last executing test programs: 2m56.788101703s ago: executing program 2 (id=85): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="06000000040000000400000022bf000000040000324e6e246b77b6677ca4ad3fc6ce94c3688c9169db4bfcbdd03e53a7ef45908c1601ce84c8f57f51d489c70892b7e9218c2b69c7b1f3e7ed8b348bcd0301a6c599936f8044cee1a29de44f142c771c06ad4a7f0ef961ec0debed0e2236e26211e12b1f989df8aac466aec0b52e57b28a9f750b7659820391b02fb044d05613118a6dd919423d65803bba608e42140039f0a5df4f5c8aa74112635e44fa57c3c06b61eeeb64db8427682eebbd4d88dbcf901a3cbe810b25474ebb5b2c58716a5213da8cf8a86de2fee5f72c765aff0bf126fe65bbff67c8e898dcd1a29afbba0769bf91fa4066f1d0529f219853828ad141c815eb4ed021507eb512db07a6f3fbe23c289880564edbd923b86a05543f5f7fb07396333c3d3d4fe8949630987b923eecd5d274ca8449d694e508cdc3467d9712bc5c5f9c084f104878a1eed81a2b502ec5be48b6c7d19d307c0797d208b2e9635417a79fa4a380128b115c4a373ea209cd844a1982fd5cebf61d2b42f6", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r1 = socket$nl_rdma(0x10, 0x3, 0x14) recvmmsg(r1, &(0x7f0000006080)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x20, 0x0) sendmsg$RDMA_NLDEV_CMD_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000080)=ANY=[@ANYBLOB="100000000114a73a"], 0x5c}}, 0x0) mmap(&(0x7f0000fa2000/0x4000)=nil, 0x4000, 0x0, 0x82011, r0, 0x0) mmap(&(0x7f0000fa3000/0x3000)=nil, 0x3000, 0x0, 0x13, r0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$inet_sctp(0x2, 0x1, 0x84) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002640)=@newtaction={0xe94, 0x30, 0x3f, 0x0, 0x0, {}, [{0xe80, 0x1, [@m_pedit={0xe7c, 0x1, 0x0, 0x0, {{0xa}, {0xe50, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x2c, 0x5, 0x0, 0x1, [{0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}]}, @TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{}, 0x2}, [{0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, {0xfffffffc, 0x0, 0x0, 0x0, 0x100, 0x81}, {0x0, 0x0, 0x0, 0x0, 0x3}, {}, {0x5943}, {0x0, 0x800000, 0x0, 0xfffffffc}, {}, {}, {0x0, 0x0, 0x0, 0x10}, {}, {}, {0x0, 0xa2}, {0x0, 0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x1cbe}, {0x0, 0x0, 0x0, 0x5, 0x8}, {0x0, 0xfa9}, {0x0, 0x1}, {}, {}, {0x8}, {}, {0xfffffffd, 0xfffffffe, 0x400000}, {0x0, 0xfffffffc}, {}, {}, {}, {0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0x0, 0x4, 0xffffff6a}, {0x0, 0x0, 0x0, 0x0, 0x5}, {}, {0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0x2}, {}, {0x0, 0x0, 0x0, 0x0, 0x100}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x800000}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x10000000, 0x0, 0x0, 0x8}, {0x0, 0x7fffffff}, {0x3, 0x0, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x27a}, {0x0, 0x0, 0xffffffff}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, {}, {}, {}, {0x0, 0x4, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x0, 0xfffffffd}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x80000000, 0x0, 0x0, 0xffffffff}, {0x0, 0xfffffffc, 0x0, 0x0, 0xfffffffc}, {}, {0x0, 0x3}, {0x0, 0x0, 0x0, 0x4}, {}, {}, {0x0, 0x0, 0xa, 0x0, 0x200}, {0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1, 0x0, 0x0, 0x100000}, {0x0, 0x0, 0x7}, {0x0, 0x0, 0x0, 0x0, 0x1}, {0xc}, {}, {0x0, 0x0, 0x2b7f}, {0x3ff, 0x0, 0x0, 0x0, 0x8}, {0x0, 0x6}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0xcfc, 0x0, 0x0, 0xfffffffc}, {}, {}, {0x4}, {}, {0x0, 0x0, 0x0, 0x0, 0x800}, {0xfffffffd, 0x0, 0x0, 0xfffffffd, 0xa92}, {0x0, 0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x40000000, 0x1, 0x0, 0x10001}, {0x0, 0x0, 0x20}, {}, {0x80000, 0x0, 0x0, 0x0, 0x0, 0x2000000}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}, {0xfffffffc}, {}, {0x0, 0x0, 0x1ff}, {}, {0x0, 0xa, 0xfffffffc}, {0x0, 0x0, 0x0, 0x8}, {0x0, 0xfffffffe}, {0x0, 0x0, 0x0, 0x3}, {}, {}, {0x0, 0x0, 0x40, 0x0, 0x0, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1, 0x2}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x2}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {0x0, 0x1}, {}, {0x2}, {0x5}, {}, {}, {0x0, 0x1}, {}, {}, {0x7, 0x1}, {}, {}, {0x0, 0x1}, {}, {}, {0x1}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe94}}, 0x40000) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000900)=@o_path={&(0x7f00000008c0)='./file0\x00', 0x0, 0x4008, r5}, 0x18) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000940)={r2, r6}) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000010900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021740000000c0a01030000000000000000070000000900020073797a31000000000900010073797a30000000004800038044000080080003400000000238000b80200001800a00010071756f7461000000100002800c000140000000000000000014"], 0xf8}}, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f0000000000)={0xd833, 0x200, 0x0, 0x7, r7}, &(0x7f0000000040)=0x10) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320003000000000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a09040000000000000000020000000900010073797a30000000000900020073797a3200000000f8000000080a0102000000000000000002000000e2000740b8e67a1fbef4d0318808accf49ff541cdc09aae6de736dd41204825bce4f4b9fb56b4ccab011e7836b2b18e1949e3e4c1d5e3bf3cbae3d92580448a8b4cd143482358d32be4de4b687008ad19a154d3934c124931211576d827cde2e8d564b7a64f54cee5428d20bceb233c48071f5502b2d98b03f6b9f06b78a0f50e2e40fefc6be6545ca974c7cc5fe86ee08eb4149c0e231c3b777048547ca670bd6726e532f0fc4020643020086d2a33de15a522262addec2a6c29aca90df28c45708a31c057d6a61890ff42a38f70729108f0adf5efd5a189d3576f75be63264a77900002c000000080a010100000000000000000200fffd0900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x178}, 0x1, 0x0, 0x0, 0x40000000}, 0x0) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000380), 0xffffffffffffffff) r11 = socket$alg(0x26, 0x5, 0x0) bind$alg(r11, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r12 = accept4(r11, 0x0, 0x0, 0x0) accept4$inet(r12, &(0x7f0000000180)={0x2, 0x0, @initdev}, 0x0, 0x80000) getsockname$packet(r12, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000280)=0x14) sendmsg$DEVLINK_CMD_PORT_SPLIT(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="00042bbd7000ffdbdf2509000000080001007063690011000200303030303a30303a3100d3302e30000000000800030001000072ae6c75ce2e1b"], 0x40}, 0x1, 0x0, 0x0, 0x20000085}, 0x8000) r13 = openat$ppp(0xffffffffffffff9c, &(0x7f00000002c0), 0x242000, 0x0) ioctl$PPPIOCGUNIT(r13, 0x80047456, &(0x7f0000000640)) sendmsg$DEVLINK_CMD_RELOAD(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01000000000000000000250000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008a00", @ANYRES32, @ANYBLOB="0e0001006e657464657673696d0000000f0002006e657464657673696d30000008008b00", @ANYRES32=0x0, @ANYBLOB="4046337cc4cd60fa86200debad18"], 0x64}}, 0x0) 2m56.571213032s ago: executing program 2 (id=89): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000040)=ANY=[@ANYBLOB="400000002100000426bd7000fedbcf2502fa1f00050000081400000008000200ffffffff08000d000400000808000200e00000020c000c400000000000000006"], 0x40}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@gettfilter={0x3c, 0x2e, 0x100, 0x70bc25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x10, 0xfff1}, {0xe, 0xf}, {0x8, 0xffff}}, [{0x8, 0xb, 0x5}, {0x8, 0xb, 0x9}, {0x8, 0xb, 0xc0e}]}, 0x3c}}, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c00028008000140000000001400017b090001006cdbf80789f3f947dd000280080003"], 0xe4}, 0x1, 0x0, 0x0, 0x8001}, 0x20050840) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f030041000b05d25a806c8c6394f90324fc60100000000a000200053582c137153e3704020180fc5409000c00", 0x33fe0}], 0x1}, 0x0) 2m56.411010094s ago: executing program 2 (id=92): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r1, 0x100, 0x70bd2d, 0x25dfdbff, {{}, {}, {0x10, 0x13, @udp='udp:syz2\x00'}}, [""]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x44084) ioctl$XFS_IOC_PATH_TO_HANDLE(r0, 0xc0385869, &(0x7f0000000240)={r0, &(0x7f0000000140)='-%:]{\',/\x00', 0x30000, &(0x7f0000000180)={@_ha_fsid={[0x64e, 0x7]}, {0x6f73, 0x3, 0xfffffae3, 0x3}}, 0x6, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000200)=0x9}) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000280)={r0, 0xfffffffffffffc8c, 0x7, 0x8}) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000002c0)={r2, r3, 0x13, 0x0, @void}, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r3) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_MPP(r0, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x4c, r4, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r5}, @val={0xc, 0x99, {0x40, 0x4d}}}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}, @NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @device_b}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x4008000) syz_genetlink_get_family_id$ethtool(&(0x7f00000004c0), r3) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_DISCONNECT(r6, &(0x7f00000005c0)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)={0x20, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000000}, 0x881) getsockopt$inet_int(r3, 0x0, 0xc, &(0x7f0000000600), &(0x7f0000000640)=0x4) r7 = openat$cgroup_ro(r2, &(0x7f0000000680)='blkio.bfq.empty_time\x00', 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000800)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)=@ipv6_delrule={0xc0, 0x21, 0x20, 0x70bd25, 0x25dfdbff, {0xa, 0x0, 0x80, 0x6, 0x0, 0x0, 0x0, 0x7, 0x1}, [@FRA_SRC={0x14, 0x2, @private0={0xfc, 0x0, '\x00', 0x1}}, @FRA_SRC={0x14, 0x2, @ipv4={'\x00', '\xff\xff', @multicast2}}, @FRA_DST={0x14, 0x1, @local}, @FIB_RULE_POLICY=@FRA_SUPPRESS_IFGROUP={0x8, 0xd, 0x8001}, @FRA_DST={0x14, 0x1, @loopback}, @FRA_DST={0x14, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @FIB_RULE_POLICY=@FRA_IP_PROTO={0x5, 0x16, 0x5e}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_SRC={0x14, 0x2, @remote}, @FIB_RULE_POLICY=@FRA_TABLE={0x8, 0xf, 0xfffffff1}]}, 0xc0}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) getsockname$packet(0xffffffffffffffff, &(0x7f0000000840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000880)=0x14) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000008c0)={@map=r2, r7, 0xc, 0x10, 0x0, @void, @value=r7}, 0x20) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000940), r2) sendmsg$IPVS_CMD_DEL_SERVICE(r9, &(0x7f0000000a40)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000980)={0x78, r10, 0x200, 0x70bd29, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ipvlan1\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x400}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6erspan0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @rand_addr=0x64010101}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000b80)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000b40)={&(0x7f0000000ac0)=@ipv6_deladdrlabel={0x5c, 0x49, 0x200, 0x70bd2b, 0x25dfdbfd, {0xa, 0x0, 0x10, 0x0, 0x0, 0x1}, [@IFAL_LABEL={0x8, 0x2, 0x2}, @IFAL_LABEL={0x8}, @IFAL_ADDRESS={0x14, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}}, @IFAL_LABEL={0x8, 0x2, 0x1}, @IFAL_ADDRESS={0x14, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x2000c010}, 0x800) r11 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000c00), r9) sendmsg$L2TP_CMD_TUNNEL_CREATE(0xffffffffffffffff, &(0x7f0000000cc0)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000c80)={&(0x7f0000000c40)={0x2c, r11, 0x1, 0x70bd2b, 0x25dfdbfb, {}, [@L2TP_ATTR_IP_SADDR={0x8, 0x18, @initdev={0xac, 0x1e, 0x0, 0x0}}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x9}, @L2TP_ATTR_L2SPEC_LEN={0x5, 0x6, 0x36}]}, 0x2c}, 0x1, 0x0, 0x0, 0xc000}, 0x4001) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000dc0)={r9, 0x58, &(0x7f0000000d40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$nl_route(r3, &(0x7f0000000e80)={&(0x7f0000000d00)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000e40)={&(0x7f0000000e00)=@newlinkprop={0x40, 0x6c, 0x800, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, 0x40, 0x4200}, [@IFLA_GROUP={0x8, 0x1b, 0x7}, @IFLA_WEIGHT={0x8, 0xf, 0x5}, @IFLA_MASTER={0x8, 0xa, r12}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x20000001) socket(0x15, 0x0, 0x5) ioctl$sock_kcm_SIOCKCMCLONE(r9, 0x89e2, &(0x7f0000000ec0)={r3}) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r13, 0xc038943b, &(0x7f0000000f40)={0x401, 0x18, '\x00', 0x0, &(0x7f0000000f00)=[0x0, 0x0, 0x0]}) 2m56.20108666s ago: executing program 2 (id=95): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000010000000000000000000000a5000000a000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xe, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000a40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)=ANY=[@ANYRES32=r0, @ANYRES32=r0, @ANYBLOB="04"], 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[], 0x5c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x63, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0x7, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0x4, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYRES64=0x0, @ANYRES8=r0], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca25c53}, 0x4008840) r1 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2m56.081661334s ago: executing program 2 (id=99): r0 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x5, 0x3032, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x80001, 0x0) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000001300)={'nat\x00', 0x0, [0x5, 0x88980000, 0x2, 0x7, 0xa]}, &(0x7f0000000140)=0x54) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)={0x28, 0x35, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x10}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 2m55.726754226s ago: executing program 2 (id=103): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r1 = socket$inet(0x2, 0x3, 0x33) (rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket(0x23, 0x805, 0x0) connect$vsock_stream(r2, 0x0, 0x0) (async) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x58, r3, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_ADDR={0x34, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xc}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0xc480) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) getsockopt$inet_mreqsrc(r1, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) (async, rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x2, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x19}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x98}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 32) socket$vsock_stream(0x28, 0x1, 0x0) 2m40.113293707s ago: executing program 32 (id=103): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r1 = socket$inet(0x2, 0x3, 0x33) (rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket(0x23, 0x805, 0x0) connect$vsock_stream(r2, 0x0, 0x0) (async) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r2, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x58, r3, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x3}, @MPTCP_PM_ATTR_ADDR={0x34, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xc}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast2}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e21}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x8}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0xc480) (async) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) getsockopt$inet_mreqsrc(r1, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x28) (async, rerun: 32) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x2, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x19}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x98}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (rerun: 32) socket$vsock_stream(0x28, 0x1, 0x0) 1.873222002s ago: executing program 1 (id=1923): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000000)={@remote, 0x200000, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x200000, 0x2, 0x0, 0x0, 0xfff9, 0x99}, 0x20) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000280)={&(0x7f00000003c0)={0x1ec, 0x2, 0x2, 0x301, 0x0, 0x0, {0x5, 0x0, 0x2}, [@CTA_EXPECT_TUPLE={0x78, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @local}, {0x8, 0x2, @dev={0xac, 0x14, 0x14, 0x3a}}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}, @CTA_EXPECT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x2}, @CTA_EXPECT_NAT={0x158, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x34, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x9}]}, @CTA_EXPECT_NAT_TUPLE={0xa0, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @initdev={0xac, 0x1e, 0x0, 0x0}}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x14, 0x4, @remote}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_TUPLE={0x78, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x1}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x2}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @rand_addr=0x64010102}}}]}]}]}, 0x1ec}, 0x1, 0x0, 0x0, 0x40000}, 0x20000000) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r2 = accept$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x0, @private1}, &(0x7f0000000100)=0x1c) ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f00000001c0)={'wg2\x00', 0x4}) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_DREG={0x8}, @NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000300)={{0xffffffffffffffff, &(0x7f0000000180)='fou\x00', 0x88000, &(0x7f00000001c0)={@align=0x8000, {0x1, 0x2, 0x2, 0x5}}, 0x101, &(0x7f0000000200), &(0x7f0000000240)=0x6}, {[0x3ff, 0x98, 0x4, 0x10001]}, 0x4, 0x5e, &(0x7f0000000280)=""/94}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_OCB(r3, &(0x7f0000000480)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, 0x0, 0x200, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r4}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2004c050}, 0x1) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(streebog256-generic,pcbc(fcrypt-generic))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000500), r3) sendmsg$IPVS_CMD_SET_DEST(r6, &(0x7f0000000680)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000640)={&(0x7f0000000540)={0xc4, r7, 0xbfe9d25840bec755, 0x70bd29, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x3b}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffff}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_SERVICE={0x40, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x8}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x8}}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'dh\x00'}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x800}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}]}, 0xc4}, 0x1, 0x0, 0x0, 0x4000001}, 0x4c050) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000700)={&(0x7f00000005c0)={0x104, r7, 0x200, 0x70bd29, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_SERVICE={0x24, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x51}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x87}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}, @IPVS_CMD_ATTR_DAEMON={0x50, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @private2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond_slave_1\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x101}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vxcan1\x00'}]}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}]}, 0x104}, 0x1, 0x0, 0x0, 0x20000080}, 0x40000) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0xb8200, 0x0) 1.692638271s ago: executing program 1 (id=1925): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@ipv6_newaddrlabel={0x30, 0x48, 0x3, 0x0, 0x0, {}, [@IFAL_ADDRESS={0x14, 0x1, @empty}]}, 0x30}}, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x6, 0xe8c}, 0x10) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="3800000012002102000000001000000000"], 0x38}}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x3, 0x4, &(0x7f0000000b40)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x2e}]}, &(0x7f0000000680)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="1800000007140100000000000000000005006000b8"], 0x18}}, 0x0) socketpair(0xf, 0x800, 0x8, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r5, 0x1, 0x28, &(0x7f0000000080)=0x80000000, 0x4) bind$bt_hci(r5, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={0xf4, r4, 0x20, 0x0, 0x25dfdbfb, {0x38}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}, {{@pci={{0x8}, {0x11}}, {0x8}}}, {{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x1}}}]}, 0xf4}, 0x1, 0x2, 0x0, 0x850}, 0x0) sendmsg$DEVLINK_CMD_TRAP_SET(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x54, r4, 0x8, 0x70bd2b, 0x25dfdbfe, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5, 0x83, 0x1}}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x4000004) 1.649956129s ago: executing program 1 (id=1926): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x2c, r1, 0x6a98047402e98331, 0x0, 0x0, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x841}, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0x4, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000001d71186e000000000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x625}, 0x94) 1.503910054s ago: executing program 1 (id=1928): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000030900010073797a310000000054000000030a010400000000000000000100ffff0900030073797a31000000002800048008000240000000000800014000000005140003006e7230000000000000000000000000000900010073797a31000000003c000000050a01020000000000000000010020000c00024000000000000000010900010073797a3100000015040004800b00070066696c746572"], 0xd8}}, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000000c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x4, 0x3, 0x2, 0x2, {0xa, 0x4e23, 0x3, @mcast2, 0x8}}}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000140)="6f728cda18b097c5512c4906a65a43dd087eb48623b38a0e7cdef177572e416a4bb45b5fc19b3cdb5ebe7730217451d552e1301f963c568d8f6e810e5d21d555ebfe5be31a887a3c21f4484754852a998367541888bcb02a87408d14ecc6ba295d281925d25cf74b0792753795a52e66d4d87543f120665fa6e7cd3c5c887f4cb1c88837c44615ee0b39fae0aea68516603a9457946a60569ebc9f5b91bd0809c26f56490a7265978ef71330ee255e2ed8be209a7048cb267ef29f96621393f38b3b73d6a903e28aaf12e25e12c3862d786b794ed4c89c2e931d", 0xda}], 0x1, &(0x7f0000000240)=[{0x18, 0x10e, 0x1, "0a04f4326b27"}, {0xf0, 0x1e4, 0x67ad, "525e7832a32bcec9bbbcea3a227ddbd3724789dcf8cd2954d67b913230833290a6ff9f7a39a0ba7dea19f17bdf1fafc4120600123e56f55d7a599d56250dfc0b0124c4c7b5d1737123c1e35c0360d78293af5edaf8578763b014142f1b73af6529f338cda9b69bbc7abfa907b8604900444c1e98d2e560d3e4d764f3368d051ae6bb7a8b37de3d9b427757c3e3ca1f299537cf4d423950023e2b4b3a7d0971305a53b3c502ae1cfabc870f0017460d2d3fbb23a3c8b36b2d76ecfc0fd3d531386bf5c508c9c1ce482a6c6b7e8a1120f77c4fa3316035bdb0ab856a876390"}, {0x38, 0x10c, 0x7d2c, "51f3a8f89d0066cb10dcddff9c1e5f4f1551708bbb07a4727cd46c44366d718444fa"}, {0xf8, 0x32, 0x9, "08c06a4da66492d68d2060fb1827ba10f4d0c63fdaac88c5186e7990007d6e97dc3c745f7b23a0bb2a673ea0e069553719d3126507d36655286c437185bf63c088b5d30984155934abe11e588eb22b3064e35aee6074cf55f33585c98c780375cad6030673ff32e489ccddee7d4d867daec08cfe6dc0908f521811f5a7669a49802510bc4eb6af6ff31cb52f7d1be6a283ad4409275a52fbb348858f1f87f9c0a2b90c1eb7cd08420b1a1204a0725b8bd3e40d92b6d3794f071627906c53ef8240067036bf17b4aff930b6807fcc67183870ae96375bcf9f338072e209ddacff92b0a75506"}, {0x68, 0x84, 0x401, "3992fc5b500694ebd1c5ed75568ee46c3483529bc0f439ee8a4689e39a66c6b8ff2fdd8ea4038c623574ed26679c110ef4db4f5cc2a9f71cb7945c73decfcd100ee0a02d45de5ca5648abc7bb4dc9cc1f5cce08e"}], 0x2a0}, 0x8000) 1.393394929s ago: executing program 1 (id=1929): socket(0x10, 0x3, 0x0) close(0x4) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x0) write$tun(0xffffffffffffffff, 0x0, 0xc6) r0 = socket(0x14, 0x80002, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x61d0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r1, &(0x7f0000000700)=[{&(0x7f00000000c0)="0232", 0x2}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040024}, 0x8040) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r3, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xb0260000) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r2, 0xc6e9f000) mmap(&(0x7f0000d8c000/0x1000)=nil, 0x1000, 0x1000001, 0x32, 0xffffffffffffffff, 0xf1dea000) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, r2, 0xffffe000) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$sock_ifreq(0xffffffffffffffff, 0x89a3, &(0x7f0000000100)={'bridge_slave_1\x00', @ifru_names='ip6gretap0\x00'}) ppoll(&(0x7f0000000000)=[{r2, 0x88}, {r3, 0x28}, {r3, 0x25}, {r3, 0xc100}, {r2}, {r2}, {r3, 0x1000}, {r2, 0x100f}], 0x8, &(0x7f0000000080)={r4, r5+10000000}, &(0x7f00000000c0)={[0x4]}, 0x8) mmap$xdp(&(0x7f0000941000/0x1000)=nil, 0x1000, 0x7000000, 0x1010, r2, 0x5ae11aa5497cb696) 1.301614505s ago: executing program 4 (id=1931): ioctl$XFS_IOC_START_COMMIT(0xffffffffffffffff, 0x80585882, &(0x7f00000001c0)={0xffffffffffffffff}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1a, 0x3, &(0x7f0000000480)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @tracing=0x17, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000580)={'wg1\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000300)={r1, r3}, 0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r5, 0x8914, &(0x7f00000002c0)={'rose0\x00', 