last executing test programs: 4.553205793s ago: executing program 1 (id=6542): r0 = socket(0x1, 0x2, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b00)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f670600dcca55f21f3ca9e822d182054d54d53cd20100714e4beb5447000001000000008f2b900029cb25e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b52710aeee835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed00000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5bc6d3fd0500000022eb9e1403e6c8f7a187eaf60f3817f0f046a307a403c19d9829c90bd2114252581567acae715cbe326c2ed0a432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1b172191d359645fae2d074ea5724ab77ea04fe507938b1213cdd4a92860e5980868940b197d983a98611041c58c5382734d24b3123dd40c6d612c8a19948cd257748b1e7324adddbe61d51013f7d6b313c6df7b7b29678d70fc94dcc3e99e2472e78968ed94e7a54988656e8fff6b1d9b9993c71edd5cc10a2bea8d94d751b77fa7c48c712af35a9ffe670e8fa451942f48741119496bc30137e1202aed6bb5cd5c2d0256d049e4a335e2ea5545e5624be2391c37c0a2ae3bbb5b58778b85424bcdb84358359b2cb2782fc0e82f17b12d641ce6a72ab0ac794f878140897703bebe4420115d26675f27598841965fa9108825200"/572], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)=ANY=[@ANYRES32=r2, @ANYRES32=r1, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000140)={r2, &(0x7f0000000180), &(0x7f00000000c0)=@tcp6=r0}, 0x20) bind$unix(r0, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r0, &(0x7f0000001680)=[{{&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000000d40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000500)=""/65, 0x41}], 0x1}}], 0x2, 0x0, 0x0) ppoll(&(0x7f0000000180)=[{r0, 0x64a0}], 0x1, 0x0, 0x0, 0x0) 3.551413792s ago: executing program 1 (id=6560): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$GTP_CMD_NEWPDP(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000000000000080002000000000008000800fcffffff0800020001000000"], 0x2c}}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r3, &(0x7f0000000fc0)={0x0, 0x0, &(0x7f0000000f80)={&(0x7f0000000f00)={0x28, 0x2, 0x3, 0x301, 0x0, 0x0, {0x0, 0x0, 0xa}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x3}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x2, 0x2}}]}, 0x28}, 0x1, 0x0, 0x0, 0x4044090}, 0xc4) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_REGISTER_FRAME(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="04012cbd7000ffdbdf253a00000008000300", @ANYRES32=r4, @ANYBLOB="09000000060065000000000006006500800000000000000000000000000007e7aafb64fa"], 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0xc800) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="580000001000010040000000000086f1d4f97d0693f586fa2becae14b67400000000000053c68bcd41af66565c29df2398d413b05815326a8b39112f8d7c837c14341237e5a5137ebba92acc988b83a3298f82c9e1c65cde63457d5a5b889b15990e94a644c47559ff44c84b2233d6f8d1c188b3b588a208afc51a5c81", @ANYRES32=0x0, @ANYBLOB="8a430100000000001c0016801800018014000b00ffffff7f00000000020000000000000014000300776c616e300000000000000000000000050011009a000000"], 0x58}, 0x1, 0x0, 0x0, 0x4004080}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x80a40, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'veth0_virt_wifi\x00', 0x1}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000400)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8001, 0xfffffff9, 0x57, 0x1bc4, 0x1, 0x5, 0x5, 0x400, 0x36}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4}, 0x0) r10 = socket(0xa, 0x3, 0x3a) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r10, 0x89f2, &(0x7f0000000640)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000016c0)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x3, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x8, 0x6, 0x5, 0x101}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) close(0xffffffffffffffff) r11 = socket(0x400000000010, 0x3, 0x0) r12 = socket$unix(0x1, 0x5, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000340), r11) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r13, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r14 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0x4, 0x1, 0x1, 0x40}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r14}, 0x38) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r14, &(0x7f00000001c0), &(0x7f0000000180)=""/10, 0x2}, 0x20) 3.24413766s ago: executing program 1 (id=6563): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) r0 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f00000000c0), 0x10) sendmsg$can_bcm(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000b80)=ANY=[@ANYBLOB="050000"], 0x48}}, 0x0) sendmsg$can_bcm(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="050000009f6000"/16, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0xea60, @ANYBLOB="0000000001"], 0x48}, 0x1, 0x0, 0x0, 0x20000800}, 0x44801) recvmsg$unix(r1, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r8, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) sendmmsg$inet(r8, &(0x7f0000000100)=[{{&(0x7f0000000000)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x36}}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000680)="fa61", 0x2}], 0x1}}], 0x1, 0x20040804) setsockopt$sock_int(r8, 0x1, 0x12, &(0x7f0000000140)=0xffff0000, 0x4) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[], 0x128}, 0x4000004) recvmsg(r9, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) write$cgroup_pid(r0, &(0x7f00000001c0), 0x12) 2.341761146s ago: executing program 0 (id=6576): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0x450, @mcast2, 0x4}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @random="2b0436d23321"}) (async) write$tun(r1, &(0x7f0000000000)=ANY=[@ANYBLOB="034886dd120005000000140000006000000008008700fe88a43de1a400000000000000007d01ff020000000000000000000000000001", @ANYRES16, @ANYRES64=r2], 0xfdef) (async, rerun: 32) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000040)={'sit0\x00', @broadcast}) (rerun: 32) 2.288048585s ago: executing program 1 (id=6577): mmap(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x9, 0x10, 0xffffffffffffffff, 0x0) r0 = bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000700)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x4040004}, 0x4000891) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r2 = socket$kcm(0x29, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001000)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff5070000000000000300000000000c00095000000000000002ba728041598d6fbd30cb599e83d24bd8137a3aa81e0ed139a85d36bb3019d13bd2321af3c2bd67ce68f15c0ec71d0e6adfefcf1d8f7faf75e0f226bd917060000007142fa9ea4318123751c0a0e168c1886d0d4d35379bd223ec839bc16ee988e6e0dc8cedf3ceb9fbfbf9b0a49ef42d430f6296b72a83438810720a159cda90363db3d221e152dfca64057ff3c4744aeaccd3641110bec4e9027a0c8055bbfc3a96d2e8910c2c39e4babe802f5ab3e89cf6c662ed40000000022278d00031e5388ee5c867ddd58211d6ece3ccb0cd2b6d3cffd962867a3a2f624f992daa94a6a556f3218ce740068725c37074e468ee207d2f73902ebcfcf49822775985bf31b715f5888b24efa190000000000000000000000000000ddffffff020000000000000000ddffffff0000b27cf3d1848a54d7132be1bfb0adf9deab3323aa9fdfb52faf9cb09c3bfd09000000b91ab219ef00bb7b3de8f67ffcad3f6c3c2b1f03550000000000001cf41ab11f12fb1e0a494034007de7c6592df1a6c64d8f20a67745409e011f1264d43f153b3d34889f40159e800ea2474b540500a30b23bcee46762e2093bcc9eae5ee3e980026c96f80ee1a00000000740750fa4d9aaa705989b8e673e3296e52d337c56abf112874ec51d6fe048ba6866adebab53168770a71ad901ace383e41d277b103923a9d961f7a2591dbe4a912ffaf6f658f3f9cd16286744f83a83f138f8f92efd92239eafcc5c1b3f97a297c9e49a0c3300ef7b7fb5f09e0c8a868a353409e34d3e82279637599f35ad3f7ffffff3cac394c7bbdcd0e0eb52162e0c410ade7000026a4e739c60f03cc4146a77af02c1d4cefd4a2b94c0aed8477dfa8ceefb467f05c6977c78cdbf3f704ec73754910fe050038ec9e47de89298b7bf4d769ccc18eedd9068ca1457870eb30d219e23ccc8e06dddeb61799257ab5000013c86ba99523d61a00000000c270246c878d01160e6c07bf6cf8809c3a0d062357ba2515567230a6f8b2ad1e1f4933545fc3c741374211663f6b63b1dd044dd0a2768e825972fc4300001467c89fa0f82e8440105051e5510a33dcda5e4e202bd622549c4cffffff501d3a5dd7143fbf221fff161c12ca389cbe0000000000000fff2ecf631c6c5fd9c26a54d43fa050b88d1d43a8645bd9109b7e07869bba7131421c0f397073943330baafd243c0c6ffe673bab4113be7664e08bdd7115c61afcb718cf3c4680b2f6c7a8400e378a9b15bc20f49e298727340e87cdefb40e56e9cfad9931b8c552b2c7c503f3d0e7ab0e958adb8629aeec90e6d1857da822e40009995ae166deb9856291a43a6f7eb2e32cefbf463789eaf79b8d4c22be89f44b032dad13007b82e6044f643fc8cd07ae636a5dbe9864a117d27326850a7c3b570863f532c218b10af13d7be94987005088a83880ccab9c9920c2d2af8c5e13d52c83ac3fa7c3ae6c08384865b66d2204c2e4f3ae200f279b512b4dcb5dd9cba16b62040bf8702ae12c77e6e34991af603e3856a346cf708feeb708ab22b560cf8a4a6f31ba6d9b8cb0908000000000000001a342c010000000000e667a7592b33406f1f71c739b55db91d2309dc7ae401005f52053a39e7307c09ff3ac3e820b01c57dd74d4aafc4c383a17bc1de5347bb71ca16dcbbbaa2935ae662082b56cf666e63a759e0ef3ea7af6881513be94b362e15ffca8ec453b3a2a67be70c17b0f9c2eac765816c30c2e7133dca1c7669522e8dff8bc570a93fbdb688c3aef810000007a6ea6b11163392a19d87995b51cb6febd5f34a34998d2010fd5facf68c4f84e2f66e27c81a149d7b331983d3b74444953fc1216dfec10b724be3733c26f12538376e177ffef6fd2020000000000000008e4919a463d5332a2546032a3c06b94f168e8fc4bda0c294723fe306f26c477af4b926644672985fab7cc67bc5b5f5d38cdd8df95147ebe1cd88b0a4c6cde9951be10ba7dfddfefb238fac2303cc8982f1e55b005afcfea5eb037248fefad6bb02c162ce92ab17744c8ec3d2e80cf3205d36699fd381bc81231fb5e12e45f3059f361d08d6a6d019ebf105eaf43083c29512bcedd79ca9bf24e063d0c273ed70a2b70be521ea27dc8cf3c9bdf83b93405db07e82e2db484f8673e0e97dd7e8a872148613c3a04f3d67f4375ba5c7f1b00ffffff7f000000000801f71d79d812ced782646b5f79c8fc08bb5c11020108d702edd2ea9c96cf0d2d48aa5fc0a7bf1b51afd85350ad00b78c598fa8701b000884de790b54e5ab2e8ff0c7ae23e0b6eeac95c4c2eef2e5eb1d019d52099fbd404e8ece970f67856ba7e960bd8b1e4105ce7e31f7c9c3e3fa61aaa967b90087e91d703e98535b107b8f4653be4c46a3a1adb07d226952b8573b417018316fa96e2b8e7370baa16d4122c863709b08d4639a19a46ac90ac48a13ee9bcaa875fc700000000000003b40dc5c745fe2491e8425e600000000000000000000000000000000000000000000000000000000000000250318a44ad31baac0520a913301e630ae540f3289aebde8633f6f450c0738e16df6c7f1e0832a2a16fe6e39959735758248032cdf7320c6dc87b01e3f9a7811b200000000ae189de4b9b25f7c7a9c070000002af1c06315270de4a6605e4b4b58bef76fac54f11b84bd7bcd6b6a485edfb7684c770a39b38b08e18a51a4d4e66ca21c06a4b4198e1bc2ef990c9ba911efed626e5ee341a17bf8132b09000000d31df213c802d74797056fd3bca8b2d6cb134437cba0193ba4360bdcc98aad2560aa48291c4eb9d4e08ad7a9c5f04be1ab597124d84dfc7bd8cca8f68154a0ed356e773a797ca6d66748857b4abbf8830abeea2a46342e6a7378173cb29d5cdcd698a0203f78116b710008000000000000007c2d86b94472807c10eb9a8e2fb8bd79fe3a8316deff3ee641c9a080a2173642e673a672279bae4e7e28055da9497d7edb53be6e80482bd4d9a74b8dd4221fff0f0000705d7257ff7f76c78ba0b44ec0bdfa0d32d7042059b13a079639f14f9032b856d892ad6af5124c9c3130485e9682ff1f3c54e475d5bb496aef4bb537d7e191dfdeba109fdcf7864763f87a6d711cf52e520a6ce30e134c55e0caac037209d2f14fcddd00000000000000000000000000000000e609893bdce015e8ccfb36399844db61f6171b0b0e845e48728450c6ba4f7098f8e000676b59ab9f851f3ab77847ce05c89411277ec69c409b7ec50a3337a78675f38a568612c235ab5f2cd6d035d5f5f6a693c381adbbf7b37e37292783b2c7efe7d3a067906552f76d419e0300000000000000000000008f3a20b49fe7636806867283e35cff8d00e7b251bab3cf6377a24f8e8d4bda7503674bc94bf7f4d2fa6f25944bf0a186436d9f6831995976328a1fdc78492c65c1434855dc35c3cf7cf9610c5387794443c99b304799114132362849c3fa85d6379729ff9094933db0cfbe8887c50b87e1469fdf454cef4cbc5f7bf384000000000000a4e8c1a25f47c440144a9776be6cb40aafdb9d3cc8f6a6050974e1c4000000000000008b753f4e1bef9556efcc087a99dbf231167013a4b2eaf6338a0b100c98a331dffc09"], &(0x7f0000000140)='GPL\x00'}, 0x48) r4 = socket$kcm(0x2, 0x1, 0x0) sendmsg$inet(r4, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) sendmsg$inet(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000340)="f1", 0x1}], 0x1}, 0x40) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000040)={r4, r3}) socket$inet6_tcp(0xa, 0x1, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) socket$kcm(0x29, 0x5, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r7, &(0x7f0000000000), 0xffffff6a) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r6) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000cdf9f86c2057f5b9e11b7bc0be93ffdf4b37d924000200000085000000610000d0e6000000e6d1476995023b410b20a9a7139f17a1", @ANYRES64=r0], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, @sched_cls=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r8, 0x0, 0x8, 0xfffffffffffffef4, &(0x7f00000002c0)='\x00\x00\x00\n\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x50) sendfile(r8, 0xffffffffffffffff, 0x0, 0xffffffff002) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="3f713da207af717f0c5093ff374fab062388a190874c355b0eafe13bf7a448a6201a662ed21e005abcb3c5631ca5988d2b1300b0ce34e71b26da95cf1c197aa39b8ba4d92d44738fa0a1d763966ff31f8cfc10bf7ab052f41834", @ANYRES16=r9, @ANYBLOB="7961fdffffff0004000000000000000099006c910000e02425a0af74e42b92d4c3b9adf5bfc424a4484b7b9ce94379d9edc4229361d1c68a489b6c9b349923dd4979a8cd2d50803d4a17fd197be907317cc24664b3fa328d7c5359c8037e1e9dc55703cd4c0e83cd20bc50285d697570b3828de9c44e6886c73ff36721fc1db017c42ac6b892ac1d"], 0x20}, 0x1, 0x0, 0x0, 0x2400c080}, 0x4000054) sendmsg$NL80211_CMD_RELOAD_REGDB(r5, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r9, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0xb, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) socket$kcm(0x29, 0x5, 0x0) select(0x4c, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x77359400}) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000009, 0x200000006c832, 0xffffffffffffffff, 0x0) 2.072173402s ago: executing program 0 (id=6580): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xd, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x47, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r3}, &(0x7f0000000280), &(0x7f0000000240)=r0}, 0x20) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x32}, 0xa, @in6=@private1, 0x0, 0x4}]}]}, 0xfc}}, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r3, @ANYRES64=r4], &(0x7f0000000980)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0xd, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000750000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000095"], 0x0, 0xfffffffe, 0x47, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)) (async) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000180)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r3}, &(0x7f0000000280), &(0x7f0000000240)=r0}, 0x20) (async) socket$nl_xfrm(0x10, 0x3, 0x6) (async) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x32}, 0xa, @in6=@private1, 0x0, 0x4}]}]}, 0xfc}}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r3, @ANYRES64=r4], &(0x7f0000000980)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) (async) sendmsg$inet(r2, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) (async) 1.885693493s ago: executing program 0 (id=6582): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) recvmmsg(r1, &(0x7f000000b640)=[{{0x0, 0x0, 0x0}, 0xffff6108}], 0x1, 0x2100, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e4a44", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c00010000000000000000000c0002f60800000001180000080001"], 0x44}}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000280)={r0, 0x7, 0x104, 0x7ff}) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x200000}, 0xc) (async, rerun: 32) r3 = socket(0x10, 0x2, 0x0) (rerun: 32) write(r3, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f000000000000000000080000", 0x1c) (async) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(r4, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, r5, 0x2, 0x70bd2a, 0x25dfdbfd, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x1}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x4000850) (async) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) (async) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x28, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB='H'], 0x48}, 0x1, 0x0, 0x0, 0x20004810}, 0x0) (async) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) 1.598462442s ago: executing program 0 (id=6588): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) socketpair(0x28, 0x80008, 0x40, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000002c0)={@cgroup, 0x2b, 0x0, 0xc0, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0x0, &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000280)=[0x0]}, 0x40) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r4, 0x200, 0x70bd25, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x45}}}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x4000011) (async) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r4, 0x200, 0x70bd25, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x2, 0x45}}}}, [@NL80211_ATTR_CRIT_PROT_ID={0x6, 0xb3, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x40000}, 0x4000011) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x134, 0x24, 0x4ee4e6a52ff56541, 0x8000000, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffe0}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x104, 0x2, {{0xfffffffe, 0x2, 0x10000, 0xa, 0xe7, 0xcc36}, [@TCA_NETEM_LOSS={0xb8, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x69, 0x1, {0x40, 0xf, 0xa, 0x4006559, 0x8}}, @NETEM_LOSS_GE={0x14, 0x2, {0x5, 0xfffffffa, 0xa, 0x6}}, @NETEM_LOSS_GI={0x18, 0x1, {0xd82c, 0x8, 0x6, 0x0, 0xc5e0}}, @NETEM_LOSS_GI={0x18, 0x1, {0x1000, 0x2, 0x0, 0x8, 0x1}}, @NETEM_LOSS_GI={0x18, 0x1, {0x4, 0x4, 0x9de, 0x9, 0xb502}}, @NETEM_LOSS_GI={0x18, 0x1, {0x8, 0x0, 0xfffff001, 0xf6, 0x3}}, @NETEM_LOSS_GE={0x14, 0x2, {0x5b, 0x20000, 0x3, 0xa}}, @NETEM_LOSS_GE={0x14, 0x2, {0x2, 0x40003, 0x0, 0x6}}]}, @TCA_NETEM_JITTER64={0xc, 0xb, 0x6}, @TCA_NETEM_CORRUPT={0xc, 0x4, {0x40009, 0xae}}, @TCA_NETEM_LATENCY64={0xc, 0xa, 0x100020}, @TCA_NETEM_LATENCY64={0xc, 0xa, 0x1}]}}}]}, 0x134}, 0x1, 0x0, 0x0, 0x4546cfee17049510}, 0x0) 1.520040205s ago: executing program 3 (id=6591): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) pipe(&(0x7f0000000680)) setsockopt$sock_int(r0, 0x1, 0x20, &(0x7f0000000080)=0x100001, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)=@newlink={0x44, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r3, 0x64e90, 0x16ac1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_MCAST_FLOOD={0x5, 0x1b, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x400c080}, 0x200088c2) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000380)={'pimreg\x00', 0x5005}) writev(r4, &(0x7f0000000bc0)=[{0x0, 0x49}, {&(0x7f0000000680)="589daae13b0000c4fa0a", 0xa}], 0x2) setsockopt$inet_int(r0, 0x0, 0x1, &(0x7f0000000000)=0xffffff7e, 0x4) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000140)={'ip6_vti0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', 0x0, 0x29, 0x5, 0x7f, 0xfffffff7, 0x4, @private2, @dev={0xfe, 0x80, '\x00', 0x2b}, 0x8, 0x7, 0xfffff0a9, 0x9}}) sendmsg$sock(r0, &(0x7f0000000440)={&(0x7f0000000180)=@xdp={0x2c, 0x3, r5, 0x33}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000200)="b71fd4039d2dc48b54cb966493f4e37af1a12df68a67e9c3c825b9be2b9df47c933914e1a49d91ef0bdb9cec2a6fa8915a1263e78395d27d46390d89", 0x3c}, {&(0x7f0000000240)="0d401c657073ecb9e2a3999184950c3d458c3281accc2d884bd1e01e7d501112f2869b1eb667e341afbc55b5445beb531c467f668a8d4eaf8c97670205b73c6f03ccea3e692fb1280a2a91a1acd945ec2c3ca1e46006e75771923ed392584fced6657fd82d8228ed2ce9884b5d7ab1c37343f84354e36a991c1578378e1fae006e96fc5172fbe46fbcadf4ff7e0e080fdc2b0cb8ac180da6c2f46138dc0b28e72075dbec9589fc81b831fa964053381718b7a0063fd76d033ff0ba0d61ae77af2119e6ec873de15378d3e405de64844eaf53dee84eaff8582b", 0xd9}, {&(0x7f0000000340)="20b818aa46dc25264cee98acfb596646fdb6c82a183f05f0444bb720a8c0c28e31f6b3952f5289bf431a416301db4e5e5b68", 0x32}], 0x3, &(0x7f00000003c0)=[@mark={{0x14, 0x1, 0x24, 0x6}}, @mark={{0x14, 0x1, 0x24, 0x58}}, @mark={{0x14, 0x1, 0x24, 0x1}}, @mark={{0x14, 0x1, 0x24, 0x16}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}], 0x78}, 0x24004010) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) r6 = socket$inet(0xa, 0x801, 0x84) connect$inet(r6, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000640), 0x2, 0x0) listen(r6, 0x5) r7 = accept4(r6, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r7, 0x84, 0x9, &(0x7f0000000440)={0x0, @in6={{0xa, 0x4e22, 0x5, @empty, 0xffff}}, 0xd, 0x0, 0x45, 0xc0000000, 0x50, 0x401, 0x8}, &(0x7f0000000500)=0x9c) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CQM(r7, &(0x7f0000000600)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000005c0)={&(0x7f0000000500)={0xb4, r8, 0x4, 0x70bd28, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_HYST={0x8}]}, @NL80211_ATTR_CQM={0xc, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x5}]}, @NL80211_ATTR_CQM={0x34, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0xaa2d}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x9fa}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x395}, @NL80211_ATTR_CQM_TXE_PKTS={0x8, 0x6, 0x7fffffff}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x9}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x8}]}, @NL80211_ATTR_CQM={0x38, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_RSSI_LEVEL={0x8, 0x9, 0x7}, @NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT={0x8, 0x3, 0x2ffd8d01}, @NL80211_ATTR_CQM_RSSI_THOLD={0xc, 0x1, [0x7ff, 0x0]}, @NL80211_ATTR_CQM_RSSI_HYST={0x8, 0x2, 0x9}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x22}, @NL80211_ATTR_CQM_TXE_RATE={0x8, 0x5, 0x59}]}, @NL80211_ATTR_CQM={0x1c, 0x5e, 0x0, 0x1, [@NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x12f}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x29e}, @NL80211_ATTR_CQM_TXE_INTVL={0x8, 0x7, 0x662}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x48010}, 0x2000c004) 1.499395953s ago: executing program 0 (id=6592): unshare(0x6020400) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000002c0)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)=@deltclass={0x40, 0x29, 0x8, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0x9}, {0x1, 0xe}, {0x18, 0x12}}, [@TCA_RATE={0x6, 0x5, {0xff, 0xfb}}, @tclass_kind_options=@c_sfb={0x8}, @tclass_kind_options=@c_multiq={0xb}]}, 0x40}, 0x1, 0x0, 0x0, 0x20040000}, 0x40011) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f0000000400)={'batadv_slave_1\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000004c0)={'wpan4\x00', 0x0}) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r8) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r10, 0x8933, &(0x7f0000000340)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="4d7e2cbd7000000000002a00000008002f00090000000c0005000200aaaaaaaaaaaa0c0005000202aaaaaaaaaaaa050036000000000008000200", @ANYRES32=r11, @ANYBLOB="05003700ee"], 0x4c}, 0x4, 0x700000000000000}, 0x0) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r5, &(0x7f0000000600)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000500)={0x98, r6, 0x0, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_SEC_LEVEL={0x34, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x4}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r11}, @NL802154_ATTR_SEC_LEVEL={0x14, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x98}, 0x1, 0x0, 0x0, 0x80080}, 0x4000004) sendmsg$BATADV_CMD_TP_METER(r1, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x4c, r3, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x1}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xa46}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xdc}, @BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0x1}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r4}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) r12 = syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/net\x00') r13 = socket(0x10, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r13, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) sendmsg$nl_route(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@can_newroute={0x24, 0x18, 0x1, 0x0, 0x25dfdbfe, {0x1d, 0x1, 0x6}, [@CGW_SRC_IF={0x8, 