{@ip={@rand_addr=0x64010101, @empty, 0xffffffff, 0xff000000, 'veth1_vlan\x00', 'dvmrp1\x00', {0xff}, {}, 0x32, 0x2, 0x14}, 0x6, 0xc0, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x1}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0xa, 0x0, 0x5, 0x0, 0x4], 0x5, 0x1}, {0xffffffffffffffff, [0x2, 0x4, 0x5, 0x0, 0x1], 0x1, 0x1}}}}, {{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x9, 0x3, 0x194c, 'syz0\x00', {0x7}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d0) socket$packet(0x11, 0x3, 0x300) (async) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0xf, 0x3, 0x9, 0x7fffffff, 0x6, 0xa0, 0x40004}, 0x19) (async) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000300)=@nameseq={0x1e, 0x1, 0x3, {0x2, 0x2, 0xfffffffe}}, 0x10, &(0x7f00000008c0)=[{&(0x7f0000000440)="acbabf5511959d868313fcf7244e69", 0xf}, {&(0x7f0000000380)="31a1dcfcd8f901ba4649ff725246dcd1b541f30714305e9ed3353e34af84b40c8da1366a14b151d28b48fc956920dac396d7eedcd53269c338b88ef410136570f0f35915a8a39b1fdacbd75689877c670b50efa44d", 0x55}, {&(0x7f0000000400)="003c63e18327b1ff1d8d3b15563d35e758a86e4c098501d5d23eb35d706cd7fd949d8f565424", 0x26}, {&(0x7f0000000940)="c4144f99539d73ce2f7be34af02f0beca72e1ed92d4163e94ad47e0e4271295ee4af161f2daa354703d0ec46a1f5c3b6fb48d9ffa75e9c581c05bf2dc6f97e42eff4b6312ffc38ba78f670d3bd44dd851719084e5eac59ac3255a0e3405ac3cf18cf16b0085fcf45bfa21b9db13dc9cfe0e25c29bba231d50189679d24969d21246cd2f5f132cc43c9ddf0ee71ae4891f6c8a6c16bed3225fb505d3ef1542d67942963dd1d8ec723ed960eccac3157790f0ba6842c8c4a301965827571f2ba5344da21a2c92b79bdca214a16cccb191619cd5d2e970e548ef0b602e93543fa84dc9842a1e3d9aae7538fe27cb9a39f73a0e993f5d14ee6c08d48761eb1134105db702902f9efd3fef90553ee0f", 0x10d}, {&(0x7f0000000680)="377920dea317132c70f86a82ccc8505a5ce836accd8069f02f7aa36c", 0x1c}, {&(0x7f00000006c0)="5994caf2ce717b2c4bd5b8515f90b0772a3ee6f597e69f194085cab5ff282234b50654198cab7f6fe426397ef4a0fa4f814c87e0e257d264072bd2b6023441e47ff496bc38774ad0c0837c76f9528449d8517f5cd0b14e5ea181dd77f02ab4434d1c278021c35ae375daed979d3d0b30410fa638f72a01ef4590e381c71f30892fdb04646cf4637be4f3a5432b5797b557ad38d705318629fa7ac5ddbf875557e3ae2e7f7009fe53ac32c1f7b65e6c042ce70f7a86bc99db9cfbf9b78a78", 0xbe}, {&(0x7f0000000780)="a5e866dd5409508500529f20a632cb48dc21052272b940e3ba2d81332941f296f80f9186798259bfaf54d7e5056dddeb98d6f46df54663bc6a4ebd3bc6d240010000003cfc0b2c0a5450f72b58e30087503828dfec80647d5ec54af596fc031dff347e5a504db57215bef075495f82297e95fcd180c961567c3dc17f26c3552b0a580eefc011c9742f92cf8794947a9d4c2643ce97df049c7fd9b80ea2c676314276b1d00edda753c16af421fd09f6d7694384620a62f051210e83382b0800"/200, 0xc8}, {&(0x7f0000000880)="605a59484e36d188a72984885987b8b992c5ab342825ddb3", 0x18}], 0x8, &(0x7f0000000480)="197e3debbd30e8a995ace80d02b790dccba2b36169b47dfb395fd656a954c25994c852720cfaf03d609b312a0bdd6c8b29241bcd5b266f51dc09c3527b9f7a4d17a24ba93dddc5d1440678cc5e6df406503daba063217d87ecb982c9f6a35eed1e0ee85012f091a3376b53a5d4f59864b9661658d43825c048375ff5c98fa7b7f31de2e69717870131225adb890b860fddbaf7102766fcd0916039b9cd31ad125f67b9cb027ae0cd1db47d0f2632007ce75c5467d4b064ffc1a6599a593799e9d25da22581fd7c", 0xc7, 0x14}, 0x40) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x270, 0x120, 0xffffffff, 0xffffffff, 0x120, 0xffffffff, 0x1d8, 0xffffffff, 0xffffffff, 0x1d8, 0xffffffff, 0x7fffffe, 0x0, {[{{@ip={@rand_addr=0x64010101, @empty, 0xffffffff, 0xff000000, 'veth1_vlan\x00', 'dvmrp1\x00', {0xff}, {}, 0x32, 0x2, 0x14}, 0x6, 0xc0, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x1}}, @inet=@rpfilter={{0x28}, {0x1}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0xa, 0x0, 0x5, 0x0, 0x4], 0x5, 0x1}, {0xffffffffffffffff, [0x2, 0x4, 0x5, 0x0, 0x1], 0x1, 0x1}}}}, {{@uncond, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x9, 0x3, 0x194c, 'syz0\x00', {0x7}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d0) (async) 1.771567706s ago: executing program 1 (id=5253): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newlink={0x38, 0x10, 0x437, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4048b}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_TTL={0x5, 0x4, 0x7}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4c050}, 0x4000804) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="000426bd7000fbdbdf250100000014000700fc00000000000000000000000000000106000a004e24000008000600640101000880080000000000080008000a01010006000a804e220000"], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) 1.680577325s ago: executing program 3 (id=5254): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5c0100001000130780fffffffcdbdf252001000000000000000000000000000020010000000000000000000000000001000000004e210002000000006c000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="fc010000000000000000000000000000000000fe32000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000090000000000000001000000ffffffff"], 0x15c}, 0x1, 0x0, 0x0, 0x880}, 0x2000) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000100)={0xa, 0xfffe, 0x4, @mcast2={0xff, 0x3}}, 0x1c) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000340)=ANY=[], 0x8) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='batadv0\x00', 0x10) sendto$inet6(r1, &(0x7f0000000000)="ac149f64c29a021a05ff208b4247a4d6c97c69e6a095cfb4", 0x18, 0x20008880, 0x0, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r0) r2 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r2, &(0x7f0000000040), 0x10) listen(r2, 0x0) r3 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r3, &(0x7f0000000080), 0x10) close(0x3) sendmmsg(r3, &(0x7f0000000100)=[{{0x0, 0x0, 0x0}}], 0x1, 0x24008094) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000180)="78f832958651e132ac8baebd430e708a", 0x10) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$TUNSETOFFLOAD(r5, 0x400454c9, 0xba98575a95aeb70d) ioctl$TUNSETLINK(r5, 0x400454cd, 0x337) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="010000000000000000000f"], 0x1c}, 0x1, 0x0, 0x0, 0x4004040}, 0x10) 1.551899957s ago: executing program 2 (id=5257): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000001080)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000300)="c99bfa", 0x3) r1 = socket(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000016c0)=@newqdisc={0x14c, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0x3}, {0xffff, 0xffff}, {0xfff3, 0xd}}, [@qdisc_kind_options=@q_choke={{0xa}, {0xffffffffffffffcb, 0x2, [@TCA_CHOKE_STAB={0x104, 0x2, "1f8271b57326d2cd06c77f7141082f8bc18164a8cde63d55c42552f43f2cb0126f46de26c849626f8f1e92ec1693d6580135c73acfe420c078830b68732dd35588582d1623a87e1c705a6260fccb8a9723b1299a305b1fe6d1858aad80f29d43bc45d44ee93b8a1cd5a2f7bd1c8d4711330bd8e17da2ca0f428712c1f913fd0526a82497ee4888b2695491dabe3af483ec6c939b9ab1893cada806b245f320eeb8005c6a6b520e65a4449408ae841b548e6e309f3b9ad5fbd764d7338052495f89a82be087b692eb11f5b9153d0a3f22b5586c2078662e25d9ab57d339904f6e824fc2b705ac50cde174f48bb04e934ea306e91be9343d09e05192691250e303"}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x8000, 0x4, 0x7, 0x15, 0x17, 0xb}}]}}]}, 0x14c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0xf) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001a80)=@newtaction={0x48, 0x5a, 0x1, 0x0, 0x0, {0x2}, [{0x34, 0x1, [@m_pedit={0x30, 0x0, 0x0, 0x0, {{0xa}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x80, 0x3, 0x0, 0xfffffffd}, 0x10) sendmsg$nl_route(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000001a000100000000000100"/28], 0x1c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x4, &(0x7f0000000900)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a200000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x70, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 1.549298483s ago: executing program 1 (id=5258): pipe(&(0x7f00000045c0)={0xffffffffffffffff}) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x8000, 0x6, 0x8000, 0x6}, 0x1c) mmap(&(0x7f0000000000/0x2000)=nil, 0x30000, 0x2, 0x11, r1, 0x0) vmsplice(r1, &(0x7f0000000100)=[{&(0x7f0000000140)="0500a461a0ab309e37398dfa466ef6e2f1a55ab25e0200000007658dc0e99ae905c6a48664a247", 0x27}, {&(0x7f0000000180)="b1fd8f8ca3b81debdc96731402b42eb5643498c4a069d37733784600dd185b52d561904276ffc10223388d70ae16c80870e060c84ae081967bf8ea5bb4a710d57d764ddbb16d919169137da00b87a1cc3e4629de76c3d0b7ba04556653", 0x5d}], 0x2, 0x1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000040), r3) splice(r0, 0x0, r3, 0x0, 0x10000000000066, 0xa) 1.528574678s ago: executing program 4 (id=5260): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wpan0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001800dd8d000020000000000002000000000000060000060006001500010000001800168014000100000000000000010000001000000011"], 0x3c}}, 0x0) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100fdffffff000000001d00000008000300", @ANYRES32=r1, @ANYBLOB="40002f800c0003000000000000000000080001"], 0x5c}}, 0x20000000) 1.446895396s ago: executing program 3 (id=5261): r0 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_int(r0, 0x29, 0x5, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3400000040000100fcff070004000000010000000400488014000180100010800c000f80080091002d2e260008000200", @ANYRES32=r1, @ANYBLOB="9165f5eb4e4d66de765700160f4032f8042a339acb546e654b1a5cd8dad5b76b104d16bcd9874216366447cba60d2460e6cac88a3d84f100840c8c343c81dd6fcbfaaf0b3d7f210d1fed63b4f9a1a848c809f0"], 0x34}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) socket$inet6(0xa, 0x3, 0x1) (async) setsockopt$inet6_int(r0, 0x29, 0x5, 0x0, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="3400000040000100fcff070004000000010000000400488014000180100010800c000f80080091002d2e260008000200", @ANYRES32=r1, @ANYBLOB="9165f5eb4e4d66de765700160f4032f8042a339acb546e654b1a5cd8dad5b76b104d16bcd9874216366447cba60d2460e6cac88a3d84f100840c8c343c81dd6fcbfaaf0b3d7f210d1fed63b4f9a1a848c809f0"], 0x34}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) (async) 1.384270719s ago: executing program 4 (id=5263): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x3) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000080)) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000000)=@gcm_128={{0x303}, "2d9421fe8a4c9563", "cf6ff9ff337ed301000100c747fbbfc1", "dbdc27ff", "16de86d67a8426bd"}, 0x28) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[@ANYBLOB="340000001c00010029bd7000ffdbdf2507000000", @ANYRES32=r3, @ANYBLOB="80007f0a0a0002"], 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x4040004) r4 = socket(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x0) bind$vsock_stream(r1, &(0x7f0000000000)={0x28, 0x0, 0xffffffff, @host}, 0x10) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=@newlink={0x20, 0x10, 0x401, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x585d}}, 0x20}, 0x1, 0x0, 0x0, 0x40840}, 0x8900) 1.377998813s ago: executing program 2 (id=5264): bpf$ENABLE_STATS(0x20, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv6_getaddr={0x18, 0x16, 0x3c2be10bca706f15, 0x0, 0x0, {0xa, 0x78}}, 0x18}}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@ipv6_getaddr={0x18, 0x16, 0x3c2be10bca706f15, 0x0, 0x0, {0xa, 0x78}}, 0x18}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001e80)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000480000000820000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1886d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd364158a4591c559f76c0130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce74c4dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f00c484d339c480f70006a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08ef74c48785f895b4ec8d1141d5e8744d7f09ab4df6027bf48cabecead649f96ea24d3287a7b01ab84d336f3c0f45a0642d6f2c494160cb7f46ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe91ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcffff3ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d253e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a0000000000000000895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd3153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf2af469bdfb361b9c"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001e80)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000480000000820000095000000000000002ba7e1d30c04aa8b3382022ce2a1d97411a0f6b599e83f24a3aa81d36bb7019c13bd23212fb56f040026fbfefc4a056bdc17487902317142fac7e7be168c1886d0d4d94f2f4eb45c652fbc1626cca2a28d67893547db51ee988e6e06c8cedf7ceb9fc40400ae5e4aa74c92c6a51cbf9b0a4def23d410f6accd364158a4591c559f76c0130bfc4e90a6341865c3f5ab3e89cf6c662ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0c18ce74c4dae15cb7947c491b8bea3fd2f73902ebcfcf4982277d9800011b405bbf7b02433a9bcd715f5888b2007f000000001c000000010000000000000600000000309329170ee5b567e70f00c484d339c480f70006a10f58fa64533500000000000000000000000031000000000000001208e75a89faffbfb11b7dc6ea31001e846c12423a169f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d617de7a6520655a80d0900f4d433623c850af895abba14f6fbd7fbad1f98e26ad4deaf1a4f294b2a431ab9142f3a06d54740a4bc5e3abd378af7c9676a08ef74c48785f895b4ec8d1141d5e8744d7f09ab4df6027bf48cabecead649f96ea24d3287a7b01ab84d336f3c0f45a0642d6f2c494160cb7f46ce680eeb80157eb23f9902519ac655fa73103170cbc496d7122034b85e7e87a2db762cbb253fbd76b9117c1a11d18aa2040c5f0c289906000000000000005ffe91ff799a11d9b219c00c369a12bf8685b862d0dbdd956cbda1bae489bcef5ae59136aaadc59609f4d42617c0e6066938b521a0f2e2467a6c435ad5b800262a5da053ced5e95394e500000072737638ac44fb61310e2df511c60b3c88113996a81fb64bce5eb95ce91738640ff7ae6ed6b62086e699955926934389cdf9bcffff3ffd86fe9ce05268bf8a3958f2206cdc7095682c14f10be1075832956762b2dcc6251e7b74cb1da627e332765511c58215bf84d253e8778e6e8ffe4ea50b076446f35efffc806b340658342d2d9e1ef68c6ef3e98407d2fcefb34a0000000000000000895ddbb76122b1222e4da37177fe833e4fcaa67997e92a206ebd085bd9f90008d3fdd528efe6c1dca17f45ba5e8bd3153a0077bb43f8a63dd390d18f0239b41da1a52383a4c6768ca1bb66b8fb3c5000f6f246fd20356a60769b461b6cdf133de073b1df08ae09268b0073bb97d88d741a5546e76caf4b6b1387ff37ec13d262dae0260be74cdf7bb6d3107597430ef5bbd476bb9d69b2aef9f3cb644b4bf01ccf16d40720939daf2af469bdfb361b9c"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000040)=r2, 0x4) (async) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f0000000040)=r2, 0x4) r4 = socket$inet(0x2, 0x2, 0x1) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000001200)=0xe095, 0x4) (async) setsockopt$sock_int(r4, 0x1, 0x6, &(0x7f0000001200)=0xe095, 0x4) bind$inet(0xffffffffffffffff, 0x0, 0x0) (async) bind$inet(0xffffffffffffffff, 0x0, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000180)={'netpci0\x00', 0x1}) ioctl$TUNSETQUEUE(r5, 0x400454d9, &(0x7f00000003c0)={'ip6_vti0\x00', 0x400}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="fc00000019000100000000000000000000000000000000000000006254ab9400fc912f16449d0000000000fe8000000000000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000700000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000440005002001000000000000000000000000000000000002320000000a000000fc010000000000000000000000000000000000000400"/180], 0xfc}}, 0x0) sendmsg$inet(r4, &(0x7f00000005c0)={&(0x7f00000003c0)={0x2, 0x0, @broadcast}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000080)='\b\x00', 0x2}, {&(0x7f0000000180)="96bc1480bb35", 0x6}], 0x2, &(0x7f0000000240)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @broadcast}}}], 0x20}, 0x20048894) syz_emit_ethernet(0xfdef, &(0x7f0000000140)=ANY=[], 0x0) 1.255894334s ago: executing program 3 (id=5266): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r0, &(0x7f0000000080)="96", 0x1, 0x50, &(0x7f0000000100)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000000)=0x6, 0x4) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x7, &(0x7f00000000c0)="fa", 0x1) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000cc0)={'wlan1\x00'}) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) sendto$inet(r3, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f00000000c0)='hybla', 0x5) recvfrom$inet(r3, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) shutdown(r3, 0x1) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000240)=@getchain={0x24, 0x11, 0x1, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0xd, 0x4}, {0xfff1, 0xfff2}, {0xffe0}}}, 0x24}}, 0x40000) 1.174010841s ago: executing program 2 (id=5268): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x2) (async) syz_emit_ethernet(0x4e, &(0x7f0000000600)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6000000000180601fe8000000000000000000000000000aafe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="b39078000000"], 0x0) 1.095187526s ago: executing program 2 (id=5270): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f00000000c0)=@gcm_256={{0x303}, '\x00', "5193bb672965593497c186a80e00", '\x00\x00=*', "1202000000040030"}, 0x38) r1 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r1, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) getsockname$l2tp(r1, 0x0, &(0x7f0000000100)) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000400)={@in6={{0xa, 0x4e24, 0x8, @loopback}}, 0x0, 0x0, 0x41, 0x0, "b208405cce4456e4fc8f2dabd194ff3763f799f91cf7e5e8260998f956ec57c24451db07550335ebf4a3d0168ccaa268e928f39cd7494c2b19ebef230a3373685fbacfcf3b6e9633bd997a9bfcf08f67"}, 0xd8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)={0x1c, 0x0, 0x1, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000001000090400"/20, @ANYRES32=0x0, @ANYBLOB="000000000000000028001280090001007665746800000000180002801400010000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\n'], 0x5c}}, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback, 0xffff}, 0x1c) 911.6331ms ago: executing program 3 (id=5272): r0 = socket$l2tp(0x2, 0x2, 0x73) getsockname$l2tp(r0, 0x0, &(0x7f0000000040)) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$inet(r1, &(0x7f0000000700)={&(0x7f0000000140)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000000000000100000002000000000000001400000000000000000000000200000008000000000000004c0000000000000000000000070000000728"], 0x1b0}, 0x20000000) socket$l2tp(0x2, 0x2, 0x73) (async) getsockname$l2tp(r0, 0x0, &(0x7f0000000040)) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) sendmsg$inet(r1, &(0x7f0000000700)={&(0x7f0000000140)={0x2, 0x4e23, @local}, 0x10, 0x0, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000000000000100000002000000000000001400000000000000000000000200000008000000000000004c0000000000000000000000070000000728"], 0x1b0}, 0x20000000) (async) 854.846684ms ago: executing program 3 (id=5274): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x1e) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "dce02de9d7bd466b", "72e64b3892cb7025848c9f40363cf916", "cfff3c66", "e2b768b4bb9e0d9b"}, 0x28) sendto$inet6(r0, &(0x7f0000000300)='S', 0xfffffffffffffe94, 0xc000, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) close(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="680000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000400012800c0001006d6163766c616e00300002800800010010000000100005800a000400aaaaaaaaaabb000008000300030000000a000400aaaaaaaab1aa000008000500", @ANYRES32=r3], 0x68}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x839, 0x70bd28, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x1, 0xffe0}, {0xd, 0x10}, {0x1, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20004894}, 0x0) 602.175554ms ago: executing program 1 (id=5277): socket$nl_crypto(0x10, 0x3, 0x15) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r0, 0x0, 0x3, &(0x7f0000000000)=0x1, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r0) 573.846115ms ago: executing program 0 (id=5278): r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r1, r2, 0x5}, 0x10) (async) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r3}, &(0x7f0000000000), &(0x7f0000000080)=r0}, 0x20) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r1}, &(0x7f0000000140), &(0x7f0000000180)=r0}, 0x20) (async) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000002200)={0xffffffffffffffff, 0x20, &(0x7f00000001c0)={&(0x7f0000001200)=""/4096, 0x1000, 0x0, &(0x7f0000000100)=""/146, 0x92}}, 0x10) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="240000001e000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00T'], 0x24}}, 0x0) (async) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x89ff, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ringparam={0x11, 0x0, 0x20040001}}) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x4, &(0x7f0000002240)=@raw=[@map_idx={0x18, 0x3, 0x5, 0x0, 0xa}, @printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5c9}}], &(0x7f00000000c0)='GPL\x00', 0x4, 0x1000, &(0x7f0000000200)=""/4096, 0x41000, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r4}, 0xe) 472.093599ms ago: executing program 3 (id=5279): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x8804, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_FLUSH(r2, 0x0, 0x15, 0x0, 0x0) close(r0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r6 = socket$nl_rdma(0x10, 0x3, 0x14) r7 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r7, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0xf}, 0x3}], 0x1c) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000340)={'lo\x00', 0x0}) sendmsg$can_raw(r7, &(0x7f0000000140)={&(0x7f0000000000)={0x1d, r9}, 0x10, &(0x7f00000005c0)={&(0x7f0000000100)=@can={{}, 0x80, 0x3, 0x4, 0x2, "07000000008000"}, 