0x1}) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB="5000000010000d0400000000000000000000000093f7a84d6302ece493a58963520adae2cd2fe8b4e109235b9dc456c1021b14a6b9fefbbf6bbf93125bfe0d3b22f468b2a175d5a88fe4dcb13ecd37cc4aa78c3cae962d81fbcf4dc7e167c2849c910731db13c491b53c00262d9ea4638e4a1d1c7349933e90c5c819e24ea6cc686680bc7d04f5b7f54c884ab73cad49000a997c9bdad7bccb9a54e441e548d1519ea01588ee4674fb7d0b9628e2816146a336703ccff0141c533d4dd8d2ffc7611cd4171aebf0a3384568f59e7f4b4a8cb19bf84ce35389172676764418fe7a88b16518f98e598f7f", @ANYRES32=0x0, @ANYBLOB="00000000868400001c0012800c0001006d6163766c616e000c0002800800090001000000140035006d6163766c616e300000000000000000", @ANYRES8=r3], 0x50}, 0x1, 0x0, 0x0, 0x10}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r7 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r6, &(0x7f00000003c0)=ANY=[@ANYBLOB="0a000000bbbb00bbbbbbaaaaaaaaaabb86dd6d0020000008110000000000000000000000000000000000ff"], 0x42) socket(0x10, 0x803, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0003000000000000140012800c0001006d6163766c616e000400028008000500", @ANYRES64=r9], 0x44}}, 0x884) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r11, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r11, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x38, 0x10, 0x439, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r12, 0x21801, 0x6536d5ef40a93735}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) r13 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r13, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0x0, 0x0, 0x4000000}, 0x0) 1.235781576s ago: executing program 3 (id=1933): r0 = epoll_create1(0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="64000000020605000000000000000000000049001400078008000800000000000800064000000000050001001b00000005000500020000000500040000000000090002009c5b7a310000000015000300686173683a6970"], 0x64}}, 0x0) ioctl$XFS_IOC_ERROR_INJECTION(r0, 0x40085874, &(0x7f0000000000)={r1, 0x7}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x90}}, 0x0) 1.141210963s ago: executing program 5 (id=1934): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0xc, &(0x7f0000000040)=0xa, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="500000d4779a1400003c2a998e63ceed62440d09b10088007a00001701", @ANYRES32=0x0, @ANYBLOB="0000000000000000300012800b0001006272696467650000200002800800080088a8ffff05000700070000000a0014000180c200000d0000"], 0x50}}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1f}}, 0x10) (async) setsockopt$inet_tcp_int(r0, 0x6, 0xc, &(0x7f0000000040)=0xa, 0x4) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="500000d4779a1400003c2a998e63ceed62440d09b10088007a00001701", @ANYRES32=0x0, @ANYBLOB="0000000000000000300012800b0001006272696467650000200002800800080088a8ffff05000700070000000a0014000180c200000d0000"], 0x50}}, 0x0) (async) 1.076703112s ago: executing program 0 (id=1935): socket(0x1, 0x5, 0x5) r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r0, 0x114, 0x3, &(0x7f00000007c0), 0x10) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0xce) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000014007910480000000000690032000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0xa3}, 0x21) bind$vsock_stream(r1, &(0x7f0000009c80)={0x28, 0x0, 0xffffffff, @host}, 0x10) 1.045277628s ago: executing program 4 (id=1936): r0 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'gretap0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67000000000000140600000fff07006706000020000000350200000ee60000bf25000000000000bd350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad53010000000000840400000000000014000000000000009500000000000000db13d5d8b740f2cdaabc8383c8f56b8c2b84a800ea6553f3ef4392b3815dcf00c3eebc52267b042d19d6e31e25e589d5f2692c75a547d6f186641ae8c557ccff3878a93b51a0389749df734f49ed5078b10f1e7f2b37626a3ace1ea89f7d2c570720a86853e26168761f0a53358f7ee2baa0e6a67a98a0d57ac09f36cfefbbc7492bbe7cdf64971a57fd64efd46c26"], &(0x7f0000000100)='GPL\x00'}, 0x48) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r0) sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r3, 0x100, 0x70bd27, 0x25dfdbff, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20044881}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0x5}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0xffffffffffffffff}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}]}}]}, 0x48}}, 0x0) 1.025712237s ago: executing program 3 (id=1937): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000000)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3, '\x00', 0x0, 0x0, 0xff7ffffd}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x7, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000500000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bc8900000000000035090100000000009500000000000000b7080000000100007b9a00fe00000000b509ffffff1f0000c3aaf0fff1000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018220000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7050000080000004608ebff76000000bf9800000000000056080000000000008500000000000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r2 = socket$isdn(0x22, 0x3, 0x21) (async) unshare(0x4000400) select(0x40, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffff2}, &(0x7f00000000c0)={0x4}, 0x0, 0x0) recvmmsg(r2, &(0x7f0000002780)=[{{&(0x7f0000000080)=@nl=@unspec, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000100)=""/245, 0xf5}, {&(0x7f0000000200)=""/203, 0xcb}, {&(0x7f0000000300)=""/206, 0xce}, {&(0x7f0000000400)}, {&(0x7f0000000440)=""/13, 0xd}, {&(0x7f0000000480)=""/40, 0x28}], 0x6, &(0x7f0000000540)=""/220, 0xdc}, 0xadb}, {{&(0x7f0000000640)=@l2tp6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f00000006c0), 0x0, &(0x7f0000000840)=""/48, 0x30}, 0x4}, {{&(0x7f0000000880)=@ethernet={0x0, @dev}, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000900)}, {&(0x7f0000000e80)=""/4096, 0x1000}, {&(0x7f00000009c0)=""/164, 0xa4}, {&(0x7f0000000a80)=""/186, 0xba}, {&(0x7f0000000940)}], 0x5, &(0x7f0000000bc0)=""/33, 0x21}, 0xbb}, {{&(0x7f0000000c00)=@xdp, 0x80, &(0x7f0000000d00)=[{&(0x7f0000000c80)=""/67, 0x43}, {&(0x7f0000001e80)=""/156, 0x9c}], 0x2}, 0x9}, {{&(0x7f0000001f40)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000002300)=[{&(0x7f0000001fc0)=""/142, 0x8e}, {&(0x7f0000000d40)=""/27, 0x1b}, {&(0x7f0000002080)=""/238, 0xee}, {&(0x7f0000002180)=""/224, 0xe0}, {&(0x7f0000002280)=""/128, 0x80}], 0x5, &(0x7f0000002380)=""/141, 0x8d}, 0xd8}, {{0x0, 0x0, &(0x7f0000002640)=[{&(0x7f0000002440)=""/136, 0x88}, {&(0x7f0000002500)=""/254, 0xfe}, {&(0x7f0000002600)=""/16, 0x10}], 0x3, &(0x7f0000002680)=""/251, 0xfb}, 0x4}], 0x6, 0x20100, &(0x7f0000002900)={0x0, 0x3938700}) 957.21662ms ago: executing program 0 (id=1938): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x80000001, '\x00', 0x0, 0x0}, 0x48) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x10448) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x2, 0xc3, "4c8e38", 0x6, 0x7}) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xa, 0x11, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, [@map_val={0x18, 0x7, 0x2, 0x0, r0, 0x0, 0x0, 0x0, 0xe4}, @map_idx={0x18, 0x1, 0x5, 0x0, 0x7}, @tail_call, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}]}, &(0x7f0000000980)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x2e, '\x00', 0x0, @fallback=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) 956.876104ms ago: executing program 5 (id=1939): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {}, {0x10, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x8, 0x2, [@TCA_FW_ACT={0x4}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x8}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x24000880) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x64, 0x10, 0x401, 0xffffffff, 0x0, {}, [@IFLA_LINKINFO={0xb, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x34, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_FLAGS={0x6, 0x10, 0x31f4}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @broadcast}, @IFLA_IPTUN_ENCAP_DPORT={0x6, 0x12, 0x4e21}, @IFLA_IPTUN_TTL={0x5, 0x4, 0x7}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @empty}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @broadcast}]}}}]}, 0x64}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) socket(0x400000000010, 0x3, 0x0) (async) socket$unix(0x1, 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x7}, {}, {0x10, 0xe}}, [@filter_kind_options=@f_fw={{0x7}, {0x8, 0x2, [@TCA_FW_ACT={0x4}]}}, @TCA_RATE={0x6, 0x5, {0x6, 0x8}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x24000880) (async) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newlink={0x64, 0x10, 0x401, 0xffffffff, 0x0, {}, [@IFLA_LINKINFO={0xb, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x34, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_FLAGS={0x6, 0x10, 0x31f4}, @IFLA_IPTUN_REMOTE={0x8, 0x3, @broadcast}, @IFLA_IPTUN_ENCAP_DPORT={0x6, 0x12, 0x4e21}, @IFLA_IPTUN_TTL={0x5, 0x4, 0x7}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @empty}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @broadcast}]}}}]}, 0x64}}, 0x0) (async) 855.06486ms ago: executing program 0 (id=1940): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000006600020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x2d, 0x2, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) (async) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r3, &(0x7f0000000640)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x2, @private1, 0x28}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000040)="dcdb", 0x2}], 0x1, &(0x7f0000000680)=ANY=[@ANYBLOB="140000000000000029000000430000000800000000000000c80000000000000029000000040000002f150000000000000570d00e57facb7c88d46d46872602468f8835c7377b75ef0062fea10d356d1938ba00cc9ae797b9fe8a7737e2c88b1743c844fe8b2dc684a73e0c1183f753a151df98edaec2f969461b06d89f4b5225bdc49ac3c3d34ff18a2f64a3896af2152ff36d8d4cf7c9d527f4286146207446c8b904010f0738000000000c086b4b00000080000000000400000000000000010000000000000001000000000000000300000000000000010000000000000000140000000000000029000000340000000700000000000000280000000000000029000000390000002c02020900000000fe8000000000000000000000000000aa140000000000000029000000080000000300000000000000a80000000000000029000000360000008711000000000000050200090738000000020c02040009000000000000000100000000000000f2dd072e00000000090000000000000000000000000000000100000000000000c910fe800000000000000000000000000015002b00d15a0bd955e1288db6febfb75a1e9bb04b81de87f02e131ad30c1ac50a7e6d7522f3771c2499f37a87a1030001070000000000000000010000000000001400000000000000290000003400000003000000000000002000000000000000290000003600000011000000000000000502000800000000200000000000000029000000370000002b00000000000000c20400000e5a0000480000"], 0x280}}], 0x1, 0x880) (async) sendmmsg$inet6(r3, &(0x7f0000000640)=[{{&(0x7f0000000000)={0xa, 0x4e22, 0x2, @private1, 0x28}, 0x1c, &(0x7f0000000180)=[{&(0x7f0000000040)="dcdb", 0x2}], 0x1, &(0x7f0000000680)=ANY=[@ANYBLOB="140000000000000029000000430000000800000000000000c80000000000000029000000040000002f150000000000000570d00e57facb7c88d46d46872602468f8835c7377b75ef0062fea10d356d1938ba00cc9ae797b9fe8a7737e2c88b1743c844fe8b2dc684a73e0c1183f753a151df98edaec2f969461b06d89f4b5225bdc49ac3c3d34ff18a2f64a3896af2152ff36d8d4cf7c9d527f4286146207446c8b904010f0738000000000c086b4b00000080000000000400000000000000010000000000000001000000000000000300000000000000010000000000000000140000000000000029000000340000000700000000000000280000000000000029000000390000002c02020900000000fe8000000000000000000000000000aa140000000000000029000000080000000300000000000000a80000000000000029000000360000008711000000000000050200090738000000020c02040009000000000000000100000000000000f2dd072e00000000090000000000000000000000000000000100000000000000c910fe800000000000000000000000000015002b00d15a0bd955e1288db6febfb75a1e9bb04b81de87f02e131ad30c1ac50a7e6d7522f3771c2499f37a87a1030001070000000000000000010000000000001400000000000000290000003400000003000000000000002000000000000000290000003600000011000000000000000502000800000000200000000000000029000000370000002b00000000000000c20400000e5a0000480000"], 0x280}}], 0x1, 0x880) shutdown(r3, 0x1) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x85, &(0x7f00000001c0)={0x0, @in={{0x2, 0x4e24, @empty}}, 0xffff, 0xffc0}, 0x90) connect$qrtr(r2, &(0x7f0000000440)={0x2d, 0x0, 0x1}, 0xc) bind$xdp(r2, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) socket(0x400000000010, 0x3, 0x0) (async) r10 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) (async) r11 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000022c0)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r12, {0xfff3, 0xffe0}, {}, {0x5, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) (async) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000022c0)=@newtfilter={0x4c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r12, {0xfff3, 0xffe0}, {}, {0x5, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}, @TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x1}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001040)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) (async) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001040)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r5, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) socket$packet(0x11, 0x3, 0x300) (async) r13 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r13, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756a85d86dd", 0x5ea, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r5, 0x1, 0xd8, 0x6, @multicast}, 0x14) 831.489138ms ago: executing program 3 (id=1941): r0 = socket$netlink(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'veth0_to_bond\x00', &(0x7f0000000440)=@ethtool_perm_addr={0x20, 0x6, "fbb020b1c236"}}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'wlan0\x00', 0x0}) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmmsg$inet6(r4, &(0x7f00000015c0)=[{{&(0x7f0000000080)={0xa, 0x4e21, 0x1000, @mcast2}, 0x1c, 0x0}}, {{&(0x7f0000000040)={0xa, 0x4e22, 0x1ff, @mcast2, 0xfffffff8}, 0x1c, 0x0}}], 0x2, 0x84) sendmsg$NFT_BATCH(r3, 0xfffffffffffffffe, 0x4004890) 776.776869ms ago: executing program 4 (id=1942): r0 = socket$can_j1939(0x1d, 0x2, 0x7) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={&(0x7f0000000040)={0x78, 0xf, 0x8, 0x201, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x8}, [@generic="48de0550bb74f08dbf628f98aa7521279d0ea8058c34d85bc22d9b3bc818b0d9a17d01a20c68e0552902c74790c060aa7ded0a2ff8d392d373c535bd2eff3bda88beb4861fe787d9914dc6331271e96515f60124b631f46b7492c6424f2c58070b"]}, 0x78}, 0x1, 0x0, 0x0, 0x20000810}, 0x840) bind(r0, &(0x7f0000000300)=@generic={0x1d, "89d079df2815ae43ccda410d348bbaf2c702c43620d58cdcb15013f741d03baaac7b8af347ca8ca97c8c3809f4ce980c1cc8c67d21e7f9df75174022adfe4be24c8bdd3404567381bdb993980ee0e2e9c718953d01b39522000cc983dffd0c0b4dd1d9a48151cb47dfb833b15605350d8a722fa9893e21643cd43ffd3fd8"}, 0x80) (async) bind(r0, &(0x7f0000000300)=@generic={0x1d, "89d079df2815ae43ccda410d348bbaf2c702c43620d58cdcb15013f741d03baaac7b8af347ca8ca97c8c3809f4ce980c1cc8c67d21e7f9df75174022adfe4be24c8bdd3404567381bdb993980ee0e2e9c718953d01b39522000cc983dffd0c0b4dd1d9a48151cb47dfb833b15605350d8a722fa9893e21643cd43ffd3fd8"}, 0x80) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r3, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0xfff7ff1f, 0x1}}, 0x20) (async) r4 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r3, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0xfff7ff1f, 0x1}}, 0x20) writev(r2, &(0x7f00000008c0)=[{&(0x7f0000000180)="f4ed2843e7ae3539f31830bde4ceaf697c9517acc52967a5ddca0bdfed27ce7043d7bd2f2aa2cd6c18100a93b4932cbf349a6725061f4e08ea42bfc45c90a411261f6903f381c795b5c0a21d331f8f99ee40e78ff355236052dcc5cd6935bc226eb8d562038976ab92d95d1461883afe83d9a72340a40ed43304f654d9f715cd50e25ba01be352760e2b34bd9db860a924fec33d58760acf9162026f5ffc8bd301c7", 0xa2}, {&(0x7f00000000c0)="aa098ae1d8c23d4b1605dc7707", 0xd}, {&(0x7f0000000480)="d6e4a143eac7f1a2be8e30280c54c11d177984479d5b3634fd98f9fad13a2af7b34adf62804029330839a730cfea9a4fbef2dac2527c7ba4c381efa0bfb256536e6278ba8bf224f39c679c61e1d52f681e40144a96d0bd30f422cd8b4ee12ce986d9c3c4c7cffb42eaf14a00267abbfbf6fbf1edcac01edb6495f61937e439ec0c0511a2b2e45d0aa2a3a72aeb64ae1109434f14d07b71e80b7ddb894c1d1ddcac34595fc7862f5b0aaac0b615a0bb18614f77d77cbfd84c9183866f6b27a9f7f0aa8561c3deb39a8b97816491fc1778bafdb841762e31ad58dbaa387d6194654ace8ec47692dd719098595ce34ee7a2", 0xf0}, {&(0x7f0000000240)="545a9a280020c7baecf4dc27acaa64f8ebc89acb3137ef46f73c086546c509d1c1e2a8c37753828bd5999a26d887bb2471e10c0eb4ac2971cae49fa3a4411c6f631c82ce530b672f76e7fe3175128d8b5bcdfd4968580ae491441e65dbc647f6b849", 0x62}, {&(0x7f0000000580)="b2f7ec0e04329e69895eec8e980d9d22c96ccfc4e0c2b94aa304d84b3f73f945ab811914915b3df17974cb1ad119bf8726ec49bb5d54de598dd41b4b45af63da79bc6d240eecaa736de9de911f4b0c", 0x4f}, {&(0x7f0000000600)="72c8b19004cb11e627718f856bfd0a742756cdc165e580062c42e35bad001b01c75d2c9a514cc55cc2956c569346c64acb1ccbb60336c7c2e8fa003a8ac1516902caa28155152ce0834f6694c5fd0029869a4372413dc65dd63f1928045ebd433572c156e0b12256f7d148ddfc546b36721f9f60490a549a3cd6b73682bb8c21d26d3039b6092afec950a69fa9c615554e6f8e22f819ae10aed1658ce1cadfde68f6dbf10cdc7e9c6f641e0a49", 0xad}, {&(0x7f0000000100)="81ec51500e3bc0678be07f3bdededde21ff962c64fb5e30ea689e9ce419abbc266a1ff0bba6c958366588c69a6017f52b1e9ff2caa", 0x35}, {&(0x7f00000006c0)="371e974cbe8208168c086eb3a84dbb068fa63e6aa2ff41161e4ffa3e55c8b382347561dc7c0180ef38c0aade7a8aa5d4aaef418ac755ef54754ed189bd5be172f3f70202371196111aff4265875e51d6fe757ac9", 0x54}, {&(0x7f0000000740)="6d74b7807ac70c7a16d7b9767123963f2df34fe7bf5d024a863f4bd596f0d0a8c1df9b3aff8ba28c3e3552fef27495e243b2a19a6b4dd05ba8b8baaffb7787ebed9a041cb6d903080cdbb304e9e3da97375a50cec59e00d7b9c340e283103a5e6eb231be75c4f59d1165086b8e8d029299cb5cd3029db640778737ffe93b804fb42cbef4b796d44591296d8943b2326168b8b894899fd77008808796f882edc42c8c4a40a2affb8804e683db5abcb168aec999e830a2bd8870af041ce1b4178ceda7d127d48f6e94b2bed8e35eb954f62e24238198a7de27a010cc82feff456d50b3198363291d8f7d", 0xe9}, {&(0x7f0000000840)="3ad073d6086906a90e7b37cfad8dc411c18a5dfedfcd785321be15336c224324dda3daf2579282a32aed35f658a8f60482d04443b1f5a4dfec8b6ee872f7cfd14093fa44d017ad5d9fe50ca9b98118aeabf29097aaa1df3cebb7122d1e3e24114242", 0x62}], 0xa) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) (async) sendmsg$NFT_BATCH(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) (async) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003d00000095"], &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="0f00000004000000080000000b"], 0x48) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={r5, r6, 0x7, 0x0, @val=@tcx={@void, @value=r5}}, 0x1c) r7 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x4, 0x7, 0x7f}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000900)=@framed={{0x18, 0x3}, [@map_fd={0x18, 0x2, 0x1, 0x0, r7}, @call={0x85, 0x0, 0x0, 0x1b}]}, &(0x7f0000000000)='GPL\x00'}, 0x80) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000900)=@framed={{0x18, 0x3}, [@map_fd={0x18, 0x2, 0x1, 0x0, r7}, @call={0x85, 0x0, 0x0, 0x1b}]}, &(0x7f0000000000)='GPL\x00'}, 0x80) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a00)={{0x1, 0xffffffffffffffff}, &(0x7f0000000980), &(0x7f00000009c0)=r3}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x277963f4935cfbf9, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000d00)={'syztnl1\x00', &(0x7f0000000c80)={'syztnl0\x00', 0x0, 0x0, 0x80, 0x8, 0xfffffff9, 0x22, @mcast1, @private0, 0x4, 0x700, 0x456, 0x2}}) bpf$ITER_CREATE(0x21, &(0x7f0000000d40)={r1}, 0x8) (async) r12 = bpf$ITER_CREATE(0x21, &(0x7f0000000d40)={r1}, 0x8) r13 = bpf$ITER_CREATE(0x21, &(0x7f0000000e00)={r4}, 0x8) r14 = bpf$MAP_CREATE(0x0, &(0x7f0000000e40)=@base={0x3, 0xb, 0x9, 0xd, 0x2, 0x1, 0x7, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x2, 0x2}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000f40)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000ec0), &(0x7f0000000f00)='%-5lx \x00'}, 0x20) r16 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000f80)={0xffffffffffffffff, 0x5, 0x10}, 0xc) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001040)={{r3}, &(0x7f0000000fc0), &(0x7f0000001000)='%pB \x00'}, 0x20) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001040)={{r3, 0xffffffffffffffff}, &(0x7f0000000fc0), &(0x7f0000001000)='%pB \x00'}, 0x20) r18 = bpf$MAP_CREATE(0x0, &(0x7f0000001080)=@base={0x21, 0x7fffffff, 0x1, 0xfffff665, 0x8022, 0xffffffffffffffff, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0, @value=r4}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000011c0)={0x6, 0x2c, &(0x7f0000000a80)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x80000001}, {{0x18, 0x1, 0x1, 0x0, r6}}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @map_fd={0x18, 0x9, 0x1, 0x0, r7}, @tail_call={{0x18, 0x2, 0x1, 0x0, r8}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3cb}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r9}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x2}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r10}}, @map_idx={0x18, 0xb, 0x5, 0x0, 0xd}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000c00)='GPL\x00', 0x0, 0x0, &(0x7f0000000c40), 0x41000, 0x21, '\x00', r11, 0x25, r12, 0x8, &(0x7f0000000d80)={0x8, 0x1}, 0x8, 0x10, &(0x7f0000000dc0)={0x5, 0x7, 0x4, 0x3}, 0x10, 0x0, 0x0, 0x5, &(0x7f0000001100)=[r13, r2, r14, r15, r16, r17, r18], &(0x7f0000001140)=[{0x2, 0x4, 0xd, 0x7}, {0x4, 0x3, 0x3, 0x5}, {0x0, 0x5, 0x5, 0x9}, {0x3, 0x2, 0xb, 0x4}, {0x1, 0x3, 0x4, 0x3}], 0x10, 0x10}, 0x94) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200000054000480500001800a000100696e6e65720000004000028008000240200000840800034000000007080004400000000f08000140000000001c0005800c000100707b796c6f6164000c00028008000240000000050900010073797a30000000000900020073797a32"], 0xa8}}, 0x0) 717.074968ms ago: executing program 5 (id=1943): r0 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_OCC_MAX_CLEAR(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000280)={&(0x7f0000000100)=ANY=[@ANYBLOB="44010000", @ANYRES16=r0, @ANYBLOB="200025bd7000fedbdf251c00000008000100705a690011000200303030303a30303a31302e3000000000080011000200303030302b3c8443695f37c23a30303a31302e300000000008000b0003000000696d0000000f0002006e657464657673696d30000008000b00ff010000080001007063690011000200303030303a30303a31302e300000000008000b0081000000080001007067690011000200303030303a30303a31302e300000000008000b00fffffeff0e0001006e657464657673696d0002000f0002006e657464657673696d30000008000b00030000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008000b00020000000e0001006e657464657673696d0000000f0002006e657464657673696d3000"/307], 0x144}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) getsockopt$llc_int(r1, 0x10c, 0x2, &(0x7f0000001b00), &(0x7f00000004c0)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0xd, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="18f9ffffff000000000c000000000000000000f528ceab0810995845bc515746ecdaf749d129dd4c26d4ac7019375763f210ca08d5781a3df3305bd85f7983e787f01cd027f7a411a04ed62f91ac16d8943477c0141674d2d924207fce0359b59732a26416ff7145347bdcf74d14e665937320ce0bb31044541f07660b82326fd04e5fc4ee996297d120703bdfc2dec3b2a23d7b34bf0ce7b1033eb72bf1576e736a8b8a96e08e7a89ef"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) 656.995058ms ago: executing program 3 (id=1944): pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r1 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) (async) bind$inet6(r1, &(0x7f0000000080)={0xa, 0xe64, 0x3, @ipv4={'\x00', '\xff\xff', @empty}, 0x202}, 0x1c) (async) r2 = socket(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r2, &(0x7f0000000480)={0xa, 0xe64, 0x3, @empty, 0x2}, 0x1c) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) (async) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) (async) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) (async) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x0) (async) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) (async) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r8, 0x0) (async) r9 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r9, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000100080c10000000000000000000", 0x58}], 0x1) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x9, 0x1, 0x80}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xb}, 0x90) (async) close(r0) (async) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000170900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x2000c450) sendmsg$NFT_BATCH(r10, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000010300000a48000000060a010400000000000000000a0000050900020073797a32000000001c000495180001800d000100737900000000040002800900010073797a310000000014000000110001000000000000000040f219000a"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) (async) sendmsg$NFT_BATCH(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[], 0xe0}}, 0x0) (async) close(r0) 656.547746ms ago: executing program 4 (id=1945): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001140)={0x24, 0x40, 0x107, 0x70bd26, 0x0, {0x4, 0x7c}, [@nested={0xc, 0x1c2, 0x0, 0x1, [@typed={0x8, 0x9, 0x0, 0x0, @pid}]}, @nested={0x4, 0x2}]}, 0x24}}, 0xc000) 524.301544ms