0x9, r14}, @CGW_DST_IF={0x8, 0xa, r14}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c00f70682933b1500000000006251a5724773ed", @ANYRES32=0x0, @ANYBLOB="0304000000000000140012800a000100767863616e0000000400028008001c00", @ANYRES32=r12, @ANYBLOB], 0x3c}, 0x1, 0x0, 0x0, 0x40}, 0x0) 1.350326188s ago: executing program 1 (id=6593): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x1, @none}, 0xe) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$nl_route_sched_retired(r2, &(0x7f00000004c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)=@delqdisc={0xa8, 0x25, 0x100, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {0x9, 0xc}, {0x3, 0x2}, {0xd, 0xffe0}}, [@q_dsmark={{0xb}, {0x3c, 0x2, [@TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0xfffb}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x2a}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x11e}, @TCA_DSMARK_INDICES={0x6, 0x1, 0x35}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x7}]}}, @q_dsmark={{0xb}, {0x30, 0x2, [@TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x8cc}, @TCA_DSMARK_SET_TC_INDEX={0x4}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x5}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x1}, @TCA_DSMARK_DEFAULT_INDEX={0x6, 0x2, 0x8}, @TCA_DSMARK_SET_TC_INDEX={0x4}]}}]}, 0xa8}}, 0x0) sendmsg$alg(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001600)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x24008090}, 0x40000) sendmsg$nl_generic(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x14004845}, 0x0) recvmsg$can_raw(r2, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000080)=""/64, 0x40}, {&(0x7f0000000240)=""/172, 0xac}], 0x2}, 0x1021) sendmsg$RDMA_NLDEV_CMD_GET(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000004c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x8000000}, 0x4000010) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000040)={'wg0\x00', 0x0}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000080)={r0}) bind$xdp(r2, &(0x7f00000000c0)={0x2c, 0xe, r6, 0x32, r7}, 0x10) 1.271219611s ago: executing program 3 (id=6595): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, 0x0, &(0x7f0000010040), 0x2, 0xffffffffffffffff, 0x4}, 0x38) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r1) socket$kcm(0x10, 0x2, 0x0) close(0x3) r2 = socket(0x10, 0x803, 0x0) write(r2, &(0x7f0000000040)="2600000022004701050007108980e8ff06006d20002b1ffec0e90101c7bb0000b00000000000", 0x26) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000d9bffc), 0x4) r3 = socket(0x2a, 0x2, 0x0) getsockname$packet(r3, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080), 0xc) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@getchain={0x2c, 0x66, 0x400, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x2}, {0x3, 0x8}, {0x6, 0x6}}, [{0x8, 0xb, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x4000000) bind$bt_l2cap(r2, &(0x7f0000002080)={0x1f, 0xe9, @any, 0x0, 0x1}, 0xe) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x20000000ed071, 0xffffffffffffffff, 0xfffff000) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x10, 0xd, 0x0, &(0x7f00000000c0)='GPL\x00', 0x1, 0x0, 0x0, 0x41100, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) bpf$LINK_GET_FD_BY_ID(0x1e, 0x0, 0x0) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r4, 0x29, 0x20, &(0x7f0000000180)={@private2, 0x800, 0x0, 0x2, 0x1}, 0x20) socket(0x6, 0xa, 0x91) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000180)={@loopback={0x200000000000000}, 0x800, 0x0, 0x2, 0x1}, 0x20) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4001c00) setsockopt$inet_sctp6_SCTP_RESET_ASSOC(0xffffffffffffffff, 0x84, 0x78, &(0x7f0000000280), 0x4) 1.180092171s ago: executing program 4 (id=6596): syz_extract_tcp_res(&(0x7f0000000340)={0x41424344, 0x41424344}, 0xc, 0x7) syz_emit_ethernet(0x9a, &(0x7f00000003c0)={@local, @empty, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x8c, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, r0, 0x41424344, 0x0, 0x2, 0x1e, 0x0, 0x0, 0x0, 0x0, {[@nop, @fastopen={0x22, 0x11, "a29993d2a28e031af47636fb6b6069"}, @fastopen={0x22, 0x4, "690f"}, @mss={0x2, 0x4, 0x5}, @md5sig={0x13, 0x12, "ab519c9940eb739563a3c52b43aee4a2"}, @sack={0x5, 0x26, [0x3a, 0xffffff4c, 0x43, 0x1, 0x8, 0xea39, 0x8000, 0x8, 0x9]}, @md5sig={0x13, 0x12, "625fbe96fc97dc524d8a397b7b38957f"}]}}}}}}}, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) ioctl$NILFS_IOCTL_GET_BDESCS(r1, 0xc0186e87, &(0x7f0000000480)={&(0x7f0000000040)=[{0x6, 0x1000, 0x81, 0x9b, 0xffffffff}], 0x1, 0x28, 0xad8, 0x8}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@ipv6_newrule={0x1c, 0x1a, 0x1, 0x0, 0x0, {0x81, 0x80, 0x0, 0x0, 0xf}}, 0x1c}}, 0x0) r3 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000700)=@base={0x10, 0x4, 0x4, 0x6}, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r3, &(0x7f0000000200), &(0x7f0000000240)=@udp, 0x1}, 0x20) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1000002, 0x28011, r1, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r1, 0x2000) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e20, 0xc2, @local, 0x80}}, 0x4, 0x3}, &(0x7f00000002c0)=0x90) setsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000300)=@assoc_value={r4, 0x649a}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x5, &(0x7f0000000140)=ANY=[@ANYRES8, @ANYRESOCT=r1, @ANYRES64=r1, @ANYRES16=r1, @ANYRESHEX=r1], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, r1}, 0x94) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000380)={'wg1\x00', 0x800}) 1.076108836s ago: executing program 0 (id=6598): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$smc(&(0x7f0000000080), r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000400)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_NETMASK={0x5, 0x14, 0x4b}]}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x58}}, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0xc}, 0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000640)=0x10) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r3, 0x84, 0x13, 0x0, 0x0) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r4, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000100)='a', 0xdd02}], 0xc, &(0x7f0000000000)=[@sndrcv={0x24, 0x84, 0x1, {0x0, 0x0, 0xc}}], 0x30}], 0x1, 0x0) setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f00000000c0)={0x1, 0x6}, 0x4) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000007feffff720af0fff8ffffff71a4f0ff000000002d030000000000001d400500000000004704000001ed000072030000000000001d44000000000000db0a00fee10000007303000000000000b500f3ff000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0x9}, {0xffff, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newtfilter={0x24, 0x2c, 0xd3b, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff3}, {}, {0x2, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x8080) 1.070053073s ago: executing program 4 (id=6599): r0 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.kill\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000040)=ANY=[@ANYRESHEX=r0], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNLIST(r0, 0x800448d2, &(0x7f0000000000)={0x0, 0x0}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) accept4(r3, 0x0, 0x0, 0x0) bind$alg(r2, &(0x7f0000000180)={0x26, 'skcipher\x00', 0x0, 0x0, 'chacha20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000000)="b7f2288d3aaea2bc0000def1260a00"/32, 0x20) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000340)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x6, [@func={0x9, 0x0, 0x0, 0xc, 0x1}]}, {0x0, [0x0, 0x3e, 0x5f, 0x0]}}, &(0x7f0000000240)=""/197, 0x2a, 0xc5, 0x1, 0x40}, 0x28) r4 = accept(r2, 0x0, 0x0) sendmsg$alg(r4, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=[@op={0x18}], 0x18, 0x1}, 0x400c040) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x11, 0x71, 0x10, 0x33}, [@ldst={0x6}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x3, &(0x7f0000000080)=""/201, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffffffffffd56, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002c80)={0x1c, 0x40, 0x1, 0x7fffc, 0x4, {0x1}, [@nested={0x8, 0xcb, 0x0, 0x1, [@nested={0x4, 0x8}]}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) syz_genetlink_get_family_id$wireguard(&(0x7f00000013c0), r4) 1.02156198s ago: executing program 3 (id=6600): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xf, 0x4, 0x8, 0x1, 0x0, 0xffffffffffffffff, 0x3}, 0x50) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000002c00)=ANY=[@ANYBLOB="bf16000000000000b70700000900f0ff4070000000000000500000000000000095000000000000002ba728041598d6fbd30cb599e8c73d24a3aa81d36bb3019c13bd23212fb56fa54f26fb0b71d0e6adfefc41d86bd917487960717142fa9ea4318123741c0a0e168c1886d0d4d94f2f4e345c652ebc1626e3a2a2ad35806150ae0209e62f51ee988e6e0dc8ce974a22a550d6fd70800c86ae3b3e05df3ceb9fc474c2a100c788b277beee1cbf9b0a4def23d410f6296b32a8343881dcc7b1b85f3c3d44aeaccd3641110bec4e90a6341965c39e4b3449abe802f5ab3e89cf6c662ed4048d3b3e22278d00031e5388ee6f867ddd58211d6ececb0cd2b6d357b8580218ce740068725837074e468ee23fd2f73902ebcfcf49822775985bf31b715f5888b2c81f96a810b946855c9fc52ac17cbc97a616811a4c2dc3470009b966abaf41939aeca3e7b00c2e9d5db7a34fe2a29ac88c360a878a2b9ab9440c1961e80477166f3f847e855cdddc941d996d61ea0ce23b37e9d21c849d1e1e53087a3b109012e3a3ecbd219265048bf5c72b7ba2806b73323301b4bc94d0e4afde44867d71049a7c89bc615e215571ac910d80a58b5169576ff9906c34d2342806960b6bcb00000000000000000000000000113ee640b9ed1e04a0bfb125204d30990361bf45ef45277a167cd2c2e6ce9138143aa5ea7ee6f7c6d8b00437e070b004c5aa90766538b4fe45a16f14b270904d36eaa87508ac6d46639b3971ac6a88dc531fcc5ffc6b76b334795d88156336a9a452a9022485bb572dacb7aa25f748bc75918a16d9d5ae21004cd799ac4951beb2c6c9b5baf60081b86cc2e31c49f4ea055fb3639036c95c69b1ae60e685d486dbd1d5e7d0daacd73acfc80b9c9c92"], &(0x7f0000000140)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000017c0)=r0, 0x4) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, &(0x7f0000000780)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x44, 0x0, 0x200, 0x70bd2a, 0x25dfdbfb, {}, [@SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x2}, @SEG6_ATTR_DSTLEN={0x8}, @SEG6_ATTR_ALGID={0x5, 0x6, 0xe1}, @SEG6_ATTR_ALGID={0x5, 0x6, 0xe}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x40}, 0x40) 999.194495ms ago: executing program 2 (id=6601): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2241, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) socket$tipc(0x1e, 0x2, 0x0) (async) r2 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x2, 0x2}, 0x10) sendmsg$tipc(r2, &(0x7f0000000040)={&(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x42, 0x4000}, 0xfffffffb}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc000}, 0x40) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'pimreg\x00', 0x5005}) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000380)={'pimreg\x00', 0x5005}) writev(r0, &(0x7f0000000bc0)=[{0x0, 0x49}, {&(0x7f0000000680)="589daae13b0000c4fa0a", 0xa}], 0x2) socket$packet(0x11, 0x3, 0x300) (async) r3 = socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000080)=ANY=[@ANYBLOB="1802000000000000000000000000000085100000010000009500000000000000180000000001000020000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000002885000000c700000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x1b, &(0x7f00000001c0)=""/152, 0x41000, 0xa}, 0x23) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) socket$nl_route(0x10, 0x3, 0x0) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) (async) sendmsg$nl_route_sched(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000300)=0x14) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r6, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=@newqdisc={0x90, 0x24, 0xe0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0x9c4}, @TCA_TBF_PBURST={0x8, 0x7, 0x1fc0}, @TCA_TBF_PARMS={0x28, 0x1, {{0x0, 0x0, 0x0, 0x9}, {0x0, 0x0, 0x0, 0x5, 0x4, 0x3}, 0xfffffffd, 0x83, 0xfffffffd}}]}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xa, 0x1, 0x1, 0x40, 0x2, 0xffffffff, 0x0, 0x1}}, {0x6, 0x2, [0x2]}}]}]}, 0x90}}, 0x4000080) bind$packet(r3, &(0x7f0000000040)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r3, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) (async) sendto$inet6(r3, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="1206"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x65, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)}, 0x94) (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x50, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313f, 0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)}, 0x94) socket(0x2, 0x80805, 0x0) (async) r7 = socket(0x2, 0x80805, 0x0) sendmmsg$inet_sctp(r7, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="3000000000000000840000000100000000000000040200000100"/44, @ANYRES32=0x0, @ANYBLOB="200000000000000084"], 0x50}], 0x1, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x42000, 0x0) close(r8) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r9, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r8, 0x4010744d, &(0x7f0000000180)) (async) ioctl$TUNGETVNETLE(r8, 0x4010744d, &(0x7f0000000180)) 867.605618ms ago: executing program 3 (id=6602): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0xa, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @cb_func={0x18, 0x7, 0x4, 0x0, 0xfffffffffffffffc}, @generic={0x65, 0x8, 0x0, 0xfffa}, @initr0={0x18, 0x0, 0x0, 0x0, 0x4}, @exit]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0x58, 0x24, 0xd0f, 0x70bd2d, 0x0, {0x60, 0x0, 0x0, r3, {0x0, 0xa}, {0xffff, 0xffff}, {0x0, 0xffff}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x2c, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x4, 0x2, 0x0, 0x0, 0x7, 0x8}, {0x12, 0x3, 0x4000, 0x1, 0x1, 0x400}, 0xa5, 0x4, 0x10000000}}]}}]}, 0x58}}, 0x44080) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x25dfdbfe, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 697.336094ms ago: executing program 3 (id=6603): r0 = socket$inet6(0x10, 0x6, 0x7f) socket$rds(0x15, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="06000000040000000b00000005"], 0x50) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000500), 0xffffffffffffffff) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) r3 = socket$kcm(0x29, 0x5, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) write$cgroup_int(r4, &(0x7f0000000000), 0xffffff6a) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r2) sendfile(r3, r4, 0x0, 0xffffffff000) sendmsg$NL80211_CMD_GET_PROTOCOL_FEATURES(r4, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r5, 0x0, 0x70bd2c, 0x25dfdbfd, {}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x44010}, 0x40000) r6 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000004c0), 0xc, &(0x7f0000000580)={&(0x7f0000000600)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="000129bd7000fcdbdf250200000008000700", @ANYRES32=r4, @ANYBLOB='\b\x00\a\x00', @ANYRES32=r6, @ANYBLOB="08003ed0df7bc8a13ba8092a5141830500e0000001c213bca9a7fe0c2c03b02d29cc8a4d50f61e098ee2f08cd27618a234730852fb129f787cb90f3481095d5b37a6816bd1a84e20f45c9f31b0a7f694ead1f16d55153d6e03a3ec3013edd6d1b1d0e7ab047d2f2c555b3d01a4e322543f46f299f78a440476cfc14bef73d6c97fbb3145a19a05f8387c2b8fdf1eb12ed34ee135dd7c33287c45180a826941b44167"], 0x2c}}, 0x20048000) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r7 = accept$inet6(r0, &(0x7f0000000440)={0xa, 0x0, 0x0, @private0}, &(0x7f0000000480)=0x1c) close(r7) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x80002, 0x0) socket$inet6_icmp(0xa, 0x2, 0x3a) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="0000cf3a077c00000c0001800800000000c6000100", @ANYRES32=r8, @ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000e00)=@newtaction={0x10a8, 0x30, 0xb, 0x0, 0xfffffffe, {}, [{0x1094, 0x1, [@m_sample={0x1090, 0x1c, 0x0, 0x0, {{0xb}, {0x64, 0x2, 0x0, 0x1, [@TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x7}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x3}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x1}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x3}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x1}, @TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x800}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x1}, @TCA_SAMPLE_PSAMPLE_GROUP={0xfffffffffffffecc, 0x5, 0x7}, @TCA_SAMPLE_TRUNC_SIZE={0x8, 0x4, 0x2}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x4, 0x7fffffff, 0x1, 0x2, 0x34f4}}]}, {0x1004, 0x6, "c0d2f7b25ed20d66a6f5cf09c8a1895c39011d4b0344e84815269f6ac6c8653b7af2856a0fdcd5f5a97ac1bb458bee2a962d0e402e118681d16f62567ac5ffdd161cfee92e741e642de7f6858d5368ef2ca53a603c9b830cd43bbdc88f40b79cb8150673d40b2bbcfa3e6a6ef372083c1aafaa6eec6309b2951006747effbe6a924368873e6f17570295705de559ba12ba8289765b166242ba7c1f4634baa43f1e1847b5164df03be2d428b29c04fab2e151e1b6ec3a6e47cc1fd065a1cef1c180c733aa8f2355f68a61f6753714859a0018930f58bcd511a29c1df98a8fe329410d44fbfdf52ff16169264de0a78e5d5f52b750f813c533d9a7d5d3eff32a3d9d230ba41e79b59536601c3f20cff17f4850c73548f9cbe3dd8d55b3b5ce8178803d7dcad848667f977d33dbaa7769568686e207fba92cce7fe5910d44ec5a981bfa56a2143ad6cd0c5a4fbe6dd36940e789ec16bb3cd1e4407c180a4f6e94d125008ff62b4970c60eb39f63ca3feaf1de4941049954a5453bd5c5dfc5f651644f7f853a3a69bb85878ff5b4c1ca5854dbc6e78e3466430fac3333b5756d8661ae7d1ca73775e2e8d39d41247deec51927ff10fd6a798fc8fa5f9b6e74d4dea3f77b8c19988465610c6637550c5bee31b094076b63f98fd35f322ddb2f90de712f1b75fc9bb3918110864ec4dd3b9d39dfd9847fc688c25bc4c0a120fc87aef2f7cacc7918944c19aee7d8b6f33cd7a08d09c4bf0e3a34f3179142e500d1ed7b0ce024809d930925e7cea8ec2214bce3332f64f689f3a654832c1d2007daec8faf587fb7c403ecfafbbcc879e343b255ca679d6bd56b0ac048b9cf5321e03c2a12de3c4be9c9a378da0f85e0acd9caced3424c933b149185ecae1d662c2f7b65e364b350e06e494fbffc910b6bb420e7915ec0b34cc1eb8cf4e9e56f79c0a86e70d9b0150253ca70f7a2b9c108dd5cb207e8dd5843ba82b6249065d064358b7e2f2e72e5089636890765ce8fe07d10f852a1ea787da137fb7213dab554cac58174191b46db7a509168cf901234e9a298f3b891d113fdf64bfd2fcc827f817bbb51268f9bcdb6c4a52fec733e24f73a9044d881b8b487dc18397f4c7985e4fd5868c0b354e26330bf540e0779fa856ced939fef7d3d73a5abc104c8327b053efdf0782a61ecb8e408bea97afec895384be167a978ca8937c5a2d18fb86d0e814f78d60bbce58a01412065f9f023135f857bda148445b5ad80052fc33baf2e524b0c500c25dba19428031f8ac8dd958602ebc66baffa0d3cc9345009d6f7c54c3ce2e701d4ee238ef7e743a75242e20190f75df06b52d4370bed0fad082f9daf81b296df09a2b380916ac4f430104f266ac770320b39aedb715fcd45938532e16078d7dc25e13827be8a67c79b80ac1fa0485ba850ac1f8afcc49c85057fba4b5115105fc847f5e6c9e83e534a71459ba3bb6123fa155c7fbe05ca5ae713039a320bd0f21a3d19e8e97f70d459d57316aeec702c174d72368ff281e93609d8f79b09099c8a31cef4b5320fc9a56e193e1ed775f8f0eaae13a8c860ca768576882f16aee0c20c16a3e5ad7a8783f445af0e583d951af6197d18d3624bf9c2108e6b669f5bb2184eda944ead1be5506b12857a7046961881f61755214091a3c925365b6b7e2fb3e7073885fdcaed19a91b17a38053d640f9e3d7b1b697c9337f0d146f34a9d935f54c121b73ef5ae1fa6c82c4ff2a1b1e33396d3f872a21608cb40ace7bc1137a83fd9b6ef0d8b048a61973be388b28e6ccc51ba86fd6405c291b907af871aba3778f819f7e5d8ee3dc6d5239f369a282c9ac0a5a4e0fb87ffcc3cad12d462c904be68623d4593b6423fcecd4f54870bc75145bfc592628249bf58bc708b607929d039f5f82931e20ab71ea539adbaf882719f1e5ff914927ead58f446611c5a7ae5443953b9eef6dc006cc0898679449e92edc64faf40d68f19d17cf0c91787d26d9d227dadb457f2efe210b551d9825bdfa9b9916e097eb8f6803fea5d2334efc8ab4c1d01f0827db15069d04e348b9ebada90a15b538fb9bf893eeaf3c3961413a033daaa7badc920588ee83b8ee8fe2755241deaf9e89334678d2d12405bdb25c3c8dca5008b7e68ea0d1392bbb20b74c31ec78c6cf7695e2fb5bc00d794c74c3ac5f4fc219235db913ee6a63c37fdb827d904d868c2c925e20e919fd0b56035a16cf4f7e1f08a6678a3a033980da6bbd45546868df6d468374c4b01a2aa8e3339fc2c3f5a7d4433b3de76f5863261c9ac83be58813d96cfc86fbb36322a56ef102303949028ec28d90f168602622276c5a0eef23b1f207f2129dfab2a5ae32d2ad4c3853c9807e9f8988fb24deebb4b6cb541111e41e76c9072ba7e04e661a722caa63bc4fb02aad4079f696bce162a452148c46a57fb00b2bb57ec7f05e5dd15a249299aa7daaaa51d183c93252de5a0e6588a469cb6bfe6b284935d03d6976c4ff5dc400099bb9c0e919673c87b3cab25ecd5cf3d2dc1ce90c4f69dfa328f0d22fb765e07991ac867baf964d722f4c7563f719f59831722847974498b8cced9df180a768879814221f13341b3e8f719a9ef970dfabbdb13506fb16b403d8072c352c18b08587b942ad4fd900f66dffdb0e980451d0efd4b635581afcdab69e3a4699736bef47be367a6456e6ec51794c513ff1c9ff518c5ebe3895f07208ad902e682b88d5eff4c607e66a6f1ac38dcf0773617764760a67923f03b67cee54164de72f32908f611da206576875800b572b3cace33985baf2a68abc3e6a36a53a8eb37bb365867d13c31c1210da8d393554189f019b1ac2795e62fc47592cb181e941ce2497c98d09c045e25b8e370410dbe0f4b08f729fb866bb4cb63811688c827dd684cfe7e3baeef09822ca50d1fae8e5ef617b71259a36b7e8f88ead3389200ab2f6889db960ac0086d47b2e1e2f7ca01f309ccd10e7f44318f1ce9bccfe65ee0227c53a5e836e31b7376c5009f3a4fcfc8e4568831503bac92575ba1a5f2bd1b128af8902c221991c9ad85c342f87cd269ffe4d67a850776facea4668489bd05ef97066dcc762f8b8705c2f4d02f8964799ce5964b876221013534d624f93fc1a35bba0b3f1d7eba22ad317b790fbd5fb099e8d165dd00529fcd767833b90753f3ba6c616ac5b07b0de65d790b329b1656ebb58981a0e76c1c143ac3b866ea8e120803ba44a758241e7fc10f70592fb26ec9a61d1b8b0a19348750164af74972fa5da3db318aefc772e18dd637d18c8235534da139838b5e0f77f9baaf68c818f6c0b25c3f61e00ea3bd6e9bc9912c4747d618609e2aae1d1c33df2f31e8c40a029cc568ef9005c7fa0a5994d2acbc1e1d504e2246ad3d7105a5f5c2339aa0adc751ff1efffc49a073c55c1307e5645c74a5921b24a5a6632d466c6fa25af2f36ad37127086bb8593ae3b5be106420caf0ab7219be3c279acbc48645c832e1146cd20889c110850220781522971e8974eea259056e94af1e77ce17151fd296e41ea505dc390c127ec154e51b3d47b823e3e8d3225d4e4f0f822e71367bf1c55393b5eaf1ea00078e5db84d17c43f9cf1f46968aa237897838bdd6502645edc22db67bfc7e73bf070909c981588fec207b682a952f5aa26b3be264be18f131947c89dcb1edd6b44ac6bb84b9d1ff0e2b822a87ce9f21581a474367876aa5dae1e90b47ee90c9288c3c5ffb4202cefe81f02f9c6b0ef4b44c12b8b10d25cfa8a245b0bde79c125a6bfadbaa31560b1e9a6b58e7458c25b7ac9296ea884b5088083b4fe813825e4ae03aad0384f576c5cf60d27a48f964cad4766249085946f44534754415a50a147ab0180d525700802b9f8b36a49d9fcbd27598c29bb255429ac0fd7428527882668cbfd915a0d9cb500e3f38b806130831d3d65bb69a4fa4d97cafa56af987cc9d61555235155f5563ee0894c26795c2118b3929e6210f3f1405dbe64a7c7a222ba20cd48de0211be8cccc4391594f79e804e1714cbde9042b5c212e41418a61524aa0b9f57241a3960337e174cbfb4c760c0967c04040a7f04b03662b1814a3990243535e8cfda100cd836c18a7416bbbd5b2605ff276662d26cb6c4f83bdf12c7b2b96158a3e98ccf8798bd07fd4c83b627a765527e38cad07777eaa3baa25a1e76980a6225e15fd869cd6f1f62d401ba3789ff6a281b666f92c290941fac149751cfb96332508d61b3857687f78e225d41074308b020b5da0bf7d25a3613ad30ecb5af219089a0ae51a1f2772addeb53bf285d33a500901fd4552a93ec2989cdf0f313dbcdd5c53e433d1414dbc01795aa9b9aeb944709c310f9031d370e5e5180d8c535809a68eff2b6b3d33c76b0aa8837d268b0a905cd31d2a07221b7665fd52332521386c436ae9545315267b5a7531b320b58e97ddd161e6ff15cc74325190dbe3033a10c736e28e0962a28cdc57d8947aa379c0cfb74980eb8b664875c59f33b9eede97e19550619ca926282c0ee0eaae07bbd31455d42a79a6331f8ef6e7344854350e0fd88e451dcb94c56de54ef0eb4cfc3ffe08cd8b66bb1eb97c7a9fbaa2c4a102a796959837fdf647d40226292166dbc74d87d81ff47bdae4dd017f41cb3ca99d77b588040a4b5b0ecc69f854a642a211d55acd2da185bd8d18623f777b4a002069d4788d4c0d08960fff28178a84b12391c82848764c6236b19267fc11af396f102867b42ed09e425b7ddba83ea89aa4678b7453beb6b62ef7c982991e00565a9e9c0bd5301b2b4c4a3c5909cd75c511e8f210534edbe2c3dcafc867c8800bf286e566244e95d7de006c7b77fcf2434e15a21d2c0b8385ce2fe82c66749cbe628c9bfadada3b054f4d5637ecf0a2f30af303c492a3260b7973ccc8d55cf0aa52d64c3649f675f3a92c985ea77488fc265a133eba5e316f2ec8b039ad7de8edfd0d8275e532a726da8f2fdafeac192bce297302e41cf4ef23c2ff993cb460fea7bfc712a89ec94316465878d568aec957a4ee333240b570fcf635e99f7604589f977230be24cec5d83191023519fd00661996fd81cf47cf520b2cfbbf4bb08c873ec92091c8ef2e880bc207988714bb9610d0a68d58900a715126d8cdc24642a58981ab9bc66b946b6aea4f55d46f095858e4efb414f2b4c82b596d97c5abd119f61cc351a00adc5c1e866877200cf1a723967697f7be7abcf70df8cecf0699d14e410d5b5fd2ef8f76b36653f17f2c1b35aac602fdf5b16b4ca08a5c0d280f3774dd5818a7c9a165efa480e98bea8887243832365ec3e926fbbc7342abae99c35c3da1481d00be4b85a044b351f7a9bcb45603617199f09b9f2e6293ed8bb10d6479d49f8e421d1b32a2ea4843703313fd93f28b4fd2e9d20d2d8cc02a9ebdd92f323451fed47adde24526d4eb734456a864fd977942884252d04ba5fabb00a8fcae2f347fc68ea35532561c252677da0e16e9150da3d30c898b03d2d431b1324c98d5b0d8b39ed7db497a7e0f655818ff57ae4d2083f9adcea961cba0d48f722cd0723cc21d89c3c75471f81b76ce62e21f643a9d02418eee868279275a7c02cf8b4aa4689601d53ad2b636766aab005dc295cc111601e759f84c845347d9cbb8417ff71d2941fba7a6a958d1d33af7298530a6f38a8d7e14b70c486996dd0e6d8a5d80cb35a1ea9276347035effdae657a69accba2ceed34b206b94f0f5a3558af31dd9c76e83df2d71a5336e195a510290c77c599bb90e8fa784638eec30a5f34dde901437c"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x2}}}}]}]}, 