0x210}}, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000100)={'lo\x00', &(0x7f0000000140)=@ethtool_rxnfc={0x2d, 0x11, 0x4, {0x6, @tcp_ip4_spec={@remote, @multicast1, 0x4e21, 0x4e22, 0x4}, {0x0, @empty, 0xa7, 0x0, [0x40, 0x56c]}, @udp_ip6_spec={@mcast1, @private2={0xfc, 0x2, '\x00', 0x10}, 0x4e20, 0x4e23, 0x4}, {0x0, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 0x0, 0x2, [0x1c00]}, 0x7, 0x7}}}) sendmsg$inet(r4, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r5, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f00000002c0)=r1}, 0x20) ioctl$XFS_IOC_FD_TO_HANDLE(r6, 0xc038586a, &(0x7f0000000680)={r4, &(0x7f0000000540)='}\x00', 0x20080, &(0x7f0000000580)={@align=0x7, {0x9, 0x5, 0x626, 0xffffffffffffff8c}}, 0x9, &(0x7f0000000600), &(0x7f0000000640)=0x6}) poll(&(0x7f00000006c0)=[{r2, 0x20}, {r5}, {r10, 0x141}, {r0, 0x4209}, {r2, 0x10}, {r8, 0x4100}, {r6, 0x20}, {r11, 0x852d}], 0x8, 0x1) recvmsg$unix(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000340)=""/229, 0xec1}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000007d80)=[{{0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f0000000100)=""/59, 0x3b}, {&(0x7f00000004c0)=""/119, 0x77}, {&(0x7f0000000880)=""/135, 0x87}, {&(0x7f0000002300)=""/4096, 0x1000}, {&(0x7f0000000a00)=""/255, 0xff}, {&(0x7f0000000b00)=""/223, 0xdf}, {&(0x7f0000000c00)=""/237, 0xed}, {&(0x7f00000001c0)=""/212, 0xd4}, {&(0x7f0000000080)=""/32, 0x20}, {&(0x7f0000000e00)=""/113, 0x71}], 0xa}, 0xfff}, {{0x0, 0x0, 0x0}, 0x4}], 0x2, 0x10002, 0x0) 471.58253ms ago: executing program 4 (id=5280): socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$rxrpc(0x21, 0x2, 0x2) (async) r1 = socket$rxrpc(0x21, 0x2, 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)={0x118, 0x2f, 0x1, 0x0, 0x25dfdbfc, "", [@nested={0x107, 0xf2, 0x0, 0x1, [@typed={0xc, 0x2, 0x0, 0x0, @u64=0xfac0a}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@mcast2}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43f9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f17", @typed={0x4, 0xe9}]}]}, 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000002680)=@mangle={'mangle\x00', 0x2, 0x6, 0x778, 0x0, 0x478, 0x2a0, 0x1b0, 0x388, 0x6a8, 0x6a8, 0x6a8, 0x6a8, 0x6a8, 0x6, 0x0, {[{{@ipv6={@mcast1, @mcast1, [], [0x0, 0xff000000], 'team0\x00', 'vlan1\x00', {}, {}, 0x11}, 0x0, 0x188, 0x1b0, 0x0, {0x7a00000010000000}, [@common=@srh1={{0x90}, {0x5c, 0x0, 0x0, 0x0, 0x0, @empty, @mcast2, @private2, [0x0, 0xff], [0x0, 0xffffffff, 0xffffffff], [0x0, 0x0, 0x0, 0xff]}}, @common=@inet=@multiport={{0x50}, {0x0, 0xc, [0x1, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x4e21, 0x0, 0x0, 0x4e20, 0x0, 0xfffd], [0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe, 0xfd, 0xfd]}}]}, @HL={0x28}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@private2={0xfc, 0x2, '\x00', 0x1}, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x18, 0xff, 0x6}}}, {{@ipv6={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [0x0, 0x0, 0xff000000, 0xffffff00], '\x00', 'bond_slave_0\x00', {}, {}, 0x0, 0x0, 0x6}, 0x0, 0xa8, 0xe8, 0x48000000}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x8, 0x4, @ipv6=@private0, 0x4e23}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x1c}, @mcast1, [0xff000000, 0xffffffff, 0xffffff00, 0xffffff00], [0xffffff00, 0xffffff00, 0xff], 'veth0_vlan\x00', 'veth1_to_bond\x00', {0x9865820c52afa8d5}, {0xff}, 0x84, 0x1, 0x0, 0x28}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4, @ipv6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x0, 0x37}}}, {{@uncond, 0x0, 0x208, 0x230, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@rt={{0x138}, {0x0, [], 0x9, 0x0, 0x0, [@private0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private0={0xfc, 0x0, '\x00', 0x1}, @empty, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, @mcast2, @mcast2, @private0, @empty, @loopback, @ipv4={'\x00', '\xff\xff', @local}, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2a}}, @private1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2]}}]}, @HL={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x814) setsockopt$RXRPC_SECURITY_KEY(r1, 0x110, 0x1, &(0x7f00000000c0)='\x00e\xa9f\x9e\xbbT}\x15\x91H\x93sW\x94\b\xa2\xf0Es&\xc7\xf8\x8c\xc8\xb1&\x12\xebS\x98\xf3C]A\xf5$\x1e\xf5g|a\xc0\r\x00\x00', 0xff1e) r4 = accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000080)=0x14) setsockopt$packet_buf(r4, 0x107, 0x5, &(0x7f0000000100)="225dc5efab1fbee5da2169f4b665ba7a25eae5f5dec552654c5dc88b26b061adc73d3848111aa1036ec27bd477789ef76ed3fbb877b05e37db1bacda447127adf1010ff01b92fb5e0566f8251b96f86ae9361fbf25dbd007408a68a30efed75aa4e0076332d35705d3b30d00f421ba9312d2298b0f713283139df445b6e95dc8a33ca747850f781d2db962f933fef04928d982c2d41a718e06b6055090d72f4316f5880da2a7d58b92ce5293b80d0a368552dd16a21a6e79434af30bb8df8388e8e074076aad7072f8d24d", 0xcb) r5 = socket(0x25, 0x1, 0x0) setsockopt$TIPC_IMPORTANCE(r5, 0x10f, 0x7f, 0x0, 0x0) (async) setsockopt$TIPC_IMPORTANCE(r5, 0x10f, 0x7f, 0x0, 0x0) getsockopt$TIPC_CONN_TIMEOUT(r5, 0x10f, 0x82, &(0x7f0000000200), &(0x7f0000000280)=0x4) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r5, 0x894b, &(0x7f0000000000)) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, 0x0, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, 0x0, 0x100, 0x0, 0x0, {{}, {@val={0xfffffffffffffeb8, 0x3, r6}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10}]}, 0x40}}, 0x0) 430.117398ms ago: executing program 0 (id=5281): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000080)=0x474c, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000000), 0x4) (async) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000000), 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000200)=ANY=[@ANYBLOB="400000001000030428bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0800000000000000140012800b0001006772657461700000040002a00a0001"], 0x40}}, 0x0) socket(0x2, 0x80805, 0x0) (async) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000080)=[@in={0x2, 0x0, @private=0xa010101}]}, &(0x7f0000000100)=0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) sendmsg$IPSET_CMD_SWAP(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x5c, 0x6, 0x6, 0x801, 0x0, 0x0, {0x1, 0x0, 0x6}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME2={0x9, 0x3, 'syz0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0ff0000000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001010404000001007d60b7030000010000006a0a00fe00000000850000000d000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000000000639100000000000000000000ff7f0000292f17cee19d0001000000000000000000cb04fcbb0ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e84cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fb484510bef2e4852f5c2fe6faaf75e5cc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5d053bdec75dca3772be2c9d2d29db3d36dd015c7bd3f15aa6aadbeab2a01685108e61aa000000000000000000000000008b798b4f7458d1863cc67d4c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f1c6edc76609073909826151e2b42bf0ed0c8cef3ba2a730a00c87c493db845b10e9468bda6f82881eb8c9cfa72b08eecc972a3fd2c46f3c1cde71a19d1a2982492abaa96665372831210e00d2bfea3bf97ff8836d000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000100), 0x237}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0x1f00, 0xf, 0x2f, &(0x7f00000007c0)="9f44948721919580684010a49e66", 0x0, 0x7ff, 0x0, 0xb1, 0xfffffd85, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39"}, 0x23) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r4, 0x1f00, 0xf, 0x2f, &(0x7f00000007c0)="9f44948721919580684010a49e66", 0x0, 0x7ff, 0x0, 0xb1, 0xfffffd85, &(0x7f0000000700)="389ceff69d08b0af1cc71b6262d50660bbaf31a7f8cd6a6f911beb65d5fe6b54bf21a66489121f24fefd198059288c9b735e1898e77a7469489a249292c02a72bc193a3008ebdbf4e9dd4ee8fcceef55402c913c8dd0ebece1330aaa93ece835c5044a246a5967e3acd7c950b3b19f351830e545eb9bc3a9c6dd22ce97f1f857cfe8b68a2370b69ea336006b589368f92deb68f3dfc6f2bfee09f8342da437fce5dcdf658e453e3132bb42067575318c39"}, 0x23) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x10, 0xe, &(0x7f00000002c0)=ANY=[@ANYRESDEC=r3, @ANYRES8=r2, @ANYRES8=r1, @ANYRES16, @ANYRESDEC, @ANYRES64], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0), 0x10, 0x0, r4}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x10, 0xe, &(0x7f00000002c0)=ANY=[@ANYRESDEC=r3, @ANYRES8=r2, @ANYRES8=r1, @ANYRES16, @ANYRESDEC, @ANYRES64], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f00000000c0), 0x10, 0x0, r4}, 0x94) 284.093722ms ago: executing program 4 (id=5282): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x0, 0x0}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x29, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="300000090000010044bd7000fddbdf25000000003b95702059a7126462f1cf86a7a0469994a6e32d65c3fb69dbcbc61c40c0db454beaa51839b78f8dc819af316aee70142d6e29802861ab6c797c8535001e8c62aaab4caa1fbcea774c87850e1dd81c7a3597069d8ca24b71a3cb52277fcbcee33cf6c52af7885bc0ede4069701aee03d6a345f0f38ac6e2d115b65371b079a8350309ceadae6", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b00000000000800040000050000"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r1, 0x0, 0x0, 0xb, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001800090000000000000000001c140000fe000001000000000a00120002"], 0x30}}, 0x0) 212.497728ms ago: executing program 0 (id=5283): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), 0xffffffffffffffff) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="020d000014000000000000000000000005000600000000000a00000013000000fc0100080000000000000000ea2fa43c000000100000000005000500000000000a00000000000000000000000000000000000000000000000000000001000000080012000200020000000002000000001000330402"], 0xa0}}, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="0100000000000a00000005"], 0x1c}}, 0x0) 212.10171ms ago: executing program 2 (id=5284): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x84, &(0x7f0000000000)={r2, @in={{0x2, 0x0, @empty}}}, 0x90) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r4, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803002e000b12d25a80648c2594f90324fc60180c02400a000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000000)=@newlink={0x48, 0x10, 0x1, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x421a2, 0x1000}, [@IFLA_IFNAME={0x14, 0x3, 'wlan0\x00'}, @IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_RSS_QUERY_EN={0xc, 0x7, {0xfffffffc, 0x3}}]}]}]}, 0x48}}, 0x0) 210.917039ms ago: executing program 4 (id=5285): bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_udp(0x2, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@typedef={0x1, 0x0, 0x0, 0x8, 0x3}]}, {0x0, [0x2e]}}, 0x0, 0x27}, 0x20) socket$unix(0x1, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000300), 0x1) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r1, &(0x7f0000000340)="376011e53c3ff16f6e68927ca77a3c9454d4a3f1256c016055c8cfec2a35deae4190f5e94386e914855e27518c318e55676d85fa198a839c544226544323f5557f485c969fdca8e969a0ca54b45c944d", &(0x7f0000004880)=@udp6=r2}, 0x20) recvmmsg(r0, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000240)=""/112, 0x70}], 0x1}}], 0x2, 0x142, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_netdev_private(r3, 0x89f0, &(0x7f00000002c0)="d9568e334bd140bc615d38d2ebf6ab6e1799b161252d34be8ebf746c64630a238eb33a757d7d45e6cb5c46b7fc6c188dea1a9c03d22374f787b60f") ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'bridge_slave_0\x00', 0x0}) r5 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001100a7cc4a372eaf541d002007000000", @ANYRES32=r4, @ANYBLOB="00000000100000001c001a80080002802d00ff0008000200", @ANYRES16=r5, @ANYRES32=r5], 0x44}}, 0x2000800) pipe(&(0x7f0000000140)) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0x18, 0x7, &(0x7f0000000040)=ANY=[@ANYRES64=0x0], &(0x7f0000000080)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x8, '\x00', r4, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) 142.211768ms ago: executing program 0 (id=5286): sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="40000000002dca70f02d24c214d1149622414e02010400000000000000000a009a000400018018000380140001800800010000000000000000000000000000000044a64358473d3bc721c335be697260aca13944d61b7a03759f133ef31e96ef6c041c77e46bb88831d8e95dc9d65a66c65e0cd26c33a986d7e3943742b3e7421529711b201a8e159d368b0aad34708e41c8ead1157c4d43aea33038786fe2c89c3b24d26e60ea1c1480c91f5e501da1c951d30de624756f468036638c465c986f6684fe9909b0777139e1534eec4cd778e4f8d83172edabdf3d171960e2ca38913b284f99e93ca21425c5a7fefdbccd92e998f25e28c035178aee960ff462cc33f37dd285cb020204118f14577996c7febd352b89700fd8ed39b43ac5ccc8f3afef931afc1360276f662f82e617b3fc99847ba7a5af4cb3e77956b70fd1a4438f94803c62"], 0x40}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0x7a, 0xa, 0x0, 0xff00, 0x0, 0x71, 0x10, 0x8e}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000dc0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000540)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000fbdbdf25270000000e0001006e657464657673696d0000000f0002006e657464657673696d3000001c0053"], 0x50}, 0x1, 0x0, 0x0, 0x24040011}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000001e004b05000000000000000007000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3], 0x28}}, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r2, 0x10e, 0xc, &(0x7f0000000640)=0x4, 0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x54}}, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@delqdisc={0x2c, 0x25, 0x8, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x0, 0xb}, {0xfff1, 0x10}}, [@TCA_RATE={0x6, 0x5, {0x95, 0x7}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000050}, 0x20008041) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x0, 0xffffffffffffffff, 0x4}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x17, 0x10, &(0x7f0000000500)=ANY=[@ANYBLOB="0b000000ff070000000000000300000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000001"], 0x0, 0x886, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x80000000}, 0x94) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r5) socket$alg(0x26, 0x5, 0x0) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f00000000c0)={0x0, 0x44, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd2b, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bond0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x20000800) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)={0x38, 0x1410, 0x8b7fbbc5948fecd9, 0x70bd29, 0x25dfd9fc, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8, 0x4a, 0x1}, @RDMA_NLDEV_ATTR_STAT_AUTO_MODE_MASK={0x8, 0x4c, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x20004085}, 0x4004080) ioctl$SIOCSIFHWADDR(r5, 0x8b34, &(0x7f0000000000)={'wlan1\x00', @random="000500000020"}) sendmsg$netlink(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="1c00000042000106"], 0x1c}], 0x1}, 0x0) 78.967433ms ago: executing program 2 (id=5287): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newtaction={0x50, 0x30, 0x1, 0x70bd28, 0x0, {}, [{0x3c, 0x1, [@m_skbmod={0x38, 0x101, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SKBMOD_ETYPE={0x6, 0x5, 0x54}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="1c000000180001002cbd7000000000002d"], 0x44}}, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000080)=[@in={0x2, 0x0, @rand_addr=0x64010102}], 0x10) shutdown(r1, 0x1) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000000)={0x0, 0x5}, &(0x7f0000000040)=0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x34, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x80000001}, {}, {}, [@map_idx={0x18, 0xb, 0x5, 0x0, 0x9}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8001}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @map_val={0x18, 0x2, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x8fa3}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @map_idx_val={0x18, 0xb, 0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x1}}}, &(0x7f0000000640)='GPL\x00', 0xdf, 0xf9, &(0x7f0000000680)=""/249, 0x40f00, 0x18, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000780)={0x8, 0x4}, 0x8, 0x10, &(0x7f00000007c0)={0x2, 0x9, 0xd562, 0x7}, 0x10, 0x0, 0x0, 0x4, 0x0, &(0x7f0000000800)=[{0x1, 0x3, 0x6, 0x6}, {0x2, 0x4, 0xa, 0x6}, {0x1, 0x1, 0xc, 0x4}, {0x4, 0x5, 0x3, 0x8}], 0x10, 0x1}, 0x94) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000900)=@o_path={&(0x7f0000000440)='./file0\x00', r2, 0x4000, r1}, 0x18) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000002aaaaaaaaaaaa08004500006000000000002f9078640101000000000024806558000000000000000010000800000086dd"], 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007e40)=[{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f00000000c0)="4789d3aefc1a4d03345aed327be33c", 0xf}], 0x1, 0x0, 0x0, 0x20000800}], 0x1, 0x20040894) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000380)) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20010840) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r6, &(0x7f0000000080)=[{{&(0x7f0000000100)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c, &(0x7f0000000140)=[{&(0x7f0000000180)="aabbcc", 0x3}], 0x1}}, {{&(0x7f00000001c0)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c, &(0x7f0000000200)=[{&(0x7f0000000240)="aabbcc", 0x3}], 0x1}}], 0x2, 0x0) r7 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0) sendmsg$NBD_CMD_CONNECT(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[], 0x6c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x0, 0x1, 0x40}]}, &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 28.572079ms ago: executing program 0 (id=5288): r0 = socket$kcm(0x2, 0xa, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x10}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b4315428293240a227ac00004a32c26f793edf59f1bb5326a7a23d4107b2a7cf2ec10b6c534b4fa809ede718326888c002a3c6fbb66625421f550a85e70ab68527d4817b868d8ad0b3b854e02684db770dfc28d6c0d237a41d43a2aec083215d3d4a2917273080683476fbc8a57bf7957a57d153aac3cfc1f1cd", @ANYRES16=r2, @ANYBLOB="01000000000002000000010000001c000180080003007f0000010600010002000000080006000f000000"], 0x30}}, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000040)=@ethtool_ringparam={0x10, 0x5, 0xd400, 0x3e0f, 0x69f, 0xf37, 0x5, 0x4, 0x6}}) socket$kcm(0x2, 0xa, 0x2) (async) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x10}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) (async) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="b4315428293240a227ac00004a32c26f793edf59f1bb5326a7a23d4107b2a7cf2ec10b6c534b4fa809ede718326888c002a3c6fbb66625421f550a85e70ab68527d4817b868d8ad0b3b854e02684db770dfc28d6c0d237a41d43a2aec083215d3d4a2917273080683476fbc8a57bf7957a57d153aac3cfc1f1cd", @ANYRES16=r2, @ANYBLOB="01000000000002000000010000001c000180080003007f0000010600010002000000080006000f000000"], 0x30}}, 0x0) (async) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000040)=@ethtool_ringparam={0x10, 0x5, 0xd400, 0x3e0f, 0x69f, 0xf37, 0x5, 0x4, 0x6}}) (async) 13.723244ms ago: executing program 4 (id=5289): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x4044800) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=ANY=[@ANYBLOB="48000000100005ff00000000000000000000004a", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r3], 0x48}}, 0x0) socket(0x10, 0x3, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r4, &(0x7f0000000280)="ca", &(0x7f0000000000)=""/3, 0x2}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r4, &(0x7f0000000140), &(0x7f0000000000)=""/6, 0x2}, 0x20) r5 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYBLOB='\b'], 0x40}}, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) ioctl$TUNGETDEVNETNS(r1, 0x54e3, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000011008108090f9becdb4cb92e264831371900000069bd6efb2502eaf60d002700020400bf050005001201", 0x2e}], 0x1}, 0x0) 0s ago: executing program 0 (id=5290): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r0, &(0x7f0000000080)={0x27, 0x0, 0x0, 0x7, 0x0, 0x6, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x10000000000001}, 0x60) (async) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, 0x0, 0x10, 0x70bd29, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40081c4}, 0x44000) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0200000004000000020000000c000000001466bfdac3c37dd5273545b9193c412d42832b1bc897a82f6f0b95c99bcf82e5ef1a49736b94ceead334e440a96111d5713c3408ca"], 0x48) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a88000000060a010400000000000000000a0000010900010073797a31000000005c000480580001800b0001007461726765740000480002802c0003009ac420002e00000000000000009dfb78c7699c74e891a0c70000000000000000000000000000000008000240000000000e00010049444c4554494d45520000000900020073797a32"], 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) r3 = socket$alg(0x26, 0x5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000008c0)=ANY=[], 0xbc}}, 0x0) (async) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) close(r0) kernel console output (not intermixed with test programs): 410.476564][ T8516] IPVS: starting estimator thread 0... [ 410.485407][ T5834] Bluetooth: hci2: command tx timeout [ 410.566484][T17734] IPVS: using max 39 ests per chain, 93600 per kthread [ 410.655206][ T5834] Bluetooth: hci1: command 0x041b tx timeout [ 410.673650][T17740] netlink: 'syz.2.3329': attribute type 1 has an invalid length. [ 410.683633][T17740] netlink: 'syz.2.3329': attribute type 7 has an invalid length. [ 