ago: executing program 5 (id=1946): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512\x00'}, 0x58) r1 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000140)="d0d0648b9fff74a74c4b12ed95", 0xd}, {&(0x7f0000000240)="6fbccee3101c7a3518719d", 0xb}, {&(0x7f0000000000)="c9bf51ba4f1785089658b6b41db8da336f37a213e5848adbdab75e64a14fad286c0d65b523c3b756", 0x28}], 0x3}, 0x0) (async) sendmsg$kcm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000140)="d0d0648b9fff74a74c4b12ed95", 0xd}, {&(0x7f0000000240)="6fbccee3101c7a3518719d", 0xb}, {&(0x7f0000000000)="c9bf51ba4f1785089658b6b41db8da336f37a213e5848adbdab75e64a14fad286c0d65b523c3b756", 0x28}], 0x3}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000200)={'geneve0\x00', 0x0}) close(0xffffffffffffffff) (async) close(0xffffffffffffffff) syz_init_net_socket$netrom(0x6, 0x5, 0x18) (async) syz_init_net_socket$netrom(0x6, 0x5, 0x18) socket(0x22, 0x2, 0x3) (async) r4 = socket(0x22, 0x2, 0x3) sendmmsg$inet6(r4, &(0x7f0000001380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4005) (async) sendmmsg$inet6(r4, &(0x7f0000001380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4005) syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r2) (async) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080), r2) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) socket$nl_audit(0x10, 0x3, 0x9) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x41100, 0xe4bd6a1de0769cb0, '\x00', r3, @flow_dissector=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x41100, 0xe4bd6a1de0769cb0, '\x00', r3, @flow_dissector=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) r7 = socket(0x10, 0x803, 0x0) r8 = socket(0x10, 0x803, 0x0) r9 = socket(0x1, 0x803, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001400b59527bd7000fcdbdf2523090000", @ANYRES32=r10, @ANYBLOB="140002"], 0x34}}, 0x0) (async) sendmsg$nl_route(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001400b59527bd7000fcdbdf2523090000", @ANYRES32=r10, @ANYBLOB="140002"], 0x34}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)=ANY=[], 0x34}}, 0x4040800) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="942522574c07fc590f92eec2b06e97ee40c0c4a0785fac6bbc7d3b3badb3c3e09f075b5bc16779d5ef773c52e405d44588408172797eea981c4598ae18240d90c2d1b53afb67e073437703436c8823641b7bd61ffa5b22e0324e6e47b8b40f1556d05aa1c198323ed4269e86a1"], 0x74}}, 0x4c004) socket(0x10, 0x3, 0x0) sendmmsg(r11, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_inet_SIOCSARP(r6, 0x8955, &(0x7f0000000080)={{0x2, 0x4e1e, @rand_addr=0x64010102}, {}, 0x0, {0x2, 0x4e20, @remote}, 'xfrm0\x00'}) ioctl$sock_TIOCOUTQ(r6, 0x5411, &(0x7f00000001c0)) sendmsg$TIPC_NL_BEARER_DISABLE(r4, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB="01000000", @ANYRES16=r5, @ANYBLOB="100026bd7000fedbdf25020000001c0003800800030002000000080001000400000008000300faffffff3800028008000100070000000800020006000000080002001800000004000400080001000500000008000200000000000800010001feffff5c0007800c000400f8ffffffffffffff08000100080000000c000400ff070000000000000c00030069000000000000000c000300d40000000000000008000100020000000800010004000000080002000700000008000100010000001c000680080006000001000008000100070000000400020004000200180002800400040008000200080000000800020000feffff"], 0xf8}, 0x1, 0x0, 0x0, 0x10008881}, 0x40040) socket$packet(0x11, 0x3, 0x300) (async) r12 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout_data(r12, 0x107, 0x16, &(0x7f00000000c0)={0x2, &(0x7f0000000180)=[{0x3c}, {0x6}]}, 0x10) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="5800000010000300"/20, @ANYRES32=r3, @ANYBLOB="00000000000000001c0012800b00010067656e65766500000c00028005000c00010000001c001a8018000a8014000700fc"], 0x58}, 0x1, 0x2}, 0x0) (async) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="5800000010000300"/20, @ANYRES32=r3, @ANYBLOB="00000000000000001c0012800b00010067656e65766500000c00028005000c00010000001c001a8018000a8014000700fc"], 0x58}, 0x1, 0x2}, 0x0) 522.537996ms ago: executing program 0 (id=1947): r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0x8, 0x7f}, 0x50) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x440, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$TUNSETTXFILTER(r2, 0x400454d1, &(0x7f0000000140)=ANY=[@ANYBLOB="d2e6725d5a"]) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x11, 0xa, &(0x7f0000000680)=@framed={{0x18, 0x8, 0x0, 0x0, 0xed00, 0x0, 0x0, 0x0, 0x7ffffffd}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x1, 0x0, r0}, @generic={0x24, 0x8, 0x0, 0x0, 0xb000}, @initr0, @exit]}, &(0x7f0000000000)='GPL\x00', 0x4, 0xee, &(0x7f0000000340)=""/238}, 0x80) 425.206825ms ago: executing program 4 (id=1948): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) r2 = socket(0xa, 0x3, 0x3a) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000040)='westwood', 0x8) r3 = socket$inet(0x2, 0x2, 0x1) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20004090) sendmsg$inet(r3, &(0x7f0000000140)={&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, &(0x7f0000000300)=[{&(0x7f00000001c0)="0800e5bb59ec815a", 0x8}], 0x1, &(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000000000000000000007000000830b040a0101027f00000100000000001c000000000000000000000008"], 0x40}, 0x4800) getsockopt$inet_tcp_buf(r1, 0x6, 0x1a, 0x0, &(0x7f00000000c0)) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x38, 0x3, 0x8, 0x5, 0x0, 0x0, {}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x84}, @CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @sctp=[@CTA_TIMEOUT_SCTP_SHUTDOWN_ACK_SENT={0x8}, @CTA_TIMEOUT_SCTP_SHUTDOWN_RECD={0x8}]}, @CTA_TIMEOUT_L3PROTO={0x6}]}, 0x38}}, 0x0) 408.086402ms ago: executing program 3 (id=1949): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$sock_int(r1, 0x110, 0x7, 0x0, 0x0) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000040), r0) sendmsg$NLBL_CALIPSO_C_LIST(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x34, 0x0, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008015) sendmsg$NFC_CMD_DEP_LINK_UP(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002abd7000fbdbdf250400000006000a006b983800080001"], 0x24}, 0x1, 0x0, 0x0, 0x40080c0}, 0x8000) 366.556433ms ago: executing program 5 (id=1950): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x48, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x1c, 0x3, 0x0, 0x1, [{0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000054000000060a010400000000000000000100000008000b40000000000900010073797a30000000002c0004802800018008000100666962001c000280080002400000001908000340000000010800014000"], 0xdc}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000001e0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c000180060001"], 0x70}, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000014ac1414aa00000000000000001400020002000000e000000200000000000004000d000100756470"], 0x54}}, 0x0) sendmsg$TIPC_NL_SOCK_GET(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000000), 0xc, &(0x7f0000000340)={&(0x7f0000000480)={0x78, r5, 0x300, 0x70bd29, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x4}, @TIPC_NLA_MEDIA={0x60, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x78}, 0x1, 0x0, 0x0, 0x40094}, 0x14) 257.198798ms ago: executing program 1 (id=1951): socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$TIPC_SRC_DROPPABLE(r0, 0x10f, 0x80, &(0x7f0000001640)=0x4f1d, 0x4) sendmmsg$inet(r0, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0xf5) r1 = socket(0x6, 0x80003, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@newlinkprop={0x20, 0x6c, 0xb21, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x34400, 0x10010}}, 0x20}, 0x1, 0x0, 0x0, 0x40080}, 0x10) 256.874038ms ago: executing program 4 (id=1952): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="540000001400b59500000000000000000a000000", @ANYRES32=r1, @ANYBLOB="140001000040000000000000000000000000000014000200fe8000000000000000000000000000aa140006"], 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x80) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$inet6(r2, &(0x7f00000005c0)={&(0x7f0000000180)={0xa, 0x4e21, 0x400, @dev={0xfe, 0x80, '\x00', 0x39}, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000001c0)="897d50a6b7a3a555bbb7beca72208e263126893480c306160441803320c9405dfdcf7cc1f93facfe51ba9edf4aefc896123892491ab171b13edb20b0e13538862ab9a6ef55f9eb102386ef055b7b538a512130c010bf0def5493b51481bbd0a24c10442eb78768ccd3fd874ed622f6392844e0057f2c76f32502c77035927ea0cb3e0701a13d9164324bb31a69332f9fd8956803409388f444510bc598a3e6f04dfcbef9accb500980bc3fefccdcd8e464b719d8ad1d1527", 0xb8}, {&(0x7f0000000280)="edc5dbded2c7b4acfd4cf3f111b3a4426529298536dcf3101c36646ebb9b423c57b2d79ff0dc04d15a466c1dd95936f6ee0fa4e79e5549dff7a520cbceb6a81acab76e70c31a5db928ba667dfe62972ff80da5dce5fda374b7e6a7241c036fe6462040b4c84a9126fbfa6e2f2e779764bc9dde1b961fcbabcd8b13f14bca1ae86233475e16982adb777b562bba66ee108d4d27fae0199cb5c2207beb8da99ce205374a2c1572689cb7b6404dd8eb3504c006c7b99c9014a0c62a39c1e4fa32d1dbd9f338ca7747947bf3fb5d71ec6543c65d955109d98f8e63564f80046a3aea7a5db92fe4cd772e29fdd4cf1675ed5ef081b7c8a5cb", 0xf6}], 0x2, &(0x7f00000003c0)=[@rthdr={{0x48, 0x29, 0x39, {0x29, 0x6, 0x0, 0x7f, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @private1, @remote]}}}, @rthdrdstopts={{0x28, 0x29, 0x37, {0x33, 0x1, '\x00', [@enc_lim={0x4, 0x1, 0x80}, @enc_lim={0x4, 0x1, 0x8}, @ra]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x7}}, @hopopts_2292={{0x40, 0x29, 0x36, {0x0, 0x4, '\x00', [@calipso={0x7, 0x20, {0x3, 0x6, 0xff, 0x2c3, [0x8000000000000001, 0x6, 0x9]}}, @pad1]}}}, @hopopts_2292={{0x40, 0x29, 0x36, {0x4, 0x4, '\x00', [@calipso={0x7, 0x20, {0x1, 0x6, 0x3, 0xa6, [0xffffffffffffff69, 0x2, 0x9]}}, @pad1]}}}, @dstopts_2292={{0x28, 0x29, 0x4, {0x87, 0x1, '\x00', [@ra={0x5, 0x2, 0xb4}, @padn, @pad1, @jumbo={0xc2, 0x4, 0xff}]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x5}}, @hopopts={{0x68, 0x29, 0x36, {0x2b, 0x9, '\x00', [@calipso={0x7, 0x38, {0x0, 0xc, 0x40, 0xe2, [0xfffffffffffffff8, 0x0, 0x0, 0x7, 0xa35c, 0x5]}}, @ra={0x5, 0x2, 0x9}, @padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}, @jumbo={0xc2, 0x4, 0x86d0}]}}}], 0x1b0}, 0x40050) sendmmsg(r0, &(0x7f0000000000), 0x4000000000001f2, 0x0) 255.178885ms ago: executing program 0 (id=1953): sendmsg$inet(0xffffffffffffffff, &(0x7f0000002480)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x41, 0x0, 0x11}, 0x0) r0 = socket$kcm(0x2, 0x5, 0x84) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0x0, 0x2, 0x0, 0x9}, {0x10000002, 0x0, 0x0, 0xc}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r2) recvmsg$unix(r1, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0x64, &(0x7f0000000000)=r3, 0x10) sendmsg$inet(r0, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffc0}], 0x1}, 0x80d1) r4 = socket$kcm(0x2, 0x1, 0x84) sendmsg$inet(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x32}}, 0x10, 0x0}, 0x40040d4) (async, rerun: 64) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) (rerun: 64) close(r6) (async) recvmsg$unix(r5, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r4, 0x84, 0x64, &(0x7f0000000000)=r7, 0x10) sendmsg$inet(r4, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x10, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0xffc0}], 0x1}, 0x80d1) close(0x3) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) (async) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000440)=[{0x73, 0xfd, 0xfd, 0x5ae9}, {0x16, 0x0, 0x7, 0x2}]}, 0x10) (async, rerun: 64) r11 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 64) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r11, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r13 = socket$nl_route(0x10, 0x3, 0x0) (async) ioctl$XFS_IOC_SCRUB_METADATA(r9, 0xc040583c, &(0x7f00000001c0)={0xf, 0x10, 0x2, 0x10, 0x447ccbf1}) sendmsg$nl_route(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000004c0)=@ipv6_newroute={0x44, 0x18, 0x1, 0x70bd2c, 0x0, {0xa, 0x80, 0x0, 0x0, 0xff, 0x2, 0xff, 0x0, 0x400}, [@RTA_OIF={0x8, 0x4, r12}, @RTA_ENCAP_TYPE={0x6, 0x15, 0x6}, @RTA_ENCAP={0x18, 0x16, 0x0, 0x1, @SEG6_IPTUNNEL_SRH={0x14, 0x1, {{0x2, {0x4, 0x0, 0x4, 0x0, 0x80, 0x30, 0xb9}}}}}]}, 0x44}}, 0x0) (async, rerun: 32) sendmmsg$inet(r10, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) (async, rerun: 32) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff008}, {0x6}]}, 0x10) (async) tee(r8, r9, 0x8, 0xd) (async) r14 = syz_init_net_socket$ax25(0x3, 0x5, 0xf0) ioctl$XFS_IOC_SCRUBV_METADATA(r14, 0xc0285840, &(0x7f0000000180)={0x2, 0x6, 0x3, 0x0, 0xfab, 0x3, 0x0, &(0x7f0000000100)=[{0x4, 0x101, 0x1}, {0x1c, 0x1ff, 0x7}, {0x0, 0x1ff, 0x5}]}) 248.076529ms ago: executing program 3 (id=1954): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000200)={0x0, 0x0, 0x207}, 0x20) (async, rerun: 32) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (rerun: 32) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000940)=@newtaction={0x48, 0x76, 0x1, 0x0, 0x0, {0x0, 0x0, 0x300}, [{0x34, 0x1, [@m_vlan={0x30, 0x4, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0) 171.622111ms ago: executing program 5 (id=1955): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$kcm(0x29, 0x7, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000080)=r0, 0x4) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000040)) r2 = getpid() r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000140), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a5fdad88000000001c00028006000500000000007a824fb6e8ff158294bc34ff4168e6e27aa3cc1519b3462a54265fba4f8982a6b655dd4b77c06d090646172972b427f39234070f06ead751f7e63fdf56a6cd3a7dc367c818c491a50c8164de5a2e32bcf4585fadd0002660d202aa181abe5928baa9b1691438d31ef15bb4ad6df71cc4c37e64e9bf35bc8dd5a5f855c276e8a2ad923f56338cb2f65ff6271a1a5a0aaca29937f2a34d47d52ca280be7905a1202caf55574cbec1d950dd7e582811b66fb5db45a46ccb05d13660fa4aeba0249957a2b33c5a0125155f81adaa3f557c152dd9cbf794d611155f1018333c63acf16367d6bf2710efc6bf98ea5a8e2374da1f9a"], 0x3c}}, 0x404c840) sendmsg$DEVLINK_CMD_RELOAD(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x3c, r4, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8, 0x8b, r2}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r6, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe000031f, 0x0, "ff00000058b274e6d845167fefe428970548fc3c7b00000000000000fcff00", 0xb2, 0xb, 0x6, 0x6}, 0x3c) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=ANY=[@ANYBLOB="400000001000010400000060a6a846f44e384f52c08715609b0000000e546091e4fbfddeb63f301421cfbfd67d7a9bd0f299f18437ae982796647b703d1179ca8bff6f61deda53d1967ef1b85d9287521716e9febe54b6ecf55bdfca7801a4e41945b57599fb22906c823210099c2a26e7b4e7d1d3a91d68f0f2b6941cb6d6daec92be1b6e4538c886356d", @ANYRES32=0x0, @ANYBLOB="0000000000000000200012800b0001006272696467650000100002800c002e000000000003000000"], 0x40}}, 0x0) 0s ago: executing program 0 (id=1956): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PUBL_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x14, r3, 0xf13}, 0x14}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000300)=ANY=[@ANYBLOB="240000001800dd8d00000000000001800200000000000000000000000600120002"], 0x24}}, 0x0) r4 = accept4(r0, 0x0, 0x0, 0x0) ioctl$PPPOEIOCDFWD(r4, 0xb101, 0x0) sendmsg$nl_route_sched_retired(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r4, 0x89f8, &(0x7f0000000140)={'syztnl2\x00', &(0x7f0000000480)={'gretap0\x00', 0x0, 0x700, 0x1, 0x159, 0x59, {{0x35, 0x4, 0x3, 0x0, 0xd4, 0x66, 0x0, 0x0, 0x29, 0x0, @initdev={0xac, 0x1e, 0x4, 0x0}, @multicast1, {[@ssrr={0x89, 0x1f, 0xea, [@multicast1, @private=0xa010101, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1, @rand_addr=0x64010102]}, @timestamp_addr={0x44, 0x2c, 0x3d, 0x1, 0x0, [{@local, 0xf221}, {@multicast1, 0x2}, {@empty, 0xfffffff0}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}]}, @cipso={0x86, 0x74, 0x3, [{0x6, 0xe, "aadd677941808c63f56a2789"}, {0x1, 0x3, "95"}, {0x6, 0x10, "928032a0a3344d9bc5c17453c2df"}, {0x5, 0xf, "1a0f953a50ab3610f81b3fefb2"}, {0x5, 0xf, "4b2a90c43c6027f1e61e1d00dd"}, {0x0, 0x7, "6e2c8adfef"}, {0x1, 0xc, "840152ed88227ef3e293"}, {0x6, 0xe, "fe53702a83c446bc28445357"}, {0x1, 0x8, "d1ea06cfedf9"}, {0x2, 0x6, "5c16cd87"}]}]}}}}}) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@newqdisc={0x38, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_BACKLOG_LIMIT={0x8, 0x1, 0x5}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) sendmsg$FOU_CMD_DEL(r5, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x54, 0x0, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@FOU_ATTR_IFINDEX={0x8, 0xb, r6}, @FOU_ATTR_IFINDEX={0x8, 0xb, r9}, @FOU_ATTR_PEER_V6={0x14, 0x9, @mcast2}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @private=0xa010102}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000}, 0x0) recvmmsg$unix(r4, &(0x7f00000029c0)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000002a00)=""/4100, 0x1004}], 0x1}}], 0x1, 0x10000, 0x0) kernel console output (not intermixed with test programs): 0' already exists in 'hsr' [ 88.036233][ T5822] Cannot create hsr debugfs directory [ 88.545888][ T5821] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.566381][ T5821] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.577093][ T5821] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.596978][ T5821] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.657537][ T5823] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 88.672269][ T5823] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 88.684659][ T5823] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 88.706886][ T5823] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 88.768717][ T5825] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.788192][ T5825] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.818165][ T5825] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.831623][ T5825] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.926175][ T5822] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 88.942593][ T5822] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 88.955166][ T5822] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 88.967068][ T5822] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 89.040160][ T5821] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.087260][ T5826] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 89.098880][ T5826] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 89.111316][ T5826] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 89.137549][ T5826] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 89.151770][ T5821] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.184564][ T5823] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.196647][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.203990][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.213805][ T5827] Bluetooth: hci0: command tx timeout [ 89.219259][ T5827] Bluetooth: hci1: command tx timeout [ 89.225243][ T5843] Bluetooth: hci4: command tx timeout [ 89.225261][ T5839] Bluetooth: hci3: command tx timeout [ 89.238237][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.245369][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.283592][ T5839] Bluetooth: hci2: command tx timeout [ 89.300515][ T5823] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.330862][ T1134] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.338102][ T1134] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.360840][ T5825] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.370924][ T1134] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.378100][ T1134] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.472328][ T5825] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.509984][ T1323] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.517147][ T1323] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.530439][ T5822] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.549524][ T33] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.556727][ T33] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.618778][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.661338][ T5822] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.706081][ T5826] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.734715][ T33] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.741908][ T33] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.817470][ T33] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.824689][ T33] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.849752][ T33] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.856987][ T33] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.871305][ T33] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.878549][ T33] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.051955][ T5826] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 90.127264][ T5821] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.157351][ T5823] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.336869][ T5823] veth0_vlan: entered promiscuous mode [ 90.349306][ T5821] veth0_vlan: entered promiscuous mode [ 90.377045][ T5823] veth1_vlan: entered promiscuous mode [ 90.426076][ T5821] veth1_vlan: entered promiscuous mode [ 90.457095][ T5825] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.495914][ T5823] veth0_macvtap: entered promiscuous mode [ 90.511287][ T5823] veth1_macvtap: entered promiscuous mode [ 90.547856][ T5822] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.574133][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.601376][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.627512][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.636050][ T5821] veth0_macvtap: entered promiscuous mode [ 90.652516][ T59] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.662097][ T59] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.677633][ T59] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.687231][ T59] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.698098][ T5821] veth1_macvtap: entered promiscuous mode [ 90.836696][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.868650][ T5825] veth0_vlan: entered promiscuous mode [ 90.882890][ T5822] veth0_vlan: entered promiscuous mode [ 90.905663][ T5821] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.972482][ T5825] veth1_vlan: entered promiscuous mode [ 90.986545][ T1134] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.000745][ T5822] veth1_vlan: entered promiscuous mode [ 91.025651][ T59] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.035247][ T59] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.057846][ T59] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.079348][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.096852][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.182246][ T1134] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.190930][ T1134] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.222103][ T5825] veth0_macvtap: entered promiscuous mode [ 91.266272][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.270372][ T5822] veth0_macvtap: entered promiscuous mode [ 91.284181][ T5825] veth1_macvtap: entered promiscuous mode [ 91.292771][ T5839] Bluetooth: hci1: command tx timeout [ 91.293892][ T5827] Bluetooth: hci4: command tx timeout [ 91.298364][ T5839] Bluetooth: hci0: command tx timeout [ 91.304467][ T5835] Bluetooth: hci3: command tx timeout [ 91.319758][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.346648][ T5823] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 91.373895][ T5827] Bluetooth: hci2: command tx timeout [ 91.401258][ T5822] veth1_macvtap: entered promiscuous mode [ 91.426217][ T5826] veth0_vlan: entered promiscuous mode [ 91.454314][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.462216][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.490752][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.511049][ T5826] veth1_vlan: entered promiscuous mode [ 91.538715][ T5825] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.556610][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.596888][ T129] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.612704][ T129] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.637678][ T129] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.650071][ T129] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.668406][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.726915][ T129] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.744946][ T5951] trusted_key: syz.2.6 sent an empty control message without MSG_MORE. [ 91.767814][ T129] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.770682][ T5950] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2'. [ 91.798757][ T129] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.803878][ T5950] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2'. [ 91.855407][ T5955] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2'. [ 91.860978][ T5826] veth0_macvtap: entered promiscuous mode [ 91.875104][ T5955] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2'. [ 91.875108][ T129] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.922905][ T5826] veth1_macvtap: entered promiscuous mode [ 91.934195][ T5955] Zero length message leads to an empty skb [ 91.949817][ T42] cfg80211: failed to load regulatory.db [ 92.002712][ T129] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.016600][ T129] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.025329][ T5955] syzkaller0: entered promiscuous mode [ 92.031296][ T5955] syzkaller0: entered allmulticast mode [ 92.102505][ T33] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.126758][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.134077][ T33] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.192607][ T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.212438][ T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.229055][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.263533][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.294259][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.336576][ T13] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.347459][ T13] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.383805][ T13] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.392615][ T13] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.547310][ T5969] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 92.651984][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.661218][ T5976] netlink: 1047 bytes leftover after parsing attributes in process `syz.2.9'. [ 92.675948][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.686929][ T5976] bridge_slave_1: default FDB implementation only supports local addresses [ 92.787560][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.820470][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.137747][ T5981] netlink: 36 bytes leftover after parsing attributes in process `syz.3.10'. [ 93.318279][ T5999] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 93.363751][ T5827] Bluetooth: hci4: command tx timeout [ 93.369266][ T5835] Bluetooth: hci3: command tx timeout [ 93.375573][ T5843] Bluetooth: hci0: command tx timeout [ 93.375585][ T5839] Bluetooth: hci1: command tx timeout [ 93.451564][ T5839] Bluetooth: hci2: command tx timeout [ 93.518970][ T6009] netlink: 'syz.1.18': attribute type 18 has an invalid length. [ 93.535138][ T6014] netlink: 20 bytes leftover after parsing attributes in process `syz.3.19'. [ 93.566963][ T6006] syzkaller0: entered promiscuous mode [ 93.572539][ T6006] syzkaller0: entered allmulticast mode [ 93.708490][ T6020] netlink: 20 bytes leftover after parsing attributes in process `syz.4.21'. [ 93.765890][ T6020] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.21'. [ 94.529477][ T6061] netlink: 8 bytes leftover after parsing attributes in process `syz.4.33'. [ 95.009773][ T6082] netlink: 'syz.4.36': attribute type 62 has an invalid length. [ 95.350203][ T6098] net veth1_virt_wifi : renamed from virt_wifi0 [ 95.574876][ T6107] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 95.834012][ T6121] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 96.021945][ T6139] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 96.409308][ T6160] syz.1.64 uses obsolete (PF_INET,SOCK_PACKET) [ 97.011396][ T6195] netlink: 'syz.1.73': attribute type 19 has an invalid length. [ 97.105324][ T6202] __nla_validate_parse: 11 callbacks suppressed [ 97.105346][ T6202] netlink: 64 bytes leftover after parsing attributes in process `syz.3.74'. [ 97.481608][ T6213] ip6t_REJECT: ECHOREPLY is not supported [ 97.731897][ T6225] netlink: 16 bytes leftover after parsing attributes in process `syz.2.85'. [ 97.740957][ T6225] netlink: 16 bytes leftover after parsing attributes in process `syz.2.85'. [ 97.846819][ T6243] netlink: 207952 bytes leftover after parsing attributes in process `syz.2.89'. [ 97.859920][ T6242] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.88'. [ 97.969045][ T6242] 8021q: adding VLAN 0 to HW filter on device bond1 [ 98.271638][ T6260] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.97'. [ 98.387435][ T6269] Driver unsupported XDP return value 0 on prog (id 15) dev N/A, expect packet loss! [ 98.545598][ T6271] netlink: 'syz.2.99': attribute type 1 has an invalid length. [ 98.593955][ T6281] xt_policy: output policy not valid in PREROUTING and INPUT [ 98.717440][ T6288] smc: net device team0 applied user defined pnetid SYZ2 [ 98.726911][ T6288] netlink: 32 bytes leftover after parsing attributes in process `syz.4.104'. [ 98.758011][ T6291] netlink: 65039 bytes leftover after parsing attributes in process `syz.1.105'. [ 98.868522][ T6293] ip6_vti0 speed is unknown, defaulting to 1000 [ 98.897580][ T6293] ip6_vti0 speed is unknown, defaulting to 1000 [ 98.907513][ T6293] ip6_vti0 speed is unknown, defaulting to 1000 [ 98.926430][ T6299] netlink: 'syz.4.106': attribute type 4 has an invalid length. [ 98.934545][ T6299] netlink: 17 bytes leftover after parsing attributes in process `syz.4.106'. [ 99.209682][ T9] IPVS: starting estimator thread 0... [ 99.304294][ T6306] IPVS: using max 26 ests per chain, 62400 per kthread [ 99.333742][ T6311] netlink: 484 bytes leftover after parsing attributes in process `syz.0.109'. [ 99.434049][ T6315] netlink: 'syz.4.111': attribute type 1 has an invalid length. [ 99.466341][ T6315] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 99.487171][ T6315] bridge0: port 2(bridge_slave_1) entered disabled state [ 99.495848][ T6315] bridge0: port 1(bridge_slave_0) entered disabled state [ 99.522059][ T6293] infiniband syz2: set down [ 99.531567][ T6293] infiniband syz2: added ip6_vti0 [ 99.544794][ T6315] bridge0: entered allmulticast mode [ 99.572539][ T24] ip6_vti0 speed is unknown, defaulting to 1000 [ 99.654113][ T6293] RDS/IB: syz2: added [ 99.664308][ T6293] smc: adding ib device syz2 with port count 1 [ 99.677233][ T6293] smc: ib device syz2 port 1 has no pnetid [ 99.717267][ T10] ip6_vti0 speed is unknown, defaulting to 1000 [ 99.749499][ T6293] ip6_vti0 speed is unknown, defaulting to 1000 [ 100.071838][ T6338] netlink: 'syz.0.119': attribute type 28 has an invalid length. [ 100.099795][ T6338] netlink: 'syz.0.119': attribute type 3 has an invalid length. [ 100.277864][ T6347] netlink: 'syz.0.122': attribute type 4 has an invalid length. [ 100.439461][ T6293] ip6_vti0 speed is unknown, defaulting to 1000 [ 100.912607][ T6293] ip6_vti0 speed is unknown, defaulting to 1000 [ 101.109907][ T6366] netlink: 'syz.4.129': attribute type 1 has an invalid length. [ 101.143479][ T6366] netlink: 'syz.4.129': attribute type 1 has an invalid length. [ 101.339056][ T6374] netlink: 'syz.3.131': attribute type 9 has an invalid length. [ 101.364660][ T6374] netlink: 'syz.3.131': attribute type 11 has an invalid length. [ 101.442430][ T6293] ip6_vti0 speed is unknown, defaulting to 1000 [ 101.913145][ T6398] geneve2: entered promiscuous mode [ 101.933720][ T6398] geneve2: entered allmulticast mode [ 102.199038][ T6293] ip6_vti0 speed is unknown, defaulting to 1000 [ 103.004044][ T6429] x_tables: unsorted underflow at hook 3 [ 103.558505][ T6442] 8021q: adding VLAN 0 to HW filter on device bond1 [ 103.681630][ T6452] bond1: (slave veth3): Enslaving as an active interface with a down link [ 103.758171][ T6442] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 103.789846][ T6442] bond1: (slave batadv1): making interface the new active one [ 103.830547][ T6442] batadv1: entered promiscuous mode [ 103.856414][ T6442] bond1: (slave batadv1): Enslaving as an active interface with an up link [ 104.009185][ T6472] __nla_validate_parse: 8 callbacks suppressed [ 104.009204][ T6472] netlink: 100 bytes leftover after parsing attributes in process `syz.4.157'. [ 104.163596][ T6477] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 104.227297][ T6482] netlink: 12 bytes leftover after parsing attributes in process `syz.4.161'. [ 104.251003][ T6477] bond2: (slave lo): Enslaving as an active interface with an up link [ 104.279110][ T6477] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 104.362892][ T6483] vlan2: entered allmulticast mode [ 104.369591][ T6483] bridge1: entered allmulticast mode [ 104.465827][ T6486] bridge1: port 1(veth3) entered blocking state [ 104.488915][ T6486] bridge1: port 1(veth3) entered disabled state [ 104.503263][ T6486] veth3: entered allmulticast mode [ 104.517325][ T6486] veth3: entered promiscuous mode [ 104.618524][ T6492] netlink: 8 bytes leftover after parsing attributes in process `syz.3.165'. [ 104.633148][ T6492] netlink: 8 bytes leftover after parsing attributes in process `syz.3.165'. [ 104.967525][ T6509] netlink: 4 bytes leftover after parsing attributes in process `syz.0.170'. [ 105.005762][ T6511] validate_nla: 3 callbacks suppressed [ 105.005780][ T6511] netlink: 'syz.4.171': attribute type 1 has an invalid length. [ 105.019230][ T6511] netlink: 96 bytes leftover after parsing attributes in process `syz.4.171'. [ 105.028205][ T6511] netlink: 658 bytes leftover after parsing attributes in process `syz.4.171'. [ 105.053104][ T6511] netlink: 1 bytes leftover after parsing attributes in process `syz.4.171'. [ 105.147788][ T6515] netem: change failed [ 105.164584][ T6516] warning: `syz.3.173' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 105.292867][ T6516] bond1: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 105.359219][ T6516] bond1 (unregistering): Released all slaves [ 105.489602][ T6535] netlink: 'syz.1.176': attribute type 1 has an invalid length. [ 105.524228][ T6534] netlink: 108 bytes leftover after parsing attributes in process `syz.4.174'. [ 105.541829][ T6534] netlink: 108 bytes leftover after parsing attributes in process `syz.4.174'. [ 105.747906][ T6536] bond3: (slave gretap1): making interface the new active one [ 105.784613][ T6536] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 105.823483][ T6542] netem: change failed [ 105.934674][ T6547] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 106.021840][ T6547] bond1: (slave lo): Enslaving as an active interface with an up link [ 106.063756][ T6547] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 106.715054][ T6568] tipc: Started in network mode [ 106.720139][ T6568] tipc: Node identity ac14140f, cluster identity 4711 [ 106.768834][ T6568] tipc: New replicast peer: 255.255.255.255 [ 106.788120][ T6568] tipc: Enabled bearer , priority 10 [ 106.852626][ T6571] ip6_vti0 speed is unknown, defaulting to 1000 [ 107.794308][ T5829] tipc: Node number set to 2886997007 [ 108.141946][ T6599] netlink: 'syz.4.191': attribute type 8 has an invalid length. [ 108.984680][ T6631] IPVS: length: 79 != 24 [ 109.066505][ T6635] Bluetooth: MGMT ver 1.23 [ 109.187930][ T6640] __nla_validate_parse: 5 callbacks suppressed [ 109.187948][ T6640] netlink: 24 bytes leftover after parsing attributes in process `syz.0.202'. [ 109.431084][ T6644] netlink: 96 bytes leftover after parsing attributes in process `syz.1.203'. [ 109.567448][ T6644] xt_nfacct: accounting object `\$9ZM#mU|^c\F9YⳈ' does not exist [ 109.630481][ T6646] netlink: 256 bytes leftover after parsing attributes in process `syz.1.203'. [ 109.706925][ T6653] netlink: 16 bytes leftover after parsing attributes in process `syz.4.206'. [ 109.827258][ T6656] netlink: 8 bytes leftover after parsing attributes in process `syz.3.207'. [ 109.880648][ T6658] lo speed is unknown, defaulting to 1000 [ 109.904317][ T6658] lo speed is unknown, defaulting to 1000 [ 109.911222][ T6658] lo speed is unknown, defaulting to 1000 [ 109.945700][ T6658] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 109.992492][ T6660] syzkaller0: entered promiscuous mode [ 109.998572][ T6660] syzkaller0: entered allmulticast mode [ 110.052039][ T6658] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 110.156709][ T6658] lo speed is unknown, defaulting to 1000 [ 110.217539][ T6658] lo speed is unknown, defaulting to 1000 [ 110.253792][ T6658] lo speed is unknown, defaulting to 1000 [ 110.281335][ T6658] lo speed is unknown, defaulting to 1000 [ 110.294094][ T6658] lo speed is unknown, defaulting to 1000 [ 110.421113][ T6673] Cannot find del_set index 1 as target [ 110.759038][ T6697] openvswitch: netlink: IP tunnel dst address not specified [ 110.794246][ T6697] netlink: 4 bytes leftover after parsing attributes in process `syz.1.218'. [ 110.832362][ T6697] openvswitch: netlink: Unknown nsh attribute 0 [ 110.878040][ T6697] netlink: 'syz.1.218': attribute type 1 has an invalid length. [ 111.008819][ T6704] netlink: 8 bytes leftover after parsing attributes in process `syz.0.219'. [ 111.169754][ T6711] netlink: 'syz.4.221': attribute type 1 has an invalid length. [ 111.235198][ T6711] bond2: entered promiscuous mode [ 111.241283][ T6711] 8021q: adding VLAN 0 to HW filter on device bond2 [ 111.270340][ T6712] netlink: 'syz.0.222': attribute type 10 has an invalid length. [ 111.320171][ T6717] bond2: (slave bridge2): making interface the new active one [ 111.329578][ T6705] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 111.340799][ T6717] bridge2: entered promiscuous mode [ 111.348366][ T6717] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 111.357863][ T6712] bridge0: port 2(bridge_slave_1) entered disabled state [ 111.366338][ T6712] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.388685][ T6712] bridge0: port 2(bridge_slave_1) entered blocking state [ 111.396014][ T6712] bridge0: port 2(bridge_slave_1) entered forwarding state [ 111.404434][ T6712] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.411655][ T6712] bridge0: port 1(bridge_slave_0) entered forwarding state [ 111.427330][ T6712] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 111.446135][ T6711] bond2: (slave ipvlan3): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 111.461633][ T6711] bond2: (slave ipvlan3): The slave device specified does not support setting the MAC address [ 111.598283][ T6722] netlink: 8 bytes leftover after parsing attributes in process `syz.0.224'. [ 111.973518][ T6739] netlink: 'syz.0.230': attribute type 21 has an invalid length. [ 112.001721][ T6739] IPv6: NLM_F_CREATE should be specified when creating new route [ 112.034395][ T6739] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 112.041867][ T6739] IPv6: NLM_F_CREATE should be set when creating new route [ 112.073291][ T6745] netlink: 4 bytes leftover after parsing attributes in process `syz.0.230'. [ 112.083873][ T6745] bridge_slave_1: left allmulticast mode [ 112.089562][ T6745] bridge_slave_1: left promiscuous mode [ 112.097007][ T6745] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.111790][ T6744] netlink: 60 bytes leftover after parsing attributes in process `syz.4.232'. [ 112.146993][ T6745] bridge_slave_0: left allmulticast mode [ 112.152723][ T6745] bridge_slave_0: left promiscuous mode [ 112.183433][ T6747] netlink: 'syz.1.231': attribute type 10 has an invalid length. [ 112.190284][ T6745] bridge0: port 1(bridge_slave_0) entered disabled state [ 112.237264][ T6745] bond0: (slave bridge0): Releasing backup interface [ 112.325605][ T6747] batman_adv: batadv0: Adding interface: netdevsim0 [ 112.343066][ T6747] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 112.382119][ T6747] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 112.654838][ T59] syzkaller0: tun_net_xmit 76 [ 112.660209][ T59] syzkaller0: tun_net_xmit 48 [ 114.146913][ T6767] bond0: entered promiscuous mode [ 114.160831][ T6767] bond_slave_0: entered promiscuous mode [ 114.192051][ T6767] bond_slave_1: entered promiscuous mode [ 114.218214][ T6767] batadv0: entered promiscuous mode [ 114.240561][ T6767] hsr1: entered promiscuous mode [ 114.259479][ T6767] hsr1: entered allmulticast mode [ 114.276884][ T6767] bond0: entered allmulticast mode [ 114.282076][ T6767] bond_slave_0: entered allmulticast mode [ 114.332192][ T6767] bond_slave_1: entered allmulticast mode [ 114.351695][ T6767] batadv0: entered allmulticast mode [ 114.365874][ T6767] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 114.386416][ T6767] bond0: left promiscuous mode [ 114.391261][ T6767] bond_slave_0: left promiscuous mode [ 114.414232][ T6767] bond_slave_1: left promiscuous mode [ 114.430931][ T6767] batadv0: left promiscuous mode [ 114.471032][ T6785] 8021q: VLANs not supported on xfrm0 [ 114.557380][ T5827] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 114.565973][ T5827] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 114.574464][ T5827] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 114.596669][ T5827] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 114.607183][ T5827] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 114.681124][ T6795] netlink: 'syz.4.246': attribute type 1 has an invalid length. [ 114.852370][ T6791] ip6_vti0 speed is unknown, defaulting to 1000 [ 114.969647][ T6799] block nbd0: server does not support multiple connections per device. [ 114.981845][ T6805] netlink: 40 bytes leftover after parsing attributes in process `syz.1.250'. [ 115.021147][ T6799] block nbd0: shutting down sockets [ 115.168370][ T6816] netlink: 48 bytes leftover after parsing attributes in process `syz.4.251'. [ 115.263984][ T33] batadv1: left promiscuous mode [ 115.336832][ T6821] netlink: 48 bytes leftover after parsing attributes in process `syz.0.253'. [ 115.611623][ T6823] netlink: 'syz.3.254': attribute type 1 has an invalid length. [ 115.703644][ T6820] syzkaller0: entered promiscuous mode [ 115.713683][ T6820] syzkaller0: entered allmulticast mode [ 115.854648][ T6823] bond2: entered promiscuous mode [ 115.861225][ T6823] 8021q: adding VLAN 0 to HW filter on device bond2 [ 115.885204][ T6824] bond2: (slave bridge1): making interface the new active one [ 115.893520][ T6824] bridge1: entered promiscuous mode [ 115.899486][ T6824] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 115.909758][ T6813] ip6_vti0 speed is unknown, defaulting to 1000 [ 115.924868][ T6791] lo speed is unknown, defaulting to 1000 [ 116.735576][ T5839] Bluetooth: hci5: command tx timeout [ 117.663096][ T6813] lo speed is unknown, defaulting to 1000 [ 118.046471][ T6866] netlink: 16 bytes leftover after parsing attributes in process `syz.3.264'. [ 118.208319][ T6876] netlink: 8 bytes leftover after parsing attributes in process `syz.3.268'. [ 118.294188][ T6880] netlink: 28 bytes leftover after parsing attributes in process `syz.0.267'. [ 118.322596][ T6881] netlink: 28 bytes leftover after parsing attributes in process `syz.0.267'. [ 118.590035][ T6890] netlink: 12 bytes leftover after parsing attributes in process `syz.0.269'. [ 118.721435][ T6791] chnl_net:caif_netlink_parms(): no params data found [ 118.806540][ T5839] Bluetooth: hci5: command tx timeout [ 119.158879][ T6910] netlink: 212344 bytes leftover after parsing attributes in process `syz.3.273'. [ 119.352680][ T6791] bridge0: port 1(bridge_slave_0) entered blocking state [ 119.383832][ T6914] netlink: 'syz.1.274': attribute type 6 has an invalid length. [ 119.393141][ T6791] bridge0: port 1(bridge_slave_0) entered disabled state [ 119.400429][ T6791] bridge_slave_0: entered allmulticast mode [ 119.454773][ T6791] bridge_slave_0: entered promiscuous mode [ 119.504816][ T6791] bridge0: port 2(bridge_slave_1) entered blocking state [ 119.511997][ T6791] bridge0: port 2(bridge_slave_1) entered disabled state [ 119.533229][ T6791] bridge_slave_1: entered allmulticast mode [ 119.541302][ T6791] bridge_slave_1: entered promiscuous mode [ 119.604428][ T6925] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.277'. [ 119.735533][ T6791] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 119.768804][ T6791] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 119.891196][ T6791] team0: Port device team_slave_0 added [ 119.919766][ T6791] team0: Port device team_slave_1 added [ 120.020641][ T6791] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 120.063407][ T6791] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 120.124282][ T6791] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 120.131949][ T6941] netlink: 4 bytes leftover after parsing attributes in process `syz.1.284'. [ 120.146251][ T6791] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 120.220616][ T6944] netlink: 4 bytes leftover after parsing attributes in process `syz.1.284'. [ 120.326185][ T6791] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 120.352547][ T6791] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 120.529302][ T6791] hsr_slave_0: entered promiscuous mode [ 120.545843][ T6791] hsr_slave_1: entered promiscuous mode [ 120.556564][ T6949] netlink: 'syz.4.287': attribute type 32 has an invalid length. [ 120.566454][ T6791] debugfs: 'hsr0' already exists in 'hsr' [ 120.593087][ T6791] Cannot create hsr debugfs directory [ 120.677212][ T6949] bond3: Setting coupled_control to off (0) [ 120.683535][ T6952] bond2: option mode: unable to set because the bond device has slaves [ 120.746853][ T24] IPVS: starting estimator thread 0... [ 120.758712][ T6956] IPVS: sh: FWM 3 0x00000003 - no destination available [ 120.776811][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 120.795383][ T6956] IPVS: sh: FWM 3 0x00000003 - no destination available [ 120.833885][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 120.853163][ T6957] IPVS: using max 26 ests per chain, 62400 per kthread [ 120.884869][ T5839] Bluetooth: hci5: command tx timeout [ 120.952693][ T6962] netlink: 72 bytes leftover after parsing attributes in process `syz.0.292'. [ 121.158014][ T6977] netlink: 256 bytes leftover after parsing attributes in process `syz.3.291'. [ 121.467392][ T1323] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.519630][ T6981] netlink: 60 bytes leftover after parsing attributes in process `syz.0.294'. [ 121.547865][ T6981] netlink: 60 bytes leftover after parsing attributes in process `syz.0.294'. [ 121.661515][ T7001] xt_policy: input policy not valid in POSTROUTING and OUTPUT [ 121.675957][ T7000] netlink: 'syz.3.300': attribute type 2 has an invalid length. [ 121.704554][ T1323] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.786042][ T1323] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 121.906524][ T1323] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.139313][ T6791] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 122.198838][ T6791] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 122.258878][ T6791] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 122.403723][ T6791] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 122.427379][ T1323] bridge_slave_1: left allmulticast mode [ 122.433450][ T1323] bridge_slave_1: left promiscuous mode [ 122.440229][ T1323] bridge0: port 2(bridge_slave_1) entered disabled state [ 122.452577][ T1323] bridge_slave_0: left allmulticast mode [ 122.459626][ T1323] bridge_slave_0: left promiscuous mode [ 122.467577][ T1323] bridge0: port 1(bridge_slave_0) entered disabled state [ 122.774982][ T1323] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 122.795764][ T1323] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 122.814092][ T1323] bond0 (unregistering): Released all slaves [ 122.964078][ T5839] Bluetooth: hci5: command tx timeout [ 123.114269][ T7058] netlink: 'syz.1.313': attribute type 1 has an invalid length. [ 123.156541][ T7057] netlink: 12 bytes leftover after parsing attributes in process `syz.1.313'. [ 123.192152][ T7057] netlink: 12 bytes leftover after parsing attributes in process `syz.1.313'. [ 123.259815][ T7058] bond4: entered promiscuous mode [ 123.265446][ T7058] 8021q: adding VLAN 0 to HW filter on device bond4 [ 123.384495][ T7075] netlink: 20 bytes leftover after parsing attributes in process `syz.0.316'. [ 123.409669][ T7075] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 123.447167][ T6791] 8021q: adding VLAN 0 to HW filter on device bond0 [ 123.509726][ T7075] netlink: 12 bytes leftover after parsing attributes in process `syz.0.316'. [ 123.580672][ T6791] 8021q: adding VLAN 0 to HW filter on device team0 [ 123.649558][ T129] bridge0: port 1(bridge_slave_0) entered blocking state [ 123.656888][ T129] bridge0: port 1(bridge_slave_0) entered forwarding state [ 123.736850][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 123.744178][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 124.255675][ T1323] hsr_slave_0: left promiscuous mode [ 124.265123][ T1323] hsr_slave_1: left promiscuous mode [ 124.272375][ T1323] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 124.281421][ T1323] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 124.300780][ T1323] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 124.310657][ T1323] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 124.334537][ T1323] veth1_macvtap: left promiscuous mode [ 124.340283][ T1323] veth0_macvtap: left promiscuous mode [ 124.351619][ T1323] veth1_vlan: left promiscuous mode [ 124.361742][ T1323] veth0_vlan: left promiscuous mode [ 124.632732][ T1323] team0 (unregistering): Port device team_slave_1 removed [ 124.651114][ T1323] team0 (unregistering): Port device team_slave_0 removed [ 124.781418][ T7112] netlink: 'syz.0.325': attribute type 3 has an invalid length. [ 124.801642][ T7097] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 124.836911][ T7097] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 124.966764][ T7097] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 124.993225][ T7097] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 125.095925][ T7097] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 