0x10a8}}, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) close(0x3) socket$can_bcm(0x1d, 0x2, 0x2) close(0x3) r10 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r10, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0x6001, 0x4, 0x3f0, 0x1f8, 0xe8, 0x1f8, 0x308, 0x308, 0x308, 0x4, 0x0, {[{{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, 0xff, 0xff000000, 0x2, 0x7, {@empty, {[0xff, 0xff, 0xff, 0xff, 0x0, 0xff]}}, {@mac, {[0x0, 0x0, 0x0, 0xff, 0xff]}}, 0x7ff, 0x9d, 0xf9, 0xd, 0x0, 0x7, 'ip6tnl0\x00', 'hsr0\x00', {}, {0xfd}}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1f8}}, {{@arp={@multicast2, @remote, 0x0, 0x0, 0x0, 0x8, {@empty, {[0x0, 0x0, 0xff]}}, {@empty, {[0x0, 0x0, 0x0, 0xff, 0xff, 0xff]}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 'veth1_vlan\x00', 'team_slave_0\x00', {0x101}, {}, 0x0, 0xe2}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@broadcast, @multicast2, @private, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="f9bcdc63c0c8", @mac, @multicast2, @rand_addr=0x64010101, 0x4, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) 631.53513ms ago: executing program 4 (id=6604): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_crypto(0x10, 0x3, 0x15) tee(r2, r0, 0x0, 0x1) sendmsg$nl_route_sched(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000017c0)=@newtaction={0x894, 0x30, 0xfbed, 0x70bd29, 0x25dfdbff, {}, [{0x880, 0x1, [@m_police={0x87c, 0x1, 0x0, 0x0, {{0xb}, {0x850, 0x2, 0x0, 0x1, [[@TCA_POLICE_RESULT={0x8, 0x5, 0xffffffff}, @TCA_POLICE_RATE={0x404, 0x2, [0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3, 0x1, 0x0, 0x0, 0x6, 0x0, 0x3, 0x4, 0x2, 0x2, 0x4000, 0x0, 0x0, 0x9, 0x0, 0xfffffffe, 0x0, 0x0, 0xfffffffc, 0x2, 0x5f41fde7, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x6, 0x0, 0x0, 0x7ff, 0x0, 0x4e16, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x8001, 0x1, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x28, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0xfffffffe, 0x1, 0x0, 0x100000, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x75b, 0x0, 0x0, 0xf, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x3bf0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x1, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x2, 0x1000, 0x0, 0x0, 0x9, 0x3, 0xa088, 0x0, 0x1, 0x0, 0x0, 0x3, 0x0, 0x87, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xb7fe6bd0, 0x6, 0x1ffffffe, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xaa84911, 0x0, 0x0, 0xe6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x18, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0xffffffff, 0xffffffff, 0x0, 0x0, 0x7, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0xfff, 0x1, 0x0, 0x0, 0x0, 0x2]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x9, 0x0, 0x0, 0x4, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xfffffffc, 0x200, 0x0, 0x0, 0xffffffff, 0x7, 0x0, 0x0, 0x0, 0x3a4f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x800007, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x40000, 0x2, 0x2, 0x4, 0x0, 0x0, 0x0, 0x894e, 0x0, 0x2, 0x0, 0x9, 0x0, 0x17a00, 0x0, 0x5, 0x80, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x9, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x8db, 0xffffffff, 0x0, 0x9, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x80, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x10, 0x0, 0x0, 0xf, 0x0, 0x7c, 0x0, 0x5, 0x0, 0x4, 0xffffffff, 0x0, 0x0, 0xcd9, 0x0, 0x0, 0x7, 0x5, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x4000, 0x10, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0xfffffff9, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x319e, 0xfb18, 0x6, 0x9, 0x0, 0x484a, 0x0, 0x2, 0x0, 0x6, 0x0, 0xfffffffc, 0x9, 0x0, 0x20000000, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfbfffffe, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x2, 0x5a62, 0x0, 0x0, 0x0, 0x0, 0x4]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, {0x3, 0x0, 0x0, 0xff, 0xfffc, 0x5}, {0x5, 0x0, 0x0, 0x9, 0x0, 0xfffffffc}}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa, {0x0, 0x2}}}}]}]}, 0x894}}, 0x0) r3 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r4, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@ipv4_newaddr={0x18, 0x14, 0x1, 0x70bd28, 0x25dfdbfc, {0x2, 0x20, 0x1, 0xc8, r4}}, 0x18}}, 0x40000c0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3806}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_DPORT={0x6, 0x12, 0x4e24}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @rand_addr=0x64010100}]}}}, @IFLA_MASTER={0x8, 0xa, r4}]}, 0x4c}}, 0x0) 583.293083ms ago: executing program 2 (id=6605): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=@newsa={0xf0, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in=@multicast1, @in=@multicast2, 0x1, 0x714, 0x4e23, 0x5, 0x2, 0x0, 0x0, 0x3a}, {@in=@multicast2, 0x4d4, 0x6c}, @in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x0, 0x193, 0xffffffffffffff3a, 0x0, 0x8251c, 0x2, 0xfffffffffffffff8, 0xe2e237c}, {0x9, 0x0, 0x20000001f, 0xfffffffffffffffe}, {0x0, 0xfffffffc, 0xfff}, 0x70bd2a, 0x0, 0x2, 0x1, 0x0, 0x58}}, 0xf0}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) sendmmsg$inet6(r0, &(0x7f0000000000), 0x1, 0x4010) setsockopt$inet6_tcp_buf(r0, 0x6, 0x1c, &(0x7f0000000080)="d2c01825642b74f308d3008fa858d13554f00402e01f08cf61ed6def182fb3b30630e174e976301c45fb91281f4db227", 0x30) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$SIOCSIFMTU(r1, 0x89fb, &(0x7f0000000040)={'bond0\x00', 0x100007}) 507.372816ms ago: executing program 2 (id=6606): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_buf(r1, 0x6, 0x1f, &(0x7f00000000c0)='G', 0x1) setsockopt$inet6_tcp_int(r1, 0x6, 0x11, &(0x7f0000000040)=0x5b9, 0x4) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="00012dbd7000fcdbdf25070000000c00170000000000000000000c000600020000000000000008000100030000000a0004007770616e30000000080001000000000008000300", @ANYRES32=0x0, @ANYBLOB="a09c9ef733785436b76fc484ae3521596384ee428c726c6aea1ee1b8cb7afd0cf2a951e39001d31035c9c64c1044df00187c60813983807596470eaa85bbea1497e52caead438c588a0da753d3466d53a820abb000cfd5d960ea13728e1716cbc22823e7e9b758367b659a80c214014916e9663a045e6c2900bf5840137286ebd6d9c8479c2965156d51d8e2bbfb53d8e38af5851cb377d3d60c360f073dc9b69f017ff457ece26b12e77554ace3704b18ec04ae41602df957c2b49dcebe9b0fc788a7f6bb7b189f6b324173634bd8cd2ae877d7725cd953c669e6f9be35b7a33b86600079c77d5aa43abd7fbeda829e8ff99af89774daf6c74eafced6b8f9d579efb3f60f2b965c3ae3f3b03ee90fcab11a0055f8ad9c70a1419287b8086111e7649000b3c8a5fd2eb64bfc8d742acb07e781793eb13b54423aa1ea4be5782112a04831149458277245458bf001811adf56922ee5ecbfe9b0d9fbe1c6ba18c79008f8bd7cf37b7620478ea12b7f27139aa1b8194567856a9c373b18cd4e20449ab15f4bf7d0557bd0e7bc52662c4f2b163162afb210d28edbc2f3c66aae6dc72dbb0924aae382553de2b4b5eb67a603df63af9b30df49b385e580357e53d65c000000"], 0x50}, 0x1, 0x0, 0x0, 0x4002}, 0x10) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket(0x10, 0x80002, 0x0) (async) r5 = socket$netlink(0x10, 0x3, 0x0) (async) r6 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r8) (async) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r9, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) (async) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c00000010001fff000000000100000000000000", @ANYRES32=r10, @ANYBLOB="0000000000000000140012800900010076657468000000000400028008000a00", @ANYRES32=r5], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4280400000000001400350076657468305f746f5f626f6e6400000008000a00", @ANYRES32=r10], 0x3c}, 0x1, 0x0, 0x0, 0x4008800}, 0x8000) (async) sendmmsg$alg(r4, &(0x7f00000000c0), 0x492492492492627, 0x0) (async) r12 = syz_genetlink_get_family_id$nl802154(&(0x7f00000002c0), r0) (async) r13 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r13, 0x8933, &(0x7f0000000180)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_KEY(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x28, r12, 0x400, 0x70bd2c, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r14}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x28}, 0x1, 0x0, 0x0, 0x2000c004}, 0x800) (async) r15 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DEL_VIF(r15, 0x0, 0x15, 0x0, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001", @ANYBLOB="5e7841adca0f7ecc57abf9fe39aaf35c324109f14d692688a7ce9314f5b169f01cd81d61453388c62dd03befee8a26118d97566f8c75982abe4520ada08c1039085b73a407b16649193160ca764bf03c27dff26cd767a376db2669ef2291d02d40f62103008e0555655a9552293f4b4562a47eefee886c1f7d27280f8044db7b617c260fb97c115dc9aa710c6824b584a2", @ANYRES16=0x0, @ANYBLOB="c87e4e8b646851ec930e41139a49671fb5d6dac0844f4525788c731cecc3a2ec5e0cb8d39df677f98c12fe58ccba672c06dca14637ae805d1893432c5a6c70f4d06c609e718bd07541464fb4d039a84b8ef210a06e7481c8ef1a3be6c573be769c2e7a385c3241e8b4bae0d2c70f33b3d09b7c928d8198ec"], 0x7c}}, 0x4000800) (async) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200fffe540004802800018007000100637400001c0002800800014000000002080002400000000e05f50300010000002800018007000100637400001c0002800800024000000011080004400000000c05000300010000000900010073797a30000000000900020073797a320000000014000000110001"], 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x2000c0c2) 391.057742ms ago: executing program 4 (id=6607): syz_emit_ethernet(0x40, &(0x7f0000000040)={@local, @empty, @void, {@generic={0x892f, "a9c854852b695593931b8cf6b12abf7612177e80cc0cb2bb3a44cdd1561ca72fa08de0704c9bee68c26adceddbb174a32c65"}}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)={0x1c, 0x2e, 0x9, 0x70bd27, 0x0, {0x4}, [@typed={0x8, 0xc, 0x0, 0x0, @uid}]}, 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010829bd7000000000000b00000008000300", @ANYRES32=r5, @ANYBLOB="60005080110001004abee339084eeef16f162471f4000000080003000aac0f000500020007"], 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$NL80211_CMD_LEAVE_OCB(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x300, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r5}, @void}}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x2000c01c) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="28000000120001032cbd7000fbdbdf2507000000", @ANYRES32=0x0, @ANYBLOB="6b8a00003015010008001d0080"], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x0) 281.738611ms ago: executing program 2 (id=6608): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x400c4) (async) socket(0x10, 0x803, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b405003400000000009500090000000000000000000000000000e700000000de"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85}, 0x52) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) (async) socket$rds(0x15, 0x5, 0x0) (async) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000001680)=ANY=[@ANYBLOB="0500d2890fab", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYBLOB="04c6806fe23e48f3fa704e6677e0550bb46642f8c455c46a604e16529c3bfc6c538d30787217333d15090b92f285ea25bd2638bbc61eadac2ddbc5ff6c1ee5406bc8ee6b01ee50b297a496906e03d06d93607d40fdb9ea864b3e1a745ea9d68b8180b0a834db349408b73f768e080380a96496428b4dd2de5cb69d", @ANYRESHEX=r0], 0x48) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="024482bd3104000ed946107f2eb9d65f339780958f0dbc0cefaf1cf523a5d1874e3b2279a7397d5cbf4cb8dd8ac4b036ab9dba63c29e762c9cd8fbe648aa6a33bfd8ec66c0ad6709a3e095f78289463e6b40323574", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) (async) ioctl$F2FS_IOC_RELEASE_VOLATILE_WRITE(r2, 0xf504, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={r3}, 0x4) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000015c0)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_PORT_LIST_GET(r4, &(0x7f0000003340)={0x0, 0x0, &(0x7f0000003300)={&(0x7f0000002ec0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16, @ANYBLOB="07082abd7000fddbdf250300000008000100", @ANYRES32=r5, @ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x20000091}, 0x4010) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x20, 0x11, &(0x7f0000001500)=ANY=[@ANYRESDEC=r1, @ANYRES8, @ANYRESOCT=r4], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000540)={r6, 0x0, 0x22, 0x0, &(0x7f0000000080)="3d25ab555b05d02caedd8f52970040fee5a990ec7661bcf85f9871eb5f7eef2d45f0", 0x0, 0x304a0000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x4, 0x0, 0x60f}, 0x50) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd27, 0x25dfdbfd, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'xfrm0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xd1}, 0x8014) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040)=0xffffffffffffffff, 0x4) (async) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900"], 0x7c}}, 0x0) (async) r8 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r8, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) (async) setsockopt$inet6_group_source_req(r8, 0x29, 0x2b, &(0x7f0000000240)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x4e21, 0x4, @empty, 0x3}}}, 0x108) (async) setsockopt$inet6_MCAST_MSFILTER(r8, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x190) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x2, 0x6, &(0x7f0000001740)=@framed={{0x18, 0x2}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @call={0x85, 0x0, 0x0, 0x8c}]}, &(0x7f0000000040)='GPL\x00'}, 0x94) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001580)={{r1}, &(0x7f0000000300), &(0x7f0000001540)}, 0x20) r9 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r9, 0x0) 245.077638ms ago: executing program 2 (id=6609): sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) r0 = socket$netlink(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000740)=ANY=[@ANYBLOB="38000000090601a1c97bb73d035c2300000000000900020073797a3100000000050001"], 0x38}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB='$\x00\x00\x00v\x00\t\a'], 0x24}, 0x1, 0x5502000000000000, 0x0, 0x20000000}, 0x4000) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000004c0)={r3, 0xc0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) r6 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000440)=r5, 0x4) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180)={0x0, r3}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x3, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af0ff00000000bfa200000000000007020000f5ffffffb703000008000000b704000080000000850000001900000095"], &(0x7f0000001b80)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x41, '\x00', 0x0, @sched_cls=0x2e, r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) ioctl$XFS_IOC_START_COMMIT(r2, 0x80585882, &(0x7f00000005c0)={0xffffffffffffffff}) bind$packet(r7, &(0x7f0000000640)={0x11, 0x6, r4, 0x1, 0x0, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) getsockname$netlink(r0, &(0x7f00000000c0), &(0x7f0000000100)=0xc) 179.900118ms ago: executing program 2 (id=6610): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001100)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x7f8}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001180)={{r4}, &(0x7f00000010c0), &(0x7f00000002c0)=r3}, 0x20) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r2) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="12000000010000000400000008"], 0x48) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x1, 0x40, 0x5, 0x41}, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xd, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r7, 0x0, 0xe, 0x0, &(0x7f00000008c0)="7a7fa22c2aff88df53ef2a2d280f", 0x0, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)={0x34, r5, 0x205, 0xffffffec, 0x25dfdbfd, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}]}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x1}]}, 0x34}}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={r3, 0xe0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000380)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x3, &(0x7f00000003c0)=[0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0, 0x0, 0x0], 0x0, 0xb0, &(0x7f0000000440)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000480), &(0x7f00000004c0), 0x8, 0x72, 0x8, 0x8, &(0x7f0000000500)}}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000680)={'vxcan1\x00', 0x0}) r10 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r11, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xd, 0xf}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000780)={'veth0_virt_wifi\x00', 0x0}) sendmsg$ETHTOOL_MSG_RINGS_SET(r1, &(0x7f0000000100)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f00000007c0)={0x94, r5, 0x400, 0x70bd29, 0x25dfdbff, {}, [@ETHTOOL_A_RINGS_RX={0x8, 0x6, 0xff}, @ETHTOOL_A_RINGS_TX={0x8, 0x9, 0x1}, @ETHTOOL_A_RINGS_RX_JUMBO={0x8, 0x8, 0x1}, @ETHTOOL_A_RINGS_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_vlan\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}]}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0x2}, @ETHTOOL_A_RINGS_RX_MINI={0x8, 0x7, 0xe434}, @ETHTOOL_A_RINGS_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r12}]}]}, 0x94}}, 0x40) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@ipv4_newroute={0x4c, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x5}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x5}, @RTA_ENCAP={0x28, 0x16, 0x0, 0x1, @SEG6_IPTUNNEL_SRH={0x24, 0x1, {{0x1000000}, [@loopback]}}}]}, 0x4c}}, 0x0) 108.247584ms ago: executing program 4 (id=6611): r0 = accept(0xffffffffffffffff, &(0x7f0000000000)=@phonet, &(0x7f0000000080)=0x80) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'gre0\x00'}) (async) syz_emit_ethernet(0x46, &(0x7f00000001c0)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x7, 0x4, 0x2, 0xb, 0x38, 0x6a, 0x0, 0x8, 0x1, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x37}, {[@lsrr={0x83, 0x3, 0xc3}, @timestamp_addr={0x44, 0x4, 0xb1, 0x1, 0xf}]}}, @dest_unreach={0x3, 0x17, 0x0, 0x0, 0x7, 0x2, {0x5, 0x4, 0x1, 0x12, 0x6, 0x68, 0x7, 0x40, 0x33, 0xffff, @loopback, @broadcast}}}}}}, 0x0) 100.404907ms ago: executing program 4 (id=6612): r0 = socket(0x21, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x40, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x6de9608e9ceab21f}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x14, 0x2, [@TCA_FQ_QUANTUM={0x8}, @TCA_FQ_FLOW_PLIMIT={0x8, 0x2, 0x6de5}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x2}, 0x2000400c) 85.570471ms ago: executing program 3 (id=6613): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@deltaction={0xc4, 0x31, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@TCA_ACT_TAB={0x28, 0x1, [{0x14, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xf, 0x1, 'tunnel_key\x00'}}, {0x10, 0x4, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}]}, @TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x2, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x11, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xed92}}]}, @TCA_ACT_TAB={0x6c, 0x1, [{0x14, 0x0, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0x10, 0x14, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'police\x00'}}, {0x10, 0x15, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x4}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}, {0xc, 0x15, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfbd}}]}]}, 0xc4}}, 0x10) (async) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfe2a}]}}]}, 0x44}}, 0x20004055) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) (async) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x3}, 0x8) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 0s ago: executing program 1 (id=6614): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a44, 0x1700) (async) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a44, 0x1700) pipe(&(0x7f0000000dc0)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r0, &(0x7f0000000040)=0xfffffffffffffffe, r1, 0x0, 0xb, 0x0) recvmmsg(r0, &(0x7f0000002600)=[{{&(0x7f0000000080)=@in6={0xa, 0x0, 0x0, @private1}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000100)=""/188, 0xbc}], 0x1, &(0x7f0000001600)=""/4096, 0x1000}, 0x1}], 0x1, 0x20, &(0x7f0000002640)={0x77359400}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r2) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="01002dbd7000fedbdf2531"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c890}, 0x2000c800) (async) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="01002dbd7000fedbdf2531"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c890}, 0x2000c800) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f0000001540)=[{{&(0x7f0000000280)={0x2, 0x4e22, @private=0xa010101}, 0x10, &(0x7f0000001140)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{0x0, 0x0, 0x0}}, {{&(0x7f00000001c0)={0x2, 0x4e23, @rand_addr=0x64010102}, 0x10, &(0x7f0000000240)=[{&(0x7f0000000340)='v&U', 0x3}], 0x1}}], 0x3, 0x48000) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000400)={0x93de, 0x5, 0x0, 0x3, 0x1ff, 0x7, 0xdff8, 0xb, r5}, 0x20) (async) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r4, 0x84, 0xa, &(0x7f0000000400)={0x93de, 0x5, 0x0, 0x3, 0x1ff, 0x7, 0xdff8, 0xb, r5}, 0x20) kernel console output (not intermixed with test programs): alid length. [ 582.275400][T26360] lo speed is unknown, defaulting to 1000 [ 582.320683][T26375] sctp: [Deprecated]: syz.4.5110 (pid 26375) Use of int in max_burst socket option. [ 582.320683][T26375] Use struct sctp_assoc_value instead [ 582.430653][T26383] bridge0: port 1(vlan4) entered blocking state [ 582.443553][T26383] bridge0: port 1(vlan4) entered disabled state [ 582.450094][T26383] vlan4: entered allmulticast mode [ 582.455258][T26383] geneve0: entered allmulticast mode [ 582.461845][T26383] vlan4: entered promiscuous mode [ 582.466924][T26383] geneve0: entered promiscuous mode [ 582.614098][T26391] sctp: [Deprecated]: syz.0.5115 (pid 26391) Use of struct sctp_assoc_value in delayed_ack socket option. [ 582.614098][T26391] Use struct sctp_sack_info instead [ 582.904711][T26412] (: renamed from bridge_slave_0 (while UP) [ 583.106474][T26417] netlink: 'syz.3.5121': attribute type 2 has an invalid length. [ 583.126668][T26425] tc_dump_action: action bad kind [ 583.518319][T26442] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 585.392421][T26461] __nla_validate_parse: 14 callbacks suppressed [ 585.392443][T26461] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5132'. [ 585.436417][T26463] netlink: 'syz.1.5133': attribute type 1 has an invalid length. [ 585.612973][T26466] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 585.716365][T26393] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 585.888443][T26482] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5138'. [ 585.959847][T26487] netlink: 'syz.2.5140': attribute type 9 has an invalid length. [ 585.968850][T26487] netlink: 'syz.2.5140': attribute type 6 has an invalid length. [ 586.245325][T26501] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5143'. [ 586.261023][T26499] netlink: 224 bytes leftover after parsing attributes in process `syz.2.5142'. [ 586.665887][T14116] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.689545][T14116] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.735495][T14116] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 586.781525][T14116] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 587.068552][T26524] bridge11: entered promiscuous mode [ 587.083656][T26524] bridge11: entered allmulticast mode [ 587.294657][ T9264] IPVS: starting estimator thread 0... [ 587.401504][T26543] IPVS: using max 40 ests per chain, 96000 per kthread [ 587.450273][T26552] netlink: 64 bytes leftover after parsing attributes in process `syz.1.5159'. [ 587.507330][T26548] syzkaller1: entered promiscuous mode [ 587.534068][T26548] syzkaller1: entered allmulticast mode [ 587.573361][T26559] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5160'. [ 587.615607][T26567] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 587.728807][T26562] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 587.953717][T26584] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5164'. [ 588.151102][T26579] syzkaller0: entered promiscuous mode [ 588.178010][T26579] syzkaller0: entered allmulticast mode [ 588.213358][T26586] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5165'. [ 588.232777][T26586] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 588.634153][T26603] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5170'. [ 588.680623][T26605] syzkaller0: entered promiscuous mode [ 588.687246][T26605] syzkaller0: entered allmulticast mode [ 590.953112][T26610] netlink: 'syz.1.5173': attribute type 1 has an invalid length. [ 591.188069][T26616] netlink: 40 bytes leftover after parsing attributes in process `syz.4.5175'. [ 591.214736][T26616] nbd: must specify at least one socket [ 591.240250][T26619] netlink: 'syz.3.5176': attribute type 1 has an invalid length. [ 591.255358][T26619] netlink: 248 bytes leftover after parsing attributes in process `syz.3.5176'. [ 591.333465][T26625] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5179'. [ 591.342577][T26625] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 591.372024][T26625] batman_adv: batadv0: Removing interface: syzkaller0 [ 591.414174][T26628] syzkaller0: entered promiscuous mode [ 591.423613][T26630] netlink: 'syz.3.5176': attribute type 1 has an invalid length. [ 591.430270][T26628] syzkaller0: entered allmulticast mode [ 591.439963][T26630] netlink: 248 bytes leftover after parsing attributes in process `syz.3.5176'. [ 591.487710][T26633] syzkaller1: entered promiscuous mode [ 591.497336][T26633] syzkaller1: entered allmulticast mode [ 592.425046][T26691] geneve3: entered promiscuous mode [ 592.448432][T14116] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.466094][T14116] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.490409][T14116] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.515823][T14116] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 592.568960][T26699] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5201'. [ 592.581518][T26700] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5201'. [ 593.114724][T26721] block nbd2: server does not support multiple connections per device. [ 593.124519][T26721] block nbd2: shutting down sockets [ 593.188300][T26746] tipc: Started in network mode [ 593.193268][T26746] tipc: Node identity ea9b4835f3ad, cluster identity 4711 [ 593.200535][T26746] tipc: Enabled bearer , priority 0 [ 593.212129][T26746] tipc: Resetting bearer [ 593.230839][T26746] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5213'. [ 593.246739][T26745] tipc: Disabling bearer [ 593.309719][T26750] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5214'. [ 593.611122][T26763] netlink: 'syz.3.5217': attribute type 1 has an invalid length. [ 593.658055][T26763] bond12 (unregistering): Released all slaves [ 593.783504][T26774] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5219'. [ 593.823935][T26774] netlink: 'syz.0.5219': attribute type 1 has an invalid length. [ 593.870537][T26774] bond7: entered promiscuous mode [ 593.876765][T26774] bond7: entered allmulticast mode [ 593.883057][T26774] 8021q: adding VLAN 0 to HW filter on device bond7 [ 594.081074][T26793] netlink: 'syz.2.5225': attribute type 5 has an invalid length. [ 594.091052][T26793] netlink: 120 bytes leftover after parsing attributes in process `syz.2.5225'. [ 594.175278][T26798] syzkaller0: entered promiscuous mode [ 594.180893][T26798] syzkaller0: entered allmulticast mode [ 594.879913][T26830] netlink: 'syz.3.5236': attribute type 1 has an invalid length. [ 594.917744][T26830] 8021q: adding VLAN 0 to HW filter on device bond12 [ 594.960653][T26830] bond12: (slave veth5): Enslaving as an active interface with a down link [ 594.978595][T26830] bond12: (slave dummy0): making interface the new active one [ 594.988139][T26830] dummy0: entered promiscuous mode [ 594.994179][T26830] bond12: (slave dummy0): Enslaving as an active interface with an up link [ 595.904799][T26856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.915417][T26856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.923918][T26856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.932653][T26856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.940981][T26856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.949391][T26856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.958073][T26856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.966515][T26856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.974755][T26856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 595.983030][T26856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 596.058730][T26857] team1: left allmulticast mode [ 596.065828][T26857] team2: left allmulticast mode [ 596.072519][ T9270] ip6_tunnel: syztnl2 xmit: Local address not yet configured! [ 596.091128][T26857] geneve2: left promiscuous mode [ 596.681633][ T9270] ip6_tunnel: syztnl2 xmit: Local address not yet configured! [ 596.865884][T26889] __nla_validate_parse: 101 callbacks suppressed [ 596.865920][T26889] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5249'. [ 597.296354][T26889] veth11: entered allmulticast mode [ 597.581337][T26904] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5254'. [ 597.631108][T26897] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5251'. [ 597.661356][T26902] netlink: 'syz.1.5253': attribute type 15 has an invalid length. [ 597.879091][T26921] netlink: 11348 bytes leftover after parsing attributes in process `syz.0.5258'. [ 597.894047][T26923] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 597.900158][T26923] syzkaller1: linktype set to 270 [ 597.964596][T26926] lo speed is unknown, defaulting to 1000 [ 598.012639][T26910] bridge0: port 1(ipvlan3) entered blocking state [ 598.019302][T26910] bridge0: port 1(ipvlan3) entered disabled state [ 598.031973][T26910] ipvlan3: entered allmulticast mode [ 598.037816][T26910] bridge0: entered allmulticast mode [ 598.037892][T26930] netlink: 580 bytes leftover after parsing attributes in process `syz.3.5261'. [ 598.049690][T26910] ipvlan3: left allmulticast mode [ 598.064581][T26910] bridge0: left allmulticast mode [ 598.223617][T26926] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5260'. [ 598.716843][T26978] netlink: 'syz.4.5273': attribute type 2 has an invalid length. [ 598.929144][T26989] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5278'. [ 598.981185][T26994] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5280'. [ 599.012360][T26989] netlink: 24 bytes leftover after parsing attributes in process `syz.4.5278'. [ 599.123558][T27003] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5283'. [ 599.216539][T26987] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 599.271288][T27014] sctp: [Deprecated]: syz.1.5285 (pid 27014) Use of int in max_burst socket option. [ 599.271288][T27014] Use struct sctp_assoc_value instead [ 599.641243][T27036] tipc: Enabled bearer , priority 0 [ 599.660619][T27042] tipc: Resetting bearer [ 599.708754][T27034] tipc: Disabling bearer [ 599.747584][T27048] syzkaller0: entered promiscuous mode [ 599.753988][T27048] syzkaller0: entered allmulticast mode [ 599.768921][T27047] tipc: Enabled bearer , priority 0 [ 599.787247][T27047] tipc: Enabling of bearer rejected, already enabled [ 599.879151][T27047] tipc: Resetting bearer [ 599.905121][T27047] tipc: Disabling bearer [ 599.988546][T27060] syzkaller0: entered promiscuous mode [ 599.994224][T27060] syzkaller0: entered allmulticast mode [ 600.003913][T27060] tipc: Enabled bearer , priority 0 [ 600.012455][T27059] tipc: Resetting bearer [ 600.027157][T27059] tipc: Disabling bearer [ 600.165728][T27076] netlink: 'syz.1.5303': attribute type 11 has an invalid length. [ 600.539674][T27109] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 600.552730][T27108] sch_tbf: burst 88 is lower than device veth7 mtu (1514) ! [ 600.568582][T27109] ipt_ECN: cannot use operation on non-tcp rule [ 600.792177][T27119] syzkaller0: entered promiscuous mode [ 600.797727][T27119] syzkaller0: entered allmulticast mode [ 600.978909][T27130] ip6tnl3: entered allmulticast mode [ 600.987633][T27130] netlink: 'syz.2.5321': attribute type 11 has an invalid length. [ 601.217971][T27150] net_ratelimit: 34 callbacks suppressed [ 601.217992][T27150] openvswitch: netlink: ufid size 20 bytes exceeds the range (1, 16) [ 601.231792][T27150] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 601.315276][T27155] syzkaller1: entered promiscuous mode [ 601.320827][T27155] syzkaller1: entered allmulticast mode [ 601.367904][T27157] netlink: 'syz.1.5330': attribute type 1 has an invalid length. [ 601.473501][T27155] syzkaller1: left promiscuous mode [ 601.478935][T27155] syzkaller1: left allmulticast mode [ 601.887729][T27188] lo speed is unknown, defaulting to 1000 [ 601.921125][T27186] __nla_validate_parse: 19 callbacks suppressed [ 601.921161][T27186] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5335'. [ 602.023989][ T5623] block nbd2: Receive control failed (result -1) [ 602.074321][ T5623] Bluetooth: hci3: link tx timeout [ 602.079923][ T5623] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 602.089261][ T5619] Bluetooth: hci3: link tx timeout [ 602.094425][ T5619] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 602.107251][ T5619] Bluetooth: hci3: link tx timeout [ 602.112431][ T5619] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 602.120107][ T5619] Bluetooth: hci3: link tx timeout [ 602.125246][ T5619] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 602.136560][ T5619] Bluetooth: hci3: link tx timeout [ 602.141738][ T5619] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 602.149422][ T5619] Bluetooth: hci3: link tx timeout [ 602.154576][ T5619] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 602.169559][ T5619] Bluetooth: hci3: link tx timeout [ 602.174743][ T5619] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 602.182425][ T5619] Bluetooth: hci3: link tx timeout [ 602.187573][ T5619] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 602.202089][ T5619] Bluetooth: hci3: link tx timeout [ 602.207268][ T5619] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 602.219365][T27200] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.5337'. [ 602.223919][ T5619] Bluetooth: hci3: link tx timeout [ 602.233859][ T5619] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 602.241538][ T5619] Bluetooth: hci3: link tx timeout [ 602.246684][ T5619] Bluetooth: hci3: killing stalled connection 10:aa:aa:aa:aa:aa [ 602.262634][T27200] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 602.692247][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.700784][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 602.959525][T27226] netlink: 60 bytes leftover after parsing attributes in process `syz.2.5343'. [ 603.008341][T27228] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5343'. [ 603.091686][T27228] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5343'. [ 603.141118][T27228] netlink: 'syz.2.5343': attribute type 12 has an invalid length. [ 603.205726][T27228] netlink: 'syz.2.5343': attribute type 13 has an invalid length. [ 603.280538][T27240] netlink: 36 bytes leftover after parsing attributes in process `syz.0.5346'. [ 603.552274][T27249] netlink: 48 bytes leftover after parsing attributes in process `syz.4.5349'. [ 603.679513][T27256] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5350'. [ 603.706767][T27255] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5349'. [ 604.131554][ T5619] Bluetooth: hci3: command 0x0406 tx timeout [ 604.776881][T27302] netlink: 64 bytes leftover after parsing attributes in process `syz.2.5358'. [ 604.867487][T27310] syzkaller1: entered promiscuous mode [ 604.873040][T27310] syzkaller1: entered allmulticast mode [ 604.929290][T14116] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0xc7 [ 605.076158][ T5284] veth0_macvtap: left promiscuous mode [ 605.198093][T27310] syzkaller1: left promiscuous mode [ 605.207534][T27310] syzkaller1: left allmulticast mode [ 605.505868][T27354] netlink: 'syz.4.5366': attribute type 8 has an invalid length. [ 605.525676][T27354] syzkaller1: entered promiscuous mode [ 605.531896][T27354] syzkaller1: entered allmulticast mode [ 605.538204][T27305] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 605.725730][T27373] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 605.764312][T27366] 8021q: adding VLAN 0 to HW filter on device bond13 [ 605.823937][T27379] bond13 (unregistering): Released all slaves [ 606.245152][T27411] netlink: 'syz.1.5377': attribute type 1 has an invalid length. [ 606.328844][T27411] workqueue: Failed to create a rescuer kthread for wq "phy4": -EINTR [ 606.734544][ T13] dummy0: left promiscuous mode [ 606.831330][T27456] xt_NFQUEUE: number of total queues is 0 [ 607.027561][T27466] xfrm0: left allmulticast mode [ 607.117269][T27466] bond7: left promiscuous mode [ 607.139576][T27466] bond7: left allmulticast mode [ 607.184311][T27486] __nla_validate_parse: 6 callbacks suppressed [ 607.184332][T27486] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5392'. [ 607.225161][T27485] bridge6: entered promiscuous mode [ 607.230488][T27485] bridge6: entered allmulticast mode [ 607.242771][T27485] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5393'. [ 607.337099][T27490] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5394'. [ 607.375595][T27491] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5394'. [ 607.538919][T27508] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5398'. [ 607.577032][T27508] netlink: 'syz.0.5398': attribute type 12 has an invalid length. [ 607.585480][T27508] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5398'. [ 607.600060][T27508] netlink: 'syz.0.5398': attribute type 12 has an invalid length. [ 607.800733][T27522] netlink: 'syz.4.5402': attribute type 1 has an invalid length. [ 607.839375][T27522] netlink: 36 bytes leftover after parsing attributes in process `syz.4.5402'. [ 607.850078][T27525] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5401'. [ 607.855719][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 607.924844][T27528] syzkaller1: entered promiscuous mode [ 607.930389][T27528] syzkaller1: entered allmulticast mode [ 608.136589][T27550] netlink: 32 bytes leftover after parsing attributes in process `syz.3.5407'. [ 608.164179][T27550] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 608.193130][T27550] netlink: 'syz.3.5407': attribute type 1 has an invalid length. [ 608.333624][T27550] bond13: (slave geneve3): making interface the new active one [ 608.420974][T27550] bond13: (slave geneve3): Enslaving as an active interface with an up link [ 608.472940][T14119] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 20004 - 0 [ 608.492913][T14119] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 20004 - 0 [ 608.508271][T14119] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 20004 - 0 [ 608.565912][T14119] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 20004 - 0 [ 608.597909][T27575] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5409'. [ 608.668962][T27583] syzkaller0: entered promiscuous mode [ 608.681511][T27583] syzkaller0: entered allmulticast mode [ 608.702189][T27583] syz_tun: entered allmulticast mode [ 608.760567][T27583] syz_tun (unregistering): left allmulticast mode [ 608.828033][T27583] bond7: (slave syz_tun): Releasing active interface [ 609.622967][T27642] No such timeout policy "syz1" [ 609.805474][T27656] ip_vti0: entered promiscuous mode [ 609.821040][T27656] openvswitch: netlink: IPv4 tun info is not correct [ 610.165135][T27671] bond7: entered promiscuous mode [ 610.226680][T27671] sctp: [Deprecated]: syz.4.5429 (pid 27671) Use of int in max_burst socket option. [ 610.226680][T27671] Use struct sctp_assoc_value instead [ 610.292708][T27689] netlink: 'syz.0.5434': attribute type 1 has an invalid length. [ 610.369998][T27689] 8021q: adding VLAN 0 to HW filter on device bond9 [ 610.376019][ C1] ip6_tunnel: syztnl2 xmit: Local address not yet configured! [ 610.440064][T27699] x_tables: duplicate underflow at hook 1 [ 610.557889][T27696] bond9: (slave veth17): Enslaving as an active interface with a down link [ 610.736414][T27719] netlink: 'syz.4.5437': attribute type 13 has an invalid length. [ 611.504645][T27706] bridge0: port 2(bridge_slave_1) entered disabled state [ 611.513169][T27706] bridge0: port 1(bridge_slave_0) entered disabled state [ 611.693564][T27706] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 611.895605][T27742] netlink: 'syz.0.5443': attribute type 1 has an invalid length. [ 612.067018][T27749] ip6erspan0: left allmulticast mode [ 612.074780][T27749] bond2: left promiscuous mode [ 612.079588][T27749] bond2: left allmulticast mode [ 612.084578][T27749] bridge1: left allmulticast mode [ 612.089702][T27749] bridge2: left allmulticast mode [ 612.104016][T27749] geneve4: left promiscuous mode [ 612.120253][T27749] bond7: left promiscuous mode [ 612.129025][T27749] geneve5: left promiscuous mode [ 612.134029][T27749] geneve5: left allmulticast mode [ 612.142190][T27749] ip6tnl3: left allmulticast mode [ 612.147727][T27749] bridge6: left promiscuous mode [ 612.152700][T27749] bridge6: left allmulticast mode [ 612.163828][ T6402] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 612.172768][ T6402] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.200150][ T6402] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 612.209086][ T6402] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.218023][ T6402] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 612.261544][ T6402] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.320132][ T6402] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 612.334877][ T6402] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.386846][ T6402] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.416268][ T6402] netdevsim netdevsim2 netdevsim0: unset [1, 1] type 2 family 0 port 59476 - 0 [ 612.441678][ T6402] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.461660][ T6402] netdevsim netdevsim2 netdevsim1: unset [1, 1] type 2 family 0 port 59476 - 0 [ 612.482118][T27767] netlink: 'syz.1.5451': attribute type 1 has an invalid length. [ 612.495342][ T6402] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.514822][ T6402] netdevsim netdevsim2 netdevsim2: unset [1, 1] type 2 family 0 port 59476 - 0 [ 612.540143][T27766] __nla_validate_parse: 12 callbacks suppressed [ 612.540164][T27766] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5451'. [ 612.556590][ T6402] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 612.557642][T27766] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5451'. [ 612.573609][ T6402] netdevsim netdevsim2 netdevsim3: unset [1, 1] type 2 family 0 port 59476 - 0 [ 612.601778][T27767] bond6: entered promiscuous mode [ 612.608507][T27767] 8021q: adding VLAN 0 to HW filter on device bond6 [ 612.632405][T27774] bond6: (slave bridge8): making interface the new active one [ 612.640274][T27774] bridge8: entered promiscuous mode [ 612.647531][T27774] bond6: (slave bridge8): Enslaving as an active interface with an up link [ 612.830877][T27786] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5457'. [ 613.255811][T27808] netlink: 'syz.3.5463': attribute type 15 has an invalid length. [ 613.282084][T27808] netlink: 666 bytes leftover after parsing attributes in process `syz.3.5463'. [ 613.375726][T27809] openvswitch: netlink: IP tunnel dst address not specified [ 613.421289][T27820] netlink: 216 bytes leftover after parsing attributes in process `syz.2.5467'. [ 613.446737][T27823] tunl0: Caught tx_queue_len zero misconfig [ 613.453456][T27820] netlink: 'syz.2.5467': attribute type 2 has an invalid length. [ 613.642374][T27839] xt_connbytes: Forcing CT accounting to be enabled [ 613.665010][T27839] xt_CT: You must specify a L4 protocol and not use inversions on it [ 613.752498][T27850] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5472'. [ 613.792215][T27852] lo: entered allmulticast mode [ 613.809685][T27850] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 613.852048][T27850] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 613.872834][T27850] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5472'. [ 613.907890][T27856] veth0_to_team: entered promiscuous mode [ 613.914889][T27856] veth0_to_team: left promiscuous mode [ 613.925707][T27859] netlink: 'syz.4.5475': attribute type 4 has an invalid length. [ 613.934614][T27859] netlink: 17 bytes leftover after parsing attributes in process `syz.4.5475'. [ 613.970507][T27859] bond8 (unregistering): Released all slaves [ 614.117111][T27865] veth11: entered allmulticast mode [ 614.216526][ T57] bridge_slave_1: left allmulticast mode [ 614.226912][ T57] bridge_slave_1: left promiscuous mode [ 614.249147][ T57] bridge0: port 2(bridge_slave_1) entered disabled state [ 614.318916][T27884] netlink: 14 bytes leftover after parsing attributes in process `syz.0.5480'. [ 614.332920][ T57] pimreg9: left allmulticast mode [ 614.762929][ T57] bond10 (unregistering): (slave geneve4): Releasing active interface [ 614.805983][T27908] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5483'. [ 614.970655][ T57] bond1 (unregistering): (slave veth3): Releasing active interface [ 614.988160][ T57] batadv1: entered promiscuous mode [ 615.004202][ T57] bond1 (unregistering): (slave batadv1): Releasing active interface [ 615.015578][ T57] bond1 (unregistering): Released all slaves [ 615.033694][ T57] bond2 (unregistering): Released all slaves [ 615.051953][ T57] bond3 (unregistering): (slave dummy0): Releasing active interface [ 615.062378][ T57] bond3 (unregistering): Released all slaves [ 615.090920][ T57] bond4 (unregistering): Released all slaves [ 615.111113][ T57] bond5 (unregistering): (slave veth5): Releasing active interface [ 615.121330][ T57] bond5 (unregistering): Released all slaves [ 615.147698][ T57] bond6 (unregistering): Released all slaves [ 615.165084][ T57] bond7 (unregistering): Released all slaves [ 615.194374][ T57] bond8 (unregistering): Released all slaves [ 615.211562][ T57] bond9 (unregistering): Released all slaves [ 615.244632][ T57] bond0 (unregistering): Released all slaves [ 615.256933][ T57] bond10 (unregistering): Released all slaves [ 615.270293][T27908] workqueue: Failed to create a rescuer kthread for wq "bond8": -EINTR [ 615.465863][ T57] tipc: Left network mode [ 615.698719][T27938] netlink: 'syz.4.5488': attribute type 1 has an invalid length. [ 615.790178][T27938] bond8: (slave geneve3): making interface the new active one [ 615.802376][T27938] bond8: (slave geneve3): Enslaving as an active interface with an up link [ 615.811308][T14119] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 615.825465][T27938] bond8 (unregistering): (slave geneve3): Releasing active interface [ 615.838354][T27938] bond8 (unregistering): Released all slaves [ 615.860654][T14119] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 615.993540][ T57] hsr_slave_0: left promiscuous mode [ 616.004653][ T57] hsr_slave_1: left promiscuous mode [ 616.023191][ T57] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 616.067573][ T57] batman_adv: batadv0: Removing interface: ÿÿÿÿÿÿ [ 616.385093][T14119] smc: removing ib device syz0 [ 