410.692929][T17740] netlink: 'syz.2.3329': attribute type 8 has an invalid length. [ 410.802409][T17623] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 410.828789][T17623] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 410.858670][T17623] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 410.888427][T17623] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 411.007568][T17764] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 411.104017][T17772] mac80211_hwsim hwsim40 wlan0: entered promiscuous mode [ 411.229089][T17778] netlink: 'syz.4.3342': attribute type 1 has an invalid length. [ 412.390900][T17804] can: request_module (can-proto-5) failed. [ 412.565712][ T5834] Bluetooth: hci2: command tx timeout [ 412.725289][ T5834] Bluetooth: hci1: command 0x041b tx timeout [ 413.860064][T17755] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 414.043455][T17819] netdevsim netdevsim4 netdevsim0: IPsec offload requires 128 bit authentication [ 414.105533][T17623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 414.143786][T17824] __nla_validate_parse: 12 callbacks suppressed [ 414.143803][T17824] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3355'. [ 414.168928][T17623] 8021q: adding VLAN 0 to HW filter on device team0 [ 414.205905][T17825] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3355'. [ 414.218110][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 414.225291][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 414.252752][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 414.259943][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 414.301211][T17831] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3351'. [ 414.301309][T17824] macvlan0: entered promiscuous mode [ 414.322125][T17831] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3351'. [ 414.472602][T17824] bond0: entered promiscuous mode [ 414.478503][T17824] bond_slave_0: entered promiscuous mode [ 414.484451][T17824] bond_slave_1: entered promiscuous mode [ 414.493552][T17824] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3355'. [ 414.514629][T17832] bridge0: port 3(dummy0) entered disabled state [ 414.521168][T17832] bridge0: port 2(bridge_slave_1) entered disabled state [ 414.528830][T17832] bridge0: port 1(bridge_slave_0) entered disabled state [ 414.607546][T17623] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 414.646160][ T5834] Bluetooth: hci2: command tx timeout [ 414.680022][T17835] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3358'. [ 414.770263][T17842] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 414.789156][T17842] syzkaller1: linktype set to 823 [ 414.797635][T17842] syzkaller1: tun_chr_ioctl cmd 2184212994 [ 414.804598][T17845] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 414.805627][ T5834] Bluetooth: hci1: command 0x041b tx timeout [ 414.821670][T17847] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3360'. [ 414.863225][T17847] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 414.881551][T17847] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3360'. [ 415.001070][T17623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 415.115725][T17623] veth0_vlan: entered promiscuous mode [ 415.140704][T17860] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3365'. [ 415.149495][T17623] veth1_vlan: entered promiscuous mode [ 415.188005][T17623] veth0_macvtap: entered promiscuous mode [ 415.201049][T17623] veth1_macvtap: entered promiscuous mode [ 415.222179][T17623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 415.234492][T17623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 415.249194][ T1028] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.258460][ T1028] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.283776][ T1028] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.299686][ T58] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.339714][ T1028] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.349386][ T1028] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.375988][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 415.383926][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 415.511532][T17835] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 415.678029][T17879] bond0: entered promiscuous mode [ 415.683105][T17879] bond_slave_0: entered promiscuous mode [ 415.702735][T17879] bond_slave_1: entered promiscuous mode [ 415.809789][T17893] openvswitch: netlink: Key 6 has unexpected len 4 expected 2 [ 415.929880][T17906] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3378'. [ 416.194778][T17917] delete_channel: no stack [ 416.689361][T17950] bridge0: entered promiscuous mode [ 416.704869][T17950] macsec1: entered promiscuous mode [ 416.714797][T17950] macsec1: entered allmulticast mode [ 416.720399][T17950] bridge0: entered allmulticast mode [ 416.726040][ T5834] Bluetooth: hci2: command tx timeout [ 416.734099][T17950] bridge0: port 3(macsec1) entered blocking state [ 416.740778][T17950] bridge0: port 3(macsec1) entered disabled state [ 416.756622][T17950] bridge0: left allmulticast mode [ 416.762023][T17950] bridge0: left promiscuous mode [ 416.860278][ T8515] IPVS: starting estimator thread 0... [ 416.957138][T17961] IPVS: using max 30 ests per chain, 72000 per kthread [ 416.990329][T17968] x_tables: ip6_tables: CLASSIFY target: used from hooks PREROUTING, but only usable from FORWARD/OUTPUT/POSTROUTING [ 417.704651][T18026] netlink: 'syz.3.3409': attribute type 10 has an invalid length. [ 417.759989][T18026] bridge0: port 2(bridge_slave_1) entered disabled state [ 417.767689][T18026] bridge0: port 1(bridge_slave_0) entered disabled state [ 417.850343][T18026] bridge0: port 2(bridge_slave_1) entered blocking state [ 417.857629][T18026] bridge0: port 2(bridge_slave_1) entered forwarding state [ 417.865204][T18026] bridge0: port 1(bridge_slave_0) entered blocking state [ 417.872376][T18026] bridge0: port 1(bridge_slave_0) entered forwarding state [ 417.917568][T18026] bridge0: entered promiscuous mode [ 417.923458][T18026] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 418.496683][T18062] Cannot find del_set index 4 as target [ 418.728916][T18075] openvswitch: netlink: IP tunnel dst address not specified [ 418.810125][ T5834] Bluetooth: hci2: command 0x0c1a tx timeout [ 419.166993][T18098] __nla_validate_parse: 76 callbacks suppressed [ 419.167012][T18098] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3436'. [ 419.197706][T18098] bridge0: port 2(bridge_slave_1) entered disabled state [ 419.206389][T18098] bridge0: port 1(bridge_slave_0) entered disabled state [ 419.367137][T18109] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3440'. [ 419.625358][T18124] netlink: 'syz.3.3446': attribute type 1 has an invalid length. [ 419.636628][T18124] netlink: 'syz.3.3446': attribute type 2 has an invalid length. [ 419.782180][T18132] netlink: 204 bytes leftover after parsing attributes in process `syz.1.3449'. [ 419.966683][ T30] audit: type=1800 audit(1773840152.970:5): pid=18137 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3452" name="memory.events" dev="tmpfs" ino=287 res=0 errno=0 [ 420.006643][T18142] netlink: 'syz.1.3453': attribute type 10 has an invalid length. [ 420.015521][T18141] netlink: 'syz.3.3454': attribute type 1 has an invalid length. [ 420.015698][T18142] bridge0: port 2(bridge_slave_1) entered disabled state [ 420.030915][T18142] bridge0: port 1(bridge_slave_0) entered disabled state [ 420.047457][T18142] bridge0: port 2(bridge_slave_1) entered blocking state [ 420.054688][T18142] bridge0: port 2(bridge_slave_1) entered forwarding state [ 420.062212][T18142] bridge0: port 1(bridge_slave_0) entered blocking state [ 420.069382][T18142] bridge0: port 1(bridge_slave_0) entered forwarding state [ 420.075207][T18141] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3454'. [ 420.197506][T18141] netlink: 'syz.3.3454': attribute type 1 has an invalid length. [ 420.250364][T18142] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 420.463339][T18156] syzkaller0: entered promiscuous mode [ 420.469241][T18156] syzkaller0: entered allmulticast mode [ 420.784000][T18170] netlink: 5 bytes leftover after parsing attributes in process `syz.1.3461'. [ 421.028908][T18185] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3468'. [ 421.144297][T18194] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3471'. [ 421.216818][T18194] xfrm1: entered promiscuous mode [ 421.221909][T18194] xfrm1: entered allmulticast mode [ 421.225294][T18198] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3471'. [ 421.266537][T18200] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3472'. [ 421.628209][T18214] syzkaller1: entered promiscuous mode [ 421.633904][T18214] syzkaller1: entered allmulticast mode [ 421.698422][T18214] syzkaller1: left promiscuous mode [ 421.704102][T18214] syzkaller1: left allmulticast mode [ 421.982450][T18237] team0: Device gtp1 is up. Set it down before adding it as a team port [ 422.065223][T18236] team0: Device gtp1 is up. Set it down before adding it as a team port [ 422.084233][T18245] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 422.116178][T18245] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 422.375569][T18259] erspan0: entered allmulticast mode [ 422.439376][T18265] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3496'. [ 422.696838][T18288] netlink: 'syz.0.3500': attribute type 30 has an invalid length. [ 422.773957][T18292] tunl0: entered promiscuous mode [ 422.783807][T18292] netlink: 'syz.4.3503': attribute type 3 has an invalid length. [ 423.135656][T18318] sctp: [Deprecated]: syz.1.3508 (pid 18318) Use of struct sctp_assoc_value in delayed_ack socket option. [ 423.135656][T18318] Use struct sctp_sack_info instead [ 423.199139][T18318] sctp: [Deprecated]: syz.1.3508 (pid 18318) Use of struct sctp_assoc_value in delayed_ack socket option. [ 423.199139][T18318] Use struct sctp_sack_info instead [ 423.268851][T18322] bridge2: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 423.390407][T18335] netlink: 'syz.0.3516': attribute type 26 has an invalid length. [ 423.411040][T18333] openvswitch: netlink: Message has 4 unknown bytes. [ 423.435996][T18333] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 423.514370][T18341] netlink: Unknown conntrack attr (0) [ 423.623454][T18352] netlink: 'syz.1.3522': attribute type 1 has an invalid length. [ 423.666413][T18352] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 424.133470][T18389] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 424.381564][T18406] __nla_validate_parse: 58 callbacks suppressed [ 424.381584][T18406] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3535'. [ 424.412029][T18404] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 424.441156][T18408] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3536'. [ 424.480036][T18408] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3536'. [ 424.558564][T18420] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3539'. [ 424.633065][T18418] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3538'. [ 424.651712][T18428] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3540'. [ 424.746067][T18428] xt_CT: No such helper "pptp" [ 424.821263][T18435] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3543'. [ 424.843447][T18437] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 424.886515][T16331] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 424.918432][ T8515] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 424.928807][T16331] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 425.308249][T18458] netlink: 'syz.1.3551': attribute type 10 has an invalid length. [ 425.413116][T18474] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3555'. [ 425.447334][ T8514] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 425.556311][T18485] openvswitch: netlink: IP tunnel attribute has 6 unknown bytes. [ 425.584604][ T8514] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 425.747086][T18498] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3563'. [ 425.779985][T18498] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3563'. [ 425.869042][T18511] netlink: 'syz.3.3567': attribute type 1 has an invalid length. [ 426.024560][T18517] bond2: option tlb_dynamic_lb: mode dependency failed, not supported in mode balance-xor(2) [ 426.041345][T18520] openvswitch: netlink: IP tunnel attribute has 6 unknown bytes. [ 426.067731][T18517] bond2 (unregistering): Released all slaves [ 426.118760][T18522] netlink: 'syz.4.3572': attribute type 1 has an invalid length. [ 426.130719][T18522] NCSI netlink: No device for ifindex 0 [ 426.135963][T18524] Bluetooth: MGMT ver 1.23 [ 426.217620][T18526] IPv6: sit3: Disabled Multicast RS [ 426.235322][T18526] sit3: entered allmulticast mode [ 426.463798][T18544] syzkaller0: entered promiscuous mode [ 426.483306][T18544] syzkaller0: entered allmulticast mode [ 426.803435][T18567] xt_addrtype: ipv6 does not support BROADCAST matching [ 426.827783][T18566] xt_addrtype: ipv6 does not support BROADCAST matching [ 426.991626][T18579] netdevsim netdevsim2 netdevsim0: IPsec offload requires 128 bit authentication [ 427.059986][T18585] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 427.375028][T18604] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 427.552039][T18616] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 427.832140][T18634] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 428.200817][T18649] netlink: 'syz.2.3612': attribute type 10 has an invalid length. [ 428.226181][T18649] syz_tun: entered promiscuous mode [ 428.250406][T18649] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 428.281042][T18657] netdevsim netdevsim1 netdevsim0: IPsec offload requires 128 bit authentication [ 428.391259][T18663] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 428.645324][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 428.827256][T18698] netdevsim netdevsim1 netdevsim0: IPsec offload requires 128 bit authentication [ 428.869280][T18705] openvswitch: netlink: Tunnel attr 0 has unexpected len 3 expected 8 [ 429.048702][T18719] IPVS: set_ctl: invalid protocol: 135 0.0.0.0:20003 [ 429.096372][T18719] netlink: 'syz.4.3635': attribute type 32 has an invalid length. [ 429.129766][ T5854] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.176802][T18719] bond3: option coupled_control: invalid value (52) [ 429.228218][T18719] bond3 (unregistering): Released all slaves [ 429.329250][T18747] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.348404][T18747] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.357539][T18747] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.400726][T18747] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.407855][T18754] netdevsim netdevsim1 netdevsim0: IPsec offload requires 128 bit authentication [ 429.419602][T18747] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 429.503380][T18758] tipc: Started in network mode [ 429.535852][T18758] tipc: Node identity 4, cluster identity 4711 [ 429.542050][T18758] tipc: Node number set to 4 [ 429.636566][T18767] batadv0: entered allmulticast mode [ 429.637397][T18763] __nla_validate_parse: 9 callbacks suppressed [ 429.637412][T18763] netlink: 212368 bytes leftover after parsing attributes in process `syz.1.3647'. [ 429.695617][T18763] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3647'. [ 429.713103][T18763] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3647'. [ 429.772929][T18773] netlink: 'syz.2.3651': attribute type 21 has an invalid length. [ 429.798557][T18773] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3651'. [ 430.269293][T18820] can: request_module (can-proto-5) failed. [ 430.292249][T18823] IPVS: sync thread started: state = BACKUP, mcast_ifn = lo, syncid = 2, id = 0 [ 430.497284][T18792] nbd4: detected capacity change from 0 to 63 [ 430.521019][T18827] netlink: 45 bytes leftover after parsing attributes in process `syz.3.3667'. [ 430.616125][T18829] netlink: 'syz.1.3670': attribute type 1 has an invalid length. [ 430.724310][ T5834] block nbd4: Receive control failed (result -104) [ 430.734047][ T5824] block nbd4: Receive control failed (result -32) [ 430.816574][T18848] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3674'. [ 430.891200][T18854] netlink: 207952 bytes leftover after parsing attributes in process `syz.1.3675'. [ 430.940094][T18857] xfrm1: entered allmulticast mode [ 430.944828][T18859] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 430.971835][T18862] x_tables: duplicate underflow at hook 2 [ 431.078595][T18867] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3680'. [ 431.223646][T18882] nbd: socks must be embedded in a SOCK_ITEM attr [ 431.276678][T18886] netlink: 248 bytes leftover after parsing attributes in process `syz.4.3688'. [ 431.331497][T18886] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3688'. [ 431.594029][T18913] netdevsim netdevsim4 netdevsim0: IPsec offload requires 128 bit authentication [ 431.680351][T18915] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 431.790977][T18925] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input9 [ 431.865027][T18930] sit0: entered promiscuous mode [ 431.881583][T18930] netlink: 'syz.0.3699': attribute type 1 has an invalid length. [ 431.958610][T18936] ipt_REJECT: TCP_RESET invalid for non-tcp [ 432.008263][T18936] ipt_REJECT: TCP_RESET invalid for non-tcp [ 432.016930][T18945] veth7: entered allmulticast mode [ 432.128416][T18952] syzkaller1: entered promiscuous mode [ 432.134201][T18952] syzkaller1: entered allmulticast mode [ 432.163940][T18957] netdevsim netdevsim0 netdevsim0: IPsec offload requires 128 bit authentication [ 432.193086][T18954] pim6reg1: entered promiscuous mode [ 432.200262][T18954] pim6reg1: entered allmulticast mode [ 432.454836][T18976] net_ratelimit: 9 callbacks suppressed [ 432.454854][T18976] ip_tunnel: non-ECT from 2.0.0.0 with TOS=0x3 [ 432.485475][ T8514] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 432.602068][T18988] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 432.691922][T18996] openvswitch: netlink: Tunnel attr 0 has unexpected len 3 expected 8 [ 432.854014][T19001] netlink: 'syz.3.3726': attribute type 10 has an invalid length. [ 432.865717][T19001] bridge0: port 2(bridge_slave_1) entered disabled state [ 432.873379][T19001] bridge_slave_1: left allmulticast mode [ 432.881969][T19001] bridge_slave_1: left promiscuous mode [ 432.893211][T19001] bridge0: port 2(bridge_slave_1) entered disabled state [ 432.909478][T19001] bridge_slave_1: entered promiscuous mode [ 432.917822][T19001] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 432.969317][T19008] veth0_virt_wifi: entered promiscuous mode [ 432.987914][T19010] netlink: 'syz.4.3728': attribute type 2 has an invalid length. [ 433.008917][T19010] 9: entered promiscuous mode [ 433.296441][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 433.345368][T19018] netlink: 'syz.1.3729': attribute type 7 has an invalid length. [ 433.353294][T19018] netlink: 'syz.1.3729': attribute type 8 has an invalid length. [ 433.445338][ T5834] Bluetooth: hci2: command 0x0c1a tx timeout [ 433.492368][T19029] netdevsim netdevsim3 netdevsim0: IPsec offload requires 128 bit authentication [ 433.586081][T19034] openvswitch: netlink: Tunnel attr 0 has unexpected len 3 expected 8 [ 433.610627][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 433.641021][T19038] syzkaller0: entered promiscuous mode [ 433.646664][T19038] syzkaller0: entered allmulticast mode [ 433.751085][T19038] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.777492][T19003] veth0_virt_wifi: left promiscuous mode [ 433.859286][T19038] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 433.884696][T19047] netlink: 'syz.4.3740': attribute type 1 has an invalid length. [ 433.997727][T19038] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.086988][T19038] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.155495][T19067] lo: entered promiscuous mode [ 434.163341][T19067] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 434.263184][ T1335] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.279557][T19072] xt_nat: multiple ranges no longer supported [ 434.301605][T16331] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.325490][ T5854] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 434.338656][ T1092] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.388122][ T1092] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.439775][T19081] syzkaller1: entered promiscuous mode [ 434.447952][T19081] syzkaller1: entered allmulticast mode [ 434.709762][T19097] netlink: 'syz.0.3757': attribute type 10 has an invalid length. [ 434.718330][T19097] bridge0: port 2(bridge_slave_1) entered disabled state [ 434.725974][T19097] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.738717][T19097] bridge0: port 2(bridge_slave_1) entered blocking state [ 434.745901][T19097] bridge0: port 2(bridge_slave_1) entered forwarding state [ 434.753322][T19097] bridge0: port 1(bridge_slave_0) entered blocking state [ 434.760513][T19097] bridge0: port 1(bridge_slave_0) entered forwarding state [ 434.770469][T19097] bridge0: entered promiscuous mode [ 434.776302][T19097] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 434.792162][T19098] __nla_validate_parse: 14 