125.101899][ T7097] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 125.197200][ T7137] __nla_validate_parse: 2 callbacks suppressed [ 125.197217][ T7137] netlink: 8 bytes leftover after parsing attributes in process `syz.1.332'. [ 125.216524][ T7097] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 125.225455][ T7137] netlink: 8 bytes leftover after parsing attributes in process `syz.1.332'. [ 125.234255][ T7097] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 125.597751][ T7142] ip6_vti0 speed is unknown, defaulting to 1000 [ 126.034531][ T7097] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 126.040879][ T7175] block nbd4: not configured, cannot reconfigure [ 126.055487][ T7175] netlink: 'syz.4.339': attribute type 11 has an invalid length. [ 126.058463][ T7097] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 126.081750][ T6791] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 126.109533][ T7178] block nbd4: not configured, cannot reconfigure [ 126.459298][ T7142] lo speed is unknown, defaulting to 1000 [ 126.629779][ T7210] netlink: 4 bytes leftover after parsing attributes in process `syz.3.346'. [ 126.660380][ T7202] ip6t_srh: unknown srh invflags 4000 [ 126.667117][ T7210] netlink: 4 bytes leftover after parsing attributes in process `syz.3.346'. [ 126.976424][ T6791] veth0_vlan: entered promiscuous mode [ 127.027073][ T6791] veth1_vlan: entered promiscuous mode [ 127.127000][ T7235] netlink: 'syz.0.350': attribute type 1 has an invalid length. [ 127.197601][ T7235] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 127.516702][ T6791] veth0_macvtap: entered promiscuous mode [ 127.567167][ T6791] veth1_macvtap: entered promiscuous mode [ 127.645357][ T6791] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 127.665401][ T6791] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 127.689996][ T13] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.713809][ T13] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.752244][ T7250] vlan2: entered promiscuous mode [ 127.778409][ T7250] bridge0: entered promiscuous mode [ 127.813303][ T7250] vlan2: entered allmulticast mode [ 127.818511][ T7250] bridge0: entered allmulticast mode [ 127.877521][ T13] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 127.898768][ T7263] netlink: 44 bytes leftover after parsing attributes in process `syz.4.357'. [ 127.907562][ T13] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 128.004162][ T7266] netlink: 'syz.1.358': attribute type 1 has an invalid length. [ 128.030078][ T7266] netlink: 244 bytes leftover after parsing attributes in process `syz.1.358'. [ 128.279138][ T129] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 128.300763][ T129] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 128.362688][ T7290] netlink: 'syz.4.363': attribute type 4 has an invalid length. [ 128.380170][ T7290] netlink: 224 bytes leftover after parsing attributes in process `syz.4.363'. [ 128.401651][ T7290] vcan0: tx drop: invalid sa for name 0xffffffffffffffff [ 128.461705][ T5829] lo speed is unknown, defaulting to 1000 [ 128.865129][ T7268] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 129.019273][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 129.048454][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 129.190329][ T7325] netlink: 'syz.4.371': attribute type 1 has an invalid length. [ 129.233709][ T7331] netlink: 8 bytes leftover after parsing attributes in process `syz.1.370'. [ 129.250509][ T5832] IPVS: starting estimator thread 0... [ 129.287640][ T7335] tipc: Can't bind to reserved service type 1 [ 129.364379][ T7333] IPVS: using max 28 ests per chain, 67200 per kthread [ 129.371869][ T7325] 8021q: adding VLAN 0 to HW filter on device bond4 [ 129.434825][ T7331] vlan3: entered allmulticast mode [ 129.451107][ T7331] mac80211_hwsim hwsim4 wlan0: entered allmulticast mode [ 129.527942][ T7336] bond4: (slave ip6gretap1): making interface the new active one [ 129.538207][ T7336] bond4: (slave ip6gretap1): Enslaving as an active interface with an up link [ 129.634948][ T7355] netlink: 4 bytes leftover after parsing attributes in process `syz.5.374'. [ 129.657655][ T7354] netlink: 4 bytes leftover after parsing attributes in process `syz.5.374'. [ 130.267531][ T7378] gre1: entered promiscuous mode [ 130.294034][ T7378] gre1: entered allmulticast mode [ 130.309041][ T7384] x_tables: duplicate underflow at hook 2 [ 130.436632][ T7389] netlink: 24 bytes leftover after parsing attributes in process `syz.5.382'. [ 130.448489][ T7390] netlink: 4 bytes leftover after parsing attributes in process `syz.3.383'. [ 130.542817][ T7390] team0 (unregistering): Port device team_slave_0 removed [ 130.572930][ T7394] netlink: 4 bytes leftover after parsing attributes in process `syz.4.384'. [ 130.592381][ T7390] team0 (unregistering): Port device team_slave_1 removed [ 130.715019][ T7382] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 131.323822][ T7411] netlink: 12 bytes leftover after parsing attributes in process `syz.5.387'. [ 131.685635][ T7431] ieee802154 phy0 wpan0: encryption failed: -22 [ 131.956756][ T7445] netlink: 212336 bytes leftover after parsing attributes in process `syz.5.398'. [ 132.013757][ T7449] x_tables: duplicate underflow at hook 1 [ 132.146585][ T7453] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 132.540959][ T7480] xt_hashlimit: max too large, truncated to 1048576 [ 132.901152][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.916605][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.616361][ T7537] netlink: 12 bytes leftover after parsing attributes in process `syz.0.422'. [ 133.674768][ T7537] syzkaller1: entered promiscuous mode [ 133.680316][ T7537] syzkaller1: entered allmulticast mode [ 133.687523][ T7537] PF_CAN: dropped non conform CAN skbuff: dev type 280, len 324 [ 133.699217][ T7537] netlink: 8 bytes leftover after parsing attributes in process `syz.0.422'. [ 133.708187][ T7537] netlink: 12 bytes leftover after parsing attributes in process `syz.0.422'. [ 133.725832][ T7541] netlink: 'syz.3.420': attribute type 2 has an invalid length. [ 133.844791][ T7545] netlink: 20 bytes leftover after parsing attributes in process `syz.4.425'. [ 134.047174][ T7552] netlink: 12 bytes leftover after parsing attributes in process `syz.5.426'. [ 135.190523][ T7615] netlink: 'syz.3.440': attribute type 3 has an invalid length. [ 135.381929][ T7626] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 135.503407][ T7634] __nla_validate_parse: 3 callbacks suppressed [ 135.503427][ T7634] netlink: 20 bytes leftover after parsing attributes in process `syz.0.446'. [ 135.726766][ T7644] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 135.895988][ T7642] tipc: Enabling of bearer rejected, failed to enable media [ 136.074446][ T7660] xt_NFQUEUE: number of total queues is 0 [ 136.520797][ T7684] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.457'. [ 136.660313][ T7687] netlink: 'syz.1.458': attribute type 1 has an invalid length. [ 136.793447][ T7693] netlink: 'syz.0.460': attribute type 6 has an invalid length. [ 136.851344][ T7701] netlink: 8 bytes leftover after parsing attributes in process `syz.0.460'. [ 136.891055][ T7701] netlink: 8 bytes leftover after parsing attributes in process `syz.0.460'. [ 136.955478][ T7705] netlink: 'syz.1.463': attribute type 12 has an invalid length. [ 136.979148][ T7705] xt_connbytes: Forcing CT accounting to be enabled [ 136.986282][ T7706] xt_connbytes: Forcing CT accounting to be enabled [ 137.438693][ T7729] netlink: 'syz.1.467': attribute type 1 has an invalid length. [ 137.506983][ T7729] bond5: entered promiscuous mode [ 137.512690][ T7729] 8021q: adding VLAN 0 to HW filter on device bond5 [ 137.607216][ T7733] netlink: 'syz.5.468': attribute type 1 has an invalid length. [ 137.616818][ T7733] netlink: 216 bytes leftover after parsing attributes in process `syz.5.468'. [ 138.026983][ T7749] netlink: 4 bytes leftover after parsing attributes in process `syz.5.472'. [ 138.240138][ T7757] syzkaller0: entered promiscuous mode [ 138.293110][ T7757] syzkaller0: entered allmulticast mode [ 138.354056][ T7765] netlink: 'syz.0.478': attribute type 1 has an invalid length. [ 138.384550][ T7765] netlink: 'syz.0.478': attribute type 2 has an invalid length. [ 138.395530][ T7765] netlink: 'syz.0.478': attribute type 1 has an invalid length. [ 138.480090][ T7767] netlink: 4 bytes leftover after parsing attributes in process `syz.5.479'. [ 138.490513][ T7771] delete_channel: no stack [ 138.531046][ T7767] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 138.834259][ T7783] syzkaller1: entered promiscuous mode [ 138.842261][ T7783] syzkaller1: entered allmulticast mode [ 139.134179][ T7806] netlink: 8 bytes leftover after parsing attributes in process `syz.4.486'. [ 139.155249][ T7806] vcan0: tx drop: invalid sa for name 0x0000000000000013 [ 140.170735][ T7802] bridge4: entered promiscuous mode [ 140.176771][ T7802] bridge4: entered allmulticast mode [ 140.186257][ T7802] team0: Port device bridge4 added [ 140.191817][ T7803] bridge0: port 3(team0) entered blocking state [ 140.199614][ T7803] bridge0: port 3(team0) entered disabled state [ 140.207071][ T7803] team0: entered allmulticast mode [ 140.212372][ T7803] team_slave_0: entered allmulticast mode [ 140.232740][ T7803] team_slave_1: entered allmulticast mode [ 140.241751][ T7803] team0: entered promiscuous mode [ 140.258025][ T7803] team_slave_0: entered promiscuous mode [ 140.264169][ T7803] team_slave_1: entered promiscuous mode [ 140.430547][ T7827] syz.1.493 uses old SIOCAX25GETINFO [ 140.499551][ T7830] netlink: 4 bytes leftover after parsing attributes in process `syz.4.494'. [ 140.520922][ T7832] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 140.531834][ T7834] xt_TCPMSS: Only works on TCP SYN packets [ 140.677020][ T7825] infiniband : set down [ 140.681427][ T7825] infiniband : added ipvlan0 [ 140.735950][ T7825] RDS/IB: : added [ 140.739804][ T7825] smc: adding ib device  with port count 1 [ 140.745809][ T7825] smc: ib device  port 1 has no pnetid [ 140.836237][ T7845] IPVS: sh: FWM 3 0x00000003 - no destination available [ 140.843263][ T5829] IPVS: starting estimator thread 0... [ 140.864400][ T7838] sctp: [Deprecated]: syz.0.497 (pid 7838) Use of struct sctp_assoc_value in delayed_ack socket option. [ 140.864400][ T7838] Use struct sctp_sack_info instead [ 140.883959][ T7844] IPVS: sh: FWM 3 0x00000003 - no destination available [ 140.891350][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 140.910853][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 140.919366][ T7844] netlink: 16 bytes leftover after parsing attributes in process `syz.5.499'. [ 140.929187][ T7848] netlink: 16 bytes leftover after parsing attributes in process `syz.5.499'. [ 140.953986][ T7845] IPVS: sh: FWM 3 0x00000003 - no destination available [ 140.973067][ T7846] IPVS: using max 29 ests per chain, 69600 per kthread [ 140.987134][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 141.180267][ T7862] openvswitch: netlink: IP tunnel dst address not specified [ 141.199820][ T7862] netlink: 'syz.1.503': attribute type 1 has an invalid length. [ 141.218795][ T7856] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 141.225149][ T7856] syzkaller1: linktype set to 823 [ 141.364852][ T7856] bond1: entered promiscuous mode [ 141.408961][ T7865] macvlan2: entered promiscuous mode [ 141.425203][ T7865] macvlan2: entered allmulticast mode [ 141.432541][ T7865] bond1: (slave macvlan2): Opening slave failed [ 141.501198][ T7872] vlan4: entered promiscuous mode [ 141.509128][ T5916] syzkaller1: tun_net_xmit 90 [ 141.531754][ T7872] geneve1: entered promiscuous mode [ 141.538882][ T7872] vlan4: entered allmulticast mode [ 141.546319][ T7872] geneve1: entered allmulticast mode [ 141.843770][ T5916] syzkaller1: tun_net_xmit 90 [ 142.060930][ T7897] netlink: 24 bytes leftover after parsing attributes in process `syz.5.515'. [ 142.130346][ T7898] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 142.681052][ T7915] netlink: 'syz.5.520': attribute type 2 has an invalid length. [ 142.787318][ T7920] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.522'. [ 142.921101][ T7926] geneve3: entered promiscuous mode [ 142.931898][ T7931] ICMPv6: NA: 00:00:00:00:00:00 advertised our address fe80::aa on syz_tun! [ 142.940328][ T7926] geneve3: entered allmulticast mode [ 142.964808][ T129] netdevsim netdevsim0 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 142.993164][ T129] netdevsim netdevsim0 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 143.002148][ T129] netdevsim netdevsim0 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 143.038155][ T7935] netlink: 16 bytes leftover after parsing attributes in process `syz.1.526'. [ 143.091102][ T7938] netlink: 16 bytes leftover after parsing attributes in process `syz.1.526'. [ 143.147277][ T129] netdevsim netdevsim0 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 143.396448][ T7952] netlink: 188 bytes leftover after parsing attributes in process `syz.1.531'. [ 143.425811][ T7952] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 143.510181][ T7961] IPVS: set_ctl: invalid protocol: 44 0.0.0.0:20001 [ 143.652242][ T7966] netlink: 68 bytes leftover after parsing attributes in process `syz.1.535'. [ 144.147947][ T7983] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 144.190544][ T7983] netlink: 8 bytes leftover after parsing attributes in process `syz.0.540'. [ 144.209768][ T7983] netlink: 20 bytes leftover after parsing attributes in process `syz.0.540'. [ 144.217586][ T7989] ip6_vti0 speed is unknown, defaulting to 1000 [ 144.250700][ T7983] geneve4: entered promiscuous mode [ 144.267582][ T7983] geneve4: entered allmulticast mode [ 144.464185][ T7999] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 144.496748][ T8001] tipc: Started in network mode [ 144.501783][ T8001] tipc: Node identity 060b7d299f17, cluster identity 4711 [ 144.548065][ T8001] tipc: Enabled bearer , priority 0 [ 144.593777][ T7999] syzkaller0: entered promiscuous mode [ 144.609117][ T7999] syzkaller0: entered allmulticast mode [ 144.644319][ T7998] tipc: Resetting bearer [ 144.692584][ T7998] tipc: Disabling bearer [ 144.719212][ T7989] lo speed is unknown, defaulting to 1000 [ 144.764476][ T8011] FAULT_INJECTION: forcing a failure. [ 144.764476][ T8011] name failslab, interval 1, probability 0, space 0, times 1 [ 144.777295][ T8011] CPU: 1 UID: 0 PID: 8011 Comm: syz.5.548 Not tainted syzkaller #0 PREEMPT(full) [ 144.777321][ T8011] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 144.777342][ T8011] Call Trace: [ 144.777351][ T8011] [ 144.777360][ T8011] dump_stack_lvl+0xe8/0x150 [ 144.777401][ T8011] should_fail_ex+0x412/0x560 [ 144.777431][ T8011] should_failslab+0xa8/0x100 [ 144.777457][ T8011] __kmalloc_noprof+0xe8/0x760 [ 144.777479][ T8011] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 144.777511][ T8011] tomoyo_realpath_from_path+0xe3/0x5d0 [ 144.777549][ T8011] ? tomoyo_path_number_perm+0x219/0x630 [ 144.777571][ T8011] tomoyo_path_number_perm+0x246/0x630 [ 144.777595][ T8011] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 144.777619][ T8011] ? __lock_acquire+0x6b5/0x2cf0 [ 144.777657][ T8011] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 144.777712][ T8011] ? __fget_files+0x2a/0x420 [ 144.777750][ T8011] ? __fget_files+0x2a/0x420 [ 144.777777][ T8011] ? __fget_files+0x3a0/0x420 [ 144.777804][ T8011] ? __fget_files+0x2a/0x420 [ 144.777836][ T8011] security_file_ioctl+0xc3/0x2a0 [ 144.777870][ T8011] __se_sys_ioctl+0x47/0x170 [ 144.777896][ T8011] do_syscall_64+0x14d/0xf80 [ 144.777926][ T8011] ? trace_irq_disable+0x3b/0x150 [ 144.777954][ T8011] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.777976][ T8011] ? clear_bhb_loop+0x40/0x90 [ 144.778002][ T8011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 144.778022][ T8011] RIP: 0033:0x7f2cef79c629 [ 144.778050][ T8011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 144.778066][ T8011] RSP: 002b:00007f2cf072b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 144.778095][ T8011] RAX: ffffffffffffffda RBX: 00007f2cefa15fa0 RCX: 00007f2cef79c629 [ 144.778110][ T8011] RDX: 0000200000000140 RSI: 000000000000890c RDI: 0000000000000008 [ 144.778122][ T8011] RBP: 00007f2cf072b090 R08: 0000000000000000 R09: 0000000000000000 [ 144.778134][ T8011] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 144.778145][ T8011] R13: 00007f2cefa16038 R14: 00007f2cefa15fa0 R15: 00007ffd6112e6a8 [ 144.778178][ T8011] [ 144.778191][ T8011] ERROR: Out of memory at tomoyo_realpath_from_path. [ 145.267016][ T8028] Bluetooth: MGMT ver 1.23 [ 145.291500][ T8028] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 145.578303][ T8049] netlink: 'syz.0.562': attribute type 10 has an invalid length. [ 145.587930][ T8050] netlink: 'syz.0.562': attribute type 10 has an invalid length. [ 145.724628][ T8049] team0 (unregistering): Port device team_slave_0 removed [ 145.746359][ T8049] team0 (unregistering): Port device team_slave_1 removed [ 145.899983][ T8055] bridge0: left allmulticast mode [ 145.942837][ T8055] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 145.968639][ T8070] __nla_validate_parse: 2 callbacks suppressed [ 145.968659][ T8070] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.567'. [ 145.987811][ T9] lo speed is unknown, defaulting to 1000 [ 145.993917][ T8064] netlink: 132 bytes leftover after parsing attributes in process `syz.4.565'. [ 146.015741][ T9] syz0: Port: 1 Link DOWN [ 146.296334][ T8084] netlink: 'syz.0.571': attribute type 1 has an invalid length. [ 146.362583][ T8084] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 146.400022][ T8093] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 146.531506][ T8097] sctp: [Deprecated]: syz.0.576 (pid 8097) Use of int in max_burst socket option. [ 146.531506][ T8097] Use struct sctp_assoc_value instead [ 146.536382][ T8099] netlink: 12 bytes leftover after parsing attributes in process `syz.4.575'. [ 146.707208][ T8104] syz_tun: entered allmulticast mode [ 146.732584][ T8103] syz_tun: left allmulticast mode [ 146.747732][ T8106] netlink: 'syz.4.578': attribute type 1 has an invalid length. [ 146.751421][ T8110] netlink: 'syz.0.579': attribute type 2 has an invalid length. [ 146.794637][ T8110] netlink: 8 bytes leftover after parsing attributes in process `syz.0.579'. [ 146.845629][ T8110] xt_hashlimit: overflow, try lower: 3/0 [ 146.947996][ T8115] netlink: 'syz.1.580': attribute type 1 has an invalid length. [ 146.979362][ T8115] netlink: 224 bytes leftover after parsing attributes in process `syz.1.580'. [ 146.999391][ T8106] 8021q: adding VLAN 0 to HW filter on device bond5 [ 147.122920][ T8113] bond5: (slave geneve2): making interface the new active one [ 147.154465][ T8113] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 147.188861][ T129] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 147.219890][ T129] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 147.251417][ T129] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 147.289831][ T129] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 147.933986][ T8165] netlink: 'syz.1.592': attribute type 1 has an invalid length. [ 148.013492][ T8171] netlink: 4 bytes leftover after parsing attributes in process `syz.5.593'. [ 148.101511][ T8163] 8021q: VLANs not supported on sit0 [ 148.130468][ T8165] bond6: entered promiscuous mode [ 148.136451][ T8165] 8021q: adding VLAN 0 to HW filter on device bond6 [ 148.465451][ T8199] netlink: 260 bytes leftover after parsing attributes in process `syz.1.598'. [ 148.687529][ T8208] netlink: 40 bytes leftover after parsing attributes in process `syz.4.602'. [ 149.100766][ T8232] netlink: 24 bytes leftover after parsing attributes in process `syz.5.606'. [ 149.783153][ T8267] netlink: 8 bytes leftover after parsing attributes in process `syz.3.614'. [ 149.795261][ T8281] tipc: Started in network mode [ 149.800183][ T8281] tipc: Node identity b6f050775b2d, cluster identity 4711 [ 149.812012][ T8267] nftables ruleset with unbound chain [ 149.818195][ T8281] tipc: Enabled bearer , priority 11 [ 149.892729][ T8281] netlink: 'syz.5.618': attribute type 4 has an invalid length. [ 150.504922][ T8315] syzkaller0: entered promiscuous mode [ 150.536915][ T8315] syzkaller0: entered allmulticast mode [ 150.538282][ T8325] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 150.715310][ T8329] nbd: couldn't find a device at index 0 [ 151.239762][ T8363] netlink: 'syz.0.635': attribute type 1 has an invalid length. [ 151.249734][ T8363] netlink: 'syz.0.635': attribute type 4 has an invalid length. [ 151.258444][ T8363] __nla_validate_parse: 6 callbacks suppressed [ 151.258460][ T8363] netlink: 9422 bytes leftover after parsing attributes in process `syz.0.635'. [ 152.207518][ T5888] tipc: Node number set to 3990704247 [ 152.790608][ T8401] netlink: 256 bytes leftover after parsing attributes in process `syz.4.643'. [ 152.931936][ T8410] netlink: 165 bytes leftover after parsing attributes in process `syz.3.646'. [ 153.062071][ T8416] netlink: 12 bytes leftover after parsing attributes in process `syz.5.648'. [ 153.133330][ T8423] x_tables: duplicate underflow at hook 1 [ 153.173274][ T8423] netlink: 'syz.0.651': attribute type 5 has an invalid length. [ 153.300092][ T8436] netlink: 'syz.5.655': attribute type 6 has an invalid length. [ 153.351135][ T8436] set match dimension is over the limit! [ 153.382392][ T8436] netlink: 'syz.5.655': attribute type 6 has an invalid length. [ 153.420695][ T8441] set match dimension is over the limit! [ 153.507881][ T8444] netlink: 48 bytes leftover after parsing attributes in process `syz.4.657'. [ 153.683272][ T8453] netlink: 8 bytes leftover after parsing attributes in process `syz.3.660'. [ 154.087752][ T8477] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 154.114242][ T8480] vlan2: entered allmulticast mode [ 154.129485][ T8480] geneve1: entered allmulticast mode [ 154.188616][ T8487] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 154.377073][ T8499] vlan2: entered allmulticast mode [ 154.382610][ T8499] geneve1: entered allmulticast mode [ 154.430265][ T8499] : entered promiscuous mode [ 154.570650][ T8512] A link change request failed with some changes committed already. Interface xfrm0 may have been left with an inconsistent configuration, please check. [ 154.896107][ T8521] netlink: 132 bytes leftover after parsing attributes in process `syz.5.679'. [ 155.015630][ T8527] netlink: 4 bytes leftover after parsing attributes in process `syz.0.682'. [ 155.038760][ T8527] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 155.100179][ T8533] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 155.149531][ T8533] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 155.180730][ T8533] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 155.197635][ T8533] gretap2: entered promiscuous mode [ 155.205333][ T8533] gretap2: entered allmulticast mode [ 155.244651][ T8545] netlink: 4 bytes leftover after parsing attributes in process `syz.3.686'. [ 155.280445][ T8536] netlink: 16 bytes leftover after parsing attributes in process `syz.0.685'. [ 155.298693][ T8533] netlink: 'syz.5.683': attribute type 1 has an invalid length. [ 155.502290][ T8553] syzkaller1: entered promiscuous mode [ 155.520605][ T8553] syzkaller1: entered allmulticast mode [ 156.346621][ T8600] __nla_validate_parse: 7 callbacks suppressed [ 156.346640][ T8600] netlink: 4 bytes leftover after parsing attributes in process `syz.4.701'. [ 156.385113][ T8606] netlink: 8 bytes leftover after parsing attributes in process `syz.3.702'. [ 156.394878][ T8606] netlink: 4 bytes leftover after parsing attributes in process `syz.3.702'. [ 157.101912][ T8633] netlink: 'syz.1.711': attribute type 1 has an invalid length. [ 157.235175][ T8636] syzkaller1: entered promiscuous mode [ 157.245053][ T8636] syzkaller1: entered allmulticast mode [ 157.345941][ T8642] netlink: 'syz.0.714': attribute type 1 has an invalid length. [ 157.666977][ T8670] netlink: 28 bytes leftover after parsing attributes in process `syz.4.722'. [ 157.692574][ T8670] netlink: 28 bytes leftover after parsing attributes in process `syz.4.722'. [ 158.074335][ T8692] netlink: 'syz.1.728': attribute type 1 has an invalid length. [ 158.085300][ T8690] SET target dimension over the limit! [ 158.114063][ T8692] bond7: entered promiscuous mode [ 158.119320][ T8692] bond7: entered allmulticast mode [ 158.125057][ T8692] 8021q: adding VLAN 0 to HW filter on device bond7 [ 158.211938][ T8690] syzkaller0: entered promiscuous mode [ 158.217799][ T8690] syzkaller0: entered allmulticast mode [ 158.521013][ T8709] netlink: 28 bytes leftover after parsing attributes in process `syz.3.732'. [ 158.576409][ T8710] netlink: 8 bytes leftover after parsing attributes in process `syz.3.732'. [ 158.788301][ T8714] netlink: 212348 bytes leftover after parsing attributes in process `syz.0.733'. [ 158.797911][ T8714] netlink: Unknown conntrack attr (0) [ 158.926089][ T8720] netlink: 'syz.0.734': attribute type 2 has an invalid length. [ 158.936591][ T8715] xt_cgroup: path and classid specified [ 159.640942][ T8720] 9: entered promiscuous mode [ 159.748689][ T8703] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 159.814624][ T8728] IPVS: sh: FWM 3 0x00000003 - no destination available [ 159.825759][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 159.834615][ T8728] IPVS: sh: FWM 3 0x00000003 - no destination available [ 159.842718][ C0] IPVS: sh: FWM 3 0x00000003 - no destination available [ 159.923887][ T8703] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.087076][ T8703] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.199913][ T8703] batman_adv: batadv0: Removing interface: netdevsim0 [ 160.225265][ T8703] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 160.387974][ T1134] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.483340][ T49] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.515242][ T13] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.571434][ T49] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 160.626740][ T8773] netlink: 8 bytes leftover after parsing attributes in process `syz.0.750'. [ 160.659152][ T8773] netlink: 12 bytes leftover after parsing attributes in process `syz.0.750'. [ 160.691005][ T8777] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 160.792342][ T8781] team0: Device gtp0 is up. Set it down before adding it as a team port [ 161.048998][ T8797] bond1: entered promiscuous mode [ 161.054671][ T8797] bond1: entered allmulticast mode [ 161.060432][ T8797] 8021q: adding VLAN 0 to HW filter on device bond1 [ 161.710941][ T8841] x_tables: duplicate underflow at hook 2 [ 161.937578][ T8860] __nla_validate_parse: 5 callbacks suppressed [ 161.937598][ T8860] netlink: 28 bytes leftover after parsing attributes in process `syz.0.777'. [ 161.986731][ T8862] netlink: 8 bytes leftover after parsing attributes in process `syz.3.778'. [ 162.008957][ T8862] netdevsim netdevsim3: Direct firmware load for  failed with error -2 [ 162.021945][ T8862] netdevsim netdevsim3: Falling back to sysfs fallback for:  [ 162.078810][ T8870] netlink: 'syz.0.781': attribute type 1 has an invalid length. [ 162.118049][ T8870] netlink: 32 bytes leftover after parsing attributes in process `syz.0.781'. [ 162.138483][ T8870] macvlan2: entered promiscuous mode [ 162.144491][ T8870] macvlan2: entered allmulticast mode [ 162.151283][ T8870] bond2: entered promiscuous mode [ 162.157931][ T8870] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 162.168965][ T8870] bond2: left promiscuous mode [ 162.349065][ T8879] Cannot find set identified by id 0 to match [ 162.559643][ T8890] lo: entered allmulticast mode [ 162.660459][ T8895] netlink: 'syz.0.786': attribute type 1 has an invalid length. [ 162.915861][ T8905] netlink: 248 bytes leftover after parsing attributes in process `syz.3.793'. [ 163.095417][ T8917] delete_channel: no stack [ 163.200696][ T8924] netlink: 'syz.3.798': attribute type 46 has an invalid length. [ 163.234369][ T8924] netlink: 676 bytes leftover after parsing attributes in process `syz.3.798'. [ 163.384513][ T8932] netlink: 14 bytes leftover after parsing attributes in process `syz.5.802'. [ 163.564975][ T8945] veth0_to_hsr: entered allmulticast mode [ 163.580072][ T8945] netlink: 8 bytes leftover after parsing attributes in process `syz.0.801'. [ 163.633134][ T8953] netlink: 27 bytes leftover after parsing attributes in process `syz.3.809'. [ 163.666444][ T8954] nbd: couldn't find a device at index 0 [ 163.875302][ T8971] netlink: 4 bytes leftover after parsing attributes in process `syz.4.814'. [ 163.887796][ T8972] openvswitch: netlink: Unexpected mask (mask=1040, allowed=10048) [ 163.896998][ T8972] netlink: 28 bytes leftover after parsing attributes in process `syz.5.813'. [ 164.006425][ T8979] netlink: 'syz.3.816': attribute type 10 has an invalid length. [ 164.011962][ T8976] netlink: 'syz.1.815': attribute type 1 has an invalid length. [ 164.041956][ T8982] netlink: 'syz.5.817': attribute type 3 has an invalid length. [ 164.051810][ T8982] netlink: 'syz.5.817': attribute type 3 has an invalid length. [ 164.084477][ T8979] syzkaller0: entered promiscuous mode [ 164.090580][ T8979] syzkaller0: entered allmulticast mode [ 164.103368][ T8986] tipc: Started in network mode [ 164.108364][ T8986] tipc: Node identity 8a8311d96622, cluster identity 4711 [ 164.117230][ T8986] tipc: Enabled bearer , priority 0 [ 164.154571][ T8983] bond8: (slave bridge1): making interface the new active one [ 164.180306][ T8983] bond8: (slave bridge1): Enslaving as an active interface with an up link [ 164.191916][ T8977] tipc: Resetting bearer [ 164.255602][ T8977] tipc: Disabling bearer [ 164.401386][ T8993] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 164.830197][ T9026] netlink: 'syz.0.829': attribute type 5 has an invalid length. [ 164.931261][ T9023] syzkaller0: entered promiscuous mode [ 164.965022][ T9023] syzkaller0: entered allmulticast mode [ 165.255189][ T9039] can: request_module (can-proto-0) failed. [ 165.349474][ T9050] netlink: 'syz.5.839': attribute type 1 has an invalid length. [ 165.647837][ T9070] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 165.707008][ T9078] netlink: 'syz.4.846': attribute type 3 has an invalid length. [ 166.087219][ T9102] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 166.662411][ T9132] team0: Cannot enslave team device to itself [ 166.725908][ T9134] netdevsim netdevsim5: loading /lib/firmware/. failed with error -22 [ 166.752118][ T9134] netdevsim netdevsim5: Direct firmware load for . failed with error -22 [ 166.774252][ T9134] netdevsim netdevsim5: Falling back to sysfs fallback for: . [ 167.385592][ T9176] __nla_validate_parse: 14 callbacks suppressed [ 167.385607][ T9176] netlink: 8 bytes leftover after parsing attributes in process `syz.3.875'. [ 167.413720][ T9176] : entered promiscuous mode [ 167.764190][ T9196] delete_channel: no stack [ 167.822579][ T9204] netlink: 4 bytes leftover after parsing attributes in process `syz.5.884'. [ 167.925333][ T9212] netlink: 'syz.1.886': attribute type 1 has an invalid length. [ 168.036270][ T9219] netlink: 8 bytes leftover after parsing attributes in process `syz.5.888'. [ 168.057648][ T9219] syzkaller0: entered promiscuous mode [ 168.074407][ T9219] syzkaller0: entered allmulticast mode [ 168.149206][ T9235] netlink: 388 bytes leftover after parsing attributes in process `syz.0.892'. [ 168.231962][ T9240] netlink: 'syz.0.895': attribute type 1 has an invalid length. [ 168.252481][ T9240] netlink: 96 bytes leftover after parsing attributes in process `syz.0.895'. [ 168.270723][ T9240] netlink: 1 bytes leftover after parsing attributes in process `syz.0.895'. [ 168.536238][ T9248] bond2: (slave bond_slave_1): Device is not our slave [ 168.548932][ T9248] bond2: option active_slave: invalid value (bond_slave_1) [ 168.565300][ T9248] bond2 (unregistering): Released all slaves [ 168.876169][ T9279] netlink: 204 bytes leftover after parsing attributes in process `syz.1.903'. [ 168.962274][ T9286] tipc: Enabled bearer , priority 0 [ 169.015760][ T9286] syzkaller0: entered promiscuous mode [ 169.021319][ T9286] syzkaller0: entered allmulticast mode [ 169.076091][ T9286] tipc: Resetting bearer [ 169.084084][ T49] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0xe [ 169.199849][ T9302] netlink: 4 bytes leftover after parsing attributes in process `syz.3.909'. [ 169.364770][ T9310] netlink: 4 bytes leftover after parsing attributes in process `syz.3.909'. [ 170.366322][ T9286] tipc: Disabling bearer [ 170.394860][ T9314] netlink: 16 bytes leftover after parsing attributes in process `syz.5.911'. [ 170.451907][ T5832] tipc: Node number set to 2568781097 [ 170.673473][ T9338] openvswitch: netlink: Flow actions attr not present in new flow. [ 170.687484][ T9332] xt_hashlimit: size too large, truncated to 1048576 [ 170.772400][ T9345] openvswitch: netlink: Duplicate key (type 32). [ 171.200130][ T9367] veth0_to_team: entered promiscuous mode [ 171.237794][ T9367] veth0_to_team: left promiscuous mode [ 171.986630][ T9404] syz.1.937 (9404) used greatest stack depth: 17472 bytes left [ 172.327010][ T9431] Bluetooth: MGMT ver 1.23 [ 172.602376][ T9446] __nla_validate_parse: 6 callbacks suppressed [ 172.602395][ T9446] netlink: 64 bytes leftover after parsing attributes in process `syz.1.948'. [ 173.056551][ T9471] x_tables: duplicate underflow at hook 4 [ 173.153263][ T9473] netlink: 'syz.3.956': attribute type 4 has an invalid length. [ 173.315541][ T9478] siw: device registration error -23 [ 173.362389][ T9483] netlink: 'syz.0.959': attribute type 2 has an invalid length. [ 173.375240][ T9479] netlink: 16 bytes leftover after parsing attributes in process `syz.4.957'. [ 173.389396][ T9479] netlink: 8 bytes leftover after parsing attributes in process `syz.4.957'. [ 173.543303][ T9488] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 173.613645][ T9496] netlink: 12 bytes leftover after parsing attributes in process `syz.5.963'. [ 173.653929][ T9496] 8021q: adding VLAN 0 to HW filter on device batadv1 [ 173.684142][ T9496] team0: Failed to send port change of device batadv1 via netlink (err -105) [ 173.702351][ T9498] ieee802154 phy0 wpan0: encryption failed: -22 [ 173.721035][ T9496] team0: Failed to send options change via netlink (err -105) [ 173.743091][ T9496] team0: Port device batadv1 added [ 174.125130][ T9518] netlink: 'syz.3.969': attribute type 1 has an invalid length. [ 174.260564][ T9518] 8021q: adding VLAN 0 to HW filter on device bond6 [ 174.460890][ T9523] bond6: (slave veth7): Enslaving as an active interface with a down link [ 174.530690][ T9534] netlink: 304 bytes leftover after parsing attributes in process `syz.0.972'. [ 174.596394][ T9524] 8021q: adding VLAN 0 to HW filter on device batadv2 [ 174.622315][ T9524] bond6: (slave batadv2): dev_set_mac_address on slave failed! ALB mode requires that the base driver support setting the hw address also when the network device's interface is open [ 174.690313][ T9536] netlink: 'syz.5.973': attribute type 1 has an invalid length. [ 174.705091][ T9529] netlink: 'syz.1.970': attribute type 1 has an invalid length. [ 174.753294][ T9529] netlink: 476 bytes leftover after parsing attributes in process `syz.1.970'. [ 174.788115][ T9536] 8021q: adding VLAN 0 to HW filter on device bond2 [ 174.823766][ T9529] netlink: 1041 bytes leftover after parsing attributes in process `syz.1.970'. [ 174.890124][ T9539] bond2: (slave veth3): Enslaving as an active interface with a down link [ 174.968581][ T9536] bond2: (slave veth0_to_bond): making interface the new active one [ 174.984701][ T9536] veth0_to_bond: entered promiscuous mode [ 174.993580][ T9536] bond2: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 175.098593][ T9539] bond2: (slave veth5): Enslaving as an active interface with a down link [ 175.110537][ T9539] netlink: 'syz.5.973': attribute type 1 has an invalid length. [ 175.160844][ T9539] netlink: 'syz.5.973': attribute type 2 has an invalid length. [ 175.664430][ T9570] netlink: 12 bytes leftover after parsing attributes in process `syz.5.982'. [ 177.542347][ T9593] netlink: 'syz.1.989': attribute type 1 has an invalid length. [ 177.637068][ T9602] bond9: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 177.649967][ T9602] bond9: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 177.661523][ T9602] bond9: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 177.700953][ T9593] bond9: (slave vcan0): The slave device specified does not support setting the MAC address [ 177.720598][ T9606] netlink: 12 bytes leftover after parsing attributes in process `syz.3.993'. [ 177.731631][ T9606] netlink: 4 bytes leftover after parsing attributes in process `syz.3.993'. [ 177.740983][ T9606] openvswitch: netlink: Flow actions attr not present in new flow. [ 177.748891][ T9593] bond9: (slave vcan0): making interface the new active one [ 177.750144][ T9593] bond9: (slave vcan0): Enslaving as an active interface with an up link [ 177.881787][ T9613] netlink: 'syz.1.996': attribute type 7 has an invalid length. [ 178.063864][ T9625] IPVS: set_ctl: invalid protocol: 43 127.0.0.1:20004 [ 178.527836][ T9647] netlink: 'syz.4.1008': attribute type 10 has an invalid length. [ 178.575574][ T9647] dummy0: entered promiscuous mode [ 178.581918][ T9647] dummy0: entered allmulticast mode [ 178.612552][ T9647] team0: Port device dummy0 added [ 178.631182][ T9657] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1012'. [ 178.652865][ T9660] netlink: 'syz.3.1009': attribute type 11 has an invalid length. [ 178.702775][ T9659] tipc: Enabling of bearer rejected, failed to enable media [ 178.852163][ T9670] xt_l2tp: invalid flags combination: 8 [ 178.918876][ T9672] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1015'. [ 179.005544][ T9678] netlink: 9 bytes leftover after parsing attributes in process `syz.1.1017'. [ 179.026328][ T9676] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1016'. [ 179.204724][ T9695] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 179.216118][ T9689] bond10: entered promiscuous mode [ 179.221311][ T9689] bond10: entered allmulticast mode [ 179.227729][ T9689] 8021q: adding VLAN 0 to HW filter on device bond10 [ 179.242886][ T9695] openvswitch: netlink: VXLAN extension message has 1 unknown bytes. [ 179.397943][ T9706] x_tables: duplicate entry at hook 1 [ 179.407050][ T9704] syzkaller0: entered promiscuous mode [ 179.416959][ T9704] syzkaller0: entered allmulticast mode [ 179.459132][ T9710] netlink: 'syz.0.1026': attribute type 3 has an invalid length. [ 179.471257][ T9710] netlink: 'syz.0.1026': attribute type 1 has an invalid length. [ 179.480670][ T9710] netlink: 224 bytes leftover after parsing attributes in process `syz.0.1026'. [ 179.749048][ T9724] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1029'. [ 180.423475][ T9745] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1032'. [ 181.187713][ T9751] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1033'. [ 181.289076][ T9756] af_packet: tpacket_rcv: packet too big, clamped from 39 to 4294967272. macoff=96 [ 181.728513][ T9785] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 182.228135][ T9809] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 182.250606][ T9811] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 182.277455][ T9811] bridge0: port 2(bridge_slave_1) entered disabled state [ 182.285306][ T9811] bridge0: port 1(bridge_slave_0) entered disabled state [ 182.312535][ T9811] bridge0: entered allmulticast mode [ 182.346693][ T9789] netlink: 'syz.4.1044': attribute type 1 has an invalid length. [ 182.371941][ T9789] netlink: 'syz.4.1044': attribute type 2 has an invalid length. [ 182.397274][ T9795] netlink: 'syz.4.1044': attribute type 1 has an invalid length. [ 182.416994][ T9795] netlink: 'syz.4.1044': attribute type 2 has an invalid length. [ 183.026530][ T9839] __nla_validate_parse: 4 callbacks suppressed [ 183.026550][ T9839] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1060'. [ 183.712855][ T9868] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1065'. [ 184.133378][ T9895] IPVS: set_ctl: invalid protocol: 0 172.20.20.48:20004 [ 184.255393][ T9900] syzkaller0: entered promiscuous mode [ 184.270288][ T9900] syzkaller0: entered allmulticast mode [ 184.294844][ T9900] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1077'. [ 184.325630][ T9903] netlink: 'syz.4.1078': attribute type 10 has an invalid length. [ 184.334081][ T9903] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1078'. [ 184.384752][ T9903] dummy0: left allmulticast mode [ 184.404578][ T9903] team0: Port device dummy0 removed [ 184.420567][ T9903] bridge0: port 4(dummy0) entered blocking state [ 184.429611][ T9903] bridge0: port 4(dummy0) entered disabled state [ 184.438450][ T9903] dummy0: entered allmulticast mode [ 184.446746][ T9903] bridge0: mtu less than device minimum [ 184.898734][ T9940] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 184.910084][ T9944] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 184.983539][ T9940] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 185.009434][ T9951] netlink: 'syz.3.1091': attribute type 1 has an invalid length. [ 185.033578][ T9951] netlink: 'syz.3.1091': attribute type 2 has an invalid length. [ 185.041374][ T9951] netlink: 'syz.3.1091': attribute type 1 has an invalid length. [ 185.060321][ T9951] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1091'. [ 185.148656][ T9960] netlink: 52 bytes leftover after parsing attributes in process `syz.5.1095'. [ 185.706399][T10000] bond_slave_1: entered promiscuous mode [ 185.965336][T10013] netlink: 'syz.4.1107': attribute type 2 has an invalid length. [ 185.984527][ T129] veth0_to_bond: left promiscuous mode [ 186.001697][T10013] netlink: 'syz.4.1107': attribute type 2 has an invalid length. [ 186.115116][T10024] IPVS: length: 56 != 24 [ 186.119451][T10024] IPVS: length: 56 != 24 [ 186.196666][T10024] IPVS: length: 56 != 24 [ 186.242139][T10024] IPVS: length: 56 != 24 [ 186.246663][T10024] IPVS: length: 56 != 24 [ 186.250965][T10024] IPVS: length: 56 != 24 [ 186.255551][T10024] IPVS: length: 56 != 24 [ 186.259859][T10024] IPVS: length: 56 != 24 [ 186.276370][T10024] IPVS: length: 56 != 24 [ 186.305289][T10024] IPVS: length: 56 != 24 [ 186.311963][T10024] IPVS: length: 56 != 24 [ 186.325198][T10024] IPVS: length: 56 != 24 [ 186.363644][T10024] IPVS: length: 56 != 24 [ 186.389990][T10024] IPVS: length: 56 != 24 [ 186.413106][T10024] IPVS: length: 56 != 24 [ 186.418376][T10024] IPVS: length: 56 != 24 [ 186.424024][T10024] IPVS: length: 56 != 24 [ 186.435106][T10024] IPVS: length: 56 != 24 [ 186.439720][T10024] IPVS: length: 56 != 24 [ 186.486874][T10024] IPVS: length: 56 != 24 [ 186.505178][T10024] IPVS: length: 56 != 24 [ 186.531861][T10024] IPVS: length: 56 != 24 [ 186.558927][T10024] IPVS: length: 56 != 24 [ 186.573487][T10024] IPVS: length: 56 != 24 [ 186.583071][T10024] IPVS: length: 56 != 24 [ 186.588329][T10024] IPVS: length: 56 != 24 [ 186.592707][T10024] IPVS: length: 56 != 24 [ 186.601630][T10024] IPVS: length: 56 != 24 [ 186.652050][T10024] IPVS: length: 56 != 24 [ 186.662178][T10024] IPVS: length: 56 != 24 [ 186.672288][T10024] IPVS: length: 56 != 24 [ 186.704471][T10024] IPVS: length: 56 != 24 [ 186.719052][T10024] IPVS: length: 56 != 24 [ 186.727555][T10024] IPVS: length: 56 != 24 [ 186.761462][T10024] IPVS: length: 56 != 24 [ 186.766854][T10024] IPVS: length: 56 != 24 [ 186.801179][T10024] IPVS: length: 56 != 24 [ 186.823640][T10024] IPVS: length: 56 != 24 [ 186.833436][T10024] IPVS: length: 56 != 24 [ 186.837761][T10024] IPVS: length: 56 != 24 [ 186.858115][T10024] IPVS: length: 56 != 24 [ 186.873078][T10024] IPVS: length: 56 != 24 [ 186.878294][T10024] IPVS: length: 56 != 24 [ 186.892790][T10024] IPVS: length: 56 != 24 [ 186.899406][T10024] IPVS: length: 56 != 24 [ 186.908509][T10024] IPVS: length: 56 != 24 [ 186.918652][T10024] IPVS: length: 56 != 24 [ 186.928784][T10024] IPVS: length: 56 != 24 [ 187.196862][T10076] xt_hashlimit: size too large, truncated to 1048576 [ 187.261056][T10084] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1121'. [ 187.289817][T10029] lec:lec_atm_close: lec0: Shut down! [ 187.729708][T10101] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1124'. [ 187.755244][T10103] veth0: entered promiscuous mode [ 187.761369][T10103] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1125'. [ 187.886981][T10102] veth0: left promiscuous mode [ 188.046055][T10106] bond4: entered promiscuous mode [ 188.051257][T10106] bond4: entered allmulticast mode [ 188.122688][T10106] 8021q: adding VLAN 0 to HW filter on device bond4 [ 188.254416][T10137] netlink: 'syz.4.1130': attribute type 3 has an invalid length. [ 188.343844][T10142] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1131'. [ 188.358825][T10145] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 188.607945][T10157] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 188.646679][T10161] tc_dump_action: action bad kind [ 188.957548][ T5913] lec:lec_start_xmit: lec0:No lecd attached [ 189.102833][T10189] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1147'. [ 189.130402][T10190] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1145'. [ 189.428514][T10209] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1153'. [ 189.457146][T10209] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1153'. [ 189.594277][T10218] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1154'. [ 189.621741][T10217] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1154'. [ 189.637837][T10218] openvswitch: netlink: Flow actions attr not present in new flow. [ 189.646498][T10217] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1154'. [ 190.078062][T10248] IPv6: NLM_F_CREATE should be specified when creating new route [ 190.614712][T10284] sctp: [Deprecated]: syz.0.1171 (pid 10284) Use of int in max_burst socket option deprecated. [ 190.614712][T10284] Use struct sctp_assoc_value instead [ 190.633823][T10286] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1172'. [ 190.669429][T10286] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 190.687696][T10286] netlink: 1204 bytes leftover after parsing attributes in process `syz.1.1172'. [ 190.767244][T10292] bridge6: the hash_elasticity option has been deprecated and is always 16 [ 191.241317][T10320] netlink: 'syz.3.1184': attribute type 1 has an invalid length. [ 191.311428][T10320] 8021q: adding VLAN 0 to HW filter on device bond8 [ 191.336142][T10320] bond7: (slave bond8): making interface the new active one [ 191.374168][T10320] bond7: (slave bond8): Enslaving as an active interface with an up link [ 191.452626][T10321] bond7: (slave gretap1): Enslaving as a backup interface with an up link [ 191.664297][T10341] netlink: 'syz.3.1189': attribute type 9 has an invalid length. [ 192.136767][T10371] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 192.707655][T10389] ip6_vti0 speed is unknown, defaulting to 1000 [ 193.142070][T10419] tipc: Enabled bearer , priority 0 [ 193.215886][T10419] syzkaller0: entered promiscuous mode [ 193.227321][T10419] syzkaller0: entered allmulticast mode [ 193.236956][T10419] tipc: Resetting bearer [ 193.247556][T10389] lo speed is unknown, defaulting to 1000 [ 193.258825][T10418] tipc: Resetting bearer [ 194.326820][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5360 ms [ 194.327082][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.335246][ C0] lec:lec_tx_timeout: lec0 [ 194.342276][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.347556][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 194.655284][T10418] tipc: Disabling bearer [ 194.824294][T10437] syz_tun: entered promiscuous mode [ 194.830111][T10437] macvtap1: entered promiscuous mode [ 194.840318][T10437] syz_tun: left promiscuous mode [ 194.971933][T10448] __nla_validate_parse: 4 callbacks suppressed [ 194.971953][T10448] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1219'. [ 195.150961][T10460] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1222'. [ 195.450421][T10468] tipc: Enabled bearer , priority 0 [ 195.540242][T10472] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 195.557900][T10468] syzkaller0: entered promiscuous mode [ 195.563674][T10468] syzkaller0: entered allmulticast mode [ 195.570274][T10468] tipc: Resetting bearer [ 195.585671][T10472] SET target dimension over the limit! [ 195.615585][T10467] tipc: Resetting bearer [ 195.661183][T10477] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1228'. [ 195.672787][T10478] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1228'. [ 197.005056][T10467] tipc: Disabling bearer [ 197.029429][T10492] team0: left allmulticast mode [ 197.043301][T10492] team_slave_0: left allmulticast mode [ 197.049491][T10492] team_slave_1: left allmulticast mode [ 197.080099][T10492] team0: left promiscuous mode [ 197.093255][T10492] team_slave_0: left promiscuous mode [ 197.109202][T10492] team_slave_1: left promiscuous mode [ 197.124561][T10492] bridge0: port 3(team0) entered disabled state [ 197.136458][T10492] bridge0: mtu less than device minimum [ 197.142501][T10492] dummy0: left allmulticast mode [ 197.148652][T10492] bridge0: port 4(dummy0) entered disabled state [ 197.185246][T10492] bridge_slave_0: left allmulticast mode [ 197.191096][T10492] bridge_slave_0: left promiscuous mode [ 197.198273][T10492] bridge0: port 1(bridge_slave_0) entered disabled state [ 197.219682][T10492] bridge_slave_1: left allmulticast mode [ 197.233788][T10492] bridge_slave_1: left promiscuous mode [ 197.239628][T10492] bridge0: port 2(bridge_slave_1) entered disabled state [ 197.257882][T10492] bond0: (slave bond_slave_0): Releasing backup interface [ 197.324099][T10492] bond0: (slave bond_slave_1): Releasing backup interface [ 197.365708][T10492] team0: Port device team_slave_0 removed [ 197.436695][T10492] team0: Port device team_slave_1 removed [ 197.453909][T10492] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 197.461369][T10492] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 197.480606][T10492] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 197.489357][T10492] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 197.498892][T10492] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 197.515708][ T5888] tipc: Node number set to 3969978841 [ 