616.400448][T14119] smbdirect: ib_dev[syz0] removed [ 616.630102][T27838] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 617.141798][T27981] bond12: (slave dummy0): Releasing active interface [ 618.344700][T28028] geneve0: entered promiscuous mode [ 618.375609][T28028] macvlan2: entered promiscuous mode [ 618.409349][T28033] __nla_validate_parse: 5 callbacks suppressed [ 618.409368][T28033] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5502'. [ 618.473838][T28033] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5502'. [ 618.537234][T28033] macsec2: entered allmulticast mode [ 618.567431][T28033] bond0: entered allmulticast mode [ 618.592675][T28033] bond_slave_0: entered allmulticast mode [ 618.614009][T28033] bond_slave_1: entered allmulticast mode [ 618.637086][T28033] 8021q: adding VLAN 0 to HW filter on device macsec2 [ 618.690637][ T57] IPVS: stop unused estimator thread 0... [ 618.693939][T28050] netlink: 'syz.2.5504': attribute type 12 has an invalid length. [ 618.910580][T28057] macsec1: entered allmulticast mode [ 618.916568][T28057] bond0: (slave macsec1): Error -34 calling dev_set_mtu [ 619.118727][T28064] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5507'. [ 622.189585][T28066] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 622.424535][T28150] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 622.543244][T28155] block nbd4: NBD_DISCONNECT [ 622.733490][T28167] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5526'. [ 622.742686][T28167] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5526'. [ 622.883565][T28182] openvswitch: netlink: Missing valid actions attribute. [ 622.927748][T28182] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 622.972644][T28191] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5524'. [ 623.019297][T28190] lo speed is unknown, defaulting to 1000 [ 623.026669][ T6402] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 20004 - 0 [ 623.035385][T28190] lo speed is unknown, defaulting to 1000 [ 623.046308][ T6402] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 20004 - 0 [ 623.054825][ T6402] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 20004 - 0 [ 623.103132][T28190] lo speed is unknown, defaulting to 1000 [ 623.111061][ T6402] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 20004 - 0 [ 623.135654][T28190] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 623.149886][T28190] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 623.166792][T28190] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 623.187246][T28190] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 623.279263][T28190] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 623.309445][T28198] netlink: 24 bytes leftover after parsing attributes in process `syz.1.5532'. [ 623.342192][T28190] lo speed is unknown, defaulting to 1000 [ 623.348928][T28190] lo speed is unknown, defaulting to 1000 [ 623.355675][T28190] lo speed is unknown, defaulting to 1000 [ 623.364694][T28190] lo speed is unknown, defaulting to 1000 [ 623.371399][T28190] lo speed is unknown, defaulting to 1000 [ 623.378155][T28190] lo speed is unknown, defaulting to 1000 [ 623.401997][T28200] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5533'. [ 623.431199][T28200] netlink: 'syz.4.5533': attribute type 21 has an invalid length. [ 623.664132][T28219] syzkaller0: entered promiscuous mode [ 623.683477][T28221] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5540'. [ 623.689841][T28219] syzkaller0: entered allmulticast mode [ 623.948034][T28245] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5545'. [ 624.002847][T28247] C: renamed from veth1_to_team [ 624.009729][T28247] netlink: 'syz.3.5546': attribute type 8 has an invalid length. [ 624.018091][T28247] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 624.448505][T28283] netlink: 48 bytes leftover after parsing attributes in process `syz.3.5556'. [ 624.471651][T28283] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5556'. [ 624.623824][T28289] netlink: 'syz.3.5559': attribute type 13 has an invalid length. [ 624.668356][ T6402] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.689025][T28289] netlink: 'syz.3.5559': attribute type 13 has an invalid length. [ 624.701725][ T6402] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.710572][ T6402] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.719907][ T6402] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 624.793106][T28298] IPVS: set_ctl: invalid protocol: 58 224.0.0.1:20002 [ 624.811797][T28302] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5561'. [ 624.863208][T28299] netlink: 20 bytes leftover after parsing attributes in process `syz.4.5561'. [ 624.903465][T28305] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5563'. [ 625.239305][T28328] ip6gre2: entered promiscuous mode [ 625.252258][T28328] ip6gre2: entered allmulticast mode [ 625.355516][T28331] netlink: 'syz.3.5571': attribute type 1 has an invalid length. [ 625.417047][T28331] 8021q: adding VLAN 0 to HW filter on device bond14 [ 625.466630][T28342] bond14: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 625.486495][T28331] bond14: entered promiscuous mode [ 625.501626][T28331] bond14: entered allmulticast mode [ 625.568593][T28331] macvlan2: entered promiscuous mode [ 625.579938][T28331] macvlan2: entered allmulticast mode [ 625.589636][T28331] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 625.657686][T28353] syzkaller0: entered promiscuous mode [ 625.673201][T28353] syzkaller0: entered allmulticast mode [ 625.695027][T28353] tipc: Enabled bearer , priority 0 [ 625.707338][T28351] tipc: Resetting bearer [ 625.741222][T28351] tipc: Disabling bearer [ 626.227896][ T5623] block nbd3: Receive control failed (result -32) [ 626.227907][ T5619] block nbd3: Receive control failed (result -32) [ 626.316459][T28406] netlink: 'syz.2.5592': attribute type 13 has an invalid length. [ 626.324873][T28406] netlink: 'syz.2.5592': attribute type 17 has an invalid length. [ 626.376195][T28408] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5592'. [ 626.439121][T28406] 8021q: adding VLAN 0 to HW filter on device bond0 [ 626.479156][T28406] 8021q: adding VLAN 0 to HW filter on device team0 [ 626.507105][T28419] netlink: 'syz.4.5593': attribute type 1 has an invalid length. [ 626.514914][T28419] nbd: illegal input index -1426887320 [ 626.525669][T28406] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 626.654110][T28406] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 626.664531][T28406] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 626.678625][T28406] veth1_vlan: left promiscuous mode [ 626.685022][T28406] veth0_vlan: left promiscuous mode [ 626.690992][T28406] veth0_vlan: entered promiscuous mode [ 626.718442][T28406] veth1_vlan: entered promiscuous mode [ 626.727621][T28406] veth1_macvtap: left promiscuous mode [ 626.762229][T28406] veth0_macvtap: left promiscuous mode [ 626.768818][T28406] veth0_macvtap: entered promiscuous mode [ 626.775724][T28406] veth1_macvtap: entered promiscuous mode [ 626.827023][T28406] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 626.835370][T28406] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 626.844012][T28406] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 626.852385][T28406] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 626.904131][T28406] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 626.926669][ T5806] lo speed is unknown, defaulting to 1000 [ 626.940667][ T5806] syz0: Port: 1 Link ACTIVE [ 626.975033][ T57] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 626.983925][ T57] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 627.058270][ T57] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 627.142515][T28440] syzkaller1: entered promiscuous mode [ 627.154230][T28440] syzkaller1: entered allmulticast mode [ 627.162383][T28442] netlink: del zone limit has 8 unknown bytes [ 627.176056][ T57] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 627.269274][T28445] netlink: 'syz.0.5597': attribute type 4 has an invalid length. [ 627.301631][T28445] netlink: 'syz.0.5597': attribute type 4 has an invalid length. [ 627.341900][T28451] syzkaller1: entered promiscuous mode [ 627.353929][T28451] syzkaller1: entered allmulticast mode [ 627.431034][T28457] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5601'. [ 627.564516][T28465] netlink: 108 bytes leftover after parsing attributes in process `syz.0.5603'. [ 627.586986][T28465] erspan0: left promiscuous mode [ 627.603904][T28465] 8021q: adding VLAN 0 to HW filter on device bond0 [ 627.639757][T28465] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 627.654671][ T57] bridge0: port 2(bridge_slave_1) entered blocking state [ 627.661874][ T57] bridge0: port 2(bridge_slave_1) entered forwarding state [ 627.702327][T28470] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 627.721656][T28472] netlink: 'syz.2.5606': attribute type 12 has an invalid length. [ 627.955128][T28484] sctp: [Deprecated]: syz.0.5610 (pid 28484) Use of int in max_burst socket option. [ 627.955128][T28484] Use struct sctp_assoc_value instead [ 628.770982][T28555] __nla_validate_parse: 9 callbacks suppressed [ 628.771004][T28555] netlink: 36 bytes leftover after parsing attributes in process `syz.1.5634'. [ 628.833579][T28561] netlink: 56 bytes leftover after parsing attributes in process `syz.0.5633'. [ 628.868139][T28562] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 628.915640][T28568] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5636'. [ 628.989821][T28575] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5637'. [ 629.034494][T28568] bond8: entered promiscuous mode [ 629.040232][T28568] bond8: entered allmulticast mode [ 629.113624][T28568] netlink: 208240 bytes leftover after parsing attributes in process `syz.1.5636'. [ 629.224309][T28582] dvmrp6: entered allmulticast mode [ 629.309918][T28592] sock: sock_set_timeout: `syz.3.5642' (pid 28592) tries to set negative timeout [ 629.341173][T28593] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5641'. [ 629.372964][T28593] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5641'. [ 629.557044][T28606] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5648'. [ 629.582973][T28611] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 629.591131][T28611] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 629.624545][T28606] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5648'. [ 629.731077][T28620] netlink: 76 bytes leftover after parsing attributes in process `syz.1.5651'. [ 630.048612][T28637] validate_nla: 6 callbacks suppressed [ 630.048648][T28637] netlink: 'syz.1.5657': attribute type 1 has an invalid length. [ 630.125260][T28637] 8021q: adding VLAN 0 to HW filter on device bond9 [ 630.149768][T28639] syzkaller0: entered promiscuous mode [ 630.155535][T28639] syzkaller0: entered allmulticast mode [ 630.173048][T28637] bond9 (unregistering): Released all slaves [ 630.648587][T28668] tc action pedit 'at' offset 9 out of bounds [ 630.908540][ T5727] IPVS: starting estimator thread 0... [ 631.011622][T28685] IPVS: using max 41 ests per chain, 98400 per kthread [ 631.518379][T28716] lo speed is unknown, defaulting to 1000 [ 631.720218][T28728] netlink: 'syz.2.5687': attribute type 1 has an invalid length. [ 631.746557][T28728] netlink: 'syz.2.5687': attribute type 1 has an invalid length. [ 631.908545][T28737] IPVS: set_ctl: invalid protocol: 0 10.1.1.0:20001 [ 631.992641][T28743] tipc: Enabled bearer , priority 0 [ 632.056473][T28742] tipc: Disabling bearer [ 632.354149][T28753] bond0: left allmulticast mode [ 632.359097][T28753] bond_slave_0: left allmulticast mode [ 632.370447][T28753] bond_slave_1: left allmulticast mode [ 632.390264][T14116] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.532541][T14116] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.549299][T14116] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.577475][T14116] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 632.636979][T28770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 632.644955][T28770] 8021q: adding VLAN 0 to HW filter on device team0 [ 632.680810][T28770] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 632.740376][T28772] lo speed is unknown, defaulting to 1000 [ 632.938376][T28783] 8021q: adding VLAN 0 to HW filter on device bond15 [ 632.964470][T28791] netlink: 'syz.3.5704': attribute type 2 has an invalid length. [ 632.973558][T28791] netlink: 'syz.3.5704': attribute type 8 has an invalid length. [ 633.113877][T28800] bond9: option packets_per_slave: invalid value (1048582) [ 633.187024][T28800] bond9: option packets_per_slave: allowed values 0 - 65535 [ 633.215580][T28800] bond9 (unregistering): Released all slaves [ 633.295812][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 633.328933][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 633.457542][T28830] netlink: 'syz.2.5714': attribute type 10 has an invalid length. [ 633.560175][T28829] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.667652][T28829] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.752865][T28845] sctp: [Deprecated]: syz.0.5718 (pid 28845) Use of struct sctp_assoc_value in delayed_ack socket option. [ 633.752865][T28845] Use struct sctp_sack_info instead [ 633.868558][T28829] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 633.969229][T28829] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 634.152395][T28862] veth0: entered promiscuous mode [ 634.168053][ T100] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.201299][ T100] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.220848][T28860] veth0: left promiscuous mode [ 634.247035][ T13] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.282740][ T13] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 634.597420][T28884] __nla_validate_parse: 24 callbacks suppressed [ 634.597441][T28884] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5731'. [ 634.668932][T28884] bond15: option lacp_strict: mode dependency failed, not supported in mode balance-rr(0) [ 634.680328][T28884] bond15 (unregistering): Released all slaves [ 634.697805][T28888] syzkaller0: entered promiscuous mode [ 634.713961][T28888] syzkaller0: entered allmulticast mode [ 634.988602][T28892] xt_CONNSECMARK: invalid mode: 0 [ 635.067249][T28900] TCP: TCP_TX_DELAY enabled [ 635.656968][T28921] netlink: 'syz.4.5742': attribute type 1 has an invalid length. [ 635.922765][T28936] netlink: 76 bytes leftover after parsing attributes in process `syz.0.5747'. [ 636.106170][T28940] bridge0: left allmulticast mode [ 636.153845][T28945] netlink: 16 bytes leftover after parsing attributes in process `syz.3.5750'. [ 636.297239][T28952] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5753'. [ 636.448184][T28958] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5756'. [ 636.465706][T28959] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5756'. [ 636.475723][T28959] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5756'. [ 636.479175][T28958] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5756'. [ 636.521252][T28970] netlink: 132 bytes leftover after parsing attributes in process `syz.3.5760'. [ 636.536160][T28970] netlink: 12 bytes leftover after parsing attributes in process `syz.3.5760'. [ 637.524194][T29023] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 637.542706][T29023] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 638.039624][T29056] lo speed is unknown, defaulting to 1000 [ 638.282448][T29074] lo speed is unknown, defaulting to 1000 [ 639.592035][T29129] vlan5: entered promiscuous mode [ 639.605997][T29129] bond_slave_1: entered promiscuous mode [ 639.646075][T29125] vlan5: entered promiscuous mode [ 639.669106][T29144] netlink: 'syz.2.5805': attribute type 1 has an invalid length. [ 639.733701][T29144] 8021q: adding VLAN 0 to HW filter on device bond16 [ 639.796303][T29149] bond16: (slave veth15): Enslaving as an active interface with a down link [ 639.891300][T29162] netlink: 'syz.2.5811': attribute type 16 has an invalid length. [ 639.899189][T29162] __nla_validate_parse: 11 callbacks suppressed [ 639.899209][T29162] netlink: 64138 bytes leftover after parsing attributes in process `syz.2.5811'. [ 639.989954][T29154] netlink: 'syz.3.5808': attribute type 11 has an invalid length. [ 640.012204][T29154] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 640.063948][T29177] netlink: 136 bytes leftover after parsing attributes in process `syz.0.5815'. [ 640.076530][T29176] netlink: 20 bytes leftover after parsing attributes in process `syz.1.5816'. [ 640.130933][T29180] bond15: option tlb_dynamic_lb: invalid value (115) [ 640.139014][T29180] bond15 (unregistering): Released all slaves [ 640.351824][T29196] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5822'. [ 640.392935][T29203] vlan5: entered promiscuous mode [ 640.398048][T29203] batadv_slave_0: entered promiscuous mode [ 640.472424][T29206] netlink: 'syz.4.5824': attribute type 4 has an invalid length. [ 640.523319][T29211] netlink: 'syz.0.5826': attribute type 2 has an invalid length. [ 640.536549][T29203] netlink: 240 bytes leftover after parsing attributes in process `syz.4.5824'. [ 640.554964][T29211] netlink: 'syz.0.5826': attribute type 1 has an invalid length. [ 640.582485][T29211] netlink: 108 bytes leftover after parsing attributes in process `syz.0.5826'. [ 640.637255][T29218] netlink: 40 bytes leftover after parsing attributes in process `syz.3.5829'. [ 640.679308][T29218] ip6gre3: entered promiscuous mode [ 640.695500][T29218] ip6gre3: entered allmulticast mode [ 641.561997][T29246] netlink: 'syz.1.5837': attribute type 2 has an invalid length. [ 641.594362][T29246] netlink: 228 bytes leftover after parsing attributes in process `syz.1.5837'. [ 641.612867][T29247] netlink: 'syz.1.5837': attribute type 21 has an invalid length. [ 641.742290][T29247] netlink: 132 bytes leftover after parsing attributes in process `syz.1.5837'. [ 642.302940][T29288] netlink: 'syz.2.5851': attribute type 1 has an invalid length. [ 642.383147][T29288] 8021q: adding VLAN 0 to HW filter on device bond17 [ 642.701470][ T5619] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 642.708861][ T5619] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 642.716706][ T5619] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 642.725467][ T5619] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 642.733889][ T5619] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 643.200545][T29293] bond17: (slave veth17): Enslaving as an active interface with a down link [ 643.269772][T29301] bond17: entered allmulticast mode [ 643.587528][T29340] netlink: 'syz.4.5857': attribute type 1 has an invalid length. [ 643.604806][T29344] netlink: 'syz.4.5857': attribute type 1 has an invalid length. [ 643.856007][T29363] netlink: 'syz.0.5860': attribute type 10 has an invalid length. [ 643.903729][T29363] netlink: 40 bytes leftover after parsing attributes in process `syz.0.5860'. [ 643.976830][T29369] C: renamed from veth1_to_team [ 643.983508][T29369] netlink: 'syz.4.5862': attribute type 1 has an invalid length. [ 643.992428][T29369] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 644.036276][T29310] lo speed is unknown, defaulting to 1000 [ 644.538785][T29310] bridge0: port 1(bridge_slave_0) entered blocking state [ 644.546251][T29310] bridge0: port 1(bridge_slave_0) entered disabled state [ 644.554516][T29310] bridge_slave_0: entered allmulticast mode [ 644.562148][T29310] bridge_slave_0: entered promiscuous mode [ 644.570344][T29310] bridge0: port 2(bridge_slave_1) entered blocking state [ 644.579571][T29310] bridge0: port 2(bridge_slave_1) entered disabled state [ 644.587148][T29310] bridge_slave_1: entered allmulticast mode [ 644.594682][T29310] bridge_slave_1: entered promiscuous mode [ 644.629220][T29310] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 644.648502][T29310] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 644.735672][T29310] team0: Port device team_slave_0 added [ 644.756483][T29310] team0: Port device team_slave_1 added [ 644.772621][ T5619] Bluetooth: hci1: command tx timeout [ 644.836513][T29410] syzkaller0: entered promiscuous mode [ 644.843333][T29410] syzkaller0: entered allmulticast mode [ 644.958671][T29425] __nla_validate_parse: 6 callbacks suppressed [ 644.958690][T29425] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5874'. [ 645.044169][T29310] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 645.051290][T29310] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 645.080919][T29310] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 645.106560][T29310] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 645.114620][T29310] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 645.154030][T29310] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 645.244420][T29310] hsr_slave_0: entered promiscuous mode [ 645.256439][T29310] hsr_slave_1: entered promiscuous mode [ 645.536948][T29310] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 645.567974][T29450] bond0: (slave ip6tnl0): refused to change device type [ 645.615678][T29310] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 645.675585][T29310] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 645.701045][T29452] ip6erspan1: entered allmulticast mode [ 645.846678][T29310] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 645.950689][T29310] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 645.966196][T29310] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 645.974275][T29310] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 645.983860][T29310] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 645.991958][T29310] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 646.000899][T29310] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 646.008911][T29310] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 646.019157][T29310] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 646.068534][T29310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 646.085717][T29310] 8021q: adding VLAN 0 to HW filter on device team0 [ 646.096113][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 646.108421][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 646.123923][T14117] bridge0: port 2(bridge_slave_1) entered blocking state [ 646.131534][T14117] bridge0: port 2(bridge_slave_1) entered forwarding state [ 646.287579][T29475] netlink: 'syz.2.5885': attribute type 1 has an invalid length. [ 646.316351][T29475] 8021q: adding VLAN 0 to HW filter on device bond18 [ 646.329980][T29475] bond18: (slave veth0_to_bond): making interface the new active one [ 646.342369][T29475] bond18: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 646.358885][T29475] bond18: entered promiscuous mode [ 646.366739][T29475] veth0_to_bond: entered promiscuous mode [ 646.373093][T29475] bond18: entered allmulticast mode [ 646.378486][T29475] veth0_to_bond: entered allmulticast mode [ 646.393058][T29476] macvlan3: entered promiscuous mode [ 646.399021][T29476] macvlan3: entered allmulticast mode [ 646.406127][T29476] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 646.420620][T29476] bond18: (slave macvlan3): the slave hw address is in use by the bond; giving it the hw address of veth0_to_bond [ 646.476288][T29483] netlink: 16 bytes leftover after parsing attributes in process `syz.1.5887'. [ 646.716992][T29495] x_tables: ip_tables: osf match: only valid for protocol 6 [ 646.755884][T29495] netlink: 76 bytes leftover after parsing attributes in process `syz.1.5890'. [ 646.769810][T29500] netlink: 'syz.0.5891': attribute type 1 has an invalid length. [ 646.793298][T29495] bridge_slave_1: Caught tx_queue_len zero misconfig [ 646.805350][T29501] openvswitch: netlink: Duplicate or invalid key (type 0). [ 646.823827][T29501] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 646.853498][ T5619] Bluetooth: hci1: command tx timeout [ 