callbacks suppressed [ 434.792174][T19098] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3758'. [ 434.808470][T19098] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3758'. [ 434.995596][T19107] openvswitch: netlink: Tunnel attr 0 has unexpected len 3 expected 8 [ 435.018481][T19108] : entered promiscuous mode [ 435.278957][T19125] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3770'. [ 435.367607][ T5886] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 435.383070][T19136] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3774'. [ 435.481898][T19142] netlink: 'syz.4.3776': attribute type 21 has an invalid length. [ 435.501578][T19142] netlink: 'syz.4.3776': attribute type 6 has an invalid length. [ 435.510240][T19142] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3776'. [ 435.520381][T19145] netdevsim netdevsim1 netdevsim0: IPsec offload requires 128 bit authentication [ 435.523233][T19147] netlink: 'syz.4.3776': attribute type 21 has an invalid length. [ 435.563335][T19147] netlink: 'syz.4.3776': attribute type 6 has an invalid length. [ 435.592667][T19147] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3776'. [ 435.697675][T19155] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3780'. [ 435.754662][T19155] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3780'. [ 435.768639][T19164] sctp: [Deprecated]: syz.4.3781 (pid 19164) Use of int in max_burst socket option deprecated. [ 435.768639][T19164] Use struct sctp_assoc_value instead [ 435.859486][T19172] netlink: 174076 bytes leftover after parsing attributes in process `syz.2.3782'. [ 435.957130][T19174] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3784'. [ 436.040804][T19177] syzkaller1: entered promiscuous mode [ 436.047593][T19177] syzkaller1: entered allmulticast mode [ 436.165353][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 436.751535][T19202] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 437.456349][ T5886] net_ratelimit: 4 callbacks suppressed [ 437.456393][ T5886] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.485771][ T5886] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 438.646436][T19155] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 438.770114][T19207] bridge0: port 1(bridge_slave_0) entered disabled state [ 438.774207][T19210] openvswitch: netlink: IP tunnel attribute has 7 unknown bytes. [ 438.791686][T19207] bridge0: port 2(bridge_slave_1) entered disabled state [ 439.135677][T19237] netlink: 'syz.0.3802': attribute type 24 has an invalid length. [ 439.148075][T19236] geneve2: entered promiscuous mode [ 439.153315][T19236] geneve2: entered allmulticast mode [ 439.354623][T19254] tipc: Started in network mode [ 439.372321][T19254] tipc: Node identity ac14142f, cluster identity 4711 [ 439.379553][T19254] tipc: New replicast peer: 0.0.0.0 [ 439.386719][T19254] tipc: Enabled bearer , priority 10 [ 439.393860][T19254] tipc: New replicast peer: fc01:0000:0000:0000:0000:0000:0000:0001 [ 439.441412][T19259] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.450716][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.525707][ T5854] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.549796][T19263] netlink: 'syz.1.3815': attribute type 58 has an invalid length. [ 439.683966][T19277] syzkaller0: entered promiscuous mode [ 439.690240][ T8515] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 439.698723][T19277] syzkaller0: entered allmulticast mode [ 439.859601][T19288] __nla_validate_parse: 6 callbacks suppressed [ 439.859620][T19288] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3822'. [ 439.878655][T19288] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3822'. [ 439.999515][T19300] netlink: 'syz.0.3827': attribute type 1 has an invalid length. [ 440.062222][T19303] xt_CT: You must specify a L4 protocol and not use inversions on it [ 440.119052][T19309] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3830'. [ 440.246271][T19315] netlink: 'syz.0.3833': attribute type 4 has an invalid length. [ 440.399571][T19325] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3835'. [ 440.436984][T19325] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3835'. [ 440.497524][ T8514] tipc: Node number set to 2886997039 [ 440.539196][T19335] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3840'. [ 440.565876][ T5854] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 440.581193][T19338] netlink: 'syz.2.3841': attribute type 1 has an invalid length. [ 440.615438][T19338] 8021q: adding VLAN 0 to HW filter on device bond2 [ 440.623178][T19338] bond2: entered allmulticast mode [ 440.646168][ T8515] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 440.807526][ T5854] page_pool_release_retry() stalled pool shutdown: id 76, 1 inflight 60 sec [ 440.839598][T19353] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3846'. [ 441.142535][T19321] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 441.268042][T19362] netlink: 'syz.0.3859': attribute type 29 has an invalid length. [ 441.287015][T19365] openvswitch: netlink: IP tunnel dst address not specified [ 441.295302][T19362] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3859'. [ 441.503773][ T30] audit: type=1800 audit(1773840174.500:6): pid=19387 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3856" name="memory.events" dev="tmpfs" ino=477 res=0 errno=0 [ 441.527762][T19389] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3856'. [ 441.537971][ T30] audit: type=1800 audit(1773840174.500:7): pid=19389 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3856" name="memory.events" dev="tmpfs" ino=477 res=0 errno=0 [ 441.605226][ T5824] Bluetooth: hci2: command 0x0c1a tx timeout [ 442.303236][T19435] netlink: 'syz.2.3872': attribute type 33 has an invalid length. [ 442.353231][T19430] veth1_to_bond: default FDB implementation only supports local addresses [ 442.541377][T19449] netlink: 81 bytes leftover after parsing attributes in process `syz.2.3876'. [ 442.646826][ T796] net_ratelimit: 3 callbacks suppressed [ 442.646845][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.726181][ T8514] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 442.764114][T19469] SET target dimension over the limit! [ 443.686020][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 443.728405][T19522] bond2: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 443.764864][T19522] bond2 (unregistering): Released all slaves [ 444.607625][T19586] xt_TCPMSS: Only works on TCP SYN packets [ 444.700123][T19598] xt_l2tp: v2 tid > 0xffff: 1114244 [ 444.727155][ T5854] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 444.818288][T19607] netlink: 'syz.1.3926': attribute type 1 has an invalid length. [ 444.994608][T19618] __nla_validate_parse: 4 callbacks suppressed [ 444.994626][T19618] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3929'. [ 445.094056][T19625] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3931'. [ 445.104800][T19628] tipc: Started in network mode [ 445.110504][T19628] tipc: Node identity ac14140f, cluster identity 4711 [ 445.125354][T19628] tipc: New replicast peer: 255.255.255.255 [ 445.166727][T19628] tipc: Enabled bearer , priority 10 [ 445.533481][T19637] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3928'. [ 445.765830][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.773965][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 445.894578][T19573] dvmrp6 (unregistering): left allmulticast mode [ 445.909813][T19573] bond4 (unregistering): (slave geneve3): Releasing active interface [ 446.169465][T19573] bond3 (unregistering): (slave bridge6): Removing an active aggregator [ 446.179990][T19573] bond3 (unregistering): (slave bridge6): Releasing backup interface [ 446.379867][T19573] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 446.390412][T19573] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 446.402231][T19573] bond0 (unregistering): Released all slaves [ 446.414170][T19573] bond1 (unregistering): Released all slaves [ 446.429449][T19573] bond2 (unregistering): Released all slaves [ 446.442072][T19573] bond3 (unregistering): Released all slaves [ 446.454653][T19573] bond4 (unregistering): Released all slaves [ 446.477863][T19573] bond5 (unregistering): Released all slaves [ 446.490691][T19573] bond6 (unregistering): Released all slaves [ 446.503726][T19573] bond7 (unregistering): Released all slaves [ 446.517718][T19573] bond8 (unregistering): (slave lo): Releasing backup interface [ 446.526317][T19573] bond8 (unregistering): (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 446.544925][T19573] bond8 (unregistering): Released all slaves [ 446.557597][T19573] bond9 (unregistering): Released all slaves [ 446.655336][ T796] tipc: Node number set to 2886997007 [ 446.726139][T19573] 9: left promiscuous mode [ 446.807353][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 446.832124][T19573] : left promiscuous mode [ 447.026999][T19573] tipc: Left network mode [ 447.155733][T19573] IPVS: stopping master sync thread 12035 ... [ 447.183646][T19683] netlink: 'syz.4.3946': attribute type 1 has an invalid length. [ 447.197541][T19683] netlink: 476 bytes leftover after parsing attributes in process `syz.4.3946'. [ 447.200251][T19690] netlink: 232 bytes leftover after parsing attributes in process `syz.1.3948'. [ 447.207326][T19683] netlink: 1041 bytes leftover after parsing attributes in process `syz.4.3946'. [ 447.261807][T19692] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3946'. [ 447.429975][T19699] openvswitch: netlink: Unexpected mask (mask=20040, allowed=10048) [ 447.522568][T19699] Bluetooth: MGMT ver 1.23 [ 447.529821][T19699] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 447.537030][T19699] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 447.600375][T19699] netlink: 'syz.2.3950': attribute type 11 has an invalid length. [ 447.669728][T19720] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3956'. [ 447.742246][T19604] udevd[19604]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 447.782320][T18818] udevd[18818]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 447.847814][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 447.984824][T19742] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3961'. [ 448.091717][T19573] veth0_to_team: left promiscuous mode [ 448.102253][T19573] veth1: left promiscuous mode [ 448.112319][T19573] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 448.119901][T19573] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 448.127896][T19573] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 448.137422][T19573] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 448.155281][T19573] veth1_macvtap: left promiscuous mode [ 448.160891][T19573] veth0_macvtap: left promiscuous mode [ 448.167192][T19573] veth1_vlan: left promiscuous mode [ 448.172529][T19573] veth0_vlan: left promiscuous mode [ 448.270042][T19755] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3962'. [ 448.281634][T19573] pim6reg (unregistering): left allmulticast mode [ 448.414061][T19573] team0 (unregistering): Port device team_slave_1 removed [ 448.432818][T19573] team0 (unregistering): Port device team_slave_0 removed [ 448.444948][T19573] veth0_to_team (unregistering): left allmulticast mode [ 448.579353][T19752] bond0: entered promiscuous mode [ 448.591851][T19752] bond_slave_0: entered promiscuous mode [ 448.609352][T19752] bond_slave_1: entered promiscuous mode [ 448.629850][T19752] bridge0: entered promiscuous mode [ 448.818121][ T8515] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.893238][ T5854] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 448.934392][T19573] IPVS: stop unused estimator thread 0... [ 449.093545][T19785] Cannot find del_set index 4 as target [ 449.925414][ T796] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.245393][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.245922][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 450.262367][ T8514] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 450.756852][T19729] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 450.959698][ T58] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 450.971357][ T5854] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 451.058522][T19820] openvswitch: netlink: Message has 1 unknown bytes. [ 451.065774][T19820] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 451.184117][T19834] __nla_validate_parse: 22 callbacks suppressed [ 451.184136][T19834] netlink: 27 bytes leftover after parsing attributes in process `syz.0.3983'. [ 451.218704][T19834] mac80211_hwsim hwsim30 : renamed from wlan1 [ 451.847404][ T8514] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.045854][ T5886] net_ratelimit: 3 callbacks suppressed [ 453.045874][ T5886] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 453.893314][T19806] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 453.905394][T19845] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3987'. [ 454.082755][T19868] IPVS: Error connecting to the multicast addr [ 454.093170][ T5854] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.311714][T19887] netlink: 'syz.2.3999': attribute type 1 has an invalid length. [ 454.405519][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.547537][T19892] netlink: 212344 bytes leftover after parsing attributes in process `syz.3.4000'. [ 454.704998][T19909] netlink: 1047 bytes leftover after parsing attributes in process `syz.3.4003'. [ 454.724149][T19909] bridge_slave_1: default FDB implementation only supports local addresses [ 454.805488][T19916] netlink: 36 bytes leftover after parsing attributes in process `syz.0.4004'. [ 454.885930][ T797] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 454.900649][T19922] pim6reg: entered allmulticast mode [ 454.908262][T19922] pim6reg: left allmulticast mode [ 455.090141][T19929] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.098967][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.126017][ T5854] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.134172][T19929] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.150439][ T8514] IPVS: starting estimator thread 0... [ 455.224415][T19945] netlink: 'syz.3.4013': attribute type 28 has an invalid length. [ 455.232800][T19945] netlink: 'syz.3.4013': attribute type 3 has an invalid length. [ 455.245238][T19941] IPVS: using max 31 ests per chain, 74400 per kthread [ 455.245404][T19945] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4013'. [ 455.510457][T19962] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 455.724393][T19981] ip_tunnel: non-ECT from 0.0.0.0 with TOS=0x33 [ 455.743184][T19978] syzkaller0: entered promiscuous mode [ 455.748870][T19978] syzkaller0: entered allmulticast mode [ 455.852307][T19980] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4021'. [ 455.903302][T19988] syzkaller0: left promiscuous mode [ 455.910452][T19988] syzkaller0: left allmulticast mode [ 455.922051][T19993] netlink: 112 bytes leftover after parsing attributes in process `syz.3.4025'. [ 457.611517][T19903] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 457.755873][T20003] netlink: 'syz.0.4029': attribute type 3 has an invalid length. [ 457.787592][T20003] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 457.807988][T20003] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 457.832158][T20011] netlink: 112 bytes leftover after parsing attributes in process `syz.4.4028'. [ 457.859508][T20012] geneve2: entered promiscuous mode [ 457.897835][T20019] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4027'. [ 457.964231][ T12] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 39283 - 0 [ 458.009759][ T12] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 39283 - 0 [ 458.038885][T20014] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4029'. [ 458.056551][ T12] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 39283 - 0 [ 458.108529][ T12] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 39283 - 0 [ 458.137363][T20027] netlink: 'syz.1.4031': attribute type 3 has an invalid length. [ 458.261934][ T5886] net_ratelimit: 3 callbacks suppressed [ 458.261952][ T5886] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 458.471164][T20045] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4038'. [ 458.514482][T20050] netlink: 'syz.0.4040': attribute type 11 has an invalid length. [ 458.566512][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 458.877111][T20071] 8021q: VLANs not supported on ip_vti0 [ 459.191980][T20099] netlink: 'syz.1.4057': attribute type 8 has an invalid length. [ 459.206607][ T797] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.226243][T20099] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4057'. [ 459.262448][T20105] netlink: 184 bytes leftover after parsing attributes in process `syz.4.4058'. [ 459.269185][T20103] netlink: 184 bytes leftover after parsing attributes in process `syz.4.4058'. [ 459.282960][T20099] gretap0: entered promiscuous mode [ 459.293649][T20099] gretap0: left promiscuous mode [ 459.299750][ T5886] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 459.311915][T20110] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4052'. [ 459.402360][T20110] bond3: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 459.433652][T20110] bond3 (unregistering): Released all slaves [ 459.509233][T20120] netlink: 'syz.0.4061': attribute type 2 has an invalid length. [ 459.600292][T20126] dvmrp0: entered allmulticast mode [ 459.731472][T20134] bridge0: port 4(bond0) entered blocking state [ 459.749359][T20139] netlink: 'syz.3.4067': attribute type 1 has an invalid length. [ 459.759033][T20134] bridge0: port 4(bond0) entered disabled state [ 459.778602][T20139] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4067'. [ 459.781047][T20134] bond0: entered allmulticast mode [ 459.794977][T20134] bond_slave_0: entered allmulticast mode [ 459.804702][T20134] bond_slave_1: entered allmulticast mode [ 459.830309][T20134] syz_tun: entered allmulticast mode [ 459.840203][T20134] bond0: entered promiscuous mode [ 459.852833][T20134] bond_slave_0: entered promiscuous mode [ 459.868288][T20134] bond_slave_1: entered promiscuous mode [ 459.885950][T20148] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4070'. [ 460.326571][ T5854] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 460.423026][T20160] netlink: 'syz.0.4073': attribute type 12 has an invalid length. [ 460.564926][T20160] bond4: option primary_reselect: invalid value (255) [ 460.579162][T20160] bond4 (unregistering): Released all slaves [ 460.849998][T20189] xt_l2tp: v2 tid > 0xffff: 1114244 [ 461.126095][ T5193] block nbd4: Connection timed out, retrying (0/2 alive) [ 461.133312][ T5193] block nbd4: Connection timed out, retrying (0/2 alive) [ 461.141443][T15499] block nbd4: Dead connection, failed to find a fallback [ 461.148678][T15499] block nbd4: shutting down sockets [ 461.154005][ T5193] block nbd4: Connection timed out, retrying (0/2 alive) [ 461.162049][T15499] blk_print_req_error: 138 callbacks suppressed [ 461.162065][T15499] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 461.179163][ T5193] block nbd4: Connection timed out, retrying (0/2 alive) [ 461.188999][T15499] buffer_io_error: 138 callbacks suppressed [ 461.189015][T15499] Buffer I/O error on dev nbd4, logical block 0, async page read [ 461.204080][T15499] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 461.214294][T15499] Buffer I/O error on dev nbd4, logical block 3, async page read [ 461.222752][T15499] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 461.232894][T15499] Buffer I/O error on dev nbd4, logical block 2, async page read [ 461.242178][T15499] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 461.252284][T15499] Buffer I/O error on dev nbd4, logical block 1, async page read [ 461.260823][T18816] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 461.278234][T18816] Buffer I/O error on dev nbd4, logical block 0, async page read [ 461.295591][T18816] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 461.369507][T18816] Buffer I/O error on dev nbd4, logical block 1, async page read [ 461.378058][T18816] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 461.394710][T18816] Buffer I/O error on dev nbd4, logical block 2, async page read [ 461.403248][T18816] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 461.413984][T18816] Buffer I/O error on dev nbd4, logical block 3, async page read [ 461.422842][T18816] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 461.432472][T18816] Buffer I/O error on dev nbd4, logical block 0, async page read [ 461.440478][T18816] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 461.441428][T20218] syzkaller0: entered allmulticast mode [ 461.451773][T18816] Buffer I/O error on dev nbd4, logical block 1, async page read [ 461.554060][T18816] ldm_validate_partition_table(): Disk read failed. [ 461.572618][T18816] Dev nbd4: unable to read RDB block 0 [ 461.593050][T18816] nbd4: unable to read partition table [ 461.625836][T20218] syzkaller0 (unregistering): left allmulticast mode [ 461.626880][T18816] ldm_validate_partition_table(): Disk read failed. [ 461.656623][T18816] Dev nbd4: unable to read RDB block 0 [ 461.663841][T18816] nbd4: unable to read partition table [ 461.738854][T20233] lo: entered promiscuous