197.751513][T10524] veth0: entered promiscuous mode [ 197.762363][T10522] veth0: left promiscuous mode [ 197.819498][T10532] netlink: 'syz.1.1246': attribute type 10 has an invalid length. [ 197.944060][T10537] openvswitch: netlink: Unexpected mask (mask=240040, allowed=10048) [ 197.967778][T10537] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1248'. [ 198.015384][T10541] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 198.142545][T10549] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1254'. [ 198.171733][T10553] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1253'. [ 198.459853][T10570] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 198.664547][T10585] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1265'. [ 198.678920][T10586] x_tables: duplicate underflow at hook 3 [ 199.003178][T10606] ieee802154 phy0 wpan0: encryption failed: -22 [ 199.084372][T10607] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1272'. [ 199.098617][T10607] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 199.134130][T10607] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 199.269646][T10613] vcan0: tx drop: invalid sa for name 0x0000000000000001 [ 199.369843][T10620] netlink: 'syz.1.1277': attribute type 1 has an invalid length. [ 199.401914][T10620] bond11: entered promiscuous mode [ 199.408157][T10620] 8021q: adding VLAN 0 to HW filter on device bond11 [ 199.624666][T10634] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1281'. [ 199.696700][T10640] netlink: 'syz.1.1285': attribute type 1 has an invalid length. [ 199.894455][T10644] sit1: entered promiscuous mode [ 199.899735][T10644] sit1: entered allmulticast mode [ 200.069739][T10661] ipt_REJECT: TCP_RESET invalid for non-tcp [ 200.092951][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5740 ms [ 200.101073][ C0] lec:lec_tx_timeout: lec0 [ 200.106662][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 200.135212][T10662] netlink: 'syz.0.1290': attribute type 1 has an invalid length. [ 200.411415][T10676] 8021q: adding VLAN 0 to HW filter on device bond3 [ 200.431277][T10679] syzkaller1: entered promiscuous mode [ 200.439237][T10679] syzkaller1: entered allmulticast mode [ 200.454350][T10681] __nla_validate_parse: 1 callbacks suppressed [ 200.454369][T10681] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1297'. [ 200.470864][T10681] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1297'. [ 200.552631][T10681] syzkaller0: entered promiscuous mode [ 200.562143][T10681] syzkaller0: entered allmulticast mode [ 200.672264][T10689] ip6_vti0 speed is unknown, defaulting to 1000 [ 200.698931][T10691] tipc: New replicast peer: 255.255.255.255 [ 200.709722][T10691] tipc: Enabled bearer , priority 10 [ 200.718839][T10689] rdma_rxe: rxe_newlink: failed to add vxcan1 [ 200.727878][T10695] veth0: entered promiscuous mode [ 200.911093][T10696] veth0: left promiscuous mode [ 200.964823][ T59] wlan0: Trigger new scan to find an IBSS to join [ 201.172919][T10718] bond4: (slave bond_slave_1): Device is not our slave [ 201.180118][T10718] bond4: option active_slave: invalid value (bond_slave_1) [ 201.193268][T10718] bond4 (unregistering): Released all slaves [ 201.296443][T10729] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1310'. [ 201.398014][T10738] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1312'. [ 201.408026][T10729] netlink: 'syz.3.1310': attribute type 1 has an invalid length. [ 201.463603][T10729] netlink: 'syz.3.1310': attribute type 2 has an invalid length. [ 201.691261][T10754] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1317'. [ 201.752047][T10749] bridge0: port 2(bridge_slave_1) entered disabled state [ 201.759685][T10749] bridge0: port 1(bridge_slave_0) entered disabled state [ 201.811881][T10759] netlink: 512 bytes leftover after parsing attributes in process `syz.0.1316'. [ 202.044632][T10749] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 202.065535][T10749] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 202.170333][T10781] erspan0: entered promiscuous mode [ 202.198552][T10781] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1323'. [ 202.216194][ T59] netdevsim netdevsim1 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.225166][ T59] netdevsim netdevsim1 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.234971][ T59] netdevsim netdevsim1 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.291284][ T59] netdevsim netdevsim1 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 202.551526][T10801] netlink: 'syz.0.1327': attribute type 33 has an invalid length. [ 202.872014][T10816] netlink: 'syz.4.1332': attribute type 1 has an invalid length. [ 203.011829][T10829] bond6: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 203.066844][T10829] bond6: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 203.139155][T10829] bond6: (slave ip6gre1): making interface the new active one [ 203.244127][T10829] bond6: (slave ip6gre1): Enslaving as an active interface with an up link [ 203.435349][T10849] netlink: 'syz.5.1337': attribute type 4 has an invalid length. [ 203.515464][T10852] netlink: 'syz.1.1338': attribute type 1 has an invalid length. [ 203.674870][T10852] netlink: 'syz.1.1338': attribute type 11 has an invalid length. [ 203.684865][T10852] netlink: 'syz.1.1338': attribute type 11 has an invalid length. [ 203.708832][T10852] netlink: 224 bytes leftover after parsing attributes in process `syz.1.1338'. [ 203.750272][T10852] netlink: 240 bytes leftover after parsing attributes in process `syz.1.1338'. [ 203.823939][T10863] bond12: (slave bridge3): Enslaving as a backup interface with an up link [ 203.876564][T10875] nft_compat: unsupported protocol 0 [ 203.907914][T10879] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1345'. [ 203.908056][T10875] sctp: [Deprecated]: syz.5.1343 (pid 10875) Use of int in maxseg socket option. [ 203.908056][T10875] Use struct sctp_assoc_value instead [ 203.933628][ T71] wlan0: Trigger new scan to find an IBSS to join [ 203.967139][T10884] set match dimension is over the limit! [ 204.153597][T10895] tipc: Enabled bearer , priority 0 [ 204.171666][T10895] syzkaller0: entered promiscuous mode [ 204.181544][T10895] syzkaller0: entered allmulticast mode [ 204.230166][T10895] tipc: Resetting bearer [ 204.259788][T10895] erspan0: left promiscuous mode [ 204.286344][T10895] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 204.317258][T10893] tipc: Resetting bearer [ 204.351523][T10893] tipc: Disabling bearer [ 204.704287][T10922] bridge0: port 2(bridge_slave_1) entered disabled state [ 204.729363][T10922] bridge_slave_1 (unregistering): left allmulticast mode [ 204.772078][T10922] bridge_slave_1 (unregistering): left promiscuous mode [ 204.800093][T10922] bridge0: port 2(bridge_slave_1) entered disabled state [ 205.113339][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 205.121447][ C0] lec:lec_tx_timeout: lec0 [ 205.126748][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 205.496335][T10976] __nla_validate_parse: 7 callbacks suppressed [ 205.496355][T10976] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1375'. [ 206.275543][T11017] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1386'. [ 206.306266][T11015] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1385'. [ 206.337244][T11014] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1385'. [ 206.556120][T11036] netlink: 'syz.3.1388': attribute type 1 has an invalid length. [ 206.643318][T11036] netlink: 232 bytes leftover after parsing attributes in process `syz.3.1388'. [ 206.972951][T11056] wlan0: Trigger new scan to find an IBSS to join [ 207.216690][T11090] syzkaller0: entered promiscuous mode [ 207.222378][T11090] syzkaller0: entered allmulticast mode [ 207.428677][T11102] openvswitch: netlink: Duplicate or invalid key (type 0). [ 207.437724][T11102] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 207.659810][T11121] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1402'. [ 207.924577][ T71] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 208.672844][T11131] netlink: 'syz.5.1405': attribute type 1 has an invalid length. [ 208.825648][T11138] netlink: 'syz.5.1407': attribute type 1 has an invalid length. [ 209.888642][T11064] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 210.065045][T11167] netlink: 'syz.1.1415': attribute type 1 has an invalid length. [ 210.110881][T11167] bond13: entered promiscuous mode [ 210.127205][T11167] 8021q: adding VLAN 0 to HW filter on device bond13 [ 210.134124][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 210.134156][ C0] lec:lec_tx_timeout: lec0 [ 210.146773][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 210.190303][T11167] bond13: (slave bridge4): making interface the new active one [ 210.198134][T11167] bridge4: entered promiscuous mode [ 210.205037][T11167] bond13: (slave bridge4): Enslaving as an active interface with an up link [ 210.390063][T11193] veth0_to_bond: entered allmulticast mode [ 210.419588][T11193] netem: change failed [ 210.442717][T11193] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1423'. [ 210.474532][T11193] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 210.485522][T11193] gretap2: entered promiscuous mode [ 210.491182][T11193] gretap2: entered allmulticast mode [ 210.590000][T11201] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1424'. [ 210.599872][T11202] netlink: 14560 bytes leftover after parsing attributes in process `syz.5.1426'. [ 210.690735][T11210] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1427'. [ 210.714519][T11207] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1427'. [ 210.900876][T11222] netlink: 'syz.5.1432': attribute type 21 has an invalid length. [ 210.914662][T11222] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1432'. [ 211.143965][T11239] netlink: 'syz.3.1435': attribute type 10 has an invalid length. [ 211.152133][T11239] bridge0: port 1(bridge_slave_0) entered disabled state [ 211.165677][T11239] bridge0: port 1(bridge_slave_0) entered blocking state [ 211.172818][T11239] bridge0: port 1(bridge_slave_0) entered forwarding state [ 211.184829][T11239] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 211.319294][T11248] netlink: 14 bytes leftover after parsing attributes in process `syz.1.1437'. [ 211.448213][T11253] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 211.461346][T11254] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 211.479024][T11254] syzkaller1: linktype set to 823 [ 211.491625][T11253] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 211.506773][T11254] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 211.516820][T11258] netlink: 'syz.4.1441': attribute type 32 has an invalid length. [ 211.527133][T11258] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1441'. [ 211.530407][T11254] syzkaller1: linktype set to 823 [ 211.574870][T11258] bond7: Setting coupled_control to off (0) [ 211.596974][T11258] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1441'. [ 211.763735][T11278] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1444'. [ 211.827715][T11280] netlink: 'syz.0.1446': attribute type 16 has an invalid length. [ 211.850582][T11280] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1446'. [ 212.040512][T11291] netlink: 'syz.0.1449': attribute type 30 has an invalid length. [ 212.067507][T11291] bond5: option arp_missed_max: invalid value (0) [ 212.074058][T11291] bond5: option arp_missed_max: allowed values 1 - 255 [ 212.082477][T11291] bond5 (unregistering): Released all slaves [ 212.131691][T11243] delete_channel: no stack [ 212.294761][T11298] netlink: 'syz.3.1451': attribute type 2 has an invalid length. [ 212.308881][T11298] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 212.571516][T11320] tipc: Enabled bearer , priority 0 [ 212.653151][T11320] syzkaller0: entered promiscuous mode [ 212.658753][T11320] syzkaller0: entered allmulticast mode [ 212.665427][T11320] tipc: Resetting bearer [ 212.757749][T11312] tipc: Resetting bearer [ 214.200946][T11312] tipc: Disabling bearer [ 214.210924][T11333] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wireguard%d": -EINTR [ 214.222391][T11334] netlink: 'syz.0.1463': attribute type 29 has an invalid length. [ 214.408889][T11371] netlink: 'syz.3.1475': attribute type 1 has an invalid length. [ 214.585355][T11379] bond9: (slave gretap3): making interface the new active one [ 214.654014][T11379] bond9: (slave gretap3): Enslaving as an active interface with an up link [ 214.690415][T11389] veth0_to_team: entered promiscuous mode [ 214.706956][T11389] veth0_to_team: left promiscuous mode [ 214.968026][T11403] openvswitch: netlink: Flow actions attr not present in new flow. [ 215.341492][T11421] netlink: 'syz.4.1490': attribute type 18 has an invalid length. [ 215.378188][T11421] netlink: 'syz.4.1490': attribute type 18 has an invalid length. [ 215.378228][T11054] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 215.416560][T11054] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 215.431035][T11054] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 215.440361][T11054] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 215.550792][T11393] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 215.789476][T11443] netlink: 'syz.0.1497': attribute type 1 has an invalid length. [ 216.037065][T11454] syzkaller1: entered promiscuous mode [ 216.055793][T11454] syzkaller1: entered allmulticast mode [ 216.082970][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5940 ms [ 216.091069][ C0] lec:lec_tx_timeout: lec0 [ 216.097999][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 216.176906][T11461] __nla_validate_parse: 11 callbacks suppressed [ 216.176926][T11461] netlink: 4096 bytes leftover after parsing attributes in process `syz.4.1501'. [ 216.273100][T11465] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1502'. [ 216.405142][T11056] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 216.438006][T11056] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 216.455520][T11056] netdevsim netdevsim4 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 216.696818][T11487] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1508'. [ 216.706012][T11493] netlink: 104 bytes leftover after parsing attributes in process `syz.3.1511'. [ 216.865438][T11504] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1515'. [ 216.982311][T11508] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1517'. [ 216.994828][T11506] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1516'. [ 217.016294][T11506] netlink: 21 bytes leftover after parsing attributes in process `syz.1.1516'. [ 217.048911][T11506] netlink: 21 bytes leftover after parsing attributes in process `syz.1.1516'. [ 217.226977][T11521] netlink: 'syz.4.1521': attribute type 4 has an invalid length. [ 217.254272][T11521] netlink: 'syz.4.1521': attribute type 4 has an invalid length. [ 217.262633][T11525] netlink: 'syz.0.1523': attribute type 1 has an invalid length. [ 217.309483][ T10] lo speed is unknown, defaulting to 1000 [ 217.316338][ T10] syz0: Port: 1 Link ACTIVE [ 217.357250][T11535] netlink: 104 bytes leftover after parsing attributes in process `syz.1.1525'. [ 217.375914][T11532] bond5: (slave ip6gretap1): making interface the new active one [ 217.385802][T11525] xt_l2tp: missing protocol rule (udp|l2tpip) [ 217.411206][T11532] bond5: (slave ip6gretap1): Enslaving as an active interface with an up link [ 217.471018][T11534] : renamed from bond0 [ 217.547049][T11538] syzkaller0: entered promiscuous mode [ 217.552594][T11538] syzkaller0: entered allmulticast mode [ 217.562598][T11542] netlink: 'syz.0.1528': attribute type 1 has an invalid length. [ 218.100709][T11574] netlink: 'syz.3.1531': attribute type 18 has an invalid length. [ 219.012641][T11542] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 219.042185][T11571] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 219.066923][T11571] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 219.094126][T11571] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 219.113514][T11571] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 219.238390][T11047] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 219.292703][T11047] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 219.337572][T11047] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 219.374495][T11047] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 220.215017][T11649] syzkaller0: entered promiscuous mode [ 220.225318][T11649] syzkaller0: entered allmulticast mode [ 220.384852][T11661] syzkaller0: entered promiscuous mode [ 220.390457][T11661] syzkaller0: entered allmulticast mode [ 220.584799][T11671] ip6_vti0 speed is unknown, defaulting to 1000 [ 220.739919][T11677] netlink: 'syz.0.1567': attribute type 62 has an invalid length. [ 221.095830][T11698] netlink: 'syz.3.1574': attribute type 11 has an invalid length. [ 221.110326][T11671] lo speed is unknown, defaulting to 1000 [ 221.123037][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 221.131130][ C0] lec:lec_tx_timeout: lec0 [ 221.136363][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 221.322353][T11709] IPVS: set_ctl: invalid protocol: 59 255.255.255.255:20003 [ 221.518263][T11720] netlink: 'syz.0.1581': attribute type 7 has an invalid length. [ 221.530935][T11720] __nla_validate_parse: 9 callbacks suppressed [ 221.530953][T11720] netlink: 140 bytes leftover after parsing attributes in process `syz.0.1581'. [ 221.571137][T11725] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1581'. [ 221.750912][T11731] netlink: 'syz.5.1586': attribute type 83 has an invalid length. [ 221.901169][T11735] bond8: (slave ip6gretap2): making interface the new active one [ 221.917727][T11735] bond8: (slave ip6gretap2): Enslaving as an active interface with an up link [ 222.112632][T11747] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1592'. [ 222.198980][T11747] bridge_slave_1 (unregistering): left allmulticast mode [ 222.206820][T11747] bridge_slave_1 (unregistering): left promiscuous mode [ 222.216632][T11747] bridge0: port 2(bridge_slave_1) entered disabled state [ 222.238202][T11757] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1596'. [ 222.260905][T11751] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1593'. [ 222.278347][T11754] netlink: 60 bytes leftover after parsing attributes in process `syz.0.1593'. [ 222.349587][T11763] Unknown options in mask b7f2 [ 222.368519][T11757] syzkaller0: entered promiscuous mode [ 222.374354][T11757] syzkaller0: entered allmulticast mode [ 222.410926][T11768] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1598'. [ 222.600395][T11778] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1601'. [ 222.616676][T11780] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1599'. [ 222.689549][T11778] netlink: 'syz.3.1601': attribute type 1 has an invalid length. [ 222.708514][T11778] netlink: 'syz.3.1601': attribute type 2 has an invalid length. [ 222.997294][T11800] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1607'. [ 224.529766][T11817] bond9: entered promiscuous mode [ 224.563628][T11817] 8021q: adding VLAN 0 to HW filter on device bond9 [ 224.588012][T11826] netlink: 'syz.3.1614': attribute type 10 has an invalid length. [ 224.722088][T11845] sctp: [Deprecated]: syz.1.1616 (pid 11845) Use of int in maxseg socket option. [ 224.722088][T11845] Use struct sctp_assoc_value instead [ 224.863085][T11853] netlink: 'syz.3.1618': attribute type 1 has an invalid length. [ 224.871431][T11853] netlink: 'syz.3.1618': attribute type 3 has an invalid length. [ 224.879738][T11853] NCSI netlink: No device for ifindex 813332851 [ 224.985190][T11852] bond0: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 225.005740][T11852] bond0 (unregistering): Released all slaves [ 225.106663][T11865] workqueue: name exceeds WQ_NAME_LEN. Truncating to: Ku crK:̥B| [ 225.289178][T11878] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 225.435181][T11882] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 225.635809][T11893] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 225.646712][T11893] bridge0: entered allmulticast mode [ 225.734548][T11895] netlink: 'syz.1.1633': attribute type 1 has an invalid length. [ 225.797563][T11903] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 226.092638][T11920] netdevsim netdevsim5 : renamed from netdevsim0 (while UP) [ 226.382659][T11944] xt_cluster: you have exceeded the maximum number of cluster nodes (2048 > 32) [ 226.406863][T11945] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 226.424003][T11942] netlink: 'syz.0.1648': attribute type 2 has an invalid length. [ 226.547375][T11942] __nla_validate_parse: 14 callbacks suppressed [ 226.547395][T11942] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1648'. [ 226.571267][T11952] bond0: entered promiscuous mode [ 226.656801][T11962] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1654'. [ 226.963065][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5830 ms [ 226.971141][ C0] lec:lec_tx_timeout: lec0 [ 226.983032][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 227.108037][T11976] netlink: 'syz.5.1657': attribute type 29 has an invalid length. [ 227.256376][T11984] netlink: 'syz.1.1658': attribute type 2 has an invalid length. [ 227.318379][T11984] 9: entered promiscuous mode [ 227.353907][T11987] netlink: 1044 bytes leftover after parsing attributes in process `syz.4.1659'. [ 227.513634][T11998] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1661'. [ 227.752854][T12011] netlink: 'syz.5.1665': attribute type 16 has an invalid length. [ 227.793087][T12011] netlink: 'syz.5.1665': attribute type 17 has an invalid length. [ 227.892194][T12011] bridge0: port 1(bridge_slave_0) entered blocking state [ 227.899480][T12011] bridge0: port 1(bridge_slave_0) entered forwarding state [ 227.924318][T12011] bridge0: left allmulticast mode [ 227.989369][T12011] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 228.117688][T12029] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 228.336364][T12042] xt_TCPMSS: Only works on TCP SYN packets [ 228.582160][T12049] ip6gre1: entered promiscuous mode [ 228.593800][T12049] ip6gre1: entered allmulticast mode [ 228.684960][T12055] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1675'. [ 228.714021][T12055] chnl_net:caif_netlink_parms(): no params data found [ 228.756439][T12059] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1675'. [ 228.828010][T12058] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 229.002437][ T5487] veth0_macvtap: left promiscuous mode [ 229.024619][T12068] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1678'. [ 229.114986][T12068] netlink: 'syz.4.1678': attribute type 5 has an invalid length. [ 229.136250][T12068] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1678'. [ 229.398896][T12081] macvlan0: entered allmulticast mode [ 229.430727][T12079] tipc: Started in network mode [ 229.463253][T12079] tipc: Node identity 1e2bb8ed24c1, cluster identity 4711 [ 229.470622][T12079] tipc: Enabled bearer , priority 0 [ 229.562301][T12078] tipc: Disabling bearer [ 229.698308][T12100] syzkaller0: entered promiscuous mode [ 229.714627][T12100] syzkaller0: entered allmulticast mode [ 230.216623][T12117] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1690'. [ 230.487024][T12140] netlink: 'syz.4.1695': attribute type 10 has an invalid length. [ 230.504389][T12140] bridge0: left allmulticast mode [ 230.531966][T12140] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 231.302731][T12169] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1703'. [ 231.536939][T12169] bond6: option xmit_hash_policy: invalid value (64) [ 231.566916][T12169] bond6 (unregistering): Released all slaves [ 231.687271][T12181] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1707'. [ 231.823995][T12200] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.1712'. [ 231.847293][T12201] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1711'. [ 231.891377][T12201] gre2: entered promiscuous mode [ 231.907452][T12201] gre2: entered allmulticast mode [ 231.937789][T12204] openvswitch: netlink: IP tunnel attribute has 6 unknown bytes. [ 231.993478][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 232.001612][ C0] lec:lec_tx_timeout: lec0 [ 232.006680][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 232.248884][T12218] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1717'. [ 232.294046][T12223] netlink: 209644 bytes leftover after parsing attributes in process `syz.5.1719'. [ 232.509489][T12232] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1723'. [ 232.542290][T12232] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1723'. [ 232.994701][T12256] vlan3: entered allmulticast mode [ 233.198460][T12267] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1727'. [ 233.454984][T12274] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1730'. [ 233.570810][T12285] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1733'. [ 234.279305][T12311] netlink: 'syz.5.1739': attribute type 13 has an invalid length. [ 234.648690][T12337] nbd: must specify a size in bytes for the device [ 235.314907][T12367] netlink: 'syz.3.1758': attribute type 19 has an invalid length. [ 