647.055276][T29310] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 647.115380][T29508] vlan5: entered allmulticast mode [ 647.127324][T29508] veth0_to_bond: entered allmulticast mode [ 647.258343][T29310] veth0_vlan: entered promiscuous mode [ 647.296078][T29520] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5893'. [ 647.312617][T29310] veth1_vlan: entered promiscuous mode [ 647.405879][T29310] veth0_macvtap: entered promiscuous mode [ 647.440929][T29310] veth1_macvtap: entered promiscuous mode [ 647.480641][T29533] syzkaller0: entered promiscuous mode [ 647.496413][T29533] syzkaller0: entered allmulticast mode [ 647.512628][T29310] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 647.531938][T29310] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 647.553411][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.563208][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.572299][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.581197][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 647.639630][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 647.664988][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 647.707163][T29538] netlink: 'syz.0.5898': attribute type 12 has an invalid length. [ 647.724879][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 647.734836][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 647.744547][T29538] netlink: 190972 bytes leftover after parsing attributes in process `syz.0.5898'. [ 647.784966][T29544] syzkaller0: entered promiscuous mode [ 647.790684][T29544] syzkaller0: entered allmulticast mode [ 647.799334][T29541] syzkaller0: entered promiscuous mode [ 647.805096][T29541] syzkaller0: entered allmulticast mode [ 647.815787][T29544] tipc: Enabled bearer , priority 0 [ 647.830729][T29543] tipc: Resetting bearer [ 647.855404][T29543] tipc: Disabling bearer [ 647.863044][T29552] netlink: 'syz.4.5903': attribute type 1 has an invalid length. [ 647.925827][T29553] bridge_slave_0: left allmulticast mode [ 647.938580][T29553] bridge0: port 1(bridge_slave_0) entered disabled state [ 647.948790][T29557] netlink: 'syz.3.5904': attribute type 1 has an invalid length. [ 647.961348][T29553] bridge_slave_1: left promiscuous mode [ 647.967301][T29553] bridge0: port 2(bridge_slave_1) entered disabled state [ 647.978977][T29553] bond0: (slave bond_slave_0): Releasing backup interface [ 647.987713][T29553] bond0: (slave bond_slave_1): Releasing backup interface [ 647.997299][T29553] team0: Port device team_slave_0 removed [ 648.005085][T29553] team0: Port device team_slave_1 removed [ 648.011163][T29553] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 648.024682][T29553] bond6: (slave veth7): Releasing backup interface [ 648.123134][T29564] netlink: 'syz.2.5906': attribute type 10 has an invalid length. [ 648.377132][T29577] netlink: 'syz.4.5907': attribute type 1 has an invalid length. [ 648.411869][T29577] netlink: 16150 bytes leftover after parsing attributes in process `syz.4.5907'. [ 648.440595][T29579] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5910'. [ 648.581146][ T5623] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 648.589796][ T5623] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 648.599867][ T5623] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 648.610539][ T5623] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 648.621038][ T5623] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 648.951711][ T5623] Bluetooth: hci1: command tx timeout [ 648.996436][T29587] lo speed is unknown, defaulting to 1000 [ 649.136062][T29623] netlink: 64 bytes leftover after parsing attributes in process `syz.3.5919'. [ 649.269487][T29630] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5920'. [ 649.280667][T29630] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5920'. [ 649.291069][T29630] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 649.355787][T29636] syzkaller0: entered promiscuous mode [ 649.371266][T29636] syzkaller0: entered allmulticast mode [ 649.430562][T29639] tipc: Started in network mode [ 649.435549][T29639] tipc: Node identity 12c146bb9a3c, cluster identity 4711 [ 649.442795][T29639] tipc: Enabled bearer , priority 0 [ 649.476361][T29634] tipc: Resetting bearer [ 649.485031][T29634] tipc: Disabling bearer [ 649.493337][T29587] bridge0: port 1(bridge_slave_0) entered blocking state [ 649.506244][T29587] bridge0: port 1(bridge_slave_0) entered disabled state [ 649.515090][T29587] bridge_slave_0: entered allmulticast mode [ 649.522665][T29587] bridge_slave_0: entered promiscuous mode [ 649.531875][T29638] tipc: Enabled bearer , priority 0 [ 649.549135][T29587] bridge0: port 2(bridge_slave_1) entered blocking state [ 649.559052][T29587] bridge0: port 2(bridge_slave_1) entered disabled state [ 649.576630][T29587] bridge_slave_1: entered allmulticast mode [ 649.599150][T29587] bridge_slave_1: entered promiscuous mode [ 649.648414][T29637] tipc: Disabling bearer [ 649.725381][T29587] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 649.778798][T29587] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 649.801244][T29655] bridge_slave_1: left allmulticast mode [ 649.808383][T29655] syzkaller1: left promiscuous mode [ 649.814562][T29655] syzkaller1: left allmulticast mode [ 649.820241][T29655] veth7: left allmulticast mode [ 649.825951][T29655] bond7: left promiscuous mode [ 649.831008][T29655] ip6gre2: left promiscuous mode [ 649.847466][T29655] ip6gre2: left allmulticast mode [ 649.907550][T29587] team0: Port device team_slave_0 added [ 649.925463][T29587] team0: Port device team_slave_1 added [ 649.975233][T29587] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 649.989883][T29587] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 650.016805][T29587] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 650.031513][T29587] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 650.038741][T29587] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 650.077200][T29587] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 650.162238][T29587] hsr_slave_0: entered promiscuous mode [ 650.168806][T29587] hsr_slave_1: entered promiscuous mode [ 650.175764][T29587] debugfs: 'hsr0' already exists in 'hsr' [ 650.181658][T29587] Cannot create hsr debugfs directory [ 650.330525][T29670] __nla_validate_parse: 4 callbacks suppressed [ 650.330543][T29670] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5931'. [ 650.483124][T29681] x_tables: duplicate underflow at hook 3 [ 650.631544][T29686] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 650.691835][ T5623] Bluetooth: hci4: command tx timeout [ 650.748550][T29686] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 650.804892][T29694] syz_tun: entered promiscuous mode [ 650.816711][T29694] macsec1: entered allmulticast mode [ 650.832143][T29694] syz_tun: entered allmulticast mode [ 650.855310][T29694] syz_tun: left allmulticast mode [ 650.876779][T29694] syz_tun: left promiscuous mode [ 650.910556][T29686] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 650.931967][T29699] netlink: 7 bytes leftover after parsing attributes in process `syz.0.5937'. [ 650.946262][T29587] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 650.976469][T29587] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 650.984333][T29587] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 651.021925][ T5623] Bluetooth: hci1: command tx timeout [ 651.038369][T29587] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 651.046220][T29587] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 651.055834][T29587] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 651.077183][T29587] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 651.100712][T29587] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 651.176901][T29686] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 651.377413][ T57] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 651.426184][ T100] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 651.483560][ T100] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 651.545355][ T100] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 651.592574][T29587] 8021q: adding VLAN 0 to HW filter on device bond0 [ 651.655738][T29587] 8021q: adding VLAN 0 to HW filter on device team0 [ 651.684229][T29720] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5940'. [ 651.704746][T14117] bridge0: port 1(bridge_slave_0) entered blocking state [ 651.711946][T14117] bridge0: port 1(bridge_slave_0) entered forwarding state [ 651.753770][ T100] bridge0: port 2(bridge_slave_1) entered blocking state [ 651.760962][ T100] bridge0: port 2(bridge_slave_1) entered forwarding state [ 651.838382][T29587] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 651.848823][T29587] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 651.962953][T29724] lo speed is unknown, defaulting to 1000 [ 652.095123][T29730] lo speed is unknown, defaulting to 1000 [ 652.648874][T29756] Bluetooth: MGMT ver 1.23 [ 652.771745][ T5623] Bluetooth: hci4: command tx timeout [ 652.795751][T29761] netlink: 'syz.0.5948': attribute type 3 has an invalid length. [ 652.855320][T29587] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 653.007846][T29587] veth0_vlan: entered promiscuous mode [ 653.018100][T29765] xt_hashlimit: size too large, truncated to 1048576 [ 653.047604][T29587] veth1_vlan: entered promiscuous mode [ 653.112227][T29587] veth0_macvtap: entered promiscuous mode [ 653.142132][T29587] veth1_macvtap: entered promiscuous mode [ 653.212170][T29587] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 653.258033][T29587] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 653.323479][ T6408] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.374718][ T6408] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.407361][ T6408] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.459343][ T6408] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 653.742939][T29789] gtp3: entered promiscuous mode [ 653.766946][T29789] gtp3: entered allmulticast mode [ 653.949373][ T100] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 653.978649][ T100] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 654.059649][T14119] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 654.091223][T14119] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 654.275872][T29807] IPVS: set_ctl: invalid protocol: 59 0.0.0.0:20000 [ 654.342854][T29810] netlink: 'syz.2.5960': attribute type 27 has an invalid length. [ 654.469247][T29819] xt_time: unknown flags 0xf4 [ 654.851835][ T5623] Bluetooth: hci4: command tx timeout [ 654.998342][T29833] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 655.405323][T29854] netlink: 766 bytes leftover after parsing attributes in process `syz.3.5972'. [ 655.586650][T29866] netlink: 8 bytes leftover after parsing attributes in process `syz.1.5977'. [ 655.824470][T29875] bond0: entered promiscuous mode [ 655.834681][T29875] bond_slave_0: entered promiscuous mode [ 655.849336][T29875] bond_slave_1: entered promiscuous mode [ 655.872769][T29875] bond0: left promiscuous mode [ 655.884206][T29875] bond_slave_0: left promiscuous mode [ 655.900089][T29875] bond_slave_1: left promiscuous mode [ 655.931517][T29877] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5980'. [ 656.125551][T29884] sctp: [Deprecated]: syz.1.5982 (pid 29884) Use of int in max_burst socket option. [ 656.125551][T29884] Use struct sctp_assoc_value instead [ 656.153136][T29885] netlink: 'syz.2.5983': attribute type 1 has an invalid length. [ 656.279892][T29885] 8021q: adding VLAN 0 to HW filter on device bond19 [ 656.331328][T29886] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 656.372811][T29886] bond19: (slave batadv2): making interface the new active one [ 656.407885][T29886] bond19: (slave batadv2): Enslaving as an active interface with an up link [ 656.500828][T29894] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5985'. [ 656.517177][T29891] lo speed is unknown, defaulting to 1000 [ 656.543160][T29892] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5985'. [ 656.599446][T29899] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5986'. [ 656.661661][T29899] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5986'. [ 656.838449][T29904] netlink: 72 bytes leftover after parsing attributes in process `syz.2.5987'. [ 656.892992][T29905] netlink: 'syz.1.5988': attribute type 12 has an invalid length. [ 656.941849][ T5623] Bluetooth: hci4: command tx timeout [ 656.951972][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 656.957397][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 656.962783][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 656.968167][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 656.973553][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 656.978939][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 656.984325][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 656.989714][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 656.995106][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 657.000514][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 657.062531][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 657.090553][T29906] tap0: tun_chr_ioctl cmd 2148553947 [ 657.121000][T29905] tap0: tun_chr_ioctl cmd 1074025673 [ 658.446314][T29965] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6002'. [ 658.820414][T29984] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6007'. [ 659.281256][T30013] netlink: 'syz.4.6014': attribute type 3 has an invalid length. [ 659.439860][T30023] xt_ipcomp: unknown flags 1D [ 659.687882][T30041] IPVS: rr: SCTP 172.20.20.187:0 - no destination available [ 659.908893][T30066] syzkaller0: entered promiscuous mode [ 659.916381][T30066] syzkaller0: entered allmulticast mode [ 660.063740][T30078] syzkaller0: entered promiscuous mode [ 660.079834][T30078] syzkaller0: entered allmulticast mode [ 660.087095][T30081] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 660.101051][T30078] tipc: Enabled bearer , priority 0 [ 660.110921][T30078] tipc: Resetting bearer [ 660.122066][T30077] tipc: Resetting bearer [ 660.135863][T30077] tipc: Disabling bearer [ 660.451642][ T5619] Bluetooth: hci4: command 0x0405 tx timeout [ 660.463153][T30103] __nla_validate_parse: 9 callbacks suppressed [ 660.463189][T30103] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6041'. [ 660.481787][T30104] netlink: 112 bytes leftover after parsing attributes in process `syz.1.6038'. [ 660.663359][T30109] netlink: 'syz.1.6038': attribute type 10 has an invalid length. [ 660.686888][T30104] xt_TCPMSS: Only works on TCP SYN packets [ 660.689099][T30103] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 660.700760][T30103] IPv6: NLM_F_CREATE should be set when creating new route [ 660.754506][T30108] nbd: nbd2 already in use [ 660.765763][T30108] block nbd0: NBD_DISCONNECT [ 660.780348][T30108] block nbd0: Send disconnect failed -32 [ 660.797093][T30108] block nbd0: Send disconnect failed -32 [ 660.811588][T30108] block nbd0: shutting down sockets [ 660.854574][ T57] bridge0: port 1(vlan3) entered disabled state [ 660.978606][T30120] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6043'. [ 661.141137][ T57] bond1 (unregistering): (slave ip6gretap1): Releasing active interface [ 661.172212][ T57] bond4 (unregistering): (slave ip6gretap3): Releasing active interface [ 661.258173][ T57] xfrm0 (unregistering): left allmulticast mode [ 661.284000][ T57] team0: Port device xfrm0 removed [ 661.330455][ T57] bond9 (unregistering): (slave gretap3): Releasing backup interface [ 661.361493][ T57] team0: Port device gtp2 removed [ 661.377857][ T57] bond6 (unregistering): (slave geneve3): Releasing backup interface [ 661.430521][ T57] bond14 (unregistering): (slave bridge6): Releasing active interface [ 661.438744][ T57] bridge6 (unregistering): left promiscuous mode [ 661.445146][ T57] bridge6 (unregistering): left allmulticast mode [ 661.455469][ T57] bond0 (unregistering): (slave team0): Releasing backup interface [ 661.463423][ T5623] Bluetooth: hci3: command 0x0406 tx timeout [ 661.469915][ T57] team0: left allmulticast mode [ 661.475106][ T57] tipc: Resetting bearer [ 661.481288][ T57] tipc: Resetting bearer [ 661.486745][ T57] bond0 (unregistering): Released all slaves [ 661.495968][ T57] bond1 (unregistering): Released all slaves [ 661.517590][ T57] bond2 (unregistering): Released all slaves [ 661.529328][ T57] bond3 (unregistering): Released all slaves [ 661.541174][ T57] bond4 (unregistering): Released all slaves [ 661.552782][ T57] bond5 (unregistering): Released all slaves [ 661.566065][ T57] bond6 (unregistering): Released all slaves [ 661.583663][ T57] bond7 (unregistering): Released all slaves [ 661.596074][ T57] bond8 (unregistering): Released all slaves [ 661.608304][ T57] bond9 (unregistering): (slave bond10): Releasing backup interface [ 661.624134][ T57] bond9 (unregistering): Released all slaves [ 661.644288][ T57] bond10 (unregistering): Released all slaves [ 661.659304][ T57] bond11 (unregistering): Released all slaves [ 661.670035][ T57] bond12 (unregistering): Released all slaves [ 661.680627][ T57] bond13 (unregistering): Released all slaves [ 661.694401][ T57] bond14 (unregistering): Released all slaves [ 661.881120][ T57] : left promiscuous mode [ 662.197574][ T57] tipc: Disabling bearer [ 662.205021][ T57] tipc: Left network mode [ 662.210522][T30164] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 662.259255][T30178] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6057'. [ 662.322883][T30177] mac80211_hwsim hwsim71 wlan0: entered promiscuous mode [ 662.330026][T30177] mac80211_hwsim hwsim71 wlan0: entered allmulticast mode [ 662.337692][T30177] A link change request failed with some changes committed already. Interface wlan0 may have been left with an inconsistent configuration, please check. [ 662.571717][T30195] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6062'. [ 662.778142][T30213] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6064'. [ 662.884021][T30209] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6064'. [ 662.947796][T30226] openvswitch: netlink: IPv4 tunnel dst address is zero [ 663.341859][T30250] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6068'. [ 663.373871][T30252] netlink: 'syz.4.6069': attribute type 11 has an invalid length. [ 663.487917][T30252] netlink: 'syz.4.6069': attribute type 11 has an invalid length. [ 663.617115][T30258] netlink: 'syz.1.6070': attribute type 16 has an invalid length. [ 663.647360][T30254] ip6gretap0: left promiscuous mode [ 663.656375][T30258] netlink: 37934 bytes leftover after parsing attributes in process `syz.1.6070'. [ 663.700078][T30254] 8021q: adding VLAN 0 to HW filter on device bond0 [ 663.713831][T30254] 8021q: adding VLAN 0 to HW filter on device team0 [ 663.766271][T30254] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 663.866410][T30254] veth1_vlan: left promiscuous mode [ 663.886559][T30254] veth0_vlan: left promiscuous mode [ 663.906551][T30254] veth0_vlan: entered promiscuous mode [ 663.927984][T30254] veth1_vlan: entered promiscuous mode [ 663.939946][T30272] x_tables: duplicate underflow at hook 1 [ 663.958165][T30254] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 663.967754][T30254] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 663.977719][T30254] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 663.988171][T30254] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 664.007352][T30254] 8021q: adding VLAN 0 to HW filter on device bond1 [ 664.088843][T30254] 8021q: adding VLAN 0 to HW filter on device bond2 [ 664.105100][T30254] 8021q: adding VLAN 0 to HW filter on device bond3 [ 664.115421][T30254] 8021q: adding VLAN 0 to HW filter on device bond4 [ 664.124396][T30254] ip6gretap0: entered promiscuous mode [ 664.130981][T30254] 8021q: adding VLAN 0 to HW filter on device team1 [ 664.143650][T30254] 8021q: adding VLAN 0 to HW filter on device team2 [ 664.154362][T30254] 8021q: adding VLAN 0 to HW filter on device bond5 [ 664.169472][T30254] A link change request failed with some changes committed already. Interface geneve2 may have been left with an inconsistent configuration, please check. [ 664.297478][T30269] bond1: option xmit_hash_policy: invalid value (10) [ 664.307696][T30269] bond1 (unregistering): Released all slaves [ 664.326691][T14119] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 664.335695][T14119] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.354104][ T6408] ip6_tunnel: syztnl2 xmit: Local address not yet configured! [ 664.361909][ T6408] ip6_tunnel: syztnl2 xmit: Local address not yet configured! [ 664.378917][T14119] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 664.388060][T14119] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.398763][ T5735] ip6_tunnel: syztnl2 xmit: Local address not yet configured! [ 664.409275][T30281] veth0_to_bridge: entered promiscuous mode [ 664.415323][T30281] veth0_to_bridge: entered allmulticast mode [ 664.421862][T30283] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6076'. [ 664.431223][T14119] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 664.440254][T14119] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.457321][T14119] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 664.467115][T14119] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.689136][ T57] hsr_slave_0: left promiscuous mode [ 664.707447][ T57] hsr_slave_1: left promiscuous mode [ 664.777354][T30301] openvswitch: netlink: nsh attr 8 is out of range max 3 [ 664.784478][T30301] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 665.172197][ T9285] ip6_tunnel: syztnl2 xmit: Local address not yet configured! [ 665.196491][ T9288] ip6_tunnel: syztnl2 xmit: Local address not yet configured! [ 665.272711][ T5619] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 665.288639][ T5619] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 665.297793][ T5619] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 665.306896][ T5619] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 665.315174][ T5619] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 665.633567][T30319] veth0_to_bridge: left promiscuous mode [ 665.639370][T30319] veth0_to_bridge: left allmulticast mode [ 665.838021][ T48] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 665.857509][ T48] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 665.884234][ T48] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 665.917487][ T48] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 665.945270][T30356] __nla_validate_parse: 7 callbacks suppressed [ 665.945284][T30356] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6090'. [ 665.960750][T30356] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6090'. [ 665.977509][T30349] bond1 (unregistering): Released all slaves [ 665.995579][ T48] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 666.005658][ T48] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.021498][ T48] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 666.040937][ T48] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.131867][ T57] IPVS: stop unused estimator thread 0... [ 666.157969][T30363] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6091'. [ 666.184526][T30366] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6093'. [ 666.304229][T30373] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 666.313596][T30373] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 666.322526][T30373] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 666.348655][T30376] netlink: 260 bytes leftover after parsing attributes in process `syz.1.6096'. [ 666.364526][T30324] lo speed is unknown, defaulting to 1000 [ 666.593807][T30400] lo speed is unknown, defaulting to 1000 [ 666.666476][T30405] netlink: 92 bytes leftover after parsing attributes in process `syz.0.6102'. [ 666.719287][T30324] bridge0: port 