mode [ 461.749528][T20233] netlink: 'syz.3.4096': attribute type 2 has an invalid length. [ 461.759033][T20233] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 462.282127][T20257] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 462.579740][T20291] netlink: 'syz.1.4110': attribute type 7 has an invalid length. [ 462.689109][T20301] 8021q: VLANs not supported on gre0 [ 462.824618][T20308] veth0: entered promiscuous mode [ 462.890329][T20318] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 462.963342][T20315] netlink: 'syz.2.4120': attribute type 5 has an invalid length. [ 463.017001][T20326] __nla_validate_parse: 13 callbacks suppressed [ 463.017022][T20326] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4123'. [ 463.096475][T20326] bond2: Invalid ad_actor_system MAC address. [ 463.102608][T20326] bond2: option ad_actor_system: invalid value (1) [ 463.117832][T20326] bond2 (unregistering): Released all slaves [ 463.296976][T20346] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4128'. [ 463.526758][T20359] netlink: 'syz.3.4132': attribute type 4 has an invalid length. [ 463.668413][T20306] veth0: left promiscuous mode [ 463.742996][T20374] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4138'. [ 463.761567][T20374] bridge0: port 5(batadv1) entered blocking state [ 463.769208][T20374] bridge0: port 5(batadv1) entered disabled state [ 463.789375][T20374] batadv1: entered allmulticast mode [ 463.810312][T20374] batadv1: entered promiscuous mode [ 463.970369][T20387] netlink: 209608 bytes leftover after parsing attributes in process `syz.2.4144'. [ 464.064087][T20393] openvswitch: netlink: Tunnel attr 0 has unexpected len 3 expected 8 [ 464.157286][ T30] audit: type=1800 audit(1773840197.160:8): pid=20393 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.4146" name="memory.events" dev="tmpfs" ino=998 res=0 errno=0 [ 464.196475][T20393] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4146'. [ 464.265732][ T12] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 464.276468][ T12] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 464.399719][T20419] sctp: [Deprecated]: syz.0.4154 (pid 20419) Use of int in maxseg socket option. [ 464.399719][T20419] Use struct sctp_assoc_value instead [ 464.469789][T20422] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4155'. [ 464.524316][T20422] netlink: 'syz.3.4155': attribute type 1 has an invalid length. [ 464.533412][T20422] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 464.610257][T20432] netlink: 'syz.1.4156': attribute type 1 has an invalid length. [ 464.620757][T20432] netlink: 'syz.1.4156': attribute type 3 has an invalid length. [ 464.628658][T20432] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4156'. [ 465.173912][T20441] openvswitch: netlink: Tunnel attr 0 has unexpected len 3 expected 8 [ 465.398974][T20449] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 467.403587][T20423] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 467.599570][T20462] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4165'. [ 467.673706][T20461] netlink: 88 bytes leftover after parsing attributes in process `syz.2.4167'. [ 467.737081][T20469] netlink: 'syz.0.4170': attribute type 10 has an invalid length. [ 467.756656][T20469] veth0_macvtap: left promiscuous mode [ 468.025843][T20494] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4177'. [ 468.135452][T20494] hsr0: entered promiscuous mode [ 468.145807][T20494] macvlan2: entered allmulticast mode [ 468.155731][T20494] hsr0: entered allmulticast mode [ 468.160791][T20494] hsr_slave_0: entered allmulticast mode [ 468.189634][T20494] hsr_slave_1: entered allmulticast mode [ 468.280454][T20512] netlink: 'syz.0.4180': attribute type 4 has an invalid length. [ 468.413280][T20526] netlink: 'syz.3.4182': attribute type 1 has an invalid length. [ 468.549384][T20526] 8021q: adding VLAN 0 to HW filter on device bond2 [ 468.644389][T20535] dummy0: mtu less than device minimum [ 468.652104][T20535] netlink: 84 bytes leftover after parsing attributes in process `syz.0.4187'. [ 468.669113][T20514] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4182'. [ 468.702818][T20533] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4186'. [ 468.717477][T20514] netlink: 'syz.3.4182': attribute type 1 has an invalid length. [ 468.732914][T20514] netlink: 'syz.3.4182': attribute type 1 has an invalid length. [ 468.744200][T20514] netlink: 'syz.3.4182': attribute type 2 has an invalid length. [ 468.766295][T20514] netlink: 68 bytes leftover after parsing attributes in process `syz.3.4182'. [ 468.842307][T20544] netlink: 256 bytes leftover after parsing attributes in process `syz.1.4188'. [ 469.003912][T20559] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4193'. [ 469.224270][T20575] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4196'. [ 469.279727][T20571] syzkaller0: entered promiscuous mode [ 469.294116][T20571] syzkaller0: entered allmulticast mode [ 469.679452][T20594] netlink: 'syz.4.4200': attribute type 1 has an invalid length. [ 469.762703][T20594] bond3: entered promiscuous mode [ 469.769460][T20594] 8021q: adding VLAN 0 to HW filter on device bond3 [ 469.834948][T20604] bond3: (slave bridge3): making interface the new active one [ 469.845958][T20604] bridge3: entered promiscuous mode [ 469.852240][T20604] bond3: (slave bridge3): Enslaving as an active interface with an up link [ 469.884625][T20609] netlink: 220 bytes leftover after parsing attributes in process `syz.2.4203'. [ 469.899917][T20609] xt_hashlimit: size too large, truncated to 1048576 [ 469.967175][T20618] netlink: 'syz.1.4204': attribute type 10 has an invalid length. [ 470.214252][T20618] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 470.224578][T20618] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 472.711076][T20599] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 472.929417][T20681] syzkaller1: entered promiscuous mode [ 472.934929][T20681] syzkaller1: entered allmulticast mode [ 473.294405][T20710] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4226'. [ 473.335845][T20712] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4226'. [ 473.352549][T20710] hsr_slave_0: left promiscuous mode [ 473.378381][T20710] hsr_slave_1: left promiscuous mode [ 473.552819][T20731] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4233'. [ 473.552819][T20730] syz.1.4233: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 473.654395][T20730] CPU: 0 UID: 0 PID: 20730 Comm: syz.1.4233 Not tainted syzkaller #0 PREEMPT(full) [ 473.654421][T20730] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 473.654436][T20730] Call Trace: [ 473.654463][T20730] [ 473.654477][T20730] dump_stack_lvl+0xe8/0x150 [ 473.654637][T20730] warn_alloc+0x249/0x340 [ 473.654687][T20730] ? stack_trace_save+0xa9/0x100 [ 473.654761][T20730] ? __pfx_warn_alloc+0x10/0x10 [ 473.654784][T20730] ? kasan_save_track+0x4f/0x80 [ 473.654811][T20730] ? kasan_save_track+0x3e/0x80 [ 473.654826][T20730] ? __kasan_kmalloc+0x93/0xb0 [ 473.654842][T20730] ? __kmalloc_cache_noprof+0x31c/0x660 [ 473.654859][T20730] ? xskq_create+0x56/0x170 [ 473.654954][T20730] ? xsk_setsockopt+0x54c/0x990 [ 473.654973][T20730] ? do_sock_setsockopt+0x17c/0x1b0 [ 473.655054][T20730] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 473.655077][T20730] ? do_syscall_64+0x14d/0xf80 [ 473.655131][T20730] __vmalloc_node_range_noprof+0x132/0x1730 [ 473.655179][T20730] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 473.655204][T20730] ? __kasan_kmalloc+0x93/0xb0 [ 473.655227][T20730] vmalloc_user_noprof+0xad/0xe0 [ 473.655244][T20730] ? xskq_create+0xbf/0x170 [ 473.655266][T20730] xskq_create+0xbf/0x170 [ 473.655300][T20730] xsk_init_queue+0x8a/0xe0 [ 473.655326][T20730] xsk_setsockopt+0x54c/0x990 [ 473.655351][T20730] ? __pfx_xsk_setsockopt+0x10/0x10 [ 473.655373][T20730] ? __pfx_aa_sk_perm+0x10/0x10 [ 473.655467][T20730] ? aa_sock_opt_perm+0xff/0x1a0 [ 473.655522][T20730] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 473.655557][T20730] ? __pfx_xsk_setsockopt+0x10/0x10 [ 473.655580][T20730] do_sock_setsockopt+0x17c/0x1b0 [ 473.655610][T20730] __x64_sys_setsockopt+0x13d/0x1b0 [ 473.655640][T20730] do_syscall_64+0x14d/0xf80 [ 473.655655][T20730] ? trace_irq_disable+0x3b/0x150 [ 473.655692][T20730] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.655724][T20730] ? clear_bhb_loop+0x40/0x90 [ 473.655746][T20730] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 473.655767][T20730] RIP: 0033:0x7f0677d9c799 [ 473.655817][T20730] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 473.655832][T20730] RSP: 002b:00007f0678b7a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 473.655881][T20730] RAX: ffffffffffffffda RBX: 00007f0678015fa0 RCX: 00007f0677d9c799 [ 473.655894][T20730] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000004 [ 473.655905][T20730] RBP: 00007f0677e32c99 R08: 0000000000000004 R09: 0000000000000000 [ 473.655916][T20730] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 473.655926][T20730] R13: 00007f0678016038 R14: 00007f0678015fa0 R15: 00007ffe8b5c1868 [ 473.655955][T20730] [ 473.679248][T20741] netlink: 165 bytes leftover after parsing attributes in process `syz.0.4235'. [ 473.716690][T20730] Mem-Info: [ 473.812856][T20744] netlink: 'syz.4.4237': attribute type 7 has an invalid length. [ 473.816144][T20730] active_anon:5960 inactive_anon:0 isolated_anon:0 [ 473.816144][T20730] active_file:3348 inactive_file:40091 isolated_file:0 [ 473.816144][T20730] unevictable:768 dirty:97 writeback:0 [ 473.816144][T20730] slab_reclaimable:12579 slab_unreclaimable:115554 [ 473.816144][T20730] mapped:29662 shmem:1359 pagetables:3477 [ 473.816144][T20730] sec_pagetables:0 bounce:0 [ 473.816144][T20730] kernel_misc_reclaimable:0 [ 473.816144][T20730] free:1291397 free_pcp:22436 free_cma:0 [ 473.830260][T20744] netlink: 'syz.4.4237': attribute type 7 has an invalid length. [ 474.027369][T20730] Node 0 active_anon:23872kB inactive_anon:0kB active_file:13392kB inactive_file:160156kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:122560kB dirty:384kB writeback:0kB shmem:3900kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14056kB pagetables:13860kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 474.070360][T20752] IPVS: set_ctl: invalid protocol: 59 172.20.20.24:20001 [ 474.127504][T20730] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:4kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:136kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 474.164260][T20756] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4239'. [ 474.173839][T20730] Node 0 DMA free:15328kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:32kB local_pcp:16kB free_cma:0kB [ 474.174558][T20756] IPv6: Can't replace route, no match found [ 474.214810][T20730] lowmem_reserve[]: 0 2492 2493 2493 2493 [ 474.221075][T20730] Node 0 DMA32 free:1262704kB boost:0kB min:34200kB low:42748kB high:51296kB reserved_highatomic:0KB free_highatomic:0KB active_anon:23872kB inactive_anon:0kB active_file:13392kB inactive_file:160156kB unevictable:1536kB writepending:384kB zspages:0kB present:3129332kB managed:2552760kB mlocked:0kB bounce:0kB free_pcp:35076kB local_pcp:14124kB free_cma:0kB [ 474.266850][T20756] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4239'. [ 474.275118][T20730] lowmem_reserve[]: 0 0 0 0 0 [ 474.280945][T20730] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:880kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 474.311809][T20730] lowmem_reserve[]: 0 0 0 0 0 [ 474.317007][T20730] Node 1 Normal free:3887608kB boost:0kB min:55688kB low:69608kB high:83528kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:208kB unevictable:1536kB writepending:4kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:53292kB local_pcp:24684kB free_cma:0kB [ 474.360152][T20730] lowmem_reserve[]: 0 0 0 0 0 [ 474.364916][T20730] Node 0 DMA: 0*4kB 0*8kB 2*16kB (U) 2*32kB (U) 2*64kB (U) 2*128kB (U) 2*256kB (U) 2*512kB (U) 3*1024kB (U) 3*2048kB (UM) 1*4096kB (U) = 15328kB [ 474.382579][T20730] Node 0 DMA32: 9234*4kB (UM) 5177*8kB (UM) 2564*16kB (UME) 91*32kB (UME) 364*64kB (UME) 968*128kB (UME) 800*256kB (UME) 535*512kB (UME) 290*1024kB (UME) 106*2048kB (UME) 0*4096kB = 1262256kB [ 474.402478][T20730] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 474.416983][T20730] Node 1 Normal: 5*4kB (UM) 15*8kB (UM) 14*16kB (UM) 2*32kB (UM) 12*64kB (UM) 13*128kB (UM) 11*256kB (UM) 6*512kB (UM) 8*1024kB (UM) 6*2048kB (U) 942*4096kB (UM) = 3887660kB [ 474.467341][T20730] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 474.479938][T20730] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 474.494815][T20730] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 474.505923][T20730] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 474.515735][T20730] 44794 total pagecache pages [ 474.520478][T20730] 0 pages in swap cache [ 474.524649][T20730] Free swap = 124996kB [ 474.529329][T20730] Total swap = 124996kB [ 474.533502][T20730] 2097051 pages RAM [ 474.537929][T20730] 0 pages HighMem/MovableOnly [ 474.542609][T20730] 427026 pages reserved [ 474.547380][T20730] 0 pages cma reserved [ 474.587244][T20770] netlink: 276 bytes leftover after parsing attributes in process `syz.1.4242'. [ 474.723150][T20776] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4244'. [ 474.743908][T20777] bond2: option lp_interval: invalid value (0) [ 474.750509][T20777] bond2: option lp_interval: allowed values 1 - 2147483647 [ 474.760168][T20777] bond2 (unregistering): Released all slaves [ 474.781943][T20776] ve: renamed from macvlan0 (while UP) [ 474.785612][T20782] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4246'. [ 474.810352][T20782] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4246'. [ 477.319632][T20758] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 477.727404][T20817] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 477.877974][T20829] netlink: 'syz.2.4262': attribute type 3 has an invalid length. [ 478.121523][T20853] netlink: 'syz.4.4268': attribute type 3 has an invalid length. [ 478.133522][T20852] netlink: 'syz.0.4266': attribute type 1 has an invalid length. [ 478.166296][T20852] netlink: 'syz.0.4266': attribute type 2 has an invalid length. [ 478.221398][T20853] team0: Port device team_slave_0 removed [ 478.405240][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 478.568375][T20870] netlink: 'syz.0.4273': attribute type 13 has an invalid length. [ 478.578673][T20870] gretap0: refused to change device tx_queue_len [ 478.585497][T20870] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 480.221236][T20890] __nla_validate_parse: 9 callbacks suppressed [ 480.221249][T20890] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4278'. [ 480.390919][T20890] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4278'. [ 480.400800][T20890] openvswitch: netlink: Flow actions attr not present in new flow. [ 480.945885][T20833] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 481.106650][T20900] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 481.118248][T20900] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4279'. [ 481.478220][T20928] netlink: 'syz.2.4288': attribute type 1 has an invalid length. [ 481.497278][T20934] netlink: 'syz.3.4287': attribute type 13 has an invalid length. [ 481.611064][T20929] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.4287'. [ 481.612219][T20934] lo: left promiscuous mode [ 481.686814][T20934] bond0: left promiscuous mode [ 481.691796][T20934] bond_slave_0: left promiscuous mode [ 481.698822][T20934] bond_slave_1: left promiscuous mode [ 481.706593][T20934] bridge0: left promiscuous mode [ 481.715851][T20934] bridge_slave_1: left promiscuous mode [ 481.728500][T20934] 8021q: adding VLAN 0 to HW filter on device bond0 [ 481.741631][T20934] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 481.785287][T20937] macvlan2: entered promiscuous mode [ 481.795918][T20937] macvlan2: entered allmulticast mode [ 481.807880][T20937] bond3: entered promiscuous mode [ 481.828848][T20937] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 481.877669][T20937] bond3: left promiscuous mode [ 482.103699][T20971] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 482.126389][T20971] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4303'. [ 482.138286][T20971] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4303'. [ 482.209594][T20980] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4308'. [ 482.292195][T20980] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.4308'. [ 482.323875][T20990] 8021q: VLANs not supported on ip_vti0 [ 482.384151][T20992] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4312'. [ 482.404358][T20992] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4312'. [ 482.441109][T20996] netlink: 'syz.2.4314': attribute type 1 has an invalid length. [ 482.482641][T20996] netlink: 'syz.2.4314': attribute type 2 has an invalid length. [ 482.598111][T21002] syzkaller0: entered promiscuous mode [ 482.603632][T21002] syzkaller0: entered allmulticast mode [ 483.008096][T21042] FAULT_INJECTION: forcing a failure. [ 483.008096][T21042] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 483.021959][T21042] CPU: 1 UID: 0 PID: 21042 Comm: syz.3.4327 Not tainted syzkaller #0 PREEMPT(full) [ 483.021982][T21042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 483.021993][T21042] Call Trace: [ 483.022001][T21042] [ 483.022009][T21042] dump_stack_lvl+0xe8/0x150 [ 483.022039][T21042] should_fail_ex+0x412/0x560 [ 483.022170][T21042] _copy_from_user+0x2d/0xb0 [ 483.022247][T21042] ___sys_sendmsg+0x1c6/0x360 [ 483.022300][T21042] ? __pfx____sys_sendmsg+0x10/0x10 [ 483.022370][T21042] ? __fget_files+0x2a/0x420 [ 483.022405][T21042] ? __fget_files+0x3a0/0x420 [ 483.022440][T21042] __x64_sys_sendmsg+0x1bd/0x2a0 [ 483.022461][T21042] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 483.022488][T21042] ? __pfx_ksys_write+0x10/0x10 [ 483.022523][T21042] do_syscall_64+0x14d/0xf80 [ 483.022540][T21042] ? trace_irq_disable+0x3b/0x150 [ 483.022565][T21042] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.022582][T21042] ? clear_bhb_loop+0x40/0x90 [ 483.022604][T21042] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 483.022622][T21042] RIP: 0033:0x7fb756b9c799 [ 483.022640][T21042] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 483.022655][T21042] RSP: 002b:00007fb7579fd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 483.022675][T21042] RAX: ffffffffffffffda RBX: 00007fb756e15fa0 RCX: 00007fb756b9c799 [ 483.022688][T21042] RDX: 0000000020000000 RSI: 0000200000000000 RDI: 0000000000000005 [ 483.022700][T21042] RBP: 00007fb7579fd090 R08: 0000000000000000 R09: 0000000000000000 [ 483.022710][T21042] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 483.022721][T21042] R13: 00007fb756e16038 R14: 00007fb756e15fa0 R15: 00007ffd337ab858 [ 483.022751][T21042] [ 483.209731][T21056] siw: device registration error -23 [ 483.679074][T21086] bond0: (slave syz_tun): Releasing backup interface [ 483.696039][T21086] syz_tun (unregistering): left allmulticast mode [ 483.733816][T21091] bridge0: port 2(bond0) entered blocking state [ 483.747767][T21091] bridge0: port 2(bond0) entered disabled state [ 483.763230][T21091] bond0: entered allmulticast mode [ 483.775716][T21091] bond_slave_0: entered allmulticast mode [ 483.781467][T21091] bond_slave_1: entered allmulticast mode [ 483.801199][T21091] bridge0: entered allmulticast mode [ 483.807329][T21091] bridge_slave_1: entered allmulticast mode [ 483.818320][T21098] netlink: 'syz.4.4337': attribute type 1 has an invalid length. [ 483.827519][T21098] mapping of prio or/and queue is allowed only from OUTPUT/FORWARD/POSTROUTING chains [ 483.854623][T21091] bond0: left allmulticast mode [ 483.867925][T21091] bond_slave_0: left allmulticast mode [ 483.885794][T21091] bond_slave_1: left allmulticast mode [ 483.892431][T21091] bridge0: left allmulticast mode [ 483.907644][T21091] bridge_slave_1: left allmulticast mode [ 484.192837][T21111] netlink: 'syz.2.4341': attribute type 1 has an invalid length. [ 484.241992][T21107] netlink: 'syz.2.4341': attribute type 1 has an invalid length. [ 484.260261][T21107] netlink: 'syz.2.4341': attribute type 3 has an invalid length. [ 484.277013][T21107] netlink: 'syz.2.4341': attribute type 7 has an invalid length. [ 484.296077][T21107] netlink: 'syz.2.4341': attribute type 8 has an invalid length. [ 484.318889][T21119] bond4: (slave gretap1): making interface the new active one [ 484.328020][T21107] NCSI netlink: No device for ifindex 131092 [ 484.424949][T21119] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 484.758638][T21135] netlink: 'syz.0.4349': attribute type 1 has an invalid length. [ 484.812239][T21135] 8021q: adding VLAN 0 to HW filter on device bond4 [ 484.871083][T21135] bond4: (slave veth11): Enslaving as an active interface with a down link [ 484.893681][T21135] bond4: (slave veth0_to_bond): making interface the new active one [ 484.906257][T21135] veth0_to_bond: entered promiscuous mode [ 484.912766][T21135] bond4: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 484.924330][T21135] netlink: 'syz.0.4349': attribute type 1 has an invalid length. [ 484.935850][T21135] netlink: 'syz.0.4349': attribute type 2 has an invalid length. [ 485.001233][T21146] netlink: 