235.351763][T12367] netlink: 'syz.3.1758': attribute type 1 has an invalid length. [ 235.375381][T12367] netlink: 'syz.3.1758': attribute type 1 has an invalid length. [ 235.403639][T12371] netlink: 'syz.5.1759': attribute type 10 has an invalid length. [ 236.019153][T12396] ip6_vti0 speed is unknown, defaulting to 1000 [ 236.195582][T12403] netlink: 'syz.0.1770': attribute type 1 has an invalid length. [ 236.404397][T12403] 8021q: adding VLAN 0 to HW filter on device bond6 [ 236.895398][T12396] lo speed is unknown, defaulting to 1000 [ 237.012945][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 237.021049][ C0] lec:lec_tx_timeout: lec0 [ 237.026611][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 237.168962][T12445] __nla_validate_parse: 13 callbacks suppressed [ 237.168982][T12445] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1781'. [ 237.223123][T12452] netlink: 'syz.1.1782': attribute type 64 has an invalid length. [ 237.239818][T12446] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1781'. [ 237.251759][T12452] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1782'. [ 237.262713][T12450] IPVS: length: 121 != 24 [ 237.283874][T12446] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1781'. [ 237.288890][T12445] netlink: 48 bytes leftover after parsing attributes in process `syz.0.1781'. [ 237.312251][T12456] netlink: 'syz.1.1782': attribute type 64 has an invalid length. [ 237.360364][T12456] netlink: 5 bytes leftover after parsing attributes in process `syz.1.1782'. [ 237.525673][T12464] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1787'. [ 237.543604][T12465] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1787'. [ 237.599171][T12464] 8021q: adding VLAN 0 to HW filter on device bond14 [ 237.678128][T12468] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1788'. [ 237.690217][T12474] netlink: 'syz.5.1790': attribute type 4 has an invalid length. [ 237.691376][T12473] netlink: 120 bytes leftover after parsing attributes in process `syz.0.1789'. [ 237.733163][T12473] netlink: 'syz.0.1789': attribute type 1 has an invalid length. [ 238.029908][T12489] sock: sock_timestamping_bind_phc: sock not bind to device [ 238.499580][T12504] nbd: couldn't find a device at index 0 [ 238.829764][T12525] x_tables: unsorted underflow at hook 3 [ 238.871009][T12527] syzkaller0: entered promiscuous mode [ 238.913231][T12527] syzkaller0: entered allmulticast mode [ 238.949374][T12527] 0: reclassify loop, rule prio 0, protocol 800 [ 239.156974][T12548] bridge_slave_0: left promiscuous mode [ 239.165217][T12548] bridge0: port 1(bridge_slave_0) entered disabled state [ 239.179833][T12548] bond0: (slave bridge0): Releasing backup interface [ 239.492717][T12569] netem: unknown loss type 0 [ 239.508604][T12569] netem: change failed [ 239.703419][T12579] IPVS: length: 127 != 8 [ 239.801760][T12573] netlink: 'syz.1.1818': attribute type 11 has an invalid length. [ 239.888267][T12596] Cannot find set identified by id 3 to match [ 240.079338][T12603] validate_nla: 1 callbacks suppressed [ 240.079358][T12603] netlink: 'syz.0.1827': attribute type 1 has an invalid length. [ 240.093828][T12603] netlink: 'syz.0.1827': attribute type 1 has an invalid length. [ 240.101686][T12603] netlink: 'syz.0.1827': attribute type 8 has an invalid length. [ 240.158089][T12608] block nbd1: Unsupported socket: should be TCP or UNIX. [ 240.481670][T12616] syzkaller1: entered promiscuous mode [ 240.491399][T12627] netlink: 'syz.5.1834': attribute type 1 has an invalid length. [ 240.498125][T12616] syzkaller1: entered allmulticast mode [ 240.521350][T12628] bond2: option mode: unable to set because the bond device has slaves [ 240.531424][T12628] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 240.562557][T12627] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 241.474630][T12690] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 241.500629][T12690] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 241.915393][T12716] bridge0: the hash_elasticity option has been deprecated and is always 16 [ 241.945151][T12725] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 242.032943][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 242.041009][ C0] lec:lec_tx_timeout: lec0 [ 242.046911][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 242.103846][T12725] netlink: 'syz.0.1864': attribute type 1 has an invalid length. [ 242.161000][T12732] lo: entered allmulticast mode [ 242.397073][T12754] __nla_validate_parse: 17 callbacks suppressed [ 242.397094][T12754] netlink: 260 bytes leftover after parsing attributes in process `syz.5.1871'. [ 242.513851][T12763] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1872'. [ 242.537456][T12763] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1872'. [ 242.726648][T12773] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1877'. [ 242.762860][T12776] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1878'. [ 242.766301][T12773] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1877'. [ 242.766326][T12773] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1877'. [ 242.766534][T12773] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1877'. [ 242.766553][T12773] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1877'. [ 242.861588][T12781] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1879'. [ 243.036953][T12788] netlink: 'syz.3.1881': attribute type 3 has an invalid length. [ 247.062986][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 247.071053][ C0] lec:lec_tx_timeout: lec0 [ 247.076231][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 252.085001][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 252.093123][ C0] lec:lec_tx_timeout: lec0 [ 252.097647][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 255.768147][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 257.113079][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 257.121150][ C0] lec:lec_tx_timeout: lec0 [ 257.126367][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 262.133024][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 262.141098][ C0] lec:lec_tx_timeout: lec0 [ 262.146355][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 267.923006][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5780 ms [ 267.931071][ C0] lec:lec_tx_timeout: lec0 [ 267.936282][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 270.700151][T12858] __nla_validate_parse: 4 callbacks suppressed [ 270.700170][T12858] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1898'. [ 270.740977][T12858] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1898'. [ 270.763353][T12858] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1898'. [ 270.841958][T12865] sch_fq: defrate 0 ignored. [ 271.236625][T12882] netlink: 748 bytes leftover after parsing attributes in process `syz.5.1906'. [ 271.247491][T12882] netlink: 5520 bytes leftover after parsing attributes in process `syz.5.1906'. [ 271.678423][T12899] can: request_module (can-proto-0) failed. [ 271.751667][T12910] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1912'. [ 271.847325][T12915] netlink: 'syz.3.1914': attribute type 1 has an invalid length. [ 271.889017][T12915] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1914'. [ 271.986562][T12915] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 272.015729][T12915] netlink: 148 bytes leftover after parsing attributes in process `syz.3.1914'. [ 272.073130][T12915] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1914'. [ 272.152897][T12918] bond10 (unregistering): Released all slaves [ 272.354492][T12945] netlink: 'syz.5.1920': attribute type 1 has an invalid length. [ 272.374820][T12945] netlink: 'syz.5.1920': attribute type 3 has an invalid length. [ 272.382769][T12945] netlink: 'syz.5.1920': attribute type 7 has an invalid length. [ 272.395153][T12945] netlink: 'syz.5.1920': attribute type 8 has an invalid length. [ 272.421128][T12945] netlink: 184 bytes leftover after parsing attributes in process `syz.5.1920'. [ 272.421918][T12947] netlink: 'syz.3.1921': attribute type 4 has an invalid length. [ 272.430948][T12945] NCSI netlink: No device for ifindex 131092 [ 272.452375][T12947] `: renamed from bond0 (while UP) [ 272.478117][T12950] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 272.870673][T12969] lo: entered promiscuous mode [ 272.878519][T12969] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 272.895484][T12968] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 272.962938][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 272.971020][ C0] lec:lec_tx_timeout: lec0 [ 272.976523][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 273.129588][T12984] openvswitch: netlink: IP tunnel dst address not specified [ 273.805698][T13025] openvswitch: netlink: Flow key attribute not present in set flow. [ 273.855070][T13028] netlink: 'syz.5.1946': attribute type 2 has an invalid length. [ 273.855070][T13027] netlink: 'syz.5.1946': attribute type 2 has an invalid length. [ 273.903580][T13027] netlink: 'syz.5.1946': attribute type 2 has an invalid length. [ 274.020206][T13035] netlink: 'syz.3.1949': attribute type 10 has an invalid length. [ 274.294900][T13053] ================================================================== [ 274.303038][T13053] BUG: KASAN: slab-use-after-free in mini_qdisc_pair_swap+0x68/0x190 [ 274.311152][T13053] Read of size 8 at addr ffff888044e77000 by task syz.5.1955/13053 [ 274.319078][T13053] [ 274.321452][T13053] CPU: 0 UID: 0 PID: 13053 Comm: syz.5.1955 Not tainted syzkaller #0 PREEMPT(full) [ 274.321479][T13053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 274.321498][T13053] Call Trace: [ 274.321506][T13053] [ 274.321515][T13053] dump_stack_lvl+0xe8/0x150 [ 274.321549][T13053] print_report+0xba/0x230 [ 274.321574][T13053] ? mini_qdisc_pair_swap+0x68/0x190 [ 274.321601][T13053] kasan_report+0x117/0x150 [ 274.321628][T13053] ? mini_qdisc_pair_swap+0x68/0x190 [ 274.321659][T13053] mini_qdisc_pair_swap+0x68/0x190 [ 274.321687][T13053] ? __pfx_clsact_chain_head_change+0x10/0x10 [ 274.321712][T13053] tcf_chain0_head_change_cb_del+0x24c/0x380 [ 274.321753][T13053] tcf_block_put_ext+0x129/0x390 [ 274.321787][T13053] clsact_destroy+0x25e/0x820 [ 274.321813][T13053] ? __pfx_clsact_destroy+0x10/0x10 [ 274.321836][T13053] __qdisc_destroy+0x153/0x4a0 [ 274.321861][T13053] dev_shutdown+0x233/0x440 [ 274.321888][T13053] unregister_netdevice_many_notify+0x11a9/0x2370 [ 274.321919][T13053] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 274.321939][T13053] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 274.321973][T13053] ? __kfree_rcu_sheaf+0x1f/0x5d0 [ 274.322001][T13053] unregister_netdevice_queue+0x31f/0x360 [ 274.322035][T13053] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 274.322073][T13053] nsim_destroy+0x1e5/0x680 [ 274.322103][T13053] __nsim_dev_port_del+0x14d/0x1b0 [ 274.322134][T13053] nsim_dev_reload_destroy+0x288/0x490 [ 274.322168][T13053] nsim_dev_reload_down+0x8a/0xc0 [ 274.322198][T13053] devlink_reload+0x1d1/0x8d0 [ 274.322233][T13053] ? __pfx_devlink_reload+0x10/0x10 [ 274.322261][T13053] ? apparmor_capable+0x137/0x1a0 [ 274.322310][T13053] ? bpf_lsm_capable+0x9/0x20 [ 274.322337][T13053] ? security_capable+0x7e/0x2c0 [ 274.322363][T13053] devlink_nl_reload_doit+0x9d4/0xc80 [ 274.322400][T13053] ? __pfx_devlink_nl_reload_doit+0x10/0x10 [ 274.322432][T13053] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 274.322469][T13053] genl_family_rcv_msg_doit+0x22a/0x330 [ 274.322499][T13053] ? __asan_memcpy+0x40/0x70 [ 274.322532][T13053] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 274.322570][T13053] ? bpf_lsm_capable+0x9/0x20 [ 274.322595][T13053] ? security_capable+0x7e/0x2c0 [ 274.322620][T13053] genl_rcv_msg+0x61c/0x7a0 [ 274.322652][T13053] ? __pfx_genl_rcv_msg+0x10/0x10 [ 274.322680][T13053] ? __pfx_devlink_nl_pre_doit_dev_lock+0x10/0x10 [ 274.322709][T13053] ? __pfx_devlink_nl_reload_doit+0x10/0x10 [ 274.322738][T13053] ? __pfx_devlink_nl_post_doit_dev_lock+0x10/0x10 [ 274.322768][T13053] ? __lock_acquire+0x6b5/0x2cf0 [ 274.322810][T13053] netlink_rcv_skb+0x232/0x4b0 [ 274.322835][T13053] ? __pfx_genl_rcv_msg+0x10/0x10 [ 274.322864][T13053] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 274.322897][T13053] ? down_read+0x272/0x2e0 [ 274.322916][T13053] ? genl_rcv+0xd/0x40 [ 274.322944][T13053] genl_rcv+0x28/0x40 [ 274.322970][T13053] netlink_unicast+0x80f/0x9b0 [ 274.322995][T13053] ? __pfx_netlink_unicast+0x10/0x10 [ 274.323016][T13053] ? netlink_sendmsg+0x650/0xb40 [ 274.323038][T13053] ? skb_put+0x11b/0x210 [ 274.323066][T13053] netlink_sendmsg+0x813/0xb40 [ 274.323095][T13053] ? __pfx_netlink_sendmsg+0x10/0x10 [ 274.323122][T13053] ? aa_sock_msg_perm+0xf1/0x1b0 [ 274.323146][T13053] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 274.323168][T13053] ? __pfx_netlink_sendmsg+0x10/0x10 [ 274.323191][T13053] ____sys_sendmsg+0xa68/0xad0 [ 274.323218][T13053] ? futex_unqueue+0x211/0x240 [ 274.323255][T13053] ? __pfx_____sys_sendmsg+0x10/0x10 [ 274.323288][T13053] ? import_iovec+0x73/0xa0 [ 274.323318][T13053] ___sys_sendmsg+0x2a5/0x360 [ 274.323347][T13053] ? __pfx____sys_sendmsg+0x10/0x10 [ 274.323379][T13053] ? futex_wait+0x29a/0x380 [ 274.323420][T13053] ? __fget_files+0x2a/0x420 [ 274.323465][T13053] ? __fget_files+0x3a0/0x420 [ 274.323498][T13053] __x64_sys_sendmsg+0x1bd/0x2a0 [ 274.323531][T13053] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 274.323565][T13053] ? rcu_is_watching+0x15/0xb0 [ 274.323609][T13053] do_syscall_64+0x14d/0xf80 [ 274.323637][T13053] ? trace_irq_disable+0x3b/0x150 [ 274.323683][T13053] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.323704][T13053] ? clear_bhb_loop+0x40/0x90 [ 274.323727][T13053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.323747][T13053] RIP: 0033:0x7f2cef79c629 [ 274.323767][T13053] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 274.323794][T13053] RSP: 002b:00007f2cf072b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 274.323817][T13053] RAX: ffffffffffffffda RBX: 00007f2cefa15fa0 RCX: 00007f2cef79c629 [ 274.323833][T13053] RDX: 0000000000000030 RSI: 0000200000000100 RDI: 0000000000000004 [ 274.323847][T13053] RBP: 00007f2cef832b39 R08: 0000000000000000 R09: 0000000000000000 [ 274.323860][T13053] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 274.323872][T13053] R13: 00007f2cefa16038 R14: 00007f2cefa15fa0 R15: 00007ffd6112e6a8 [ 274.323898][T13053] [ 274.323905][T13053] [ 274.806793][T13053] Allocated by task 12926: [ 274.811226][T13053] kasan_save_track+0x3e/0x80 [ 274.815929][T13053] __kasan_kmalloc+0x93/0xb0 [ 274.820544][T13053] __kmalloc_noprof+0x35c/0x760 [ 274.825412][T13053] sk_prot_alloc+0xe7/0x210 [ 274.829935][T13053] sk_alloc+0x3a/0x390 [ 274.834025][T13053] __netlink_create+0x65/0x260 [ 274.838806][T13053] netlink_create+0x3ca/0x590 [ 274.843502][T13053] __sock_create+0x4b2/0x9d0 [ 274.848126][T13053] __sys_socket+0xd6/0x1b0 [ 274.852570][T13053] __x64_sys_socket+0x7a/0x90 [ 274.857260][T13053] do_syscall_64+0x14d/0xf80 [ 274.861928][T13053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.867955][T13053] [ 274.870289][T13053] Freed by task 15: [ 274.874110][T13053] kasan_save_track+0x3e/0x80 [ 274.878810][T13053] kasan_save_free_info+0x46/0x50 [ 274.883857][T13053] __kasan_slab_free+0x5c/0x80 [ 274.888637][T13053] kfree+0x1c1/0x630 [ 274.892552][T13053] __sk_destruct+0x623/0x880 [ 274.897161][T13053] rcu_core+0x7cd/0x1070 [ 274.901443][T13053] handle_softirqs+0x22a/0x870 [ 274.906235][T13053] run_ksoftirqd+0x36/0x60 [ 274.910675][T13053] smpboot_thread_fn+0x541/0xa50 [ 274.915666][T13053] kthread+0x388/0x470 [ 274.919752][T13053] ret_from_fork+0x51e/0xb90 [ 274.924377][T13053] ret_from_fork_asm+0x1a/0x30 [ 274.929174][T13053] [ 274.931511][T13053] Last potentially related work creation: [ 274.937237][T13053] kasan_save_stack+0x3e/0x60 [ 274.941931][T13053] kasan_record_aux_stack+0xbd/0xd0 [ 274.947153][T13053] call_rcu+0xee/0x890 [ 274.951250][T13053] netlink_release+0x1709/0x1ad0 [ 274.956207][T13053] sock_close+0xc3/0x240 [ 274.960471][T13053] __fput+0x44f/0xa70 [ 274.964474][T13053] task_work_run+0x1d9/0x270 [ 274.969090][T13053] exit_to_user_mode_loop+0xed/0x480 [ 274.974391][T13053] do_syscall_64+0x32d/0xf80 [ 274.979011][T13053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 274.984918][T13053] [ 274.987254][T13053] The buggy address belongs to the object at ffff888044e77000 [ 274.987254][T13053] which belongs to the cache kmalloc-2k of size 2048 [ 275.001324][T13053] The buggy address is located 0 bytes inside of [ 275.001324][T13053] freed 2048-byte region [ffff888044e77000, ffff888044e77800) [ 275.015047][T13053] [ 275.017389][T13053] The buggy address belongs to the physical page: [ 275.023821][T13053] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x44e70 [ 275.032604][T13053] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 275.041130][T13053] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 275.048707][T13053] page_type: f5(slab) [ 275.052743][T13053] raw: 00fff00000000040 ffff88813fea9000 dead000000000100 dead000000000122 [ 275.061346][T13053] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 275.069943][T13053] head: 00fff00000000040 ffff88813fea9000 dead000000000100 dead000000000122 [ 275.078644][T13053] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 275.087332][T13053] head: 00fff00000000003 ffffea0001139c01 00000000ffffffff 00000000ffffffff [ 275.096024][T13053] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 275.104793][T13053] page dumped because: kasan: bad access detected [ 275.111224][T13053] page_owner tracks the page as allocated [ 275.116950][T13053] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6762, tgid 6761 (syz.3.238), ts 112648294084, free_ts 109325253064 [ 275.138250][T13053] post_alloc_hook+0x231/0x280 [ 275.143047][T13053] get_page_from_freelist+0x24dc/0x2580 [ 275.148618][T13053] __alloc_frozen_pages_noprof+0x18d/0x380 [ 275.154443][T13053] allocate_slab+0x77/0x660 [ 275.158983][T13053] refill_objects+0x331/0x3c0 [ 275.163677][T13053] __pcs_replace_empty_main+0x2b9/0x620 [ 275.169255][T13053] __kmalloc_noprof+0x474/0x760 [ 275.174123][T13053] sk_prot_alloc+0xe7/0x210 [ 275.178649][T13053] sk_alloc+0x3a/0x390 [ 275.182739][T13053] __netlink_create+0x65/0x260 [ 275.187521][T13053] netlink_create+0x3ca/0x590 [ 275.192223][T13053] __sock_create+0x4b2/0x9d0 [ 275.196833][T13053] __sys_socket+0xd6/0x1b0 [ 275.201264][T13053] __x64_sys_socket+0x7a/0x90 [ 275.205962][T13053] do_syscall_64+0x14d/0xf80 [ 275.210587][T13053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 275.216499][T13053] page last free pid 5888 tgid 5888 stack trace: [ 275.222837][T13053] __free_frozen_pages+0xc2b/0xdb0 [ 275.227965][T13053] vfree+0x25a/0x400 [ 275.231881][T13053] delayed_vfree_work+0x55/0x80 [ 275.236745][T13053] process_scheduled_works+0xb02/0x1830 [ 275.242311][T13053] worker_thread+0xa50/0xfc0 [ 275.246923][T13053] kthread+0x388/0x470 [ 275.251007][T13053] ret_from_fork+0x51e/0xb90 [ 275.255617][T13053] ret_from_fork_asm+0x1a/0x30 [ 275.260407][T13053] [ 275.262744][T13053] Memory state around the buggy address: [ 275.268380][T13053] ffff888044e76f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 275.276456][T13053] ffff888044e76f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 275.284528][T13053] >ffff888044e77000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 275.292602][T13053] ^ [ 275.296687][T13053] ffff888044e77080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 275.304763][T13053] ffff888044e77100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 275.312840][T13053] ================================================================== [ 275.412692][T13053] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 275.419981][T13053] CPU: 1 UID: 0 PID: 13053 Comm: syz.5.1955 Not tainted syzkaller #0 PREEMPT(full) [ 275.429391][T13053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 275.439472][T13053] Call Trace: [ 275.442776][T13053] [ 275.445728][T13053] vpanic+0x56c/0xa60 [ 275.449753][T13053] ? __pfx_vpanic+0x10/0x10 [ 275.454291][T13053] ? __pfx___schedule+0x10/0x10 [ 275.459181][T13053] panic+0xc5/0xd0 [ 275.462941][T13053] ? __pfx_panic+0x10/0x10 [ 275.467404][T13053] ? preempt_schedule_common+0x82/0xd0 [ 275.472923][T13053] ? mini_qdisc_pair_swap+0x68/0x190 [ 275.478263][T13053] check_panic_on_warn+0x89/0xb0 [ 275.483258][T13053] ? mini_qdisc_pair_swap+0x68/0x190 [ 275.488595][T13053] end_report+0x73/0x180 [ 275.492863][T13053] ? mini_qdisc_pair_swap+0x68/0x190 [ 275.498183][T13053] kasan_report+0x128/0x150 [ 275.502716][T13053] ? mini_qdisc_pair_swap+0x68/0x190 [ 275.508030][T13053] mini_qdisc_pair_swap+0x68/0x190 [ 275.513175][T13053] ? __pfx_clsact_chain_head_change+0x10/0x10 [ 275.519277][T13053] tcf_chain0_head_change_cb_del+0x24c/0x380 [ 275.525291][T13053] tcf_block_put_ext+0x129/0x390 [ 275.530261][T13053] clsact_destroy+0x25e/0x820 [ 275.534962][T13053] ? __pfx_clsact_destroy+0x10/0x10 [ 275.540194][T13053] __qdisc_destroy+0x153/0x4a0 [ 275.544996][T13053] dev_shutdown+0x233/0x440 [ 275.549536][T13053] unregister_netdevice_many_notify+0x11a9/0x2370 [ 275.555984][T13053] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 275.562778][T13053] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 275.568454][T13053] ? __kfree_rcu_sheaf+0x1f/0x5d0 [ 275.573511][T13053] unregister_netdevice_queue+0x31f/0x360 [ 275.579262][T13053] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 275.585535][T13053] nsim_destroy+0x1e5/0x680 [ 275.590070][T13053] __nsim_dev_port_del+0x14d/0x1b0 [ 275.595209][T13053] nsim_dev_reload_destroy+0x288/0x490 [ 275.600700][T13053] nsim_dev_reload_down+0x8a/0xc0 [ 275.605860][T13053] devlink_reload+0x1d1/0x8d0 [ 275.610581][T13053] ? __pfx_devlink_reload+0x10/0x10 [ 275.615833][T13053] ? apparmor_capable+0x137/0x1a0 [ 275.620933][T13053] ? bpf_lsm_capable+0x9/0x20 [ 275.625665][T13053] ? security_capable+0x7e/0x2c0 [ 275.630644][T13053] devlink_nl_reload_doit+0x9d4/0xc80 [ 275.636070][T13053] ? __pfx_devlink_nl_reload_doit+0x10/0x10 [ 275.642014][T13053] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 275.648376][T13053] genl_family_rcv_msg_doit+0x22a/0x330 [ 275.654055][T13053] ? __asan_memcpy+0x40/0x70 [ 275.658673][T13053] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 275.664776][T13053] ? bpf_lsm_capable+0x9/0x20 [ 275.669487][T13053] ? security_capable+0x7e/0x2c0 [ 275.674450][T13053] genl_rcv_msg+0x61c/0x7a0 [ 275.679000][T13053] ? __pfx_genl_rcv_msg+0x10/0x10 [ 275.684058][T13053] ? __pfx_devlink_nl_pre_doit_dev_lock+0x10/0x10 [ 275.690495][T13053] ? __pfx_devlink_nl_reload_doit+0x10/0x10 [ 275.696428][T13053] ? __pfx_devlink_nl_post_doit_dev_lock+0x10/0x10 [ 275.702958][T13053] ? __lock_acquire+0x6b5/0x2cf0 [ 275.707926][T13053] netlink_rcv_skb+0x232/0x4b0 [ 275.712714][T13053] ? __pfx_genl_rcv_msg+0x10/0x10 [ 275.717771][T13053] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 275.723111][T13053] ? down_read+0x272/0x2e0 [ 275.727556][T13053] ? genl_rcv+0xd/0x40 [ 275.731661][T13053] genl_rcv+0x28/0x40 [ 275.735687][T13053] netlink_unicast+0x80f/0x9b0 [ 275.740496][T13053] ? __pfx_netlink_unicast+0x10/0x10 [ 275.745805][T13053] ? netlink_sendmsg+0x650/0xb40 [ 275.750760][T13053] ? skb_put+0x11b/0x210 [ 275.755035][T13053] netlink_sendmsg+0x813/0xb40 [ 275.759831][T13053] ? __pfx_netlink_sendmsg+0x10/0x10 [ 275.765150][T13053] ? aa_sock_msg_perm+0xf1/0x1b0 [ 275.770111][T13053] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 275.775413][T13053] ? __pfx_netlink_sendmsg+0x10/0x10 [ 275.780720][T13053] ____sys_sendmsg+0xa68/0xad0 [ 275.785513][T13053] ? futex_unqueue+0x211/0x240 [ 275.790298][T13053] ? __pfx_____sys_sendmsg+0x10/0x10 [ 275.795611][T13053] ? import_iovec+0x73/0xa0 [ 275.800227][T13053] ___sys_sendmsg+0x2a5/0x360 [ 275.804935][T13053] ? __pfx____sys_sendmsg+0x10/0x10 [ 275.810158][T13053] ? futex_wait+0x29a/0x380 [ 275.814702][T13053] ? __fget_files+0x2a/0x420 [ 275.819316][T13053] ? __fget_files+0x3a0/0x420 [ 275.824030][T13053] __x64_sys_sendmsg+0x1bd/0x2a0 [ 275.828994][T13053] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 275.834481][T13053] ? rcu_is_watching+0x15/0xb0 [ 275.839283][T13053] do_syscall_64+0x14d/0xf80 [ 275.843897][T13053] ? trace_irq_disable+0x3b/0x150 [ 275.848945][T13053] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 275.855036][T13053] ? clear_bhb_loop+0x40/0x90 [ 275.859738][T13053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 275.865649][T13053] RIP: 0033:0x7f2cef79c629 [ 275.870096][T13053] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 275.889725][T13053] RSP: 002b:00007f2cf072b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 275.898166][T13053] RAX: ffffffffffffffda RBX: 00007f2cefa15fa0 RCX: 00007f2cef79c629 [ 275.906155][T13053] RDX: 0000000000000030 RSI: 0000200000000100 RDI: 0000000000000004 [ 275.914405][T13053] RBP: 00007f2cef832b39 R08: 0000000000000000 R09: 0000000000000000 [ 275.922399][T13053] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 275.930390][T13053] R13: 00007f2cefa16038 R14: 00007f2cefa15fa0 R15: 00007ffd6112e6a8 [ 275.938393][T13053] [ 275.942037][T13053] Kernel Offset: disabled [ 275.946366][T13053] Rebooting in 86400 seconds..