1(bridge_slave_0) entered blocking state [ 666.726848][T30324] bridge0: port 1(bridge_slave_0) entered disabled state [ 666.734243][T30324] bridge_slave_0: entered allmulticast mode [ 666.741912][T30324] bridge_slave_0: entered promiscuous mode [ 666.750034][T30324] bridge0: port 2(bridge_slave_1) entered blocking state [ 666.757452][T30324] bridge0: port 2(bridge_slave_1) entered disabled state [ 666.764858][T30324] bridge_slave_1: entered allmulticast mode [ 666.772685][T30324] bridge_slave_1: entered promiscuous mode [ 666.794833][T30324] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 666.807191][T30324] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 666.831299][T30324] team0: Port device team_slave_0 added [ 666.839369][T30324] team0: Port device team_slave_1 added [ 666.862228][T30324] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 666.869333][T30324] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 666.895566][T30324] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 666.909514][T30324] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 666.917790][T30324] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 666.945122][T30324] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 666.989489][T30324] hsr_slave_0: entered promiscuous mode [ 666.996935][T30324] hsr_slave_1: entered promiscuous mode [ 667.003674][T30324] debugfs: 'hsr0' already exists in 'hsr' [ 667.009815][T30324] Cannot create hsr debugfs directory [ 667.117694][T30324] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.185728][T30324] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.235948][T30324] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.294746][T30324] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.331672][ T5623] Bluetooth: hci5: command tx timeout [ 667.392919][T30324] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 667.406672][T30324] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 667.417006][T30324] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 667.427736][T30324] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 667.444497][T30324] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 667.466287][T30324] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 667.488138][T30324] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 667.528537][T30324] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 667.600828][T30422] veth0_to_team: entered promiscuous mode [ 667.613099][T30422] erspan0: entered promiscuous mode [ 667.619974][T30422] erspan0: left promiscuous mode [ 667.655205][T30422] veth0_to_team: left promiscuous mode [ 667.780710][T30324] 8021q: adding VLAN 0 to HW filter on device bond0 [ 667.824895][T30324] 8021q: adding VLAN 0 to HW filter on device team0 [ 667.848562][ T6402] bridge0: port 1(bridge_slave_0) entered blocking state [ 667.855773][ T6402] bridge0: port 1(bridge_slave_0) entered forwarding state [ 667.880784][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 667.887982][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 667.888674][T30434] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6107'. [ 667.927564][T30434] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6107'. [ 668.085538][T30446] netlink: 280 bytes leftover after parsing attributes in process `syz.1.6110'. [ 668.121938][T30446] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6110'. [ 668.235452][T30462] netlink: 'syz.0.6115': attribute type 1 has an invalid length. [ 668.269229][T30446] bridge0: port 2(bridge_slave_1) entered disabled state [ 668.276770][T30446] bridge0: port 1(bridge_slave_0) entered disabled state [ 668.332991][T30471] netlink: 'syz.4.6118': attribute type 1 has an invalid length. [ 668.390029][T30446] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 668.410675][T30446] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 668.425960][T30477] netlink: 'syz.3.6120': attribute type 2 has an invalid length. [ 668.570779][T30462] bond10: entered promiscuous mode [ 668.583331][T30462] 8021q: adding VLAN 0 to HW filter on device bond10 [ 668.608744][T30469] bond10: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 668.634934][T30469] bond10: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 668.646120][T30469] bond10: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 668.667618][T14117] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 668.695817][T14117] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 668.712957][T14117] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 668.722628][T14117] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 668.736491][T30481] syzkaller0: entered promiscuous mode [ 668.749855][T30481] syzkaller0: entered allmulticast mode [ 669.139492][T30324] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 669.254522][T30324] veth0_vlan: entered promiscuous mode [ 669.293036][T30324] veth1_vlan: entered promiscuous mode [ 669.355724][T30324] veth0_macvtap: entered promiscuous mode [ 669.386405][T30324] veth1_macvtap: entered promiscuous mode [ 669.411641][ T5623] Bluetooth: hci5: command tx timeout [ 669.438960][T30324] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 669.500747][T30537] 8021q: adding VLAN 0 to HW filter on device bond11 [ 669.523016][T30324] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 669.540859][ T48] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.577063][ T48] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.591958][ T48] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.654205][ T48] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.757452][T14117] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 669.797101][T14117] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 669.846979][ T100] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 669.863702][ T100] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 670.036208][T30567] netlink: 'syz.3.6141': attribute type 32 has an invalid length. [ 670.262928][T30580] netlink: 'syz.3.6148': attribute type 1 has an invalid length. [ 670.323987][T30580] bond1: entered promiscuous mode [ 670.329284][T30580] bond1: entered allmulticast mode [ 670.334957][T30580] 8021q: adding VLAN 0 to HW filter on device bond1 [ 670.371762][T30586] netlink: 'syz.2.6149': attribute type 2 has an invalid length. [ 670.425046][T30588] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 670.591993][T30596] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci5/hci5:200/input9 [ 670.681845][T30601] xt_ipcomp: unknown flags 1D [ 671.427612][T30637] openvswitch: netlink: Key type 2822 is out of range max 32 [ 671.446920][T30639] __nla_validate_parse: 16 callbacks suppressed [ 671.446942][T30639] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6165'. [ 671.492650][ T5623] Bluetooth: hci5: command tx timeout [ 672.171680][T30660] block nbd0: server does not support multiple connections per device. [ 672.184940][T30660] block nbd0: shutting down sockets [ 672.228140][T30667] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6174'. [ 672.272284][T30667] xt_hashlimit: size too large, truncated to 1048576 [ 672.333386][T30674] netlink: 'syz.1.6177': attribute type 1 has an invalid length. [ 672.380343][T30674] 8021q: adding VLAN 0 to HW filter on device bond1 [ 672.399722][T30676] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6174'. [ 672.427011][T30684] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6174'. [ 672.455131][T30684] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6174'. [ 672.467087][T30684] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6174'. [ 672.500723][T30683] syzkaller0: entered promiscuous mode [ 672.517000][T30683] syzkaller0: entered allmulticast mode [ 672.818363][T30708] tipc: Enabling of bearer rejected, failed to enable media [ 673.308398][T30736] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6190'. [ 673.571809][ T5623] Bluetooth: hci5: command tx timeout [ 673.660274][T30754] sch_tbf: peakrate 2 is lower than or equals to rate 8 ! [ 673.713872][T30758] xt_hashlimit: size too large, truncated to 1048576 [ 674.673899][T30792] syzkaller0: entered promiscuous mode [ 674.679519][T30792] syzkaller0: entered allmulticast mode [ 674.695439][T30789] netlink: 60 bytes leftover after parsing attributes in process `syz.4.6203'. [ 674.712441][T30797] gretap0: entered promiscuous mode [ 674.717984][T30797] vlan2: entered promiscuous mode [ 674.753546][T30802] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6209'. [ 674.795063][T30802] 8021q: adding VLAN 0 to HW filter on device bond2 [ 674.855292][T30813] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6211'. [ 675.086014][T30823] netlink: 'syz.2.6215': attribute type 1 has an invalid length. [ 675.215134][T30830] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 675.246969][T30831] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 675.411749][T30838] erspan2: entered allmulticast mode [ 675.686927][T30857] tipc: Enabling of bearer rejected, failed to enable media [ 675.747592][T30855] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 675.763511][T30855] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 675.781617][T30855] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 675.798818][T30855] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 675.930664][T30861] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 676.036893][T30877] netlink: 'syz.0.6229': attribute type 9 has an invalid length. [ 676.543030][T30911] __nla_validate_parse: 6 callbacks suppressed [ 676.543050][T30911] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6236'. [ 676.603339][T30911] syzkaller0: entered promiscuous mode [ 676.617747][T30911] syzkaller0: entered allmulticast mode [ 676.640984][T30911] netlink: 108 bytes leftover after parsing attributes in process `syz.4.6236'. [ 677.113809][T30936] netlink: 'syz.4.6240': attribute type 1 has an invalid length. [ 677.136296][T30936] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6240'. [ 677.374718][T30953] ip6erspan0: entered allmulticast mode [ 677.995608][T30985] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6253'. [ 678.210455][T31002] openvswitch: netlink: IPv4 tun info is not correct [ 678.227805][T31001] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6256'. [ 678.277720][T31001] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6256'. [ 678.495178][T31024] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6263'. [ 678.587043][T31024] geneve4: entered promiscuous mode [ 678.633589][ T100] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 678.685056][ T100] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 678.730606][ T100] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 678.775154][ T100] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 678.857725][T31038] syzkaller0: entered promiscuous mode [ 678.867009][T31038] syzkaller0: entered allmulticast mode [ 678.878393][T31042] tipc: Enabled bearer , priority 0 [ 678.909359][T31042] syzkaller0: entered promiscuous mode [ 678.915923][T31042] syzkaller0: entered allmulticast mode [ 678.926332][T31042] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 678.967827][T31042] tipc: Resetting bearer [ 679.004110][T31042] tipc: Resetting bearer [ 679.032813][T31042] tipc: Disabling bearer [ 679.061735][T31037] syzkaller0: entered promiscuous mode [ 679.071098][T31047] Cannot find set identified by id 0 to match [ 679.077957][T31037] syzkaller0: entered allmulticast mode [ 679.102420][T31033] netlink: 56 bytes leftover after parsing attributes in process `syz.1.6266'. [ 679.117606][T31042] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6268'. [ 679.166219][T31042] netdevsim netdevsim4 netdevsim0: entered allmulticast mode [ 679.275177][T31057] syzkaller0: entered promiscuous mode [ 679.283799][T31057] syzkaller0: entered allmulticast mode [ 679.290886][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 679.299485][ T57] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 679.469155][T31069] IPVS: persistence engine module ip_vs_pe_À not found [ 679.480626][T31068] 8021q: VLANs not supported on syzkaller1 [ 679.529295][T31074] syzkaller0: renamed from batadv_slave_1 (while UP) [ 679.549568][T31074] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6277'. [ 679.577074][T31078] syz_tun: entered allmulticast mode [ 679.599802][T31078] dvmrp6: entered allmulticast mode [ 679.689468][T31080] 5Ò: entered promiscuous mode [ 679.736074][T31085] netlink: 'syz.2.6279': attribute type 49 has an invalid length. [ 679.840095][T31085] ip6gretap0: entered promiscuous mode [ 679.852092][T31085] ip6gretap0: entered allmulticast mode [ 680.390966][T31077] syz_tun: left allmulticast mode [ 680.816877][ T5619] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 680.836512][ T5619] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 680.846535][ T5619] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 680.860294][ T5619] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 680.869174][ T5619] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 681.529681][T31182] 8021q: VLANs not supported on ip_vti0 [ 681.747393][T31132] lo speed is unknown, defaulting to 1000 [ 681.828409][T31191] __nla_validate_parse: 3 callbacks suppressed [ 681.828429][T31191] netlink: 208240 bytes leftover after parsing attributes in process `syz.2.6306'. [ 681.925497][T31200] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6307'. [ 681.935234][T31200] netlink: 'syz.2.6307': attribute type 29 has an invalid length. [ 681.944249][T31200] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6307'. [ 681.967721][T31198] syzkaller0: entered promiscuous mode [ 681.973468][T31200] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6307'. [ 681.973496][T31200] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6307'. [ 681.993728][T31198] syzkaller0: entered allmulticast mode [ 682.006684][T31200] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6307'. [ 682.016036][T31200] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6307'. [ 682.133886][T31205] netlink: 'syz.2.6309': attribute type 11 has an invalid length. [ 682.172906][T31208] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6310'. [ 682.322682][T31219] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6314'. [ 682.386622][T31132] bridge0: port 1(bridge_slave_0) entered blocking state [ 682.407523][T31132] bridge0: port 1(bridge_slave_0) entered disabled state [ 682.428702][T31132] bridge_slave_0: entered allmulticast mode [ 682.447375][T31132] bridge_slave_0: entered promiscuous mode [ 682.479446][T31132] bridge0: port 2(bridge_slave_1) entered blocking state [ 682.507301][T31132] bridge0: port 2(bridge_slave_1) entered disabled state [ 682.534069][T31132] bridge_slave_1: entered allmulticast mode [ 682.546575][T31233] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6313'. [ 682.567915][T31132] bridge_slave_1: entered promiscuous mode [ 682.686669][T31132] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 682.733714][T31132] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 682.830211][T31132] team0: Port device team_slave_0 added [ 682.867925][T31132] team0: Port device team_slave_1 added [ 682.943431][ T5619] Bluetooth: hci0: command tx timeout [ 682.967454][T31247] bond13: entered promiscuous mode [ 683.008428][T31249] syzkaller0: entered promiscuous mode [ 683.024633][T31249] syzkaller0: entered allmulticast mode [ 683.041178][T31132] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 683.057157][T31132] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 683.095899][T31132] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 683.132924][T31132] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 683.142546][T31132] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 683.218486][T31132] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 683.274112][T31260] netlink: 'syz.1.6318': attribute type 9 has an invalid length. [ 683.440223][T31132] hsr_slave_0: entered promiscuous mode [ 683.479699][T31132] hsr_slave_1: entered promiscuous mode [ 683.548729][T31132] debugfs: 'hsr0' already exists in 'hsr' [ 683.604601][T31132] Cannot create hsr debugfs directory [ 683.802796][T31279] sctp: [Deprecated]: syz.1.6322 (pid 31279) Use of int in maxseg socket option. [ 683.802796][T31279] Use struct sctp_assoc_value instead [ 684.396858][T31287] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 684.846420][T31321] netlink: 'syz.4.6329': attribute type 2 has an invalid length. [ 684.888412][T31324] netlink: 'syz.1.6332': attribute type 1 has an invalid length. [ 684.920117][T31321] netlink: 'syz.4.6329': attribute type 1 has an invalid length. [ 685.014733][ T5619] Bluetooth: hci0: command tx timeout [ 685.297873][T31316] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 685.383355][T31316] bond1: left promiscuous mode [ 685.495961][T14117] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 685.672888][T31132] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 685.704677][T31132] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 685.713814][T31132] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 685.733894][T31132] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 685.745464][T31132] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 685.774242][T31132] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 685.811562][T31132] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 685.829504][T31132] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 685.931777][T31366] syz_tun: entered allmulticast mode [ 685.957726][T31366] veth1_to_team: entered allmulticast mode [ 686.020365][T31132] 8021q: adding VLAN 0 to HW filter on device bond0 [ 686.037408][T31374] Bluetooth: MGMT ver 1.23 [ 686.046941][T31363] syz_tun: left allmulticast mode [ 686.076833][T31132] 8021q: adding VLAN 0 to HW filter on device team0 [ 686.113643][T14119] bridge0: port 1(bridge_slave_0) entered blocking state [ 686.120831][T14119] bridge0: port 1(bridge_slave_0) entered forwarding state [ 686.182854][T14119] bridge0: port 2(bridge_slave_1) entered blocking state [ 686.190061][T14119] bridge0: port 2(bridge_slave_1) entered forwarding state [ 686.324247][T31397] netlink: 'syz.4.6350': attribute type 1 has an invalid length. [ 686.379080][T31397] 8021q: adding VLAN 0 to HW filter on device bond14 [ 686.421348][T31401] vlan5: entered promiscuous mode [ 686.440598][T31401] bond14: entered promiscuous mode [ 686.446631][T31401] vlan5: entered allmulticast mode [ 686.454504][T31401] bond14: entered allmulticast mode [ 686.471283][T31397] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 686.481304][T31397] bond14: (slave batadv1): making interface the new active one [ 686.491126][T31397] batadv1: entered promiscuous mode [ 686.497126][T31397] batadv1: entered allmulticast mode [ 686.503892][T31397] bond14: (slave batadv1): Enslaving as an active interface with an up link [ 686.534250][T31404] veth1_to_batadv: entered promiscuous mode [ 686.670666][T31411] sctp: [Deprecated]: syz.2.6353 (pid 31411) Use of int in max_burst socket option. [ 686.670666][T31411] Use struct sctp_assoc_value instead [ 686.816688][T31420] bridge_slave_1: left allmulticast mode [ 686.840120][T31420] bridge_slave_1: left promiscuous mode [ 686.851930][T31420] bridge0: port 2(bridge_slave_1) entered disabled state [ 686.880769][T31420] bridge_slave_0: left allmulticast mode [ 686.910754][T31420] bridge_slave_0: left promiscuous mode [ 686.929137][T31420] bridge0: port 1(bridge_slave_0) entered disabled state [ 687.092401][ T5619] Bluetooth: hci0: command tx timeout [ 687.430830][T31445] lo speed is unknown, defaulting to 1000 [ 687.572108][T31465] netlink: 'syz.4.6364': attribute type 2 has an invalid length. [ 687.590192][T31465] netlink: 'syz.4.6364': attribute type 8 has an invalid length. [ 687.620854][T31465] __nla_validate_parse: 14 callbacks suppressed [ 687.620872][T31465] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6364'. [ 687.697159][T31471] sctp: [Deprecated]: syz.1.6365 (pid 31471) Use of struct sctp_assoc_value in delayed_ack socket option. [ 687.697159][T31471] Use struct sctp_sack_info instead [ 687.792583][T31132] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 687.875232][T31471] netlink: 'syz.1.6365': attribute type 33 has an invalid length. [ 687.885504][T31471] syzkaller0: entered promiscuous mode [ 687.896158][T31471] syzkaller0: entered allmulticast mode [ 688.007276][T31132] veth0_vlan: entered promiscuous mode [ 688.029101][T31132] veth1_vlan: entered promiscuous mode [ 688.070192][T31485] netlink: 212368 bytes leftover after parsing attributes in process `syz.2.6371'. [ 688.094155][T31485] netlink: 762 bytes leftover after parsing attributes in process `syz.2.6371'. [ 688.147527][T31488] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6372'. [ 688.157594][T31485] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6371'. [ 688.178847][T31488] 8021q: adding VLAN 0 to HW filter on device bond2 [ 688.190209][T31485] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6371'. [ 688.199708][T31485] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6371'. [ 688.224896][T31488] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 688.248552][T31492] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6372'. [ 688.263045][T31132] veth0_macvtap: entered promiscuous mode [ 688.282822][T31132] veth1_macvtap: entered promiscuous mode [ 688.302051][T31132] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 688.317547][T31132] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 688.340479][T31491] macvtap1: entered promiscuous mode [ 688.347243][T31491] bridge0: entered promiscuous mode [ 688.377517][ T6408] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.406896][ T6408] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.435172][ T6408] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.469952][ T6408] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 688.606242][T31501] tipc: Started in network mode [ 688.619373][T31501] tipc: Node identity de4384b43005, cluster identity 4711 [ 688.627124][T31501] tipc: Enabled bearer , priority 0 [ 688.636301][T31499] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6377'. [ 688.649777][ T6402] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 688.671733][ T6402] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 688.687196][T31501] syzkaller0: entered promiscuous mode [ 688.693476][T31501] syzkaller0: entered allmulticast mode [ 688.754227][T31501] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 688.769276][ T100] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 688.778840][ T100] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 688.804218][T31501] tipc: Resetting bearer [ 688.817787][T31500] tipc: Resetting bearer [ 688.848523][T31500] tipc: Disabling bearer [ 689.183946][ T5619] Bluetooth: hci0: command tx timeout [ 689.257134][T31547] netlink: 104 bytes leftover after parsing attributes in process `syz.4.6388'. [ 689.538835][T31567] openvswitch: netlink: Message has 1 unknown bytes. [ 689.588720][T31567] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 689.744490][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 690.426704][ T29] audit: type=1800 audit(1782096620.342:17): pid=31596 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.6401" name="memory.events" dev="tmpfs" ino=31 res=0 errno=0 [ 690.682630][T31606] sctp: [Deprecated]: syz.2.6406 (pid 31606) Use of int in max_burst socket option deprecated. [ 690.682630][T31606] Use struct sctp_assoc_value instead [ 691.825856][T31635] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 691.836519][T31693] IPVS: sed: FWM 3 0x00000003 - no destination available [ 691.849148][ T5748] IPVS: starting estimator thread 0... [ 691.952648][T31694] IPVS: using max 36 ests per chain, 86400 per kthread [ 692.111063][T31709] block nbd0: not configured, cannot reconfigure [ 692.135544][T31705] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 692.145276][T31707] block nbd0: not configured, cannot reconfigure [ 692.178718][T31711] netlink: 'syz.3.6437': attribute type 1 has an invalid length. [ 692.282709][T31711] 8021q: adding VLAN 0 to HW filter on device bond3 [ 692.425265][T31716] bond3: (slave veth7): Enslaving as an active interface with a down link [ 692.620739][T31729] C: renamed from veth1_to_team (while UP) [ 692.650217][T31729] netlink: 'syz.0.6440': attribute type 8 has an invalid length. [ 692.670286][T31729] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 692.927933][T31749] syzkaller0: entered promiscuous mode [ 692.957369][T31749] syzkaller0: entered allmulticast mode [ 693.046980][T31749] __nla_validate_parse: 11 callbacks suppressed [ 693.047003][T31749] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6443'. [ 693.084766][T31753] xt_hashlimit: size too large, truncated to 1048576 [ 693.102329][T31749] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6443'. [ 693.287284][T31756] syzkaller1: entered promiscuous mode [ 693.307380][T31756] syzkaller1: entered allmulticast mode [ 693.392831][T31769] ip6erspan0: entered allmulticast mode [ 693.415845][T31768] netlink: 80 bytes leftover after parsing attributes in process `syz.0.6447'. [ 693.443961][T31769] netlink: 9 bytes leftover after parsing attributes in process `syz.3.6446'. [ 693.495811][T31769] gretap0: entered promiscuous mode [ 693.782621][T31789] vlan4: entered promiscuous mode [ 694.441159][T31820] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 694.533546][T31823] tipc: Enabled bearer , priority 0 [ 694.559327][T31823] syzkaller0: entered promiscuous mode [ 694.584272][T31823] syzkaller0: entered allmulticast mode [ 694.619501][T31823] tipc: Resetting bearer [ 694.698218][T31835] tipc: Resetting bearer [ 694.729426][T31835] tipc: Disabling bearer [ 694.783501][T31831] lo speed is unknown, defaulting to 1000 [ 694.865224][T31857] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6465'. [ 694.882745][T31857] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6465'. [ 695.195713][T31872] netlink: 240 bytes leftover after parsing attributes in process `syz.4.6468'. [ 695.254133][T31872] bond15: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 695.280487][T31872] bond15 (unregistering): Released all slaves [ 695.300643][T31878] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6469'. [ 695.346870][T31877] bond15: option lacp_rate: invalid value (128) [ 695.366081][T31877] bond15 (unregistering): Released all slaves [ 695.742064][ T5623] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 695.749809][ T5623] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 695.757717][ T5623] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 695.765884][ T5623] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 695.775166][ T5623] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 696.073751][T14119] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 696.127065][T14119] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 696.188791][T14119] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 696.216117][T31897] lo speed is unknown, defaulting to 1000 [ 696.257261][T14119] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 696.577145][T14119] bond0 (unregistering): Released all slaves [ 696.591340][T14119] bond1 (unregistering): Released all slaves [ 696.605411][T14119] bond2 (unregistering): Released all slaves [ 696.618369][T14119] bond3 (unregistering): Released all slaves [ 696.631567][T14119] bond4 (unregistering): Released all slaves [ 696.648858][T14119] bond5 (unregistering): Released all slaves [ 696.662099][T14119] bond6 (unregistering): Released all slaves [ 696.674058][T14119] bond7 (unregistering): Released all slaves [ 696.688882][T14119] bond8 (unregistering): Released all slaves [ 696.703162][T14119] bond9 (unregistering): Released all slaves [ 696.717110][T14119] bond10 (unregistering): Released all slaves [ 696.735006][T14119] bond11 (unregistering): Released all slaves [ 696.750488][T14119] bond12 (unregistering): Released all slaves [ 696.762439][T14119] bond13 (unregistering): Released all slaves [ 696.779808][T14119] bond14 (unregistering): (slave batadv1): Releasing active interface [ 696.788422][T14119] batadv1: left promiscuous mode [ 696.795366][T14119] batadv1: left allmulticast mode [ 696.805214][T14119] bond14 (unregistering): Released all slaves [ 696.924612][T14119] 5Ò: left promiscuous mode [ 696.952070][T31897] bridge0: port 1(bridge_slave_0) entered blocking state [ 696.959613][T31897] bridge0: port 1(bridge_slave_0) entered disabled state [ 696.967794][T31897] bridge_slave_0: entered allmulticast mode [ 696.976500][T31897] bridge_slave_0: entered promiscuous mode [ 696.984473][T14119] tipc: Left network mode [ 696.986426][T31897] bridge0: port 2(bridge_slave_1) entered blocking state [ 696.996295][T31897] bridge0: port 2(bridge_slave_1) entered disabled state [ 697.003673][T31897] bridge_slave_1: entered allmulticast mode [ 697.010859][T31897] bridge_slave_1: entered promiscuous mode [ 697.042419][T31897] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 697.055445][T31897] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 697.096481][T31897] team0: Port device team_slave_0 added [ 697.105779][T31897] team0: Port device team_slave_1 added [ 697.134521][T31897] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 697.142298][T31897] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 697.169030][T31897] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 697.184536][T31897] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 697.192945][T31897] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 697.219260][T31897] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 697.269987][T31897] hsr_slave_0: entered promiscuous mode [ 697.271997][T31813] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 697.277874][T31897] hsr_slave_1: entered promiscuous mode [ 697.291794][T31897] debugfs: 'hsr0' already exists in 'hsr' [ 697.297579][T31897] Cannot create hsr debugfs directory [ 697.547867][T31929] netlink: 'syz.3.6478': attribute type 40 has an invalid length. [ 697.750787][T31947] netlink: 'syz.3.6481': attribute type 8 has an invalid length. [ 697.766704][T31947] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6481'. [ 697.795593][T31945] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6480'. [ 697.811929][ T5619] Bluetooth: hci2: command tx timeout [ 697.843919][T31947] veth1_to_team: entered promiscuous mode [ 697.853776][T31947] veth0_to_hsr: entered promiscuous mode [ 697.862611][T31947] hsr1: entered promiscuous mode [ 697.902573][T31944] netlink: 'syz.0.6480': attribute type 6 has an invalid length. [ 698.029025][T31957] netlink: 'syz.3.6483': attribute type 21 has an invalid length. [ 698.051657][ C0] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 698.436252][T31957] netlink: 'syz.3.6483': attribute type 4 has an invalid length. [ 698.445524][T31957] __nla_validate_parse: 2 callbacks suppressed [ 698.445556][T31957] netlink: 3 bytes leftover after parsing attributes in process `syz.3.6483'. [ 698.492775][ T5284] 8021q: adding VLAN 0 to HW filter on device eth1 [ 698.894029][T14119] IPVS: stop unused estimator thread 0... [ 698.963961][T31897] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 699.015877][T31897] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 699.025075][T31897] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 699.047564][T31897] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 699.070169][T31897] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 699.090904][T31897] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 699.112646][T31897] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 699.140948][T31897] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 699.174889][T32012] netlink: 'syz.0.6493': attribute type 4 has an invalid length. [ 699.238837][T32021] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 699.305584][T32021] team0: Device xfrm0 is of different type [ 699.342313][T32021] tipc: Enabled bearer , priority 0 [ 699.407603][T31897] 8021q: adding VLAN 0 to HW filter on device bond0 [ 699.476965][T31897] 8021q: adding VLAN 0 to HW filter on device team0 [ 699.518332][ T6402] bridge0: port 1(bridge_slave_0) entered blocking state [ 699.525549][ T6402] bridge0: port 1(bridge_slave_0) entered forwarding state [ 699.615572][ T6402] bridge0: port 2(bridge_slave_1) entered blocking state [ 699.622822][ T6402] bridge0: port 2(bridge_slave_1) entered forwarding state [ 699.901733][ T5619] Bluetooth: hci2: command tx timeout [ 700.111949][T32067] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6502'. [ 700.272917][T32070] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6502'. [ 701.971881][ T5619] Bluetooth: hci2: command tx timeout [ 702.172975][ T9284] tipc: Node number set to 2298300091 [ 702.350208][T32075] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6503'. [ 702.424770][T32075] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6503'. [ 702.716429][T32075] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6503'. [ 702.734949][T32109] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 702.815910][T31897] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 703.418287][T31897] veth0_vlan: entered promiscuous mode [ 703.449275][T31897] veth1_vlan: entered promiscuous mode [ 703.524386][T31897] veth0_macvtap: entered promiscuous mode [ 703.545555][T31897] veth1_macvtap: entered promiscuous mode [ 703.558912][T32141] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6514'. [ 703.629246][T31897] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 703.675375][T31897] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 703.721071][T14119] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 703.754794][T14119] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 703.794974][T14119] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 703.828731][T14119] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 704.052297][ T5619] Bluetooth: hci2: command tx timeout [ 704.138921][T32161] bridge0: port 3(team0) entered blocking state [ 704.155566][T32161] bridge0: port 3(team0) entered disabled state [ 704.179816][T32161] team0: entered allmulticast mode [ 704.198554][T32161] team_slave_0: entered allmulticast mode [ 704.214898][T32161] team_slave_1: entered allmulticast mode [ 704.247685][T32161] team0: entered promiscuous mode [ 704.266320][T32161] team_slave_0: entered promiscuous mode [ 704.275198][T32176] xt_CT: You must specify a L4 protocol and not use inversions on it [ 704.292122][T32161] team_slave_1: entered promiscuous mode [ 704.305019][T32161] bridge0: port 3(team0) entered blocking state [ 704.311487][T32161] bridge0: port 3(team0) entered forwarding state [ 704.377631][T32163] lo speed is unknown, defaulting to 1000 [ 704.389934][T14119] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 704.412449][T14119] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 704.533798][T32180] netlink: 32 bytes leftover after parsing attributes in process `syz.3.6520'. [ 704.579846][T32164] lo speed is unknown, defaulting to 1000 [ 704.587877][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 704.607351][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 704.723433][T32184] xt_hashlimit: size too large, truncated to 1048576 [ 704.792424][T32189] netlink: 'syz.3.6523': attribute type 1 has an invalid length. [ 704.808606][T32186] tipc: Started in network mode [ 704.820862][T32186] tipc: Node identity b646ff60e629, cluster identity 4711 [ 704.829110][T32196] openvswitch: netlink: Missing valid actions attribute. [ 704.842270][T32197] openvswitch: netlink: Missing valid actions attribute. [ 704.851270][T32186] tipc: Enabled bearer , priority 0 [ 704.867703][T32197] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 704.896546][T32196] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 704.945408][T32190] syzkaller0: entered promiscuous mode [ 704.967360][T32190] syzkaller0: entered allmulticast mode [ 705.009258][T32198] gretap3: entered allmulticast mode [ 705.079920][T32186] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 705.122800][T32190] tipc: Resetting bearer [ 705.167791][T32185] tipc: Resetting bearer [ 705.191204][T32185] tipc: Disabling bearer [ 705.464441][T32222] ip6gre1: entered promiscuous mode [ 705.489517][T32222] ip6gre1: entered allmulticast mode [ 705.514278][T32231] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 705.544339][T32228] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6527'. [ 705.775929][T32241] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 705.788137][T32244] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6532'. [ 705.879355][T32246] veth0_macvtap: entered allmulticast mode [ 705.978294][T32246] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 706.226592][ T13] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.253382][ T9284] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.281964][ T13] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.407526][T32241] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 706.548587][T32241] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 706.616233][T32287] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6537'. [ 706.641208][T32287] netlink: 11 bytes leftover after parsing attributes in process `syz.0.6537'. [ 706.651968][T32287] netlink: 11 bytes leftover after parsing attributes in process `syz.0.6537'. [ 706.660986][T32287] netlink: 52 bytes leftover after parsing attributes in process `syz.0.6537'. [ 706.697060][T32241] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 706.730630][T32289] netlink: 212348 bytes leftover after parsing attributes in process `syz.4.6539'. [ 706.751585][ T9284] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.888380][ T13] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 706.928714][ T13] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 706.932391][ T9285] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 706.985607][ T100] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 707.046988][ T100] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 707.113721][T32303] netlink: 912 bytes leftover after parsing attributes in process `syz.0.6541'. [ 707.517054][T32326] netlink: 'syz.0.6549': attribute type 1 has an invalid length. [ 707.624888][T32335] netlink: 'syz.4.6547': attribute type 3 has an invalid length. [ 707.950437][T32363] bond1: Unable to set peer notification delay as MII monitoring is disabled [ 707.960687][T32363] bond1 (unregistering): Released all slaves [ 708.695754][T32407] batadv_slave_0: entered promiscuous mode [ 708.707857][T32403] batadv_slave_0: left promiscuous mode [ 708.807897][T32414] __nla_validate_parse: 6 callbacks suppressed [ 708.807947][T32414] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6568'. [ 708.829578][T32414] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6568'. [ 708.845677][T32414] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.6568'. [ 708.937787][T32419] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6570'. [ 709.041245][T32427] syzkaller0: left promiscuous mode [ 709.047864][T32427] syzkaller0: left allmulticast mode [ 709.079480][T32427] bond1: left allmulticast mode [ 709.093957][T32427] macvtap1: left promiscuous mode [ 709.114869][T32427] ip6erspan0: left allmulticast mode [ 709.121810][T32427] hsr1: left promiscuous mode [ 709.136769][T32427] openvswitch: netlink: Message has 4 unknown bytes. [ 709.146709][T32427] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 709.214494][T32393] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 709.360885][T32448] netlink: 212408 bytes leftover after parsing attributes in process `syz.4.6578'. [ 709.374162][T32448] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6578'. [ 709.815376][T32469] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6582'. [ 709.890843][T32469] team1: entered promiscuous mode [ 709.916007][T32469] team1: entered allmulticast mode [ 709.932845][T32469] 8021q: adding VLAN 0 to HW filter on device team1 [ 710.103805][T32485] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6589'. [ 710.184154][T32493] bridge0: port 2(bridge_slave_1) entered disabled state [ 710.212519][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 710.706719][T32526] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6601'. [ 710.791254][T32536] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 711.060494][T32549] netlink: 'syz.4.6604': attribute type 1 has an invalid length. [ 711.156838][T32554] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6606'. [ 711.306934][T32561] rdma_rxe: rxe_newlink: failed to add xfrm0 [ 711.597275][ T13] ------------[ cut here ]------------ [ 711.602856][ T13] wlan1: Dropped data frame as no usable bitrate found while scanning and associated. Target station: 08:02:11:00:00:00 on 5 GHz band [ 711.616698][ T13] WARNING: net/mac80211/tx.c:757 at ieee80211_tx_h_rate_ctrl+0xbd5/0x1760, CPU#1: kworker/u8:1/13 [ 711.627500][ T13] Modules linked in: [ 711.631461][ T13] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) [ 711.640863][ T13] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 711.650998][ T13] Workqueue: events_unbound cfg80211_wiphy_work [ 711.657451][ T13] RIP: 0010:ieee80211_tx_h_rate_ctrl+0xc46/0x1760 [ 711.663943][ T13] Code: bf 09 00 00 48 8b 44 24 10 8b 30 45 31 ed 83 e6 07 41 0f 95 c5 31 ff e8 08 b8 a3 f6 43 8d 4c 6d 02 48 89 df 4c 89 f6 4c 89 e2 <67> 48 0f b9 3a 41 bd 01 00 00 00 e9 dd 01 00 00 e8 a5 b3 a3 f6 48 [ 711.683642][ T13] RSP: 0018:ffffc900001274a0 EFLAGS: 00010293 [ 711.689755][ T13] RAX: ffffffff8b224258 RBX: ffffffff90430cd0 RCX: 0000000000000005 [ 711.697797][ T13] RDX: ffff888058d7d704 RSI: ffff88804fcdd998 RDI: ffffffff90430cd0 [ 711.705843][ T13] RBP: ffffc90000127610 R08: ffff88805c1c2abf R09: 1ffff1100b838557 [ 711.713883][ T13] R10: dffffc0000000000 R11: ffffed100b838558 R12: ffff888058d7d704 [ 711.721916][ T13] R13: 0000000000000001 R14: ffff88804fcdd998 R15: dffffc0000000000 [ 711.729924][ T13] FS: 0000000000000000(0000) GS:ffff88812537c000(0000) knlGS:0000000000000000 [ 711.738929][ T13] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 711.745579][ T13] CR2: 00007f9babd99000 CR3: 0000000039b0a000 CR4: 00000000003526f0 [ 711.753613][ T13] Call Trace: [ 711.756925][ T13] [ 711.759894][ T13] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 711.766057][ T13] ? ieee80211_is_bufferable_mmpdu+0x103/0x200 [ 711.772370][ T13] invoke_tx_handlers_late+0xb5/0x1830 [ 711.777881][ T13] ? sta_info_get+0x2ec/0x300 [ 711.782746][ T13] ? invoke_tx_handlers_early+0xa30/0x1cf0 [ 711.788602][ T13] ieee80211_tx+0x2d7/0x4b0 [ 711.793182][ T13] ? __pfx_ieee80211_tx+0x10/0x10 [ 711.798254][ T13] ? ieee80211_set_qos_hdr+0x1d8/0x530 [ 711.803859][ T13] ? ieee80211_xmit+0x2e5/0x3c0 [ 711.808756][ T13] ? __ieee80211_tx_skb_tid_band+0x4cb/0x680 [ 711.814815][ T13] __ieee80211_tx_skb_tid_band+0x50f/0x680 [ 711.820670][ T13] ? ieee80211_scan_state_send_probe+0x4e6/0xa00 [ 711.827157][ T13] ieee80211_scan_state_send_probe+0x5b3/0xa00 [ 711.833406][ T13] ieee80211_scan_work+0x488/0x1ab0 [ 711.838664][ T13] cfg80211_wiphy_work+0x29e/0x420 [ 711.843852][ T13] ? process_scheduled_works+0xa20/0x14e0 [ 711.849621][ T13] process_scheduled_works+0xa8e/0x14e0 [ 711.855260][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 711.861289][ T13] ? do_raw_spin_lock+0x12b/0x2f0 [ 711.866411][ T13] ? assign_work+0x3cf/0x5d0 [ 711.871055][ T13] worker_thread+0xa47/0xfb0 [ 711.875739][ T13] kthread+0x388/0x470 [ 711.879844][ T13] ? __pfx_worker_thread+0x10/0x10 [ 711.885029][ T13] ? __pfx_kthread+0x10/0x10 [ 711.889661][ T13] ret_from_fork+0x514/0xb70 [ 711.894371][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 711.899531][ T13] ? __switch_to+0xc89/0x1420 [ 711.904285][ T13] ? __pfx_kthread+0x10/0x10 [ 711.908904][ T13] ret_from_fork_asm+0x1a/0x30 [ 711.913748][ T13] [ 711.916813][ T13] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 711.924134][ T13] CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) [ 711.933447][ T13] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 711.943536][ T13] Workqueue: events_unbound cfg80211_wiphy_work [ 711.949833][ T13] Call Trace: [ 711.953139][ T13] [ 711.956102][ T13] vpanic+0x56c/0xa60 [ 711.960159][ T13] ? __pfx__printk+0x10/0x10 [ 711.964799][ T13] ? __pfx_vpanic+0x10/0x10 [ 711.969343][ T13] ? is_bpf_text_address+0x292/0x2b0 [ 711.974726][ T13] ? is_bpf_text_address+0x26/0x2b0 [ 711.979975][ T13] panic+0xc5/0xd0 [ 711.983736][ T13] ? __pfx_panic+0x10/0x10 [ 711.988190][ T13] ? ret_from_fork_asm+0x1a/0x30 [ 711.993170][ T13] __warn+0x315/0x4c0 [ 711.997183][ T13] ? ieee80211_tx_h_rate_ctrl+0xbd5/0x1760 [ 712.003025][ T13] ? ieee80211_tx_h_rate_ctrl+0xbd5/0x1760 [ 712.008879][ T13] __report_bug+0x331/0x530 [ 712.013503][ T13] ? arch_stack_walk+0x11b/0x150 [ 712.018484][ T13] ? ieee80211_tx_h_rate_ctrl+0xbd5/0x1760 [ 712.024337][ T13] ? __pfx___report_bug+0x10/0x10 [ 712.029417][ T13] ? stack_depot_save_flags+0x33/0x800 [ 712.034965][ T13] report_bug_entry+0x19a/0x290 [ 712.039858][ T13] ? ieee80211_tx_h_rate_ctrl+0xc46/0x1760 [ 712.045703][ T13] ? ieee80211_tx_h_rate_ctrl+0xc4b/0x1760 [ 712.051550][ T13] handle_bug+0xce/0x200 [ 712.055836][ T13] exc_invalid_op+0x1a/0x50 [ 712.060382][ T13] asm_exc_invalid_op+0x1a/0x20 [ 712.065271][ T13] RIP: 0010:ieee80211_tx_h_rate_ctrl+0xc46/0x1760 [ 712.071728][ T13] Code: bf 09 00 00 48 8b 44 24 10 8b 30 45 31 ed 83 e6 07 41 0f 95 c5 31 ff e8 08 b8 a3 f6 43 8d 4c 6d 02 48 89 df 4c 89 f6 4c 89 e2 <67> 48 0f b9 3a 41 bd 01 00 00 00 e9 dd 01 00 00 e8 a5 b3 a3 f6 48 [ 712.091380][ T13] RSP: 0018:ffffc900001274a0 EFLAGS: 00010293 [ 712.097531][ T13] RAX: ffffffff8b224258 RBX: ffffffff90430cd0 RCX: 0000000000000005 [ 712.105537][ T13] RDX: ffff888058d7d704 RSI: ffff88804fcdd998 RDI: ffffffff90430cd0 [ 712.113549][ T13] RBP: ffffc90000127610 R08: ffff88805c1c2abf R09: 1ffff1100b838557 [ 712.121552][ T13] R10: dffffc0000000000 R11: ffffed100b838558 R12: ffff888058d7d704 [ 712.129559][ T13] R13: 0000000000000001 R14: ffff88804fcdd998 R15: dffffc0000000000 [ 712.137572][ T13] ? ieee80211_tx_h_rate_ctrl+0xc38/0x1760 [ 712.143441][ T13] ? __pfx_ieee80211_tx_h_rate_ctrl+0x10/0x10 [ 712.149556][ T13] ? ieee80211_is_bufferable_mmpdu+0x103/0x200 [ 712.155762][ T13] invoke_tx_handlers_late+0xb5/0x1830 [ 712.161275][ T13] ? sta_info_get+0x2ec/0x300 [ 712.166006][ T13] ? invoke_tx_handlers_early+0xa30/0x1cf0 [ 712.171872][ T13] ieee80211_tx+0x2d7/0x4b0 [ 712.176425][ T13] ? __pfx_ieee80211_tx+0x10/0x10 [ 712.181498][ T13] ? ieee80211_set_qos_hdr+0x1d8/0x530 [ 712.187019][ T13] ? ieee80211_xmit+0x2e5/0x3c0 [ 712.191915][ T13] ? __ieee80211_tx_skb_tid_band+0x4cb/0x680 [ 712.197947][ T13] __ieee80211_tx_skb_tid_band+0x50f/0x680 [ 712.203812][ T13] ? ieee80211_scan_state_send_probe+0x4e6/0xa00 [ 712.210191][ T13] ieee80211_scan_state_send_probe+0x5b3/0xa00 [ 712.216405][ T13] ieee80211_scan_work+0x488/0x1ab0 [ 712.221661][ T13] cfg80211_wiphy_work+0x29e/0x420 [ 712.226818][ T13] ? process_scheduled_works+0xa20/0x14e0 [ 712.232588][ T13] process_scheduled_works+0xa8e/0x14e0 [ 712.238196][ T13] ? __pfx_process_scheduled_works+0x10/0x10 [ 712.244216][ T13] ? do_raw_spin_lock+0x12b/0x2f0 [ 712.249288][ T13] ? assign_work+0x3cf/0x5d0 [ 712.253919][ T13] worker_thread+0xa47/0xfb0 [ 712.258568][ T13] kthread+0x388/0x470 [ 712.262669][ T13] ? __pfx_worker_thread+0x10/0x10 [ 712.267856][ T13] ? __pfx_kthread+0x10/0x10 [ 712.272484][ T13] ret_from_fork+0x514/0xb70 [ 712.277142][ T13] ? __pfx_ret_from_fork+0x10/0x10 [ 712.282286][ T13] ? __switch_to+0xc89/0x1420 [ 712.287011][ T13] ? __pfx_kthread+0x10/0x10 [ 712.291632][ T13] ret_from_fork_asm+0x1a/0x30 [ 712.296442][ T13] [ 712.300108][ T13] Kernel Offset: disabled [ 712.304446][ T13] Rebooting in 86400 seconds..