'syz.4.4352': attribute type 1 has an invalid length. [ 485.135073][T21155] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 485.169784][T21149] bond4: (slave gretap1): making interface the new active one [ 485.203627][T21149] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 485.535183][ T5824] Bluetooth: hci0: command 0x0c20 tx timeout [ 485.683549][T21189] __nla_validate_parse: 11 callbacks suppressed [ 485.683569][T21189] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4362'. [ 485.812464][T21198] netlink: 108 bytes leftover after parsing attributes in process `syz.0.4363'. [ 485.817238][T21189] 8021q: adding VLAN 0 to HW filter on device bond5 [ 485.912505][T21189] 8021q: adding VLAN 0 to HW filter on device bond5 [ 485.936912][T21189] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 485.987022][T21189] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 486.006881][T21207] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.4367'. [ 486.042400][T21209] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4366'. [ 486.144988][T21201] veth7: entered promiscuous mode [ 486.163996][T21201] bond5: (slave veth7): Enslaving as an active interface with a down link [ 486.186532][T21210] vlan2: entered allmulticast mode [ 486.191752][T21210] bond5: entered allmulticast mode [ 486.260983][T21214] tipc: Enabling of bearer rejected, failed to enable media [ 486.273116][T21216] netlink: 132 bytes leftover after parsing attributes in process `syz.0.4369'. [ 486.367194][T21218] bond5: entered promiscuous mode [ 486.372578][T21218] 8021q: adding VLAN 0 to HW filter on device bond5 [ 486.403486][T21218] bond5: (slave bridge5): making interface the new active one [ 486.431954][T21218] bridge5: entered promiscuous mode [ 486.479848][T21218] bond5: (slave bridge5): Enslaving as an active interface with an up link [ 486.637367][T21238] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4376'. [ 486.711731][T21244] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4376'. [ 487.025635][T21257] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4380'. [ 487.036068][T21257] openvswitch: netlink: nsh attr 255 is out of range max 3 [ 487.222599][T21271] netlink: 108 bytes leftover after parsing attributes in process `syz.1.4381'. [ 487.347632][T21279] netlink: 212344 bytes leftover after parsing attributes in process `syz.4.4385'. [ 487.406104][T21284] openvswitch: netlink: Unexpected mask (mask=4000040, allowed=10048) [ 487.538811][T21295] bridge0: port 1(bridge_slave_0) entered disabled state [ 487.603771][T21297] ip6gre2: entered allmulticast mode [ 487.711950][T21301] smc: adding net device wlan0 with user defined pnetid SYZ0 [ 487.814686][T21301] IPVS: set_ctl: invalid protocol: 46 255.255.255.255:20001 [ 488.284981][T21340] SET target dimension over the limit! [ 488.437496][T21355] syzkaller0: entered promiscuous mode [ 488.443007][T21355] syzkaller0: entered allmulticast mode [ 489.077521][T21400] validate_nla: 11 callbacks suppressed [ 489.077539][T21400] netlink: 'syz.3.4421': attribute type 1 has an invalid length. [ 489.248696][T21411] xt_hashlimit: size too large, truncated to 1048576 [ 489.523042][T21424] netlink: 'syz.3.4429': attribute type 16 has an invalid length. [ 489.577219][T21424] netlink: 'syz.3.4429': attribute type 17 has an invalid length. [ 489.811024][T21424] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 490.168739][T21466] netlink: 'syz.1.4439': attribute type 10 has an invalid length. [ 490.200723][T21470] xt_TCPMSS: Only works on TCP SYN packets [ 490.642845][T21496] Bluetooth: MGMT ver 1.23 [ 491.066811][T21518] bond5: option fail_over_mac: invalid value (16) [ 491.089781][T21518] bond5 (unregistering): Released all slaves [ 491.262656][T21527] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 491.451739][T21538] __nla_validate_parse: 9 callbacks suppressed [ 491.451758][T21538] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4460'. [ 491.571031][T21549] xt_hashlimit: max too large, truncated to 1048576 [ 491.601220][T21552] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4464'. [ 491.683292][T21549] netlink: 'syz.1.4462': attribute type 12 has an invalid length. [ 491.772563][T21549] bond2: option primary_reselect: invalid value (255) [ 491.798983][T21563] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4467'. [ 491.811742][T21549] bond2 (unregistering): Released all slaves [ 492.321968][T21578] netlink: 100 bytes leftover after parsing attributes in process `syz.3.4472'. [ 492.377884][T21582] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 492.381039][T21581] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4473'. [ 492.416203][T21582] netlink: 'syz.2.4474': attribute type 1 has an invalid length. [ 492.425880][T21582] netlink: 96 bytes leftover after parsing attributes in process `syz.2.4474'. [ 492.463604][T21582] netlink: 658 bytes leftover after parsing attributes in process `syz.2.4474'. [ 492.490648][T21582] netlink: 1 bytes leftover after parsing attributes in process `syz.2.4474'. [ 492.672807][T21607] netlink: 'syz.2.4478': attribute type 1 has an invalid length. [ 492.716634][T21612] sctp: [Deprecated]: syz.3.4475 (pid 21612) Use of int in maxseg socket option. [ 492.716634][T21612] Use struct sctp_assoc_value instead [ 492.899759][T21619] syzkaller0: entered promiscuous mode [ 492.905796][T21619] syzkaller0: entered allmulticast mode [ 492.955462][ T49] batman_adv: batadv1: IGMP Querier appeared [ 492.961537][ T49] batman_adv: batadv1: MLD Querier appeared [ 493.522768][T21627] IPv6: NLM_F_REPLACE set, but no existing node found! [ 494.460150][T21650] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 494.806142][ T5824] Bluetooth: hci2: command 0x0c1a tx timeout [ 495.453281][T21586] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 495.754990][T21671] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4493'. [ 495.777358][T21671] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4493'. [ 495.997170][ T58] veth0_to_bond: left promiscuous mode [ 496.131172][T21688] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 496.346206][T21702] netlink: 'syz.2.4501': attribute type 1 has an invalid length. [ 496.397131][T21708] netlink: 'syz.3.4504': attribute type 19 has an invalid length. [ 496.432067][T21701] IPVS: Scheduler module ip_vs_sip not found [ 496.729963][ T5824] Bluetooth: hci2: link tx timeout [ 496.738308][ T5824] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 496.841538][T21736] __nla_validate_parse: 2 callbacks suppressed [ 496.841556][T21736] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4512'. [ 497.080983][T21761] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4521'. [ 497.093842][T21761] team0: No ports can be present during mode change [ 497.151683][T21764] syzkaller1: entered promiscuous mode [ 497.157752][T21764] syzkaller1: entered allmulticast mode [ 497.209150][T21769] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4525'. [ 497.259102][T21771] openvswitch: netlink: ct_state flags 010000e0 unsupported [ 497.663855][T21795] netlink: 27 bytes leftover after parsing attributes in process `syz.0.4532'. [ 498.060369][T21813] netlink: 'syz.3.4537': attribute type 21 has an invalid length. [ 498.073024][T21813] IPv6: NLM_F_CREATE should be specified when creating new route [ 498.809561][ T5824] Bluetooth: hci2: command 0x0c1a tx timeout [ 499.300276][T21824] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 499.321605][T21824] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4540'. [ 499.334238][T21823] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 499.348211][T21823] syzkaller0: entered promiscuous mode [ 499.353866][T21824] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4540'. [ 499.363835][T21823] syzkaller0: entered allmulticast mode [ 499.444794][T16337] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.447423][T21824] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4540'. [ 499.463738][T21824] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4540'. [ 499.471851][T16337] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.509411][T16337] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 499.572947][T21843] bridge6: entered promiscuous mode [ 499.578682][T21841] FAULT_INJECTION: forcing a failure. [ 499.578682][T21841] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 499.625945][T21843] bridge6: entered allmulticast mode [ 499.637267][T21848] ip6t_srh: unknown srh invflags 4000 [ 499.647510][T21843] team0: Port device bridge6 added [ 499.652813][T21841] CPU: 1 UID: 0 PID: 21841 Comm: syz.4.4546 Not tainted syzkaller #0 PREEMPT(full) [ 499.652836][T21841] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 499.652846][T21841] Call Trace: [ 499.652854][T21841] [ 499.652862][T21841] dump_stack_lvl+0xe8/0x150 [ 499.652891][T21841] should_fail_ex+0x412/0x560 [ 499.652919][T21841] _copy_to_user+0x31/0xb0 [ 499.652939][T21841] simple_read_from_buffer+0xe1/0x170 [ 499.652969][T21841] proc_fail_nth_read+0x1bb/0x230 [ 499.653046][T21841] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 499.653074][T21841] ? rw_verify_area+0x2a6/0x4d0 [ 499.653091][T21841] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 499.653116][T21841] vfs_read+0x20c/0xa70 [ 499.653132][T21841] ? fdget_pos+0x246/0x320 [ 499.653161][T21841] ? __pfx___mutex_lock+0x10/0x10 [ 499.653244][T21841] ? __pfx_vfs_read+0x10/0x10 [ 499.653264][T21841] ? __fget_files+0x2a/0x420 [ 499.653291][T21841] ? __fget_files+0x3a0/0x420 [ 499.653314][T21841] ? __fget_files+0x2a/0x420 [ 499.653345][T21841] ksys_read+0x150/0x270 [ 499.653366][T21841] ? __pfx_ksys_read+0x10/0x10 [ 499.653395][T21841] do_syscall_64+0x14d/0xf80 [ 499.653411][T21841] ? trace_irq_disable+0x3b/0x150 [ 499.653434][T21841] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 499.653452][T21841] ? clear_bhb_loop+0x40/0x90 [ 499.653473][T21841] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 499.653491][T21841] RIP: 0033:0x7f8c4b15cfce [ 499.653507][T21841] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 499.653522][T21841] RSP: 002b:00007f8c4bfb5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 499.653540][T21841] RAX: ffffffffffffffda RBX: 00007f8c4bfb66c0 RCX: 00007f8c4b15cfce [ 499.653553][T21841] RDX: 000000000000000f RSI: 00007f8c4bfb60a0 RDI: 0000000000000006 [ 499.653563][T21841] RBP: 00007f8c4bfb6090 R08: 0000000000000000 R09: 0000000000000000 [ 499.653574][T21841] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 499.653584][T21841] R13: 00007f8c4b416128 R14: 00007f8c4b416090 R15: 00007ffdf0bb3d38 [ 499.653613][T21841] [ 499.906113][T21854] tipc: Started in network mode [ 499.910991][T21854] tipc: Node identity fa878d11f3f9, cluster identity 4711 [ 499.933525][T21854] tipc: Enabled bearer , priority 0 [ 499.947258][T21859] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4552'. [ 499.950965][T21858] netlink: 'syz.4.4553': attribute type 1 has an invalid length. [ 499.989291][T21861] netlink: 'syz.3.4554': attribute type 1 has an invalid length. [ 499.997654][T21861] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4554'. [ 500.038417][T21858] 8021q: adding VLAN 0 to HW filter on device bond6 [ 500.051971][T21855] syzkaller0: entered promiscuous mode [ 500.058438][T21855] syzkaller0: entered allmulticast mode [ 500.070654][T21861] bridge: RTM_NEWNEIGH with invalid state 0x1 [ 500.127485][T21870] vxcan1: tx drop: invalid sa for name 0x0000000000000002 [ 500.141663][T21865] bond6: (slave geneve3): making interface the new active one [ 500.164218][T21865] bond6: (slave geneve3): Enslaving as an active interface with an up link [ 500.177190][T16334] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 500.191509][T16334] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 500.202603][T16334] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 500.214410][T16337] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 500.259959][T21876] vlan2: entered allmulticast mode [ 500.380850][T21881] xt_hashlimit: size too large, truncated to 1048576 [ 500.575893][T21852] tipc: Resetting bearer [ 500.619085][T21852] tipc: Disabling bearer [ 500.778571][T21905] netlink: 'syz.1.4569': attribute type 1 has an invalid length. [ 500.934960][T21915] openvswitch: netlink: Flow actions attr not present in new flow. [ 501.130673][T21923] netlink: 'syz.0.4576': attribute type 1 has an invalid length. [ 501.250017][T21923] bond5: entered promiscuous mode [ 501.271516][T21923] 8021q: adding VLAN 0 to HW filter on device bond5 [ 501.538199][T21960] macvtap0: entered promiscuous mode [ 501.559722][T21960] veth0_macvtap: left promiscuous mode [ 501.648977][T21971] openvswitch: netlink: Missing key (keys=40, expected=100) [ 501.684581][T21960] macvtap0 (unregistering): left promiscuous mode [ 501.708253][T21972] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 502.048267][T21994] netlink: 'syz.0.4598': attribute type 1 has an invalid length. [ 502.057871][T21994] netlink: 'syz.0.4598': attribute type 17 has an invalid length. [ 502.066473][T21994] __nla_validate_parse: 13 callbacks suppressed [ 502.066488][T21994] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4598'. [ 502.098961][T21994] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4598'. [ 502.178445][T22001] syzkaller0: entered promiscuous mode [ 502.196689][T22001] syzkaller0: entered allmulticast mode [ 502.562565][T22033] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4605'. [ 502.622749][T22044] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 502.717058][ T8516] IPVS: starting estimator thread 0... [ 502.816187][T22051] IPVS: using max 31 ests per chain, 74400 per kthread [ 502.986698][T22065] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4615'. [ 503.264714][T22075] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.312970][T22077] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4618'. [ 503.439523][T22075] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.612983][T22075] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.635562][T22116] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4627'. [ 503.727126][T22075] bond0: (slave netdevsim0): Releasing backup interface [ 503.739921][T22075] netdevsim netdevsim1 netdevsim0 (unregistering): left promiscuous mode [ 503.742465][T22124] netlink: 'syz.2.4630': attribute type 21 has an invalid length. [ 503.770135][T22075] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 503.784321][T22124] netlink: 132 bytes leftover after parsing attributes in process `syz.2.4630'. [ 503.901079][T22133] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4633'. [ 503.933554][T16337] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 503.981958][T22138] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4632'. [ 504.020984][T22138] bridge0: port 2(batadv1) entered blocking state [ 504.041945][T22143] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 504.056526][T22138] bridge0: port 2(batadv1) entered disabled state [ 504.063133][T22138] batadv1: entered allmulticast mode [ 504.072955][T22128] netlink: 'syz.0.4631': attribute type 4 has an invalid length. [ 504.088139][T22143] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4634'. [ 504.105250][T22138] batadv1: entered promiscuous mode [ 504.112426][T16337] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.121891][T16337] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.141328][T22143] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 504.168256][ T12] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 504.217270][T22147] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 504.247819][T22147] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 504.316088][T22155] syzkaller0: entered promiscuous mode [ 504.321752][T22155] syzkaller0: entered allmulticast mode [ 504.334419][T22155] netlink: 'syz.1.4637': attribute type 21 has an invalid length. [ 504.366682][T22155] bond2: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 504.379535][T22155] bond2 (unregistering): Released all slaves [ 504.451287][T22161] dvmrp0: entered allmulticast mode [ 504.525790][ T58] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 504.535986][ T58] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 504.553156][T22165] netlink: 'syz.4.4641': attribute type 1 has an invalid length. [ 504.589722][T22165] 8021q: adding VLAN 0 to HW filter on device bond7 [ 504.731050][T22175] openvswitch: netlink: Message has 1 unknown bytes. [ 504.738708][T22175] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 505.008813][T22197] syzkaller0: entered promiscuous mode [ 505.018440][T22197] syzkaller0: entered allmulticast mode [ 505.189677][T22207] bond8: entered promiscuous mode [ 505.194740][T22207] bond8: entered allmulticast mode [ 505.200800][T22207] 8021q: adding VLAN 0 to HW filter on device bond8 [ 505.719344][T22246] bond0: left allmulticast mode [ 505.733272][T22246] bond_slave_0: left allmulticast mode [ 505.755993][T22246] bond_slave_1: left allmulticast mode [ 505.766576][T22246] bond0: left promiscuous mode [ 505.775727][T22246] bond_slave_0: left promiscuous mode [ 505.796877][T22246] bond_slave_1: left promiscuous mode [ 505.823066][T22246] bridge0: port 4(bond0) entered disabled state [ 505.858757][T22246] dummy0: left allmulticast mode [ 505.865602][T22246] bridge0: port 3(dummy0) entered disabled state [ 505.886373][T22246] bridge_slave_0: left allmulticast mode [ 505.893228][T22246] bridge_slave_0: left promiscuous mode [ 505.899575][T22246] bridge0: port 1(bridge_slave_0) entered disabled state [ 505.918949][T22246] bridge_slave_1: left allmulticast mode [ 505.924778][T22246] bridge_slave_1: left promiscuous mode [ 505.931417][T22246] bridge0: port 2(bridge_slave_1) entered disabled state [ 505.959653][T22246] bond0: (slave bond_slave_0): Releasing backup interface [ 505.977710][T22246] bond0: (slave bond_slave_1): Releasing backup interface [ 506.000537][T22246] team0: Port device team_slave_0 removed [ 506.018081][T22246] team0: Port device team_slave_1 removed [ 506.025981][T22246] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 506.033464][T22246] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 506.047225][T22246] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 506.054612][T22246] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 506.079513][T22246] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 506.221733][T22262] syzkaller0: entered promiscuous mode [ 506.237327][T22262] syzkaller0: entered allmulticast mode [ 506.273560][T22270] netlink: 'syz.0.4672': attribute type 83 has an invalid length. [ 506.375293][T22275] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 506.651112][T22298] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 508.069559][T22311] tipc: Enabled bearer , priority 0 [ 508.077437][T22312] syzkaller0: entered promiscuous mode [ 508.082929][T22312] syzkaller0: entered allmulticast mode [ 508.105983][T22322] __nla_validate_parse: 7 callbacks suppressed [ 508.106001][T22322] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4680'. [ 508.128119][T22319] tipc: Resetting bearer [ 508.134388][T22324] bond0: option ad_select: unable to set because the bond device is up [ 508.172246][T22327] bond0: option ad_select: unable to set because the bond device is up [ 508.207608][T16334] bond0: (slave bridge0): link status definitely down, disabling slave [ 508.227136][T22319] tipc: Resetting bearer [ 508.246795][T22319] tipc: Disabling bearer [ 508.367968][T22338] sctp: [Deprecated]: syz.0.4685 (pid 22338) Use of int in max_burst socket option. [ 508.367968][T22338] Use struct sctp_assoc_value instead [ 508.585960][T22352] bridge7: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 508.647157][ T5824] Bluetooth: hci5: command 0x0405 tx timeout [ 508.779606][T22370] netlink: 184 bytes leftover after parsing attributes in process `syz.2.4698'. [ 508.806620][T22374] netlink: 'syz.3.4700': attribute type 1 has an invalid length. [ 508.819575][T22376] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4698'. [ 508.835416][T22370] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4698'. [ 508.863256][T22370] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 508.893559][T22370] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4698'. [ 508.953660][T22376] netlink: 148 bytes leftover after parsing attributes in process `syz.2.4698'. [ 509.024386][T22379] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 509.041171][T22392] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4702'. [ 509.304495][T22414] dummy0: entered promiscuous mode [ 509.313128][T22414] dummy0: entered allmulticast mode [ 509.392655][T22426] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4711'. [ 509.422199][T22426] team0 (unregistering): Port device team_slave_1 removed [ 509.466344][T22430] openvswitch: netlink: Tunnel attr 0 has unexpected len 3 expected 8 [ 512.087722][T22400] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 512.311945][T22451] netlink: 'syz.0.4720': attribute type 1 has an invalid length. [ 512.436323][T22461] netlink: 80 bytes leftover after parsing attributes in process `syz.3.4724'. [ 512.470576][T22466] netlink: 80 bytes leftover after parsing attributes in process `syz.3.4724'. [ 512.472163][T22463] bond0: entered promiscuous mode [ 513.147752][T22476] syzkaller0: entered promiscuous mode [ 513.172151][T22476] syzkaller0: entered allmulticast mode [ 513.265367][T22494] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 513.288458][T22496] netlink: 'syz.3.4733': attribute type 61 has an invalid length. [ 513.309729][T22494] netlink: 'syz.1.4730': attribute type 1 has an invalid length. [ 513.309898][T22499] __nla_validate_parse: 2 callbacks suppressed [ 513.309912][T22499] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4732'. [ 513.319903][T22496] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4733'. [ 513.347249][T22494] netlink: 'syz.1.4730': attribute type 3 has an invalid length. [ 513.380842][T22494] netlink: 172 bytes leftover after parsing attributes in process `syz.1.4730'. [ 513.401376][T22494] NCSI netlink: No device for ifindex 813332851 [ 513.668525][T22516] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4741'. [ 513.732003][T22522] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.4743'. [ 513.765854][ T5824] Bluetooth: hci0: command 0x0c20 tx timeout [ 513.811083][T22524] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 513.851630][T22520] netlink: 208240 bytes leftover after parsing attributes in process `syz.1.4742'. [ 513.863471][T22520] xt_hashlimit: size too large, truncated to 1048576 [ 513.875835][T22524] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 513.935943][T22528] : renamed from vxcan1 (while UP) [ 513.948129][T22524] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 513.993003][T22524] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 514.030396][T22524] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 514.075839][T22524] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 514.091804][T22524] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 514.107941][T22524] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 514.123332][T22524] batman_adv: batadv0: Local translation table size (96) exceeds maximum packet size (-320); Ignoring new local tt entry: 26:8c:b8:9e:14:f0 [ 514.649537][T22571] x_tables: duplicate underflow at hook 2 [ 514.668080][T22570] netlink: 'syz.3.4758': attribute type 1 has an invalid length. [ 514.677846][T22572] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4757'. [ 514.688428][T22572] netlink: 'syz.1.4757': attribute type 3 has an invalid length. [ 514.728833][T22573] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4758'. [ 514.782407][T22570] 8021q: adding VLAN 0 to HW filter on device bond4 [ 514.856150][T22579] veth5: entered promiscuous mode [ 514.865444][T22579] bond4: (slave veth5): Enslaving as an active interface with a down link [ 514.889980][T22581] bond9: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 514.907981][T22581] bond9: (slave lo): Enslaving as an active interface with an up link [ 514.919285][T22583] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4756'. [ 514.939975][T22578] syzkaller0: entered promiscuous mode [ 514.949154][T22578] syzkaller0: entered allmulticast mode [ 515.293385][T22594] netlink: 'syz.0.4765': attribute type 1 has an invalid length. [ 515.349291][T22606] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4765'. [ 515.408350][T22594] netlink: 'syz.0.4765': attribute type 3 has an invalid length. [ 515.423889][T22594] netlink: 'syz.0.4765': attribute type 1 has an invalid length. [ 515.489612][T22606] tipc: New replicast peer: 255.255.255.255 [ 515.534853][T22606] tipc: Enabled bearer , priority 10 [ 515.628916][T22627] netlink: 'syz.2.4776': attribute type 4 has an invalid length. [ 516.083690][T22636] pimreg: entered allmulticast mode [ 516.102497][T22639] tipc: Enabling of bearer rejected, failed to enable media [ 516.357037][T22667] IPv6: NLM_F_CREATE should be specified when creating new route [ 516.375588][T22667] netlink: 'syz.1.4785': attribute type 1 has an invalid length. [ 516.525971][ T5878] tipc: Node number set to 159288593 [ 516.621428][T22691] netlink: 'syz.0.4792': attribute type 1 has an invalid length. [ 516.713993][T22691] bridge0: Device is already in use. [ 516.730197][T22691] bond8: (slave vcan1): The slave device specified does not support setting the MAC address [ 516.742667][T22691] bond8: (slave vcan1): Setting fail_over_mac to active for active-backup mode [ 516.770266][T22691] bond8: (slave vcan1): making interface the new active one [ 516.826251][T22691] bond8: (slave vcan1): Enslaving as an active interface with an up link [ 517.139495][T22709] syzkaller0: entered promiscuous mode [ 517.148605][T22709] syzkaller0: entered allmulticast mode [ 518.886201][T22766] netlink: 'syz.0.4810': attribute type 10 has an invalid length. [ 518.944795][T22770] __nla_validate_parse: 1 callbacks suppressed [ 518.944816][T22770] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4812'. [ 519.069013][T22776] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4815'. [ 519.137626][T22778] netlink: 14 bytes leftover after parsing attributes in process `syz.2.4816'. [ 519.227635][T22791] netlink: 'syz.0.4818': attribute type 4 has an invalid length. [ 519.260385][T22792] tc_dump_action: action bad kind [ 519.413917][T22799] syzkaller0: entered promiscuous mode [ 519.423617][T22799] syzkaller0: entered allmulticast mode [ 519.472831][T22798] net_ratelimit: 247 callbacks suppressed [ 519.472849][T22798] 0: reclassify loop, rule prio 0, protocol 800 [ 519.486523][T22799] 8021q: VLANs not supported on ip_vti0 [ 519.492277][T22799] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4821'. [ 519.507341][T22798] 8021q: VLANs not supported on ip_vti0 [ 519.584422][T22812] netlink: 48 bytes leftover after parsing attributes in process `syz.2.4826'. [ 519.969466][T22848] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4835'. [ 519.978609][T22848] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4835'. [ 520.048543][T22849] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4837'. [ 520.071279][T22849] netlink: 80 bytes leftover after parsing attributes in process `syz.1.4837'. [ 520.082460][T22849] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4837'. [ 520.188580][T19574] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 520.204753][T19574] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 520.314436][T22864] netlink: 'syz.3.4840': attribute type 11 has an invalid length. [ 520.341011][T22866] 8021q: VLANs not supported on gre0 [ 520.354749][T22868] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 520.358201][T22864] veth1_macvtap: left promiscuous mode [ 520.793618][T22903] IPVS: ip_vs_edit_dest(): server weight less than zero [ 520.833322][T22898] validate_nla: 1 callbacks suppressed [ 520.833340][T22898] netlink: 'syz.1.4853': attribute type 10 has an invalid length. [ 520.886212][T22898] syz_tun: entered promiscuous mode [ 521.044029][T22914] netlink: 'syz.1.4857': attribute type 1 has an invalid length. [ 521.067646][T22918] IPv6: NLM_F_CREATE should be specified when creating new route [ 521.393111][ T30] audit: type=1107 audit(1773840254.390:9): pid=22933 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg=']Kx/O yRjeJ* [ 521.393111][ T30] |E]OQ$i& kKMcmIMB.$,*ɍCXc-yFHP@qc5`;- o, priority 24 [ 524.353016][T23110] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 524.629426][T23135] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4915'. [ 524.803578][T23144] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4919'. [ 525.272650][T23165] wireguard0: entered promiscuous mode [ 525.278845][T23165] wireguard0: entered allmulticast mode [ 525.293355][T23165] team0: Port device wireguard0 added [ 525.316102][T23172] syzkaller1: entered promiscuous mode [ 525.321605][T23172] syzkaller1: entered allmulticast mode [ 525.442321][T23183] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4930'. [ 525.482272][T23184] netlink: 36 bytes leftover after parsing attributes in process `syz.3.4928'. [ 525.653111][T23195] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4933'. [ 525.653111][T23194] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4933'. [ 525.653175][T23194] batadv1: left allmulticast mode [ 525.712086][T23194] batadv1: left promiscuous mode [ 525.718974][T23194] bridge0: port 5(batadv1) entered disabled state [ 525.808123][T23204] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4936'. [ 525.977763][T23212] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4939'. [ 526.057499][T23220] syzkaller0: entered promiscuous mode [ 526.064057][T23220] syzkaller0: entered allmulticast mode [ 526.076212][T23220] netlink: 248 bytes leftover after parsing attributes in process `syz.4.4941'. [ 526.799348][T23257] netlink: 'syz.1.4953': attribute type 1 has an invalid length. [ 526.816498][T23255] netlink: 'syz.0.4952': attribute type 64 has an invalid length. [ 526.861277][T23257] bond2: entered promiscuous mode [ 526.866902][T23257] bond2: entered allmulticast mode [ 526.872727][T23257] 8021q: adding VLAN 0 to HW filter on device bond2 [ 526.914674][T23257] macvlan3: entered promiscuous mode [ 526.920893][T23257] macvlan3: entered allmulticast mode [ 526.931841][T23257] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 527.383865][T23287] bridge8: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 527.660878][T23313] sctp: [Deprecated]: syz.1.4968 (pid 23313) Use of struct sctp_assoc_value in delayed_ack socket option. [ 527.660878][T23313] Use struct sctp_sack_info instead [ 527.689014][T23316] sctp: [Deprecated]: syz.1.4968 (pid 23316) Use of struct sctp_assoc_value in delayed_ack socket option. [ 527.689014][T23316] Use struct sctp_sack_info instead [ 527.707983][T23313] sctp: [Deprecated]: syz.1.4968 (pid 23313) Use of struct sctp_assoc_value in delayed_ack socket option. [ 527.707983][T23313] Use struct sctp_sack_info instead [ 528.014184][T23340] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 528.026727][T23340] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 528.032820][T23340] syzkaller1: Refused to change device type [ 528.867420][T23371] bridge_slave_0: invalid flags given to default FDB implementation [ 529.106506][T23409] openvswitch: netlink: Multiple metadata blocks provided [ 529.129281][T23400] nbd: couldn't find device at index 1 [ 529.227076][T23413] __nla_validate_parse: 6 callbacks suppressed [ 529.227092][T23413] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4996'. [ 529.251589][T23413] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4996'. [ 529.372242][T23419] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4998'. [ 529.597395][T23444] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5004'. [ 529.671475][T23446] netlink: 'syz.0.5005': attribute type 142 has an invalid length. [ 529.749586][T23453] netlink: 'syz.4.5008': attribute type 3 has an invalid length. [ 529.766461][T23453] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5008'. [ 529.789835][T23457] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5009'. [ 529.809781][T23455] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 529.900701][T23465] netlink: 52 bytes leftover after parsing attributes in process `syz.3.5012'. [ 530.006859][T23469] bond9 (unregistering): Released all slaves [ 530.044267][T23471] bond9 (unregistering): Released all slaves [ 530.064576][T23473] netlink: 'syz.3.5015': attribute type 1 has an invalid length. [ 530.106416][T23473] bond5: entered promiscuous mode [ 530.112017][T23473] 8021q: adding VLAN 0 to HW filter on device bond5 [ 530.117668][T23476] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5015'. [ 530.169811][T23473] bond5: (slave bridge7): making interface the new active one [ 530.196010][T23473] bridge7: entered promiscuous mode [ 530.206224][T23473] bridge7: left promiscuous mode [ 530.374056][T23489] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5019'. [ 530.444439][T23494] netlink: 'syz.0.5021': attribute type 32 has an invalid length. [ 530.814917][T23527] netlink: 144 bytes leftover after parsing attributes in process `syz.4.5027'. [ 530.878314][T23529] syzkaller0: entered allmulticast mode [ 531.118909][T23545] openvswitch: netlink: IPv6 tunnel dst address is zero [ 531.172112][T23550] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 531.194301][T23551] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 531.241589][T23549] netlink: 'syz.0.5035': attribute type 7 has an invalid length. [ 531.250403][T23549] netlink: 'syz.0.5035': attribute type 7 has an invalid length. [ 531.543873][T23567] syzkaller0: entered promiscuous mode [ 531.563411][T23567] syzkaller0: entered allmulticast mode [ 531.727955][T23583] RDS: rds_bind could not find a transport for ::ffff:172.30.0.2, load rds_tcp or rds_rdma? [ 531.828745][T23576] bridge: RTM_NEWNEIGH bridge0 without NUD_PERMANENT [ 531.870306][T23592] netlink: 'syz.4.5045': attribute type 10 has an invalid length. [ 531.945632][T23592] bridge_slave_1: left allmulticast mode [ 531.952170][T23595] xt_hashlimit: size too large, truncated to 1048576 [ 531.958739][T23592] bridge_slave_1: left promiscuous mode [ 531.964604][T23592] bridge0: port 2(bridge_slave_1) entered disabled state [ 532.040892][T23601] netlink: Unknown conntrack attr (0) [ 532.048131][T23606] netlink: Unknown conntrack attr (0) [ 532.056058][T23592] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 532.071334][T23581] bond0: option ad_select: unable to set because the bond device is up [ 532.329544][T23619] syzkaller0: entered promiscuous mode [ 532.337133][T23619] syzkaller0: entered allmulticast mode [ 532.338373][T23621] netlink: 'syz.3.5053': attribute type 1 has an invalid length. [ 532.399362][T23621] bond6: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 532.411611][T23621] bond6: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 532.424501][T23621] bond6: (slave ip6gre1): making interface the new active one [ 532.433539][T23621] bond6: (slave ip6gre1): Enslaving as an active interface with an up link [ 532.511505][T23585] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 532.584735][T23635] netlink: 'syz.3.5056': attribute type 6 has an invalid length. [ 532.673643][T23640] netlink: 'syz.0.5057': attribute type 21 has an invalid length. [ 532.911774][T23655] netlink: 'syz.3.5061': attribute type 8 has an invalid length. [ 532.941699][T23655] bond0: entered promiscuous mode [ 532.951423][T23655] bond_slave_0: entered promiscuous mode [ 532.958825][T23655] bond_slave_1: entered promiscuous mode [ 532.977812][T23655] bridge0: entered promiscuous mode [ 533.008611][T23655] bridge_slave_1: entered promiscuous mode [ 533.035776][T23655] gretap0: entered promiscuous mode [ 533.055702][T23655] bond0: left promiscuous mode [ 533.060619][T23655] bond_slave_0: left promiscuous mode [ 533.069982][T23655] bond_slave_1: left promiscuous mode [ 533.082568][T23655] bridge0: left promiscuous mode [ 533.090031][T23655] bridge_slave_1: left promiscuous mode [ 533.097909][T23655] gretap0: left promiscuous mode [ 533.472716][T23694] 8021q: VLANs not supported on ip_vti0 [ 533.745972][T23711] netlink: 'syz.2.5078': attribute type 10 has an invalid length. [ 533.880289][T23715] bond7: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 533.898120][T23715] bond7: (slave lo): Enslaving as an active interface with an up link [ 533.915510][T23715] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 533.949401][T23727] tipc: Enabling of bearer rejected, already enabled [ 534.009676][T23732] syzkaller1: entered promiscuous mode [ 534.017268][T23732] syzkaller1: entered allmulticast mode [ 534.101444][T23737] openvswitch: netlink: Missing key (keys=40, expected=100) [ 534.109485][T23734] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 534.247257][ T5834] Bluetooth: hci1: command 0x041b tx timeout [ 534.368382][T23743] netlink: 'syz.1.5087': attribute type 10 has an invalid length. [ 534.391948][T23743] bridge0: port 2(bridge_slave_1) entered disabled state [ 534.400258][T23743] bridge_slave_1: left allmulticast mode [ 534.414235][T23743] bridge_slave_1: left promiscuous mode [ 534.421605][T23743] bridge0: port 2(bridge_slave_1) entered disabled state [ 534.434774][T23743] bridge_slave_1: entered promiscuous mode [ 534.443424][T23743] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 534.503579][T23760] syzkaller1: entered promiscuous mode [ 534.509965][T23760] syzkaller1: entered allmulticast mode [ 534.600885][T23764] vlan3: entered promiscuous mode [ 534.607062][T23764] bridge0: entered promiscuous mode [ 534.710798][T23774] __nla_validate_parse: 12 callbacks suppressed [ 534.710817][T23774] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5097'. [ 534.834866][T23781] 8021q: VLANs not supported on caif0 [ 534.860011][T23781] netlink: 'syz.4.5101': attribute type 3 has an invalid length. [ 534.872713][T23785] 8021q: VLANs not supported on caif0 [ 534.906598][T23787] openvswitch: netlink: Multiple metadata blocks provided [ 534.934209][T23790] netlink: 'syz.3.5102': attribute type 25 has an invalid length. [ 534.942851][T23782] veth9: entered allmulticast mode [ 535.059612][T23800] bond3: Removing last arp target with arp_interval on [ 535.218125][T23803] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.236558][T23803] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 39283 - 0 [ 535.249454][T16337] nci: nci_ntf_packet: unsupported ntf opcode 0xf00 [ 535.367329][T23829] delete_channel: no stack [ 535.452521][T23803] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.454301][T23832] netlink: 'syz.4.5111': attribute type 1 has an invalid length. [ 535.470996][T23803] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 39283 - 0 [ 535.499688][T23829] gretap0: entered promiscuous mode [ 535.507107][T23829] vlan4: entered promiscuous mode [ 535.564825][T23803] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.576279][T23803] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 39283 - 0 [ 535.593267][T23839] netlink: 128 bytes leftover after parsing attributes in process `syz.0.5113'. [ 535.613460][T23839] netlink: 3 bytes leftover after parsing attributes in process `syz.0.5113'. [ 535.626701][T23839] netlink: 128 bytes leftover after parsing attributes in process `syz.0.5113'. [ 535.645983][T23839] netlink: 3 bytes leftover after parsing attributes in process `syz.0.5113'. [ 535.666978][T23803] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 535.679268][T23803] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 39283 - 0 [ 535.803460][ T49] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 39283 - 0 [ 535.814678][ T49] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 535.843709][T23846] bond10: Removing last ns target with arp_interval on [ 535.864509][ T49] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 39283 - 0 [ 535.873293][ T49] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 535.893155][ T49] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 39283 - 0 [ 535.901751][ T49] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 535.922039][ T49] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 39283 - 0 [ 535.938557][ T49] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 535.947420][T23806] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 536.061671][T23853] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5119'. [ 536.113919][T23858] netlink: 190972 bytes leftover after parsing attributes in process `syz.3.5119'. [ 536.185894][T23865] netlink: 112 bytes leftover after parsing attributes in process `syz.2.5120'. [ 536.327285][T23864] workqueue: Failed to create a rescuer kthread for wq "bond9": -EINTR [ 536.472427][T23893] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.5126'. [ 536.530181][T23891] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5129'. [ 537.041790][T23930] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 537.199356][T23956] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 537.285268][ C0] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 537.451849][T23978] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 538.206386][T24042] vlan3: entered allmulticast mode [ 539.370351][ T5834] Bluetooth: hci4: command 0x0406 tx timeout [ 540.480328][T23984] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 540.784448][T24072] validate_nla: 8 callbacks suppressed [ 540.784466][T24072] netlink: 'syz.0.5173': attribute type 83 has an invalid length. [ 541.091063][T24095] netlink: 'syz.2.5182': attribute type 1 has an invalid length. [ 541.100717][T24096] __nla_validate_parse: 71 callbacks suppressed [ 541.100733][T24096] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5181'. [ 541.107439][T24095] netlink: 96 bytes leftover after parsing attributes in process `syz.2.5182'. [ 541.107459][T24095] netlink: 1 bytes leftover after parsing attributes in process `syz.2.5182'. [ 541.107474][T24095] netlink: 658 bytes leftover after parsing attributes in process `syz.2.5182'. [ 542.000723][T24164] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5200'. [ 542.034821][T24159] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5197'. [ 542.519007][T24194] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 542.540559][T24194] gretap2: entered promiscuous mode [ 542.567965][T24194] gretap2: entered allmulticast mode [ 542.842188][T24220] bond7: (slave lo): Releasing backup interface [ 542.860155][T24220] bond7: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 542.891699][T24220] bond0: (slave bridge0): Releasing backup interface [ 542.913289][T24220] batman_adv: batadv0: Interface deactivated: dummy0 [ 542.925306][T24220] batman_adv: batadv0: Removing interface: dummy0 [ 542.934515][T24220] bridge_slave_0: left allmulticast mode [ 542.941002][T24220] bridge_slave_0: left promiscuous mode [ 542.947631][T24220] bridge0: port 1(bridge_slave_0) entered disabled state [ 542.959271][T24220] bond0: (slave bridge_slave_1): Releasing backup interface [ 542.973731][T24220] bond0: (slave bond_slave_0): Releasing backup interface [ 542.987718][T24220] bond0: (slave bond_slave_1): Releasing backup interface [ 543.007715][T24220] team0: Port device team_slave_0 removed [ 543.029187][T24220] team0: Port device team_slave_1 removed [ 543.035924][T24220] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 543.043316][T24220] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 543.056767][T24220] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 543.064511][T24220] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 543.074083][T24220] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 543.137113][T24221] wireguard0: entered promiscuous mode [ 543.142609][T24221] wireguard0: entered allmulticast mode [ 543.173721][T24221] team0: Device wireguard0 is of different type [ 543.243954][T24239] netlink: 7060 bytes leftover after parsing attributes in process `syz.3.5221'. [ 543.276535][T24243] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5220'. [ 543.684676][T24270] syzkaller0: entered promiscuous mode [ 543.691329][T24270] syzkaller0: entered allmulticast mode [ 543.846978][T24277] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5230'. [ 543.856448][T24277] netlink: 60 bytes leftover after parsing attributes in process `syz.4.5230'. [ 544.022902][T24291] syzkaller1: entered promiscuous mode [ 544.029730][T24291] syzkaller1: entered allmulticast mode [ 544.159556][T24293] syzkaller0: entered promiscuous mode [ 544.168514][T24293] syzkaller0: entered allmulticast mode [ 545.624696][T24303] netlink: 'syz.4.5237': attribute type 2 has an invalid length. [ 545.798388][T24312] netlink: 'syz.4.5241': attribute type 30 has an invalid length. [ 545.868047][T24319] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 546.222654][T24235] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 546.368032][T24326] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 546.620741][T24346] sock: sock_set_timeout: `syz.4.5251' (pid 24346) tries to set negative timeout [ 546.702101][T24358] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 546.719294][T24358] syzkaller1: linktype set to 823 [ 546.744989][T24358] __nla_validate_parse: 5 callbacks suppressed [ 546.757132][T24358] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5254'. [ 546.848496][T24379] netlink: 284 bytes leftover after parsing attributes in process `syz.2.5257'. [ 546.875927][T24379] netlink: 'syz.2.5257': attribute type 1 has an invalid length. [ 546.919009][T24382] netlink: 100 bytes leftover after parsing attributes in process `syz.0.5262'. [ 546.972562][T24386] openvswitch: netlink: IP tunnel dst address not specified [ 546.982542][T24386] openvswitch: netlink: IP tunnel dst address not specified [ 547.021045][T24391] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 547.042383][T24393] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5263'. [ 547.058408][T24393] bridge: RTM_NEWNEIGH with invalid ether address [ 547.073071][T24391] netlink: 68 bytes leftover after parsing attributes in process `syz.2.5264'. [ 547.093067][T24393] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5263'. [ 547.102904][T24393] bridge: RTM_NEWNEIGH with invalid ether address [ 547.232968][T24406] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5270'. [ 547.238082][T24399] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5266'. [ 547.515447][T24423] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5274'. [ 547.609565][ T5824] block nbd6: Receive control failed (result -107) [ 547.675892][T24426] nbd6: detected capacity change from 0 to 127 [ 547.683177][T23429] block nbd6: Dead connection, failed to find a fallback [ 547.692686][T23429] block nbd6: shutting down sockets [ 547.699430][T23429] blk_print_req_error: 138 callbacks suppressed [ 547.699444][T23429] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 547.719749][T23429] buffer_io_error: 138 callbacks suppressed [ 547.719762][T23429] Buffer I/O error on dev nbd6, logical block 0, async page read [ 547.734504][T23429] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 547.746102][T23429] Buffer I/O error on dev nbd6, logical block 1, async page read [ 547.753894][T23429] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 547.764484][T23429] Buffer I/O error on dev nbd6, logical block 2, async page read [ 547.774267][T23429] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 547.797444][T23429] Buffer I/O error on dev nbd6, logical block 3, async page read [ 547.809554][T23429] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 547.826838][T23429] Buffer I/O error on dev nbd6, logical block 0, async page read [ 547.834752][T23429] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 547.867688][T23429] Buffer I/O error on dev nbd6, logical block 1, async page read [ 547.878232][T23429] I/O error, dev nbd6, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 547.889204][T23429] Buffer I/O error on dev nbd6, logical block 2, async page read [ 547.899030][T23429] I/O error, dev nbd6, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 547.907888][T24441] netlink: 'syz.4.5280': attribute type 1 has an invalid length. [ 547.909682][T23429] Buffer I/O error on dev nbd6, logical block 3, async page read [ 547.924874][T23429] I/O error, dev nbd6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 547.928170][T24441] netlink: 228 bytes leftover after parsing attributes in process `syz.4.5280'. [ 547.936796][T23429] Buffer I/O error on dev nbd6, logical block 0, async page read [ 547.963056][T23429] I/O error, dev nbd6, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 547.976684][T23429] Buffer I/O error on dev nbd6, logical block 1, async page read [ 547.985908][T23429] ldm_validate_partition_table(): Disk read failed. [ 547.992921][T23429] Dev nbd6: unable to read RDB block 0 [ 548.000995][T23429] nbd6: unable to read partition table [ 548.020004][T23429] ldm_validate_partition_table(): Disk read failed. [ 548.027834][T23429] Dev nbd6: unable to read RDB block 0 [ 548.054480][T23429] nbd6: unable to read partition table [ 548.159424][T24453] netlink: 'syz.2.5284': attribute type 11 has an invalid length. [ 548.213499][T24457] netlink: 'syz.0.5286': attribute type 83 has an invalid length. [ 548.379474][T24465] [ 548.381845][T24465] ====================================================== [ 548.388859][T24465] WARNING: possible circular locking dependency detected [ 548.395984][T24465] syzkaller #0 Not tainted [ 548.400382][T24465] ------------------------------------------------------ [ 548.407383][T24465] syz.2.5287/24465 is trying to acquire lock: [ 548.413430][T24465] ffff888035ce6698 (set->srcu){.+.+}-{0:0}, at: __synchronize_srcu+0xb6/0x3e0 [ 548.422321][T24465] [ 548.422321][T24465] but task is already holding lock: [ 548.429664][T24465] ffff88802ab63ed0 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1b3/0x450 [ 548.439121][T24465] [ 548.439121][T24465] which lock already depends on the new lock. [ 548.439121][T24465] [ 548.449509][T24465] [ 548.449509][T24465] the existing dependency chain (in reverse order) is: [ 548.458503][T24465] [ 548.458503][T24465] -> #6 (&q->elevator_lock){+.+.}-{4:4}: [ 548.466385][T24465] __mutex_lock+0x19f/0x1300 [ 548.471490][T24465] elevator_change+0x1b3/0x450 [ 548.476767][T24465] elevator_set_none+0xb5/0x140 [ 548.482134][T24465] blk_mq_update_nr_hw_queues+0x5e7/0x1a60 [ 548.488511][T24465] nbd_start_device+0x17f/0xb10 [ 548.493941][T24465] nbd_genl_connect+0x165b/0x1cf0 [ 548.499490][T24465] genl_family_rcv_msg_doit+0x22a/0x330 [ 548.505614][T24465] genl_rcv_msg+0x61c/0x7a0 [ 548.510626][T24465] netlink_rcv_skb+0x232/0x4b0 [ 548.515945][T24465] genl_rcv+0x28/0x40 [ 548.520431][T24465] netlink_unicast+0x80f/0x9b0 [ 548.525707][T24465] netlink_sendmsg+0x813/0xb40 [ 548.530979][T24465] ____sys_sendmsg+0x972/0x9f0 [ 548.536247][T24465] ___sys_sendmsg+0x2a5/0x360 [ 548.541427][T24465] __x64_sys_sendmsg+0x1bd/0x2a0 [ 548.546870][T24465] do_syscall_64+0x14d/0xf80 [ 548.551967][T24465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.558368][T24465] [ 548.558368][T24465] -> #5 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 548.566968][T24465] blk_alloc_queue+0x546/0x680 [ 548.572316][T24465] __blk_mq_alloc_disk+0x197/0x390 [ 548.577933][T24465] nbd_dev_add+0x499/0xb50 [ 548.582861][T24465] nbd_init+0x168/0x1f0 [ 548.587632][T24465] do_one_initcall+0x250/0x8d0 [ 548.592913][T24465] do_initcall_level+0x104/0x190 [ 548.598388][T24465] do_initcalls+0x59/0xa0 [ 548.603232][T24465] kernel_init_freeable+0x2a6/0x3e0 [ 548.608950][T24465] kernel_init+0x1d/0x1d0 [ 548.613852][T24465] ret_from_fork+0x51e/0xb90 [ 548.618967][T24465] ret_from_fork_asm+0x1a/0x30 [ 548.624247][T24465] [ 548.624247][T24465] -> #4 (fs_reclaim){+.+.}-{0:0}: [ 548.631444][T24465] fs_reclaim_acquire+0x71/0x100 [ 548.636896][T24465] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 548.643209][T24465] __alloc_skb+0x1d0/0x7d0 [ 548.648195][T24465] tcp_stream_alloc_skb+0x3f/0x580 [ 548.653888][T24465] tcp_sendmsg_locked+0x1375/0x5490 [ 548.659596][T24465] tcp_sendmsg+0x2f/0x50 [ 548.664347][T24465] sock_write_iter+0x406/0x4f0 [ 548.669620][T24465] vfs_write+0x61d/0xb90 [ 548.674372][T24465] ksys_write+0x150/0x270 [ 548.679211][T24465] do_syscall_64+0x14d/0xf80 [ 548.684313][T24465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.690714][T24465] [ 548.690714][T24465] -> #3 (sk_lock-AF_INET){+.+.}-{0:0}: [ 548.698350][T24465] lock_sock_nested+0x48/0x100 [ 548.703631][T24465] inet_shutdown+0x6a/0x390 [ 548.708731][T24465] nbd_mark_nsock_dead+0x2e9/0x560 [ 548.714346][T24465] recv_work+0x1c7f/0x1d90 [ 548.719302][T24465] process_scheduled_works+0xb02/0x1830 [ 548.725375][T24465] worker_thread+0xa50/0xfc0 [ 548.730485][T24465] kthread+0x388/0x470 [ 548.735076][T24465] ret_from_fork+0x51e/0xb90 [ 548.740185][T24465] ret_from_fork_asm+0x1a/0x30 [ 548.745463][T24465] [ 548.745463][T24465] -> #2 (&nsock->tx_lock){+.+.}-{4:4}: [ 548.753110][T24465] __mutex_lock+0x19f/0x1300 [ 548.758207][T24465] nbd_queue_rq+0x37b/0x1100 [ 548.763309][T24465] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 548.769358][T24465] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 548.776264][T24465] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 548.782752][T24465] blk_mq_run_hw_queue+0x348/0x4f0 [ 548.788423][T24465] blk_mq_dispatch_list+0xd16/0xe10 [ 548.794129][T24465] blk_mq_flush_plug_list+0x48d/0x570 [ 548.800015][T24465] __blk_flush_plug+0x3ed/0x4d0 [ 548.805375][T24465] __submit_bio+0x28d/0x580 [ 548.810394][T24465] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 548.816528][T24465] block_read_full_folio+0x599/0x830 [ 548.822342][T24465] filemap_read_folio+0x137/0x3b0 [ 548.827879][T24465] do_read_cache_folio+0x358/0x590 [ 548.833496][T24465] read_part_sector+0xb6/0x2b0 [ 548.838817][T24465] adfspart_check_ICS+0xa5/0xa40 [ 548.844260][T24465] bdev_disk_changed+0x7ba/0x1550 [ 548.849786][T24465] blkdev_get_whole+0x380/0x510 [ 548.855185][T24465] bdev_open+0x31e/0xd30 [ 548.859939][T24465] blkdev_open+0x470/0x610 [ 548.864861][T24465] do_dentry_open+0x785/0x14e0 [ 548.870135][T24465] vfs_open+0x3b/0x340 [ 548.874716][T24465] path_openat+0x2e08/0x3860 [ 548.879826][T24465] do_file_open+0x23e/0x4a0 [ 548.884834][T24465] do_sys_openat2+0x113/0x200 [ 548.890027][T24465] __x64_sys_openat+0x138/0x170 [ 548.895394][T24465] do_syscall_64+0x14d/0xf80 [ 548.900501][T24465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 548.906904][T24465] [ 548.906904][T24465] -> #1 (&cmd->lock){+.+.}-{4:4}: [ 548.914103][T24465] __mutex_lock+0x19f/0x1300 [ 548.919206][T24465] nbd_queue_rq+0xc6/0x1100 [ 548.924222][T24465] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 548.930271][T24465] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 548.937108][T24465] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 548.943596][T24465] blk_mq_run_hw_queue+0x348/0x4f0 [ 548.949218][T24465] blk_mq_dispatch_list+0xd16/0xe10 [ 548.954921][T24465] blk_mq_flush_plug_list+0x48d/0x570 [ 548.960798][T24465] __blk_flush_plug+0x3ed/0x4d0 [ 548.966155][T24465] __submit_bio+0x28d/0x580 [ 548.971165][T24465] submit_bio_noacct_nocheck+0x2f4/0xa70 [ 548.977298][T24465] block_read_full_folio+0x599/0x830 [ 548.983090][T24465] filemap_read_folio+0x137/0x3b0 [ 548.988623][T24465] do_read_cache_folio+0x358/0x590 [ 548.994244][T24465] read_part_sector+0xb6/0x2b0 [ 548.999513][T24465] adfspart_check_ICS+0xa5/0xa40 [ 549.004959][T24465] bdev_disk_changed+0x7ba/0x1550 [ 549.010484][T24465] blkdev_get_whole+0x380/0x510 [ 549.015843][T24465] bdev_open+0x31e/0xd30 [ 549.020589][T24465] blkdev_open+0x470/0x610 [ 549.025514][T24465] do_dentry_open+0x785/0x14e0 [ 549.030807][T24465] vfs_open+0x3b/0x340 [ 549.035387][T24465] path_openat+0x2e08/0x3860 [ 549.040491][T24465] do_file_open+0x23e/0x4a0 [ 549.045500][T24465] do_sys_openat2+0x113/0x200 [ 549.050697][T24465] __x64_sys_openat+0x138/0x170 [ 549.056055][T24465] do_syscall_64+0x14d/0xf80 [ 549.061157][T24465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.067565][T24465] [ 549.067565][T24465] -> #0 (set->srcu){.+.+}-{0:0}: [ 549.074680][T24465] __lock_acquire+0x15a5/0x2cf0 [ 549.080044][T24465] lock_sync+0x9d/0x120 [ 549.084710][T24465] __synchronize_srcu+0xca/0x3e0 [ 549.090156][T24465] elevator_switch+0x1e8/0x7a0 [ 549.095429][T24465] elevator_change+0x2cc/0x450 [ 549.100707][T24465] elevator_set_default+0x36c/0x430 [ 549.106412][T24465] blk_register_queue+0x366/0x430 [ 549.111943][T24465] __add_disk+0x677/0xd50 [ 549.116779][T24465] add_disk_fwnode+0xfb/0x480 [ 549.121962][T24465] nbd_dev_add+0x72c/0xb50 [ 549.126890][T24465] nbd_genl_connect+0x962/0x1cf0 [ 549.132344][T24465] genl_family_rcv_msg_doit+0x22a/0x330 [ 549.138399][T24465] genl_rcv_msg+0x61c/0x7a0 [ 549.143417][T24465] netlink_rcv_skb+0x232/0x4b0 [ 549.148708][T24465] genl_rcv+0x28/0x40 [ 549.153200][T24465] netlink_unicast+0x80f/0x9b0 [ 549.158480][T24465] netlink_sendmsg+0x813/0xb40 [ 549.163762][T24465] ____sys_sendmsg+0x972/0x9f0 [ 549.169029][T24465] ___sys_sendmsg+0x2a5/0x360 [ 549.174211][T24465] __x64_sys_sendmsg+0x1bd/0x2a0 [ 549.179659][T24465] do_syscall_64+0x14d/0xf80 [ 549.184759][T24465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.191161][T24465] [ 549.191161][T24465] other info that might help us debug this: [ 549.191161][T24465] [ 549.201373][T24465] Chain exists of: [ 549.201373][T24465] set->srcu --> &q->q_usage_counter(io)#51 --> &q->elevator_lock [ 549.201373][T24465] [ 549.215017][T24465] Possible unsafe locking scenario: [ 549.215017][T24465] [ 549.222492][T24465] CPU0 CPU1 [ 549.227843][T24465] ---- ---- [ 549.233205][T24465] lock(&q->elevator_lock); [ 549.237783][T24465] lock(&q->q_usage_counter(io)#51); [ 549.245667][T24465] lock(&q->elevator_lock); [ 549.252762][T24465] sync(set->srcu); [ 549.256640][T24465] [ 549.256640][T24465] *** DEADLOCK *** [ 549.256640][T24465] [ 549.264763][T24465] 6 locks held by syz.2.5287/24465: [ 549.269938][T24465] #0: ffffffff8fc3ad30 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 549.278117][T24465] #1: ffffffff8fc3ab48 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 549.287072][T24465] #2: ffff888079a659d0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: add_disk_fwnode+0xe7/0x480 [ 549.297428][T24465] #3: ffff88802ab63f60 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_register_queue+0x115/0x430 [ 549.307253][T24465] #4: ffff88802ab639c8 (&q->q_usage_counter(queue)#53){+.+.}-{0:0}, at: elevator_change+0x198/0x450 [ 549.318129][T24465] #5: ffff88802ab63ed0 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1b3/0x450 [ 549.327954][T24465] [ 549.327954][T24465] stack backtrace: [ 549.333826][T24465] CPU: 1 UID: 0 PID: 24465 Comm: syz.2.5287 Not tainted syzkaller #0 PREEMPT(full) [ 549.333845][T24465] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 549.333856][T24465] Call Trace: [ 549.333863][T24465] [ 549.333871][T24465] dump_stack_lvl+0xe8/0x150 [ 549.333913][T24465] print_circular_bug+0x2e1/0x300 [ 549.333942][T24465] check_noncircular+0x12e/0x150 [ 549.333967][T24465] __lock_acquire+0x15a5/0x2cf0 [ 549.333989][T24465] ? check_path+0x21/0x40 [ 549.334013][T24465] ? lockdep_unlock+0x5d/0xd0 [ 549.334040][T24465] ? __lock_acquire+0x146e/0x2cf0 [ 549.334062][T24465] ? __synchronize_srcu+0xb6/0x3e0 [ 549.334081][T24465] lock_sync+0x9d/0x120 [ 549.334116][T24465] ? __synchronize_srcu+0xb6/0x3e0 [ 549.334137][T24465] __synchronize_srcu+0xca/0x3e0 [ 549.334155][T24465] ? do_raw_spin_lock+0x12b/0x2f0 [ 549.334185][T24465] ? __pfx___synchronize_srcu+0x10/0x10 [ 549.334208][T24465] ? read_tsc+0x9/0x20 [ 549.334237][T24465] ? ktime_get_mono_fast_ns+0x2af/0x2d0 [ 549.334286][T24465] ? synchronize_srcu+0x295/0x2c0 [ 549.334306][T24465] elevator_switch+0x1e8/0x7a0 [ 549.334321][T24465] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 549.334340][T24465] elevator_change+0x2cc/0x450 [ 549.334355][T24465] ? do_raw_spin_unlock+0xf5/0x210 [ 549.334372][T24465] elevator_set_default+0x36c/0x430 [ 549.334387][T24465] ? __pfx_elevator_set_default+0x10/0x10 [ 549.334406][T24465] ? disk_register_independent_access_ranges+0x2db/0x380 [ 549.334430][T24465] ? blk_crypto_sysfs_register+0x11c/0x170 [ 549.334537][T24465] blk_register_queue+0x366/0x430 [ 549.334558][T24465] __add_disk+0x677/0xd50 [ 549.334579][T24465] ? down_read+0x272/0x2e0 [ 549.334597][T24465] add_disk_fwnode+0xfb/0x480 [ 549.334619][T24465] nbd_dev_add+0x72c/0xb50 [ 549.334645][T24465] ? __pfx_nbd_dev_add+0x10/0x10 [ 549.334675][T24465] ? bpf_lsm_capable+0x9/0x20 [ 549.334696][T24465] ? security_capable+0x7e/0x2c0 [ 549.334753][T24465] ? radix_tree_lookup+0x25c/0x290 [ 549.334811][T24465] nbd_genl_connect+0x962/0x1cf0 [ 549.334839][T24465] ? __pfx_nbd_genl_connect+0x10/0x10 [ 549.334863][T24465] ? rcu_is_watching+0x15/0xb0 [ 549.334885][T24465] ? trace_kmalloc+0x2a/0x110 [ 549.334903][T24465] ? __nla_parse+0x40/0x60 [ 549.334928][T24465] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 549.334949][T24465] genl_family_rcv_msg_doit+0x22a/0x330 [ 549.334968][T24465] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 549.334989][T24465] ? __lock_acquire+0x6b5/0x2cf0 [ 549.335011][T24465] genl_rcv_msg+0x61c/0x7a0 [ 549.335029][T24465] ? __pfx_genl_rcv_msg+0x10/0x10 [ 549.335047][T24465] ? __pfx_nbd_genl_connect+0x10/0x10 [ 549.335076][T24465] ? __lock_acquire+0x6b5/0x2cf0 [ 549.335111][T24465] netlink_rcv_skb+0x232/0x4b0 [ 549.335137][T24465] ? __pfx_genl_rcv_msg+0x10/0x10 [ 549.335156][T24465] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 549.335189][T24465] ? down_read+0x272/0x2e0 [ 549.335208][T24465] ? genl_rcv+0xd/0x40 [ 549.335226][T24465] genl_rcv+0x28/0x40 [ 549.335243][T24465] netlink_unicast+0x80f/0x9b0 [ 549.335270][T24465] ? __pfx_netlink_unicast+0x10/0x10 [ 549.335294][T24465] ? netlink_sendmsg+0x650/0xb40 [ 549.335319][T24465] ? skb_put+0x11b/0x210 [ 549.335350][T24465] netlink_sendmsg+0x813/0xb40 [ 549.335380][T24465] ? __pfx_netlink_sendmsg+0x10/0x10 [ 549.335408][T24465] ? aa_sock_msg_perm+0xf1/0x1b0 [ 549.335435][T24465] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 549.335459][T24465] ____sys_sendmsg+0x972/0x9f0 [ 549.335483][T24465] ? __pfx_____sys_sendmsg+0x10/0x10 [ 549.335506][T24465] ? import_iovec+0x73/0xa0 [ 549.335545][T24465] ___sys_sendmsg+0x2a5/0x360 [ 549.335566][T24465] ? __pfx____sys_sendmsg+0x10/0x10 [ 549.335585][T24465] ? futex_wake+0x4ac/0x580 [ 549.335623][T24465] ? __fget_files+0x2a/0x420 [ 549.335646][T24465] ? __fget_files+0x3a0/0x420 [ 549.335671][T24465] __x64_sys_sendmsg+0x1bd/0x2a0 [ 549.335688][T24465] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 549.335706][T24465] ? rcu_is_watching+0x15/0xb0 [ 549.335732][T24465] do_syscall_64+0x14d/0xf80 [ 549.335746][T24465] ? trace_irq_disable+0x3b/0x150 [ 549.335770][T24465] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.335786][T24465] ? clear_bhb_loop+0x40/0x90 [ 549.335804][T24465] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 549.335819][T24465] RIP: 0033:0x7f32c239c799 [ 549.335835][T24465] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 549.335850][T24465] RSP: 002b:00007f32c32fc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 549.335867][T24465] RAX: ffffffffffffffda RBX: 00007f32c2615fa0 RCX: 00007f32c239c799 [ 549.335879][T24465] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000008 [ 549.335890][T24465] RBP: 00007f32c2432c99 R08: 0000000000000000 R09: 0000000000000000 [ 549.335900][T24465] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 549.335909][T24465] R13: 00007f32c2616038 R14: 00007f32c2615fa0 R15: 00007ffd90e1dad8 [ 549.335927][T24465] [ 549.878313][T24468] netlink: 'syz.4.5289': attribute type 39 has an invalid length. [ 549.936754][T24470] nbd: nbd64 already in use [ 550.043435][T23429] udevd[23429]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory