last executing test programs: 3.304460101s ago: executing program 3 (id=5350): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000300)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="3b9601000000000000003b00000008000300", @ANYRES32=r5, @ANYBLOB="44003300400000000802110000000802110000015050505050500000000001002d1a02881b06000000000000000d00c0001c0000000100ce95000009720603fd88030303"], 0x60}, 0x1, 0x0, 0x0, 0x8015}, 0x20004080) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r9, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r8, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r11, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r13, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) close(r12) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)) r14 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) r15 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r15, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYRES32=r14, @ANYRESOCT, @ANYRESHEX=r2, @ANYRES8=r1, @ANYRESDEC=r3, @ANYRES16=r3, @ANYRES64=r4], 0x14}}, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r14, 0x8, 0x25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r16 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(r16, 0xc004743e, &(0x7f00000000c0)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_buf_alloc\x00', r0, 0x0, 0x1}, 0x18) 2.045281204s ago: executing program 1 (id=5359): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000240)=0x2, 0x4) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @remote}) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newsa={0x100, 0x10, 0x713, 0x0, 0x0, {{@in6=@mcast2, @in=@empty, 0x3}, {@in=@broadcast, 0x0, 0x33}, @in6=@loopback, {0x0, 0x0, 0x1000000000, 0x0, 0x100000001, 0x1, 0x3, 0x1}, {0x0, 0xfffffffffffffffd}, {}, 0x70bd2d, 0x0, 0xa, 0x2, 0x0, 0xf}, [@replay_val={0x10, 0xa, {0x70bd27, 0x70bd29, 0x7f}}]}, 0x100}}, 0x0) write$tun(r1, &(0x7f0000002780)=ANY=[@ANYBLOB="1c0008200203000014"], 0xfb5) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) 1.960794259s ago: executing program 2 (id=5360): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x6, 0xc, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x45}}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, &(0x7f0000000000)={0x4, 0xfa}, 0x2) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r1, 0x0, 0xe, 0x0, &(0x7f00000002c0)="e02742e86c0d85ff9782762f0800", 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 1.916728546s ago: executing program 3 (id=5362): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a310000000054000000030a0102000000000000000001000000090003002bdf7a320000000028000480080002400000000008000140000000051400030076657468315f6d6163767461700000000900010073797a31000000004c000000050a01020000000000000000010020000c00024000000000000000c00900010073797a31"], 0xe8}}, 0x0) r1 = socket(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0xc8, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x74, 0x2, [@TCA_HTB_INIT={0xf}, @TCA_HTB_INIT={0x18}, @TCA_HTB_DIRECT_QLEN={0x8}, @TCA_HTB_DIRECT_QLEN={0x8}, @TCA_HTB_DIRECT_QLEN={0x8}, @TCA_HTB_INIT={0x18}, @TCA_HTB_DIRECT_QLEN={0x8}, @TCA_HTB_DIRECT_QLEN={0x8}]}}, @qdisc_kind_options=@q_fq_codel={{}, {0x0, 0x2, [@TCA_FQ_CODEL_INTERVAL]}}]}, 0xc8}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 1.656557513s ago: executing program 1 (id=5365): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg(r1, &(0x7f0000005200)=[{{&(0x7f0000000100)=@nl=@unspec, 0x80, 0x0}}, {{&(0x7f00000015c0)=@vsock={0x28, 0x0, 0x2710, @local}, 0x80, &(0x7f0000000080)}}], 0x2, 0x4000) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r0) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000180)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010326bd6000000000002d9300000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x20040814) 1.576782391s ago: executing program 3 (id=5367): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0xfffffffc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000380)={0x1d, r5, 0x1, {0x0, 0x1, 0x3}, 0xfe}, 0x18) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x203, 0x0, 0x0, {0x2, 0x0, 0xfffd}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}], {0x14}}, 0x68}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x48, 0x16, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'macvlan0\x00'}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_SET_INFO(r6, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="000000000000000000000e090000960f2159001da2c91f9f50d5d399a5e545272e31a3047c213d99d446d62083a26ec6ec6e7d74791f40a8ba067fd4c011a9058404f91ec5111665a68f35ba8286e9ef12a7"], 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r7, @ANYBLOB="01000000020000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000740)=@newlink={0x4c, 0x10, 0xffffff1f, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_VLAN_FILTERING={0x5, 0x7, 0x6}, @IFLA_BR_VLAN_STATS_ENABLED={0x5, 0x29, 0x1}]}}}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x2000c0c1}, 0x40000) 1.561807371s ago: executing program 2 (id=5368): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a3100000000080005400000002b0900020073797a31000000000800"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002800500190084"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r0, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="c1", 0x1}], 0x1}, 0x0) setsockopt$sock_int(r1, 0x1, 0x200000010, &(0x7f0000000000)=0xfffffffc, 0x4) recvmsg$unix(r1, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}, 0x40000000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0x7}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.452499505s ago: executing program 0 (id=5370): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000710044000000000095000300"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_DEL(r1, &(0x7f0000000600)={0xfffffffffffffffe, 0x0, &(0x7f00000005c0)={&(0x7f0000000580)={0x34, 0x3, 0x7, 0x301, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0xa}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x24004000}, 0x80) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000004340), r2) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000004680)={0x0, 0x0, &(0x7f0000004640)={&(0x7f0000004500)={0x58, r3, 0x801, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_NODE={0x44, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "77f553fbbe779c210c2e6bdeb722ddffec065e7a"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000080)={r0, 0x1, 0x1, 0x9}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f00000095c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r5, &(0x7f0000000d40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000c80)={0x14, r6, 0x1}, 0x14}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'syztnl0\x00', &(0x7f0000000100)={'syztnl1\x00', 0x0, 0x2f, 0x4, 0x1, 0x9, 0x21, @private0={0xfc, 0x0, '\x00', 0x1}, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x8000, 0x20, 0x3, 0xd}}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00'}) r7 = socket$unix(0x1, 0x1, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x4, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x8085}, 0x20004010) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r4, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000300)={0x14, r6, 0x800, 0x70bd28, 0x25dfdbff}, 0x14}}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=0x0, @ANYBLOB="00000000000100001c0016801800018014000a00ff03acb172310000000008e7ffffffff08001b"], 0x44}}, 0x0) 1.417689564s ago: executing program 1 (id=5371): r0 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r0, 0x8008f513, 0x0) (async) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockname(r1, 0x0, &(0x7f0000000ac0)) (async) getsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000040), &(0x7f0000000080)=0x4) (async) r2 = socket$inet(0xa, 0x801, 0x84) listen(r2, 0x8) (async) r3 = socket$netlink(0x10, 0x3, 0x4) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000001590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r5, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async) listen(r5, 0x5) (async) accept(r5, 0x0, 0x0) (async) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) (async) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @byteorder={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_BYTEORDER_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc0}}, 0x0) (async) sendto$inet6(r6, &(0x7f0000000100)='H', 0x1, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) (async) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000000c0)={@in6={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}, 0x0, 0x0, 0x21b, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa158f35f7519d5f73b4f5d80eb4881a5b98cb9fb96d225d602392f816d09dcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) (async) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuacct.usage_percpu\x00', 0x275a, 0x0) (async) ioctl$sock_TIOCINQ(r4, 0x541b, &(0x7f0000000300)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x28011, r8, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000280)={'ip6tnl0\x00', 0x0}) (async) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r10) sendmsg$TIPC_CMD_ENABLE_BEARER(r10, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) sendmsg$TIPC_CMD_SET_LINK_TOL(r3, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3000fa00", @ANYRES16=r11, @ANYBLOB="200028bd7000fcdbdf2501000000000000000741000000140018000000096574683a6d61637365633000"], 0x30}, 0x1, 0x0, 0x0, 0x40084}, 0x800) bind$can_j1939(r8, &(0x7f00000002c0)={0x1d, r9, 0x3, {0x0, 0x1, 0x2}, 0x2}, 0x18) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xe, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="18060000000000000000000000000000711076000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x94) 1.337035605s ago: executing program 2 (id=5372): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x21, 0x0, 0x0) syz_emit_ethernet(0x7a, &(0x7f0000000180)={@local, @multicast, @void, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "dd69bf", 0x44, 0x2b, 0x0, @private0, @local, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x8100}}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000800)=ANY=[@ANYBLOB="611234000000000061134c0000000000bf2000000000000015000200000001103d200100000000009500000000000000bc26000000000000bf67000000000000070300000fff070067020000030000001606000000000078bf050000000000000f650000000000006507f4ff02000000070700004c0040001f75000000000000bf54000000000000070500000300f909ad430100000000009500000000000000050000000000000095000000000000004d9bd591d568253e9988431ec068e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305865050df26469fac5202d6293c3d5e11f4f83e7455baeeba4f"], &(0x7f0000000100)='GPL\x00'}, 0x48) 1.276470643s ago: executing program 4 (id=5373): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x48}}, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="100000002d000b02d25a806f8c6394f9101a04", 0x13}], 0x1}, 0x0) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x4044000) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0, 0x0, 0x0, 0x5c8}, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) (async) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0xfe33) (async) syz_emit_ethernet(0x1f, 0x0, 0x0) (async) close(0x4) (async) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bind$bt_l2cap(r2, &(0x7f0000000040)={0x1f, 0x0, @any, 0x4}, 0xe) connect$bt_l2cap(r2, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) setsockopt$bt_BT_SECURITY(r2, 0x112, 0x4, &(0x7f00000000c0)={0x3, 0x67}, 0x2) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') recvmsg(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x100) (async) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), r0) (async) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000280)={'syztnl0\x00', &(0x7f00000001c0)={'erspan0\x00', 0x0, 0x40, 0x20, 0x6, 0x5, {{0x1c, 0x4, 0x0, 0x12, 0x70, 0x66, 0x0, 0x8, 0x29, 0x0, @multicast2, @empty, {[@end, @timestamp_prespec={0x44, 0xc, 0x4c, 0x3, 0x8, [{@empty, 0xa}]}, @timestamp={0x44, 0x18, 0x5d, 0x0, 0x7, [0x4, 0x7ff, 0x8a, 0x100, 0x1ff]}, @timestamp={0x44, 0x8, 0xe7, 0x0, 0x1, [0x8cca]}, @timestamp={0x44, 0x2c, 0xf7, 0x0, 0x9, [0xe, 0x6, 0x7, 0x7fffffff, 0x4258c949, 0x5, 0x6, 0x1, 0x7ff, 0xfffffffe]}]}}}}}) sendmsg$ETHTOOL_MSG_STRSET_GET(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f00000002c0)={0x160, r3, 0x0, 0x70bd2d, 0x25dfdbfb, {}, [@ETHTOOL_A_STRSET_HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x3c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}]}, {0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}]}]}, @ETHTOOL_A_STRSET_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_vlan\x00'}]}, @ETHTOOL_A_STRSET_STRINGSETS={0xdc, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x75feb1364dd1992e}, @ETHTOOL_A_STRINGSET_ID={0x8}]}, {0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0xf}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}]}, {0x4}, {0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}]}, {0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}]}]}]}, 0x160}}, 0x41) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000740)=0x801, 0x4) (async) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r6, &(0x7f0000001280)={0x0, 0x0, &(0x7f0000001240)={&(0x7f00000011c0)=ANY=[@ANYBLOB="280000000b14010000e0ffffffffffff070001"], 0x28}}, 0x0) (async) socket(0x840000000002, 0x3, 0xff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket(0x25, 0x4, 0x5) (async) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000500)={&(0x7f0000000580)={0xb0, r3, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@ETHTOOL_A_CHANNELS_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8}, @ETHTOOL_A_CHANNELS_HEADER={0x58, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bridge\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x6}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x4}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x100}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0xfffff800}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0xffff}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x8001}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4004}, 0x1) 1.234609284s ago: executing program 1 (id=5374): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) (async) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001000030404000000fedbff2500000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b0001006272696467650000140002800500a5000000d30006002600001913006b65c884616bf62d8b4cf5dfb885121ee59eb84671030a4e4cef90948a41b1f205c9ad987d5293e2dfb44196534546e5eb5eb6bfd7029b36f424eb7d93030c0f6a7200659340003e39f31702c6bf6af0893cde8be936d3565675ddc0965e948f5877702837566c70296002e4c8006580d28a138e394f5a634d5f58c91290a71b3981197412e67a9eb7530ba3ecf058c23e650d762c2c39c8f714cba9ca0c88b09a72c3825a9cb74119ed5052ebfce1f3572f564a773bfc93ed4f9f581dcdaa779f3e1e040000000000000022b1f8a854aeccdc903fca0eeea7"], 0x44}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) (async, rerun: 64) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={0x0, 0xe}, &(0x7f0000000200)=0x8) (async, rerun: 64) r3 = socket(0x10, 0x3, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001840)=@newqdisc={0x470, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x3}, {0xffff, 0xffff}, {0xc, 0x7}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x444, 0x2, [@TCA_TBF_BURST={0x8, 0x6, 0x8}, @TCA_TBF_RTAB={0x404, 0x2, [0x5, 0x9, 0x3, 0x38, 0x8d, 0xffffffe0, 0x8, 0x4, 0x0, 0x1, 0x4, 0xfffff4bf, 0xa, 0x6, 0x6, 0x6, 0x6e5, 0x5, 0x9, 0x4, 0x401, 0x7ff, 0x8, 0x0, 0x3, 0x8, 0x3ff, 0x3, 0x5, 0xf8, 0x3, 0x4, 0x2, 0x9e21, 0x7ecf, 0x2, 0xc, 0x8977, 0x4312, 0x5, 0x80000000, 0xa, 0x1, 0x4, 0xd9, 0x4, 0x3, 0x3, 0x2d, 0x7a8, 0x7, 0x0, 0x1000, 0x0, 0x1, 0xe, 0xfffffffb, 0x8000, 0x27, 0xffffffff, 0xffff, 0x5, 0x9, 0xfffffffe, 0x5, 0xe, 0x101, 0x9677, 0xffffffa2, 0x8000, 0xeeec, 0x60, 0xe35, 0x9, 0xfee, 0x81, 0x400, 0x81, 0x3, 0x3362, 0x8, 0x9b6, 0x400, 0x5, 0x9, 0x7fffffff, 0x1000, 0xe6d, 0x7fffffff, 0x4, 0x1, 0x7, 0xff, 0x6, 0x5, 0x1, 0x7, 0x2, 0x10000, 0x3ff, 0xe2, 0x1, 0x8, 0x6, 0x0, 0x7fffffff, 0xfffffff9, 0x140, 0x2, 0x7, 0x81, 0x7, 0x5, 0x6, 0x69b, 0x9, 0x7fffffff, 0x7, 0xf, 0xd3bd, 0x453, 0x7, 0x8, 0x4, 0xf, 0x6, 0x400, 0x7, 0x7ff, 0x4, 0x0, 0x9, 0xdf60, 0x7, 0x10000000, 0xd, 0xfffffffc, 0x80000001, 0xfffffff8, 0xf, 0x7ff, 0x6, 0x2c8, 0x40, 0x9, 0xfffffffe, 0x0, 0x3, 0x9603, 0x719b, 0x5, 0x7, 0x10000, 0xfff, 0x5, 0x6, 0x6, 0x20000, 0xfffffff7, 0x49d, 0xf, 0x7fffffff, 0x200, 0x6, 0x0, 0x7, 0x6, 0xa, 0x2f28, 0x10000, 0x400, 0x8001, 0x6, 0x5, 0x5a2, 0x7, 0x800, 0x2, 0xaa, 0x7348fb54, 0x93a8, 0x5, 0x8000, 0x80000001, 0xfff, 0x5, 0x5, 0x3, 0xc, 0xc5, 0x4, 0x4, 0x7, 0x8001, 0x3, 0xfffffff8, 0x3ff, 0xff, 0x400, 0x8, 0x9, 0x3, 0x8, 0x8, 0x1be, 0xffffa9ab, 0x5868b5c9, 0x401, 0x1, 0x0, 0x3, 0x9, 0x7f, 0x200, 0x4b4975b4, 0xf39, 0x1, 0x101, 0x800, 0x4, 0x1000, 0xc, 0x80, 0x1dff, 0xc, 0x7, 0x8, 0xb390, 0x7f, 0xff, 0x8, 0x0, 0x8001, 0x1, 0x2, 0xddf5, 0x2, 0x5, 0xfffc0000, 0x6541, 0x5, 0x9, 0x69c, 0x2, 0x2, 0x7, 0x8001, 0x0, 0x8, 0x400, 0xfff, 0x474861a7, 0x8, 0x3, 0xd, 0x5]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x6, 0x2, 0x9, 0x2, 0x1, 0x8d}, {0x7, 0x0, 0x64, 0x40, 0x424, 0xe}, 0x0, 0x1, 0xdd8}}, @TCA_TBF_PRATE64={0xc, 0x5, 0x97bdea2cc2d43cda}]}}]}, 0x470}, 0x1, 0x0, 0x0, 0x10}, 0x0) 1.135592648s ago: executing program 3 (id=5375): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f00000000c0)={0x3, 0x1000}, 0x4) r1 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0xffffff0a, &(0x7f0000000080)=[{&(0x7f0000000040)="c018030029000b12d25a80648c2594f90324fc60100c028010000000053582c137153e370248078000f01700d1bd", 0x33fe0}], 0x1}, 0x0) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000240)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x7ff, 0xf84, 0x3}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000080)=[{r3}, {r3}], 0x2, 0xf45) setsockopt$sock_int(r3, 0x1, 0x7, &(0x7f0000000240), 0x4) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=@newlink={0x4c, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MEMBERSHIP_INTVL={0xc}, @IFLA_BR_MCAST_LAST_MEMBER_INTVL={0xc}]}}}]}, 0x4c}}, 0x0) syz_emit_ethernet(0x66, &(0x7f00000003c0)={@link_local, @dev, @void, {@ipv4={0x86dd, @gre={{0x5, 0x4, 0x0, 0x8, 0x58, 0x67, 0x0, 0x5, 0x2f, 0x0, @local, @multicast1}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x1}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x0, 0x1}, {0x8, 0x88be, 0x0, {{0x5, 0x1, 0x7, 0x3, 0x0, 0x0, 0x6, 0xb}, 0x1, {0x38}}}, {0x8, 0x22eb, 0x4, {{0x3, 0x2, 0x6, 0x1, 0x0, 0x1, 0x3, 0x6}, 0x2, {0x7, 0x4, 0x0, 0x5, 0x1, 0x1, 0x2}}}}}}}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) 956.707573ms ago: executing program 4 (id=5376): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) vmsplice(r0, &(0x7f00000006c0)=[{0xfffffffffffffffe}], 0x1, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r2, 0x8010661b, &(0x7f0000000080)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newchain={0x6c, 0x64, 0x1, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xfff2, 0xd}, {0xe, 0xd}, {0xa, 0xd}}, [@filter_kind_options=@f_flow={{0x9}, {0x24, 0x2, [@TCA_FLOW_ADDEND={0x8, 0x5, 0x5}, @TCA_FLOW_RSHIFT={0x8, 0x4, 0x8001}, @TCA_FLOW_KEYS={0x8, 0x1, 0x1d04e}, @TCA_FLOW_ADDEND={0x8, 0x5, 0x7}]}}, @filter_kind_options=@f_flow={{0x9}, {0xc, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x5317}]}}]}, 0x6c}}, 0x48010) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000380)=ANY=[@ANYBLOB="180100002e"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) 955.637473ms ago: executing program 0 (id=5377): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) (async) r1 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00000000000029f36c000000004c0000000c000000000000000800013a31302e3000"/50], 0x3c}}, 0x0) (async, rerun: 64) sendmsg$nl_crypto(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="f0000000120003"], 0xf0}}, 0x0) (rerun: 64) r2 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_GET_FEATURE(r2, &(0x7f0000000580)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)={0x10, 0x3fb, 0x400, 0x70bd29, 0x25dfdbff, "", [""]}, 0x10}, 0x1, 0x0, 0x0, 0x40}, 0x0) (async, rerun: 64) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async, rerun: 64) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x6, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="18020000fcffffff0000000000000000850000003600000085000000d000000095"], &(0x7f0000000100)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bind$alg(0xffffffffffffffff, &(0x7f0000000440)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes128\x00'}, 0x58) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async, rerun: 64) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (rerun: 64) r5 = openat$cgroup_procs(r4, &(0x7f0000000040)='cgroup.procs\x00', 0x2, 0x0) r6 = openat$cgroup_procs(r4, &(0x7f00000002c0)='tasks\x00', 0x2, 0x0) write$cgroup_pid(r5, &(0x7f00000000c0), 0x40) (async, rerun: 32) pread64(r6, &(0x7f0000001840)=""/4096, 0x1003, 0x1) (async, rerun: 32) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) r8 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) (async) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$nl_route(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000980)=ANY=[@ANYBLOB="3c00000013000100000000000000000007000000", @ANYRES32=r9, @ANYBLOB="06a00000000000001c001a8004000580"], 0x3c}}, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="4e001f07010001", @ANYRES16=r7, @ANYBLOB="080026bd7000fcdbdf25090000000800320004000000060028000000000005002f0001000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4804}, 0x4809) (async) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x0, 0xe, 0x0, &(0x7f0000001580)="e0856497d56cf0f21a0000000010", 0x0, 0x20000700, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 902.291776ms ago: executing program 2 (id=5378): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=@bridge_dellink={0x24, 0x11, 0x5, 0x0, 0x0, {0x7, 0x0, 0x0, r2, 0x0, 0x10022}, [@IFLA_AF_SPEC={0x4}]}, 0x24}}, 0x0) gettid() socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$tipc(r3, &(0x7f0000000040)=@name, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="340000003e000701feffffff00000000017c0000040042800c0001800600060090390000100002800c00168008000f00884827"], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_REG(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000140)={0x24, r5, 0x1, 0x70bd25, 0x25dfdbfc, {}, [@NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x1}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0x4}]}, 0x24}}, 0x804) socket$kcm(0x10, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="300000000001010000000000020000001c00188208000140000000000800024000000000180001400000000000000000"], 0x30}, 0x1, 0x0, 0x0, 0x804}, 0x40000) r6 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0x10, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000001000061b02000000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, 0x8}, 0x94) sendmsg$nl_generic(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x100, 0x0, 0x0, {0x0, 0x0, 0xe403}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x1}, @IFLA_BOND_PACKETS_PER_SLAVE={0x8, 0x14, 0x81}]}}}]}, 0x44}}, 0x0) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), r4) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_linger(r9, 0x1, 0xd, &(0x7f0000000000)={0x0, 0x1}, 0x8) setsockopt$inet_int(r9, 0x0, 0x13, &(0x7f0000000040)=0x80000000, 0x4) pipe(0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) sendmsg$nl_route(r10, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=@can_newroute={0x44, 0x18, 0x1, 0x0, 0x0, {}, [@CGW_DST_IF={0x8}, @CGW_SRC_IF={0x8}, @CGW_MOD_UID={0x8, 0xe, r11}, @CGW_MOD_SET={0x15, 0x4, {{{0x3, 0x1, 0x1, 0x1}, 0xa, 0x1, 0x0, 0x0, "0325175362eb4cf2"}, 0x4}}]}, 0x44}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r4, &(0x7f00000004c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8}, 0x4f, &(0x7f0000000480)={&(0x7f0000000400)={0x83, r8, 0x400, 0x70bd28, 0x25dfdbfe, {{}, {@void, @val={0x0, 0x99, {0x401, 0x10}}}}, [@NL80211_ATTR_BG_SCAN_PERIOD={0x0, 0x98, 0x8}]}, 0x50}, 0x1, 0x0, 0x0, 0x4005}, 0x24000804) 824.05057ms ago: executing program 0 (id=5379): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x34, r1, 0x701, 0x0, 0x0, {0x41}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x0) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000000), 0x8) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_CHANNEL(r2, &(0x7f0000000300)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="088ac6ba", @ANYRES16=r3, @ANYBLOB="00022dbd7000fedbdf25410000000c00990008000000620000000500190104000000"], 0x28}, 0x1, 0x0, 0x0, 0x20000800}, 0x40000) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0x3, &(0x7f00000000c0)=""/113, &(0x7f0000000040)=0x71) r4 = socket(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="180000001600010a"], 0x78}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000000)="4dc07f947163300c", 0x8) r6 = accept4(r5, 0x0, 0x0, 0x0) sendmmsg$inet(r6, &(0x7f0000000e40)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000100)='K', 0x1}], 0x1}}], 0x1, 0x8000) close(r6) r7 = socket$igmp(0x2, 0x3, 0x2) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtaction={0x6c, 0x30, 0x9, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_TTL={0x5, 0x7, 0x40}, @TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x4}}]}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x6c}}, 0x0) setsockopt$MRT_ADD_VIF(r7, 0x0, 0xca, &(0x7f0000000140)={0x0, 0x1, 0x0, 0x0, @vifc_lcl_addr=@rand_addr=0xc0586300, @private=0xffffffff}, 0x10) recvmmsg(r4, &(0x7f000001ef40)=[{{0x0, 0x0, &(0x7f000001c980)=[{0x0}, {0x0}, {0x0}], 0x3, &(0x7f000001ca40)=""/4096, 0x1000}, 0x8}, {{0x0, 0x0, 0x0}, 0x100}], 0x2, 0x20, 0x0) 760.693129ms ago: executing program 4 (id=5380): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000180)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f0000000000)={'a', ' *:* ', 'rwm\x00'}, 0xa) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000050000000000000000000024000a20000000000a1f000000000000000000010000000900010073797a300000000058000000030a0104000000000000000001000000090003803d2175fbe782c2002c00048008000240172af2e40800014000000003080002401c791e7108000240423930ce08000140000000030900010073797a300000000088000000060a010400000000000000000100000008000b400000000014000480100001800b0001006e756d67656e00000900010073797a30000000004c0004804800018008000100666962003c000280080003400000000c080001"], 0x122}, 0x1, 0x0, 0x0, 0x400c054}, 0x4000) 709.87951ms ago: executing program 4 (id=5381): bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0300df0004000000040000000a00000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000400"/28], 0x48) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000180)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x2, 0x1, 0x1, 0x0, {0xa, 0x4e23, 0xfa8d, @rand_addr=' \x01\x00', 0x7}}}, 0x32) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x3c, r1, 0x1, 0x70bd26, 0x25dfdbfe, {0x5}, [@L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaaa}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x4}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20006911}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000005c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="ac000000", @ANYRES16=r4, @ANYBLOB="01060000000000000000090000002c0004801300010062726f6164636173742d6c696e6b0000140007800800060000000000080005"], 0xac}}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x42000, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000000)={'pim6reg1\x00', 0x2}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=@ipv6_newaddrlabel={0x38, 0x48, 0x3, 0x0, 0x0, {}, [@IFAL_ADDRESS={0x14, 0x1, @empty}, @IFAL_LABEL={0x8, 0x2, 0xffffffff}]}, 0x38}}, 0x0) ioctl$TUNSETLINK(r5, 0x400454cd, 0x336) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @multicast}) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.time\x00', 0x26e1, 0x0) close(r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r9, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r9, 0x6, 0x14, &(0x7f0000000140)=0x2, 0x4) connect$inet(r9, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r9, 0x6, 0x16, &(0x7f0000000340)=[@sack_perm, @window={0x3, 0x6, 0x7}, @mss={0x2, 0x7}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @timestamp, @window={0x3, 0xfffe}, @sack_perm], 0x200000000000005e) sendto$inet(r9, &(0x7f00000007c0)="25d7", 0x2, 0xe044, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, &(0x7f00000001c0), 0x4) connect$unix(r8, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) close(r5) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x20, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000040000000000000000079120cde0000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 606.123736ms ago: executing program 0 (id=5382): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c, 0x0}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001a00)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000080)="1a64829bf8f72508a80cd8d857b57faf39ee3f9eea1eee8a57ed874438f5d4c1071331ca143e3e50586a06bc83689f2a60f917d4a74431cca878e35f69c9cc01bd35", 0x42}], 0x1, 0x0, 0x168}}], 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000007c0)="d8000000180081064e81f782db4cb904021d080006007c09e8fe55a10a0015000500142603600e1208000f0000000401a80016002000014004000000035c1f61c1d60008000000000000fb8000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cee0090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f0f49e119c849ea6e5a0fc55e4cde205a214d6102d6dcbf33fb5ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6cc", 0xd8}], 0x1}, 0x0) r2 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) readv(r2, &(0x7f0000000580)=[{&(0x7f0000003700)=""/4081, 0xff1}, {&(0x7f0000000300)=""/104, 0x68}, {&(0x7f0000000a80)=""/237, 0xed}, {&(0x7f00000000c0)=""/15, 0xf}, {&(0x7f0000000380)=""/20, 0x14}, {&(0x7f00000003c0)=""/52, 0x34}], 0x6) 604.403379ms ago: executing program 2 (id=5383): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x3}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x1e, 0xa01}, 0x14}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'tunl0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x7, 0x7, 0x7f, 0x9, {{0x24, 0x4, 0x1, 0x7, 0x90, 0x68, 0x0, 0x1, 0x4, 0x0, @broadcast, @remote, {[@cipso={0x86, 0x24, 0x1, [{0x6, 0x6, "ecbb44b1"}, {0x7, 0xb, "470ed136158795a848"}, {0x6, 0xd, "4e2f8d16570e619f162ba4"}]}, @end, @generic={0x83, 0xa, "2e0b24359c062bc6"}, @timestamp={0x44, 0x18, 0x33, 0x0, 0x9, [0xe49, 0x4, 0xc, 0x9, 0x1]}, @timestamp_addr={0x44, 0x2c, 0xeb, 0x1, 0x7, [{@dev={0xac, 0x14, 0x14, 0x24}, 0xa12d}, {@remote, 0x1000}, {@remote, 0x41a11a4a}, {@multicast1, 0x8}, {@rand_addr=0x64010102, 0xd}]}, @lsrr={0x83, 0x7, 0x68, [@remote]}]}}}}}) sendmsg$nl_route(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@ipv6_getaddrlabel={0x5c, 0x4a, 0x300, 0x70bd25, 0x25dfdbfd, {0xa, 0x0, 0x40, 0x0, r1, 0x100}, [@IFAL_ADDRESS={0x14, 0x1, @mcast2}, @IFAL_LABEL={0x8, 0x2, 0x1}, @IFAL_LABEL={0x8, 0x2, 0xc}, @IFAL_ADDRESS={0x14, 0x1, @loopback}, @IFAL_LABEL={0x8, 0x2, 0x4}]}, 0x5c}}, 0x4000891) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x1, 0x40, 0x40, 0x41}, 0x48) socket(0x10, 0x3, 0x0) (async) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x3}, 0x10) (async) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x1e, 0xa01}, 0x14}}, 0x0) (async) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000180)={'tunl0\x00', &(0x7f00000000c0)={'syztnl2\x00', 0x0, 0x7, 0x7, 0x7f, 0x9, {{0x24, 0x4, 0x1, 0x7, 0x90, 0x68, 0x0, 0x1, 0x4, 0x0, @broadcast, @remote, {[@cipso={0x86, 0x24, 0x1, [{0x6, 0x6, "ecbb44b1"}, {0x7, 0xb, "470ed136158795a848"}, {0x6, 0xd, "4e2f8d16570e619f162ba4"}]}, @end, @generic={0x83, 0xa, "2e0b24359c062bc6"}, @timestamp={0x44, 0x18, 0x33, 0x0, 0x9, [0xe49, 0x4, 0xc, 0x9, 0x1]}, @timestamp_addr={0x44, 0x2c, 0xeb, 0x1, 0x7, [{@dev={0xac, 0x14, 0x14, 0x24}, 0xa12d}, {@remote, 0x1000}, {@remote, 0x41a11a4a}, {@multicast1, 0x8}, {@rand_addr=0x64010102, 0xd}]}, @lsrr={0x83, 0x7, 0x68, [@remote]}]}}}}}) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=@ipv6_getaddrlabel={0x5c, 0x4a, 0x300, 0x70bd25, 0x25dfdbfd, {0xa, 0x0, 0x40, 0x0, r1, 0x100}, [@IFAL_ADDRESS={0x14, 0x1, @mcast2}, @IFAL_LABEL={0x8, 0x2, 0x1}, @IFAL_LABEL={0x8, 0x2, 0xc}, @IFAL_ADDRESS={0x14, 0x1, @loopback}, @IFAL_LABEL={0x8, 0x2, 0x4}]}, 0x5c}}, 0x4000891) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x1, 0x40, 0x40, 0x41}, 0x48) (async) 456.774421ms ago: executing program 2 (id=5384): socket$nl_generic(0x10, 0x3, 0x10) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x6, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) syz_80211_join_ibss(&(0x7f0000000040)='wlan0\x00', &(0x7f0000000080)=@default_ibss_ssid, 0x6, 0x0) syz_80211_inject_frame(&(0x7f00000000c0), &(0x7f0000000100)=@mgmt_frame=@beacon={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}, 0x36) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000000)={r1, 0x7f, 0x494, 0x2}) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'geneve0\x00', 0x10}) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x54, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x9}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}]}, 0x54}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000005c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a30000000000800054000000021200011800e000100636f6e6e6c696d69740000000c00028008000140fffffff73c0000000c0a01010000000000000000070400000900020073797a31000000000900010073797a3000000000100003800c0000800800034000000002"], 0xe0}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)) socket$inet6(0xa, 0x80803, 0x87) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000700)={@map, 0xffffffffffffffff, 0xf, 0x18}, 0x20) syz_emit_ethernet(0x5e, &(0x7f00000004c0)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd603000bb00282b00fe800000000000000000000000000000fe8000000000000000000000000000aa87"], 0x0) 347.936073ms ago: executing program 0 (id=5385): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000000)="5c00000014006b05c84e21000ab16d6e230675f802000000440002000800d30461bc24eeb556a705251e6182149a36c23d3b48dfd8cdbf9367b098fa51f60a64c9f408000000e786a6d0bdd70000b6c0504bb9189d9193e9bd1c1b78", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000003000000000000000000000903000000010000000000000800000000000000000000000202002b00002e00"], 0x0, 0x3f}, 0x20) 329.801985ms ago: executing program 4 (id=5386): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000240)=0x80000000, 0x4) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000002c0), 0x4) (async) syz_emit_ethernet(0x7e, &(0x7f00000003c0)={@link_local, @random="117863ac6e52", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x48, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x1, {0x0, 0x6, '\x00', 0x0, 0x0, 0x0, @private1, @mcast1, [@hopopts={0x3a, 0x1, '\x00', [@calipso={0x7, 0x8, {0x0, 0x0, 0x8}}]}]}}}}}}}, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4}, 0x1c) (async) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a48000000060a0b040000000000000000020000001c00048018000180080001006c6f67000c00028008000640000000210900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x70}}, 0x20000080) (async, rerun: 32) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (async, rerun: 32) r5 = socket$nl_crypto(0x10, 0x3, 0x15) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000280)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000200)={0x1c, r7, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) setsockopt$inet6_int(r4, 0x29, 0x1a, &(0x7f0000000100)=0x401, 0x4) (async) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty, 0xffffffff}, 0x1c) (async) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x14e22, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3d}}}, 0x1c) (async, rerun: 32) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) (rerun: 32) connect$bt_l2cap(r9, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r10 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r10, 0x400448c8, &(0x7f0000000100)={r9, r9, 0x0, 0x0, 0x0, 0x42, 0xfb, 0x0, 0x5886, 0x63, 0x1, 0x8, 'syz1\x00'}) (async) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) writev(r11, &(0x7f0000000100)=[{&(0x7f0000000180)="12c3f3", 0x3}], 0x1) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r11, 0x0) (async) ioctl$sock_bt_hidp_HIDPCONNDEL(r10, 0x400448c9, &(0x7f00000000c0)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) (async, rerun: 64) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) (async, rerun: 64) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x16}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000700)={r12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffdf3, 0x0, &(0x7f00000004c0)='N', 0x0}, 0x50) 207.577595ms ago: executing program 0 (id=5387): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x8, 0x4, 0x4, 0x20007}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xa, 0x8, &(0x7f0000000240)=ANY=[@ANYBLOB="1809000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7030000070000008500000021000000b70000000000000095"], &(0x7f0000000640)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0xe, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f0800", 0x0, 0xe8a2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendto$inet6(r0, &(0x7f0000000280)='2', 0x1, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='htcp\x00', 0x5) shutdown(r0, 0x1) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f00000000001b0000850000006d000000850000002300000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000040)='timer_start\x00', r3, 0x0, 0x80000000000}, 0x18) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000000)) r4 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) shutdown(r4, 0x1) connect$bt_rfcomm(r4, &(0x7f0000005dc0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x15}, 0xa) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, 0x33, 0x1, 0x70bd2b, 0x25dbdbfe, {0x4}, [@typed={0x8, 0x4, 0x0, 0x0, @u32=0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x50}, 0x4000000) close(r4) 205.639511ms ago: executing program 1 (id=5388): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) preadv(r1, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/54, 0x36}, {&(0x7f0000000080)=""/10, 0xa}], 0x2, 0x7, 0x7ff) r2 = socket$igmp(0x2, 0x3, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x5}, {0x0, [0x0, 0x5f, 0x30]}}, 0x0, 0x1d}, 0x28) setsockopt$MRT_ADD_VIF(r2, 0x0, 0xca, &(0x7f0000000200)={0x0, 0x4, 0x0, 0x0, @vifc_lcl_ifindex, @dev}, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007d00000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) pselect6(0x40, &(0x7f0000000180), 0x0, 0xfffffffffffffffc, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r3, 0x0, 0x0, 0xfffffffffffffce5, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000100)={0xffffffffffffffff, &(0x7f0000000340)="0b049b3e35bb24dec185c43f4a1a079728813d837925453650c5afbe7711a6a07ade6e019bf3faa089fc4573accdca8f8993045b59452b3798e3e605136f36139522e2261abd4b1d68ccaa1f4ecc098be329af2d2c778358ff8f6fc51702e4b8d93bd72d79678f79544a7279844e711006d30e805356cb812389d9f7392a696ef0e92cde4682152b7690f9b2bd9abcb3fc28ab7057eae1158164cbb808f6c09c4329ded67499d25722d738b95b7ebc1f12a39df1e884bbc6cc59473b1b0238dc018368fe5564cf2d15c8c679e735e4237226dd068b14248c0c13"}, 0x20) syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r1) getsockname$packet(r1, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x40) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="3c0000001000010500000000fbdbdf2500000000", @ANYRES32=r4, @ANYBLOB="01600000000200001c00128009000100697069700000fe7400000c0002800800", @ANYRES32=r4, @ANYBLOB], 0x3c}}, 0x84000) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000300)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, 0x12251, 0x1a001}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @remote}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x20009080) socket$kcm(0x29, 0x5, 0x0) 198.944644ms ago: executing program 4 (id=5389): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r3, @ANYBLOB="01980000000000002000128008000100677265001400028008000100", @ANYRES32=r3], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="2c0000001d00070f000000000000000007000000", @ANYRES32=r6, @ANYBLOB="00005200060005000100000008000800", @ANYRES16=r6], 0x2c}}, 0x4000000) r7 = socket(0x10, 0x3, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8}, @NFTA_PAYLOAD_DREG={0x8}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0x61}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x8c}}, 0x4) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000008c0)=@newtfilter={0x30, 0x28, 0xd27, 0x1003ffd, 0x0, {0x0, 0x0, 0x0, r9, {0xd, 0x9}, {0x4}, {0x2, 0xb}}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x810}, 0x200008c0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r10, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000240)=@newqdisc={0xb4, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r1, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x84, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x1}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1], 0x0, [0x8, 0x6, 0x3c, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x401]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x1}, @TCA_TAPRIO_ATTR_TXTIME_DELAY={0x8, 0xb, 0x1}]}}]}, 0xb4}}, 0x0) 137.264064ms ago: executing program 3 (id=5390): getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000100)={{{@in=@remote, @in=@local}}, {{@in6=@private2}, 0x0, @in6=@local}}, &(0x7f0000000240)=0xe8) (async) r0 = accept4$llc(0xffffffffffffffff, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000080)=0x10, 0xc0000) ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x80049367, &(0x7f00000000c0)) (async) r1 = accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000002c0)=0x14, 0x81000) ioctl$BTRFS_IOC_DEFRAG(r1, 0x50009402, 0x0) (async) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000000)=@newnexthop={0x24, 0x68, 0x6, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x2, 0x0, 0x1}, [@NHA_ENCAP={0xc, 0x8, 0x0, 0x1, @LWTUNNEL_IP_SRC={0x8, 0x3, @local}}]}, 0x24}}, 0x0) 558.632µs ago: executing program 1 (id=5391): r0 = socket$kcm(0x2, 0xa, 0x2) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000000)={'veth1_macvtap\x00', &(0x7f0000000080)=@ethtool_sfeatures={0x3b, 0x2, [{0xfffffffc}, {0x24caf689, 0x80003}]}}) (async) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r1, &(0x7f0000000b40)=[{{&(0x7f00000000c0)={0xa, 0x20, 0x0, @mcast2}, 0x1c, &(0x7f0000000000)=[{&(0x7f0000000240)="ad", 0x1}], 0x1}}, {{&(0x7f0000000100)={0xa, 0x4e24, 0x1, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x1}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000700)="0ba13ffee16cdf91834ff76c1e84826c9eb272f476813624326fd3a20231e3108a3b55d781c448720edb747d7f142dd4a6a8eff0d82503117ab6498fb95fe66f07bd38f16b2629fd5d7e8d981473310ba1856b5596755084863d8579c3a43ebd21dbc6e3bc4e58f5f87070a9fdbc7782cfd3c356935ce9657aec1a9e77886e36270a3e90e4a61c646f585bd4477e781777e348198aa363ccad55a974c846ead52698de1881fec80edb40f79da04a104562570444d470d693de54af4b9c7fcdd618e6a3f21d830cf1448b679aeb1dc083632831e71bf9dbff4bcb92ee2ec8f1c7838dcd76cf81f0c97265e48f4175e500fbaddabd32f000"/260, 0x104}], 0x1, &(0x7f0000000280)=ANY=[@ANYRESDEC=r1, @ANYRESHEX, @ANYRESDEC=r1, @ANYRES8], 0x58}}], 0x2, 0x0) (async, rerun: 32) r2 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000840)={'wlan1\x00', 0x0}) (async, rerun: 64) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) (async, rerun: 64) socket$kcm(0x10, 0x400000002, 0x0) r6 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r6, 0x8915, &(0x7f0000002400)={'veth0_virt_wifi\x00'}) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000a80)={0x0, 0x0, &(0x7f0000000a40)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010028bd7000fedbdf254400000008000300", @ANYRES32=r4, @ANYBLOB="0c00238095bb2bc18c951867"], 0x28}, 0x1, 0x0, 0x0, 0x18000}, 0x0) (async) r7 = socket$netlink(0x10, 0x3, 0x4) (async) r8 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000040)={0x7fffffff}, 0x10) sendmsg$kcm(r8, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000001c0)="2e0000004a008102e00f80ecdb4cb9020a", 0x11}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0) writev(r7, &(0x7f0000000080)=[{&(0x7f0000000e40)="480000001400190d09004beafd0d36020a8447000b4e230f00000000a2bc560119d7004f19dfb7f393d7359031033f817f00000000000000000101ff05c00e030002000000ffff01", 0x48}], 0x1) r9 = socket$nl_route(0x10, 0x3, 0x0) (async) r10 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a05000000000000000000070000010900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000218c0000000c0a01030000000000000000070000000900020073797a31000000000900010073797a3000000000600003805c000080080003400000000250000b80200001800a00010071756f7461000000100002800c00014000000000000000002c0001800a0001006c696d69740000001c0002800c00024000000000000000000c0001400000000000000003140000001000010000000000000000000084000a55a102bf5232edd2dc01d517371e40d5dce0a6965c9400ac2270396a375043f2076d69841645777815c56ce047d19a9b50fda97d6afd1ce32a2483a6d6a7b5f87cdb67c36c992dd5e82f99fee2195a8a8179a1825dabf2effddc9eda4ced43ca89bc256326e9029751ec76ac38c1f3"], 0x110}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a3200000000140000001100"], 0x7c}}, 0x0) r12 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r12, 0x84, 0x22, &(0x7f0000000000)={0xfff, 0x8, 0x1, 0x7ff}, &(0x7f0000000240)=0x10) (async) r13 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r13, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="340000003e0007010000000000000000017c00000400fc800c000180060006006558000008000280040011"], 0x34}, 0x1, 0x0, 0x0, 0xc000}, 0xc010) (async) sendmsg$nl_route_sched(r9, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r11, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x4}}]}, 0x30}}, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), r7) setsockopt$inet6_IPV6_XFRM_POLICY(r12, 0x29, 0x23, &(0x7f0000000480)={{{@in=@broadcast, @in6=@empty, 0x4e20, 0x5, 0x4e20, 0x9, 0x2, 0xa0, 0x0, 0x11, r11, 0xee00}, {0x7ff, 0x2, 0x9, 0x4, 0x7fffffff, 0x1, 0x65d1, 0x8}, {0x34, 0x2, 0xc, 0x2}, 0x6, 0x0, 0x1, 0x1, 0x1, 0x3}, {{@in=@dev={0xac, 0x14, 0x14, 0x39}, 0x4d4, 0x32}, 0xf304f1371cedc737, @in6=@rand_addr=' \x01\x00', 0x3505, 0x3, 0x3, 0x1, 0x8, 0x9, 0x3}}, 0xe8) 0s ago: executing program 3 (id=5392): r0 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfc, 0x10000}, 0xc) socket$can_bcm(0x1d, 0x2, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_POOL_SET(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x54, r2, 0x100, 0x70bd2d, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8}, {0x6, 0x11, 0x7fff}, {0x8, 0x13, 0x3ff}, {0x5}}]}, 0x54}, 0x1, 0x0, 0x0, 0x40800}, 0x804) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000740)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in6=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x33}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x1}, 0x0, 0x0, 0xa}}}, 0xf8}}, 0x0) sendmsg$nl_xfrm(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000580)=ANY=[@ANYBLOB="f8000000160001000000000000000000fe880000000000000000000000000001ff01000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe880000000000000000000000000001000000003300000000000000000000000000ffffacfcff2900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000008e229c44781f24b77c63e74ec4066ebe97c7b732cf97e9cc6ae24a0a701d7f3c7b070507991b5b6abd9e155de75ebe7b547c1d7eeac3e4c43c1618bae92ccc5e15fde375f40a999c4c5a1a9df520128ca6ec98c0ff96c790b2494a3e74bd77a72b9ef4ee60b259aa54ecf5464139897f150d6a45567b9ef3b722a078e8b2551e122d7c03824a15b5e254142a9bd7f623c2ea818c535f2fa0a8f5113bb8"], 0xf8}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000001e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000a80)='kfree\x00', r6}, 0x10) ioctl$HCIINQUIRY(r5, 0x800448f0, &(0x7f0000000000)={0x1, 0x2, "008000", 0xb, 0x8b}) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0xfffe}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HASH_DREG={0x8, 0x2, 0x1, 0x0, 0xa}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x7c}}, 0x0) ppoll(0x0, 0x0, &(0x7f0000000180), &(0x7f00000001c0)={[0xffffffffffffffff]}, 0x8) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000000)=0x800, 0x4) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=@newlink={0x54, 0x10, 0x503, 0x70bd29, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6230}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x18, 0x2, 0x0, 0x1, @val={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x21400}}}}}}, @IFLA_ADDRESS={0xa, 0x3, @random="3a712f0756b8"}]}, 0x54}}, 0x0) kernel console output (not intermixed with test programs): ac80211_hwsim hwsim35 wlan0: entered allmulticast mode [ 373.829613][T17712] netdevsim netdevsim1 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 373.870227][T17712] netdevsim netdevsim1 eth1 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 373.907364][T17712] netdevsim netdevsim1 eth1 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 373.917520][ T5876] Bluetooth: hci4: command tx timeout [ 374.039088][T17712] netdevsim netdevsim1 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 374.065484][T17712] netdevsim netdevsim1 eth0 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 374.087777][T17712] netdevsim netdevsim1 eth0 (unregistering): unset [1, 1] type 2 family 0 port 6081 - 0 [ 374.282641][T17938] openvswitch: netlink: IP tunnel attribute has 20 unknown bytes. [ 374.333645][T17939] dvmrp0: entered allmulticast mode [ 374.543572][T10828] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 374.604936][T17951] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 374.620235][T10828] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 374.663540][ T1106] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 374.702655][T17956] __nla_validate_parse: 3 callbacks suppressed [ 374.702676][T17956] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3370'. [ 374.727957][T17712] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 374.769846][ T1106] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 374.805927][T17712] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 374.855151][T17959] tipc: Started in network mode [ 374.869956][T17959] tipc: Node identity 6ebd31c5a5d9, cluster identity 4711 [ 374.884858][T17959] tipc: Enabled bearer , priority 0 [ 374.905392][T17712] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 374.935249][T17959] syzkaller0: entered promiscuous mode [ 374.941863][T17959] syzkaller0: entered allmulticast mode [ 374.970670][T17712] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 375.096410][T17959] tipc: Resetting bearer [ 375.119286][T17958] tipc: Resetting bearer [ 375.197405][T17958] tipc: Disabling bearer [ 375.418591][T17992] netlink: 144 bytes leftover after parsing attributes in process `syz.0.3378'. [ 375.531066][T17712] 8021q: adding VLAN 0 to HW filter on device bond0 [ 375.620911][T17712] 8021q: adding VLAN 0 to HW filter on device team0 [ 375.663475][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 375.670730][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 375.796271][ T1106] bridge0: port 2(bridge_slave_1) entered blocking state [ 375.803559][ T1106] bridge0: port 2(bridge_slave_1) entered forwarding state [ 375.925717][T18015] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.3384'. [ 375.987740][ T5876] Bluetooth: hci4: command tx timeout [ 376.463050][T18047] netlink: 'syz.2.3393': attribute type 17 has an invalid length. [ 376.473190][T18047] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3393'. [ 376.484518][T18047] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3393'. [ 376.722179][T18057] xt_limit: Overflow, try lower: 604147548/4200216962 [ 376.759648][T18060] netlink: 'syz.2.3398': attribute type 21 has an invalid length. [ 376.792361][T18057] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3397'. [ 376.811426][T17712] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 376.825111][T18060] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3398'. [ 376.832083][T18065] netlink: 'syz.2.3398': attribute type 21 has an invalid length. [ 376.922223][T18065] netlink: 152 bytes leftover after parsing attributes in process `syz.2.3398'. [ 377.028147][T17712] veth0_vlan: entered promiscuous mode [ 377.078559][T17712] veth1_vlan: entered promiscuous mode [ 377.232420][T18084] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 377.261885][T17712] veth0_macvtap: entered promiscuous mode [ 377.345154][T17712] veth1_macvtap: entered promiscuous mode [ 377.406267][T17712] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 377.447629][T17712] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 377.511997][ T1106] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.530910][ T1342] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.560732][ T1342] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.580393][ T1342] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.711889][T18109] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3411'. [ 377.887721][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 377.912366][T18118] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3413'. [ 377.922260][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 378.002977][T18120] netlink: 'syz.3.3415': attribute type 11 has an invalid length. [ 378.080276][ T1106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 378.115518][ T1106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 378.284181][T18131] vcan0: tx drop: invalid sa for name 0xffffffffffffffff [ 378.495989][T18142] IPVS: length: 75 != 8 [ 378.729181][T18157] tipc: Started in network mode [ 378.736852][T18157] tipc: Node identity ee9fa9584dd8, cluster identity 4711 [ 378.754920][T18157] tipc: Enabled bearer , priority 0 [ 378.771277][T18156] vlan2: entered allmulticast mode [ 378.812197][T18160] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 378.827890][T18156] bridge0: entered allmulticast mode [ 378.840917][T18156] bridge1: port 1(vlan2) entered blocking state [ 378.848104][T18156] bridge1: port 1(vlan2) entered disabled state [ 378.858669][T18156] vlan2: entered promiscuous mode [ 378.868448][T18156] bridge0: entered promiscuous mode [ 378.880203][T18157] syzkaller0: entered promiscuous mode [ 378.914378][T18157] syzkaller0: entered allmulticast mode [ 379.077438][T18172] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 379.398440][T18179] netlink: 'syz.1.3435': attribute type 83 has an invalid length. [ 379.407884][T18146] tipc: Resetting bearer [ 379.465932][T18146] tipc: Disabling bearer [ 379.790497][T18192] netlink: 'syz.1.3441': attribute type 1 has an invalid length. [ 379.802569][T18192] __nla_validate_parse: 8 callbacks suppressed [ 379.802591][T18192] netlink: 168864 bytes leftover after parsing attributes in process `syz.1.3441'. [ 380.029513][T18205] sch_tbf: burst 8 is lower than device ip6tnl0 mtu (1452) ! [ 380.064005][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 380.198356][T18213] netlink: 516 bytes leftover after parsing attributes in process `syz.4.3449'. [ 380.208448][T18216] IPVS: sync thread started: state = BACKUP, mcast_ifn = geneve1, syncid = 4, id = 0 [ 380.238218][T18213] netlink: 'syz.4.3449': attribute type 1 has an invalid length. [ 380.257937][T18213] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3449'. [ 380.288143][T18213] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3449'. [ 380.370487][T18221] netlink: 'syz.0.3451': attribute type 4 has an invalid length. [ 380.420299][T18221] netlink: 9 bytes leftover after parsing attributes in process `syz.0.3451'. [ 380.450226][T18226] netlink: 9 bytes leftover after parsing attributes in process `syz.0.3451'. [ 380.454816][T18225] syzkaller1: entered promiscuous mode [ 380.466173][T18225] syzkaller1: entered allmulticast mode [ 380.483650][T18226] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3451'. [ 380.692777][T18234] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3456'. [ 380.693457][T18235] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3454'. [ 380.752482][T18234] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3456'. [ 381.378589][T18266] netlink: 'syz.1.3463': attribute type 1 has an invalid length. [ 381.642056][T18270] vlan2: entered allmulticast mode [ 381.648681][T18270] veth1: entered allmulticast mode [ 381.868460][T18278] bond2: entered promiscuous mode [ 381.873568][T18278] bond2: entered allmulticast mode [ 381.889276][T18278] 8021q: adding VLAN 0 to HW filter on device bond2 [ 381.958236][T18285] bond3: entered promiscuous mode [ 381.965936][T18285] bond3: entered allmulticast mode [ 381.971610][T18285] 8021q: adding VLAN 0 to HW filter on device bond3 [ 382.269562][ T7935] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 382.890728][T18339] netlink: 'syz.2.3484': attribute type 13 has an invalid length. [ 382.932306][T18339] veth0_macvtap: left promiscuous mode [ 382.951449][T18339] macvtap0: entered allmulticast mode [ 382.972343][T18339] macvtap0: refused to change device tx_queue_len [ 383.018547][T18299] netlink: 'syz.0.3471': attribute type 11 has an invalid length. [ 383.100910][T18344] netlink: 'syz.2.3486': attribute type 10 has an invalid length. [ 383.209570][T18344] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 383.286786][T18351] syzkaller1: entered promiscuous mode [ 383.294768][T18351] syzkaller1: entered allmulticast mode [ 383.385748][T18360] netlink: 'syz.1.3491': attribute type 1 has an invalid length. [ 383.496547][ C1] vcan0: j1939_tp_rxtimer: 0xffff888044123000: rx timeout, send abort [ 383.507905][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888044123000: 0x3fe02: (3) A timeout occurred and this is the connection abort to close the session. [ 383.753482][T18376] netlink: 'syz.2.3497': attribute type 1 has an invalid length. [ 384.189228][T18401] sctp: [Deprecated]: syz.3.3503 (pid 18401) Use of struct sctp_assoc_value in delayed_ack socket option. [ 384.189228][T18401] Use struct sctp_sack_info instead [ 384.398356][T18418] netlink: 'syz.3.3507': attribute type 1 has an invalid length. [ 384.403618][T18414] netlink: 'syz.2.3506': attribute type 1 has an invalid length. [ 384.596835][T18424] netlink: 'syz.0.3509': attribute type 83 has an invalid length. [ 384.627195][T18430] netlink: 'syz.0.3509': attribute type 83 has an invalid length. [ 384.885395][T18443] netlink: 'syz.0.3515': attribute type 1 has an invalid length. [ 384.948363][T18451] __nla_validate_parse: 10 callbacks suppressed [ 384.948383][T18451] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3517'. [ 384.973322][T18450] netlink: 'syz.4.3516': attribute type 1 has an invalid length. [ 384.995560][T18450] netlink: 172 bytes leftover after parsing attributes in process `syz.4.3516'. [ 385.010102][T18444] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 385.032593][T18453] bond2: (slave gretap1): making interface the new active one [ 385.060362][T18453] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 385.096003][T18464] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3516'. [ 385.334466][T18475] netlink: 18 bytes leftover after parsing attributes in process `syz.0.3522'. [ 385.366944][T18464] dummy0: entered promiscuous mode [ 385.375417][T18464] batadv_slave_1: entered promiscuous mode [ 385.553061][T18484] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3525'. [ 385.594696][T18484] team0: No ports can be present during mode change [ 385.698053][T18499] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3530'. [ 385.741214][T18494] bond3: entered promiscuous mode [ 385.747026][T18494] bond3: entered allmulticast mode [ 385.752689][T18494] 8021q: adding VLAN 0 to HW filter on device bond3 [ 385.859123][T18506] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3533'. [ 386.118493][T18525] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3538'. [ 386.276156][T18532] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3541'. [ 386.291843][T18531] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3541'. [ 386.452321][T18543] bond4: (slave bridge2): making interface the new active one [ 386.461499][T18543] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 386.649044][T18554] bond4: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 386.760162][T18546] veth7: entered promiscuous mode [ 386.775602][T18546] bond4: (slave veth7): Enslaving as a backup interface with a down link [ 386.791824][T18560] tipc: Enabling of bearer rejected, failed to enable media [ 387.147573][T18588] gretap0: entered promiscuous mode [ 387.189363][T18588] 0{X: renamed from gretap0 [ 387.218950][T18588] 0{X: left promiscuous mode [ 387.238833][T18588] 0{X: entered allmulticast mode [ 387.260753][T18588] A link change request failed with some changes committed already. Interface 30{X may have been left with an inconsistent configuration, please check. [ 387.598119][T18605] siw: device registration error -23 [ 387.611070][T18605] siw: device registration error -23 [ 387.629426][T18605] siw: device registration error -23 [ 387.649640][T18605] siw: device registration error -23 [ 387.670581][T18605] siw: device registration error -23 [ 387.676962][T18605] siw: device registration error -23 [ 387.683104][T18605] siw: device registration error -23 [ 387.703420][T18605] siw: device registration error -23 [ 387.713331][T18605] siw: device registration error -23 [ 387.726378][T18605] siw: device registration error -23 [ 387.747680][T18605] siw: device registration error -23 [ 387.755866][T18605] siw: device registration error -23 [ 387.761941][T18610] (unnamed net_device) (uninitialized): Invalid ad_actor_system MAC address. [ 387.771823][T18610] (unnamed net_device) (uninitialized): option ad_actor_system: invalid value (1) [ 387.796271][T18605] siw: device registration error -23 [ 387.802142][T18605] siw: device registration error -23 [ 387.838929][T18605] siw: device registration error -23 [ 387.854649][T18605] siw: device registration error -23 [ 387.860895][T18605] siw: device registration error -23 [ 387.867123][T18605] siw: device registration error -23 [ 387.873159][T18605] siw: device registration error -23 [ 387.879749][T18605] siw: device registration error -23 [ 387.896070][T18605] siw: device registration error -23 [ 387.939457][T18605] siw: device registration error -23 [ 387.976602][T18605] siw: device registration error -23 [ 387.982368][T18605] siw: device registration error -23 [ 388.005019][T18605] siw: device registration error -23 [ 388.030841][T18605] siw: device registration error -23 [ 388.051369][T18605] siw: device registration error -23 [ 388.094224][T18605] siw: device registration error -23 [ 388.116131][T18605] siw: device registration error -23 [ 388.140520][T18605] siw: device registration error -23 [ 388.161327][T18605] siw: device registration error -23 [ 388.168634][T18605] siw: device registration error -23 [ 388.177869][T18605] siw: device registration error -23 [ 388.353141][T18634] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 388.360509][T18634] IPv6: NLM_F_CREATE should be set when creating new route [ 389.687144][T18658] bridge0: port 2(bridge_slave_1) entered disabled state [ 389.695019][T18658] bridge0: port 1(bridge_slave_0) entered disabled state [ 390.002248][T18681] macvtap1: entered promiscuous mode [ 390.011726][T18681] vlan0: entered promiscuous mode [ 390.019010][T18681] macvtap1: entered allmulticast mode [ 390.025601][T18681] vlan0: entered allmulticast mode [ 390.031028][T18681] veth0_vlan: entered allmulticast mode [ 391.264364][T18734] __nla_validate_parse: 22 callbacks suppressed [ 391.264387][T18734] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3599'. [ 391.569528][T18744] lo speed is unknown, defaulting to 1000 [ 392.288340][T18775] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 392.303318][T18775] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 392.344943][T18775] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 392.355388][T18775] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 392.397284][T18744] lo speed is unknown, defaulting to 1000 [ 392.527820][T18785] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3612'. [ 392.786490][T18796] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3614'. [ 392.800713][T18796] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3614'. [ 392.810656][T18796] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3614'. [ 393.023633][T18808] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 393.125832][T18817] validate_nla: 3 callbacks suppressed [ 393.125853][T18817] netlink: 'syz.4.3620': attribute type 10 has an invalid length. [ 393.230614][T18809] can: request_module (can-proto-0) failed. [ 393.232949][T18817] team0: Device dummy0 failed to register rx_handler [ 393.749326][T18843] netlink: 'syz.1.3626': attribute type 23 has an invalid length. [ 394.066458][T18856] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 394.206954][T18862] IPv6: sit1: Disabled Multicast RS [ 394.234156][T18864] netlink: 'syz.4.3633': attribute type 28 has an invalid length. [ 394.242931][T18862] sit1: entered allmulticast mode [ 394.249668][T18868] netlink: 'syz.1.3634': attribute type 25 has an invalid length. [ 394.262487][T18864] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3633'. [ 394.286648][T18870] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3632'. [ 394.412950][T18861] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3632'. [ 394.460232][T18867] ip6erspan0: entered promiscuous mode [ 394.682404][T18884] netlink: 45 bytes leftover after parsing attributes in process `syz.1.3638'. [ 394.767176][T18889] bridge: RTM_NEWNEIGH with unconfigured vlan 3 on bridge_slave_0 [ 394.828280][T18878] syzkaller1: entered promiscuous mode [ 394.849340][T18878] syzkaller1: entered allmulticast mode [ 394.902729][T18896] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3642'. [ 395.487167][T18922] vxlan1: entered promiscuous mode [ 395.500557][T18922] vxlan1: entered allmulticast mode [ 395.715768][T18931] tipc: Enabled bearer , priority 10 [ 395.748081][T18933] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 395.822315][T18933] 8021q: VLANs not supported on wg1 [ 395.845016][T18933] netlink: 'syz.3.3655': attribute type 21 has an invalid length. [ 396.021397][T18940] netlink: zone id is out of range [ 396.040797][T18940] netlink: del zone limit has 4 unknown bytes [ 396.207334][T18944] syzkaller0: entered promiscuous mode [ 396.230176][T18944] syzkaller0: entered allmulticast mode [ 396.330748][T18947] __nla_validate_parse: 12 callbacks suppressed [ 396.330773][T18947] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3658'. [ 396.372420][T18940] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3657'. [ 396.408204][T18958] netlink: 65039 bytes leftover after parsing attributes in process `syz.4.3660'. [ 396.547289][T18960] netlink: 'syz.1.3661': attribute type 15 has an invalid length. [ 396.625922][T18963] netlink: 'syz.4.3662': attribute type 1 has an invalid length. [ 396.634741][T18963] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3662'. [ 396.836322][ T5923] tipc: Node number set to 1522031246 [ 397.023084][T18968] netlink: 'syz.3.3664': attribute type 13 has an invalid length. [ 397.344216][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 398.370280][T18968] lo: entered promiscuous mode [ 398.383482][T18968] lo: entered allmulticast mode [ 398.434427][T18968] tunl0: entered promiscuous mode [ 398.454850][T18968] tunl0: entered allmulticast mode [ 398.486976][T18968] gre0: entered promiscuous mode [ 398.520812][T18968] gre0: entered allmulticast mode [ 398.597652][T18968] gretap0: entered promiscuous mode [ 398.603014][T18968] gretap0: entered allmulticast mode [ 398.666239][T18968] gretap0: refused to change device tx_queue_len [ 398.683403][T18985] netlink: 'syz.0.3669': attribute type 11 has an invalid length. [ 398.705960][T18968] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 398.712821][T18985] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3669'. [ 399.259971][T19021] nbd: socks must be embedded in a SOCK_ITEM attr [ 399.361656][T19027] sctp: [Deprecated]: syz.1.3681 (pid 19027) Use of struct sctp_assoc_value in delayed_ack socket option. [ 399.361656][T19027] Use struct sctp_sack_info instead [ 399.517440][T19032] sctp: [Deprecated]: syz.4.3682 (pid 19032) Use of struct sctp_assoc_value in delayed_ack socket option. [ 399.517440][T19032] Use struct sctp_sack_info instead [ 399.758064][T19054] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3688'. [ 400.073033][T19069] sctp: [Deprecated]: syz.2.3690 (pid 19069) Use of struct sctp_assoc_value in delayed_ack socket option. [ 400.073033][T19069] Use struct sctp_sack_info instead [ 400.362232][T19077] syzkaller1: entered promiscuous mode [ 400.379182][T19077] syzkaller1: entered allmulticast mode [ 400.506279][T19077] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3692'. [ 400.554605][T19091] IPv6: sit2: Disabled Multicast RS [ 400.563503][T19091] sit2: entered allmulticast mode [ 400.648600][T19093] IPv6: sit2: Disabled Multicast RS [ 400.658934][T19093] sit2: entered allmulticast mode [ 400.691863][T19098] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.3697'. [ 400.931262][T19103] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3698'. [ 401.209586][T19119] netlink: 'syz.2.3703': attribute type 12 has an invalid length. [ 402.104742][T19173] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3720'. [ 402.301036][T19184] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3724'. [ 402.546392][T19188] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 402.568506][T19198] netlink: 'syz.4.3727': attribute type 1 has an invalid length. [ 402.935452][T19214] lo speed is unknown, defaulting to 1000 [ 402.987271][T19215] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3732'. [ 403.194600][T19223] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3733'. [ 403.495989][T19230] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3737'. [ 403.506216][ T5876] Bluetooth: hci4: command tx timeout [ 403.625374][T19239] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3737'. [ 403.827649][T19250] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3742'. [ 403.851084][T19240] rose0: entered promiscuous mode [ 404.046788][T19214] lo speed is unknown, defaulting to 1000 [ 404.584893][T19276] team0: Device vti0 is of different type [ 404.808054][T19291] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3753'. [ 405.128940][T19304] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3756'. [ 405.233414][T19310] netlink: 'syz.1.3756': attribute type 2 has an invalid length. [ 405.529060][T19325] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3762'. [ 405.537078][T19323] 8021q: VLANs not supported on vcan0 [ 405.564584][T19325] bridge_slave_1: left allmulticast mode [ 405.579002][T19325] bridge_slave_1: left promiscuous mode [ 405.605828][T19325] bridge0: port 2(bridge_slave_1) entered disabled state [ 405.660447][T19325] bridge_slave_0: left allmulticast mode [ 405.681179][T19325] bridge_slave_0: left promiscuous mode [ 405.689448][T19325] bridge0: port 1(bridge_slave_0) entered disabled state [ 405.741107][T19335] netlink: 'syz.2.3764': attribute type 1 has an invalid length. [ 405.757992][T19331] netlink: 'syz.2.3764': attribute type 1 has an invalid length. [ 407.186481][T19409] netlink: 'syz.4.3787': attribute type 16 has an invalid length. [ 407.215020][T19409] netlink: 'syz.4.3787': attribute type 17 has an invalid length. [ 407.321350][T19400] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 407.418559][T19401] bridge0: port 1(bridge_slave_0) entered disabled state [ 407.429397][T19401] bridge0: port 2(bridge_slave_1) entered disabled state [ 407.686705][T19409] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 407.840849][T19413] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 408.052258][T19413] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 408.205376][T19454] __nla_validate_parse: 7 callbacks suppressed [ 408.205397][T19454] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3800'. [ 408.305900][T19413] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 408.462463][T19413] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 408.730551][T10813] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.856740][T10824] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.878399][T10824] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.894842][T19480] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3809'. [ 408.930039][T10817] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 408.949759][T19480] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3809'. [ 408.977040][T19480] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3809'. [ 408.992232][T19480] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3809'. [ 409.360441][T19507] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 409.430947][T19507] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 409.493020][T19507] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 430.211368][T19519] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3820'. [ 430.221218][T19515] netlink: 'syz.3.3822': attribute type 1 has an invalid length. [ 430.256339][T19515] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3822'. [ 430.636119][T19530] vcan0: entered allmulticast mode [ 430.796530][T19537] openvswitch: netlink: Key 4 has unexpected len 8 expected 12 [ 430.971422][T19547] tipc: Enabled bearer , priority 0 [ 431.003900][T19550] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3832'. [ 431.004938][T19547] mac80211_hwsim hwsim31 syzkaller0: entered promiscuous mode [ 431.023426][T19550] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3832'. [ 431.069965][T19547] mac80211_hwsim hwsim31 syzkaller0: entered allmulticast mode [ 431.090308][T19547] tipc: Resetting bearer [ 431.117056][T19550] gretap1: entered promiscuous mode [ 431.122653][T19550] gretap1: entered allmulticast mode [ 431.135595][T19547] tipc: Resetting bearer [ 431.264234][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 431.392312][T19565] netlink: 212408 bytes leftover after parsing attributes in process `syz.1.3836'. [ 431.518821][T19573] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 431.542772][T19574] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3840'. [ 431.590191][T19572] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 431.641145][T19580] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3842'. [ 431.837624][T10812] tipc: Resetting bearer [ 431.898130][T19588] netlink: 'syz.1.3846': attribute type 11 has an invalid length. [ 432.003934][ T5923] tipc: Node number set to 2739382616 [ 432.212834][T19606] netlink: 'syz.2.3850': attribute type 4 has an invalid length. [ 432.236528][T19610] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3852'. [ 432.282692][T19608] netlink: 'syz.2.3850': attribute type 4 has an invalid length. [ 432.351252][T19617] netlink: 'syz.0.3855': attribute type 9 has an invalid length. [ 432.364159][T19619] netlink: 'syz.0.3855': attribute type 9 has an invalid length. [ 432.393085][T19619] netlink: 212260 bytes leftover after parsing attributes in process `syz.0.3855'. [ 432.434468][T19617] netlink: 212260 bytes leftover after parsing attributes in process `syz.0.3855'. [ 432.479723][T19617] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 432.521785][T19623] netlink: 'syz.4.3857': attribute type 1 has an invalid length. [ 432.561180][T19630] netlink: 'syz.3.3859': attribute type 5 has an invalid length. [ 432.576964][T19620] netlink: 'syz.0.3855': attribute type 7 has an invalid length. [ 432.593657][T19619] netlink: 'syz.0.3855': attribute type 7 has an invalid length. [ 432.732673][T19642] tipc: Enabling of bearer rejected, failed to enable media [ 433.278181][T19667] bridge_slave_0: left allmulticast mode [ 433.297211][T19667] bridge_slave_0: left promiscuous mode [ 433.309789][T19667] bridge0: port 1(bridge_slave_0) entered disabled state [ 433.369810][T19667] bridge_slave_1: left allmulticast mode [ 433.398971][T19667] bridge_slave_1: left promiscuous mode [ 433.419795][T19667] bridge0: port 2(bridge_slave_1) entered disabled state [ 433.477284][T19667] bond0: (slave bond_slave_0): Releasing backup interface [ 433.500373][T19667] bond0: (slave bond_slave_1): Releasing backup interface [ 433.545472][T19667] team0: Port device team_slave_0 removed [ 433.562441][T19667] team0: Port device team_slave_1 removed [ 433.569838][T19667] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 433.579095][T19667] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 433.590140][T19667] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 433.597898][T19667] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 433.622306][T19667] vlan2: left promiscuous mode [ 433.627646][T19667] bridge0: left promiscuous mode [ 433.633201][T19667] bridge1: port 1(vlan2) entered disabled state [ 433.653470][T19667] bond2: (slave gretap1): Releasing backup interface [ 433.687736][T19669] dvmrp0: entered allmulticast mode [ 433.753652][T19681] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-tlb(5) [ 434.120718][T19708] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 434.147516][T19708] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 434.403957][T19719] delete_channel: no stack [ 434.951813][T19742] team_slave_0: entered promiscuous mode [ 434.957659][T19742] team_slave_1: entered promiscuous mode [ 434.989714][T19742] macsec1: entered promiscuous mode [ 435.014524][T19742] team0: entered promiscuous mode [ 435.026674][T19742] macsec1: entered allmulticast mode [ 435.064081][T19742] team0: entered allmulticast mode [ 435.071520][T19742] team_slave_0: entered allmulticast mode [ 435.092067][T19742] team_slave_1: entered allmulticast mode [ 435.122160][T19742] team0: Device macsec1 is already an upper device of the team interface [ 435.161677][T19742] team0: left allmulticast mode [ 435.178149][T19742] team_slave_0: left allmulticast mode [ 435.210463][T19742] team_slave_1: left allmulticast mode [ 435.228832][T19742] team0: left promiscuous mode [ 435.264484][T19742] team_slave_0: left promiscuous mode [ 435.270374][T19742] team_slave_1: left promiscuous mode [ 435.288805][T19754] validate_nla: 1 callbacks suppressed [ 435.288826][T19754] netlink: 'syz.3.3894': attribute type 28 has an invalid length. [ 435.303097][T19754] netlink: 'syz.3.3894': attribute type 3 has an invalid length. [ 435.326249][T19754] __nla_validate_parse: 19 callbacks suppressed [ 435.326270][T19754] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3894'. [ 435.449499][T19761] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3895'. [ 435.665666][T19766] sctp: [Deprecated]: syz.4.3896 (pid 19766) Use of int in max_burst socket option. [ 435.665666][T19766] Use struct sctp_assoc_value instead [ 436.007595][T19777] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3901'. [ 436.043341][T19777] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3901'. [ 436.081648][T19777] erspan0: entered promiscuous mode [ 436.117450][T19777] gretap0: entered promiscuous mode [ 436.143280][T19777] gretap0: left promiscuous mode [ 436.205136][T19777] erspan0: left promiscuous mode [ 436.312241][T19797] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3906'. [ 436.504164][T19809] netlink: 'syz.2.3908': attribute type 5 has an invalid length. [ 436.626329][T19813] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3910'. [ 436.792701][T19821] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20004 [ 436.807416][T19821] netlink: 'syz.0.3911': attribute type 1 has an invalid length. [ 436.862550][T19826] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3913'. [ 436.874683][T19826] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3913'. [ 436.963160][T19828] tipc: Enabling of bearer rejected, failed to enable media [ 437.027915][T19830] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3914'. [ 437.228928][T19838] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 437.254168][T19838] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3917'. [ 437.616267][T19864] netlink: 'syz.3.3925': attribute type 13 has an invalid length. [ 437.668480][T19864] veth0_macvtap: left promiscuous mode [ 437.694291][T19864] macvtap0: entered allmulticast mode [ 437.756113][T19864] macvtap0: refused to change device tx_queue_len [ 438.326691][T19900] netlink: 'syz.1.3936': attribute type 2 has an invalid length. [ 438.610186][T19911] sctp: [Deprecated]: syz.2.3939 (pid 19911) Use of int in max_burst socket option. [ 438.610186][T19911] Use struct sctp_assoc_value instead [ 439.170332][T19951] team0: Device wireguard0 is of different type [ 439.269366][ T51] Bluetooth: hci4: command 0x0405 tx timeout [ 439.672200][T19982] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 439.716374][T19986] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 439.917111][T20000] tipc: Failed to remove unknown binding: 66,1,1/0:2356616630/2356616632 [ 439.937989][T20000] tipc: Failed to remove unknown binding: 66,1,1/0:2356616630/2356616632 [ 439.960612][T20000] tipc: Failed to remove unknown binding: 66,1,1/0:2356616630/2356616632 [ 440.029918][T20007] geneve2: entered promiscuous mode [ 440.052949][T20007] geneve2: entered allmulticast mode [ 440.186427][T20015] pim6reg1: entered promiscuous mode [ 440.192398][T20015] pim6reg1: entered allmulticast mode [ 440.239356][ T1305] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 440.502444][T20034] __nla_validate_parse: 53 callbacks suppressed [ 440.502470][T20034] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3969'. [ 440.715559][T10817] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 440.988242][T20054] netlink: 'syz.3.3974': attribute type 6 has an invalid length. [ 441.460255][T20061] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3976'. [ 441.763341][T10817] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.790830][T10817] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.823371][T10817] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.861649][T10817] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 441.941048][T20087] netlink: 14 bytes leftover after parsing attributes in process `syz.1.3983'. [ 441.988449][T20087] netlink: 'syz.1.3983': attribute type 10 has an invalid length. [ 442.108959][T20087] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 442.196814][T20098] vcan0: entered allmulticast mode [ 442.335047][T20100] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3988'. [ 442.336901][T20102] netlink: 108 bytes leftover after parsing attributes in process `syz.3.3988'. [ 442.360233][T20105] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3989'. [ 442.372562][T20106] ip6gre0: entered promiscuous mode [ 442.392923][T20104] ip6gre0: left promiscuous mode [ 442.791505][T20125] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3995'. [ 442.857251][T20125] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 442.884871][T20125] netlink: 184 bytes leftover after parsing attributes in process `syz.0.3995'. [ 442.982410][T20138] netlink: 248 bytes leftover after parsing attributes in process `syz.2.3998'. [ 443.102494][T20142] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 443.259543][T20139] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 443.412492][T20151] lo speed is unknown, defaulting to 1000 [ 443.980196][T20151] lo speed is unknown, defaulting to 1000 [ 443.991223][T20173] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4006'. [ 444.132271][T20180] netlink: 'syz.4.4009': attribute type 49 has an invalid length. [ 444.255406][T20185] 8021q: VLANs not supported on ipvlan1 [ 445.241460][ T5959] IPVS: starting estimator thread 0... [ 445.336946][T20232] IPVS: using max 24 ests per chain, 57600 per kthread [ 445.775445][T10809] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 445.813971][T10809] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 445.914040][T20243] hsr0 speed is unknown, defaulting to 1000 [ 445.942703][T20243] hsr0 speed is unknown, defaulting to 1000 [ 445.954654][T20246] netlink: 'syz.3.4028': attribute type 1 has an invalid length. [ 446.054759][T20230] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 446.129348][T20246] bond7 (unregistering): Released all slaves [ 446.177084][T20243] hsr0 speed is unknown, defaulting to 1000 [ 446.190170][T20250] ip6tnl1: entered promiscuous mode [ 446.210060][T20250] ip6tnl1: entered allmulticast mode [ 446.241541][T20243] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 446.395127][T20243] hsr0 speed is unknown, defaulting to 1000 [ 446.429357][T20243] hsr0 speed is unknown, defaulting to 1000 [ 446.447626][T20243] hsr0 speed is unknown, defaulting to 1000 [ 446.462622][T20243] hsr0 speed is unknown, defaulting to 1000 [ 446.479448][T20243] hsr0 speed is unknown, defaulting to 1000 [ 446.492203][T20267] veth0: entered promiscuous mode [ 446.500423][T20243] hsr0 speed is unknown, defaulting to 1000 [ 446.515485][T20267] __nla_validate_parse: 2 callbacks suppressed [ 446.515506][T20267] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4033'. [ 446.540025][T20243] hsr0 speed is unknown, defaulting to 1000 [ 446.690231][T20273] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 446.740888][T20243] hsr0 speed is unknown, defaulting to 1000 [ 446.761321][T20243] hsr0 speed is unknown, defaulting to 1000 [ 447.047997][T20283] netlink: 14 bytes leftover after parsing attributes in process `syz.4.4040'. [ 447.269388][T20295] netlink: 'syz.3.4044': attribute type 11 has an invalid length. [ 447.278204][T20295] netlink: 224 bytes leftover after parsing attributes in process `syz.3.4044'. [ 447.288562][T20295] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 447.378167][T20283] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 447.392193][T20283] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 447.411169][T20283] bond0 (unregistering): Released all slaves [ 447.441919][T20292] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4043'. [ 447.452192][T20292] tc_dump_action: action bad kind [ 447.619638][T20308] netlink: 212376 bytes leftover after parsing attributes in process `syz.1.4048'. [ 447.697599][T20308] netlink: 'syz.1.4048': attribute type 2 has an invalid length. [ 447.752156][T20308] netlink: 'syz.1.4048': attribute type 2 has an invalid length. [ 447.813858][T20308] netlink: 'syz.1.4048': attribute type 1 has an invalid length. [ 448.201426][T20341] netlink: 'syz.3.4058': attribute type 28 has an invalid length. [ 448.231280][T20341] netlink: 'syz.3.4058': attribute type 3 has an invalid length. [ 448.266322][T20343] tipc: Enabling of bearer rejected, failed to enable media [ 448.285162][T20341] netlink: 132 bytes leftover after parsing attributes in process `syz.3.4058'. [ 448.333383][T20341] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4058'. [ 448.357134][T20351] sctp: [Deprecated]: syz.2.4060 (pid 20351) Use of int in maxseg socket option. [ 448.357134][T20351] Use struct sctp_assoc_value instead [ 448.579436][T20364] tipc: Enabling of bearer rejected, already enabled [ 448.739689][T20372] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4064'. [ 448.890288][T20378] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4064'. [ 448.915763][T20380] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 449.357633][T20397] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4070'. [ 449.377434][T20398] netlink: 'syz.2.4069': attribute type 1 has an invalid length. [ 449.558772][T20407] vlan4: entered promiscuous mode [ 449.565380][T20407] bridge0: entered promiscuous mode [ 449.732561][T20419] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 449.808199][T20422] (unnamed net_device) (uninitialized): option primary: mode dependency failed, not supported in mode balance-rr(0) [ 449.811168][T20413] svc: failed to register nfsdv3 RPC service (errno 111). [ 449.850625][T20413] svc: failed to register nfsaclv3 RPC service (errno 111). [ 450.689358][T20461] netlink: 'syz.2.4088': attribute type 2 has an invalid length. [ 450.792326][T20466] pimreg3: entered allmulticast mode [ 450.849949][T20471] !: renamed from dummy0 (while UP) [ 451.107265][T20477] vlan3: entered allmulticast mode [ 451.786487][T20517] __nla_validate_parse: 10 callbacks suppressed [ 451.786509][T20517] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4104'. [ 451.819188][T20513] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4102'. [ 451.829533][T20513] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4102'. [ 451.879859][T20513] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4102'. [ 452.157893][T20543] netlink: 'syz.1.4111': attribute type 16 has an invalid length. [ 452.167219][T20543] netlink: 'syz.1.4111': attribute type 17 has an invalid length. [ 452.201764][T20543] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 452.510628][T20558] netlink: 'syz.1.4115': attribute type 1 has an invalid length. [ 452.561764][ T5876] Bluetooth: hci5: command 0x0406 tx timeout [ 452.719232][T20561] validate_nla: 1 callbacks suppressed [ 452.719254][T20561] netlink: 'syz.1.4116': attribute type 2 has an invalid length. [ 452.773500][T20561] netlink: 244 bytes leftover after parsing attributes in process `syz.1.4116'. [ 453.136135][T20584] netem: incorrect gi model size [ 453.147153][T20584] netem: change failed [ 453.213321][T20587] syzkaller0: entered promiscuous mode [ 453.221251][T20587] syzkaller0: entered allmulticast mode [ 453.366006][T20599] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4126'. [ 453.495496][T20608] IPVS: length: 157 != 24 [ 453.693492][T20615] 8021q: adding VLAN 0 to HW filter on device bond0 [ 453.703109][T20615] team0: Failed to send port change of device bond0 via netlink (err -105) [ 453.714192][T20615] team0: Failed to send options change via netlink (err -105) [ 453.722011][T20615] team0: Port device bond0 added [ 453.859853][T20620] netlink: 'syz.4.4132': attribute type 3 has an invalid length. [ 453.943169][T20597] netlink: 196 bytes leftover after parsing attributes in process `syz.1.4124'. [ 453.985196][T20597] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4124'. [ 454.251435][T20639] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4140'. [ 454.508327][T20655] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4144'. [ 454.578173][T20655] geneve2: entered promiscuous mode [ 455.193001][T20694] : renamed from hsr0 (while UP) [ 455.680838][T20719] pim6reg: entered allmulticast mode [ 456.032634][T20738] pim6reg: entered allmulticast mode [ 456.107816][T20738] bpq0: left promiscuous mode [ 456.130178][T20743] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 456.150575][T20742] openvswitch: netlink: Unexpected mask (mask=440, allowed=10048) [ 456.387333][T20753] netlink: 'syz.2.4169': attribute type 1 has an invalid length. [ 456.424849][T20753] netlink: 'syz.2.4169': attribute type 2 has an invalid length. [ 456.833619][T20773] __nla_validate_parse: 9 callbacks suppressed [ 456.833640][T20773] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4176'. [ 457.039109][T20773] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 457.301824][T20794] IPVS: set_ctl: invalid protocol: 43 10.1.1.1:20003 [ 457.315971][T20799] netlink: 'syz.3.4185': attribute type 4 has an invalid length. [ 457.326119][T20799] netlink: 60 bytes leftover after parsing attributes in process `syz.3.4185'. [ 457.793578][T20823] tipc: Resetting bearer [ 457.860021][T20830] netlink: 'syz.0.4194': attribute type 9 has an invalid length. [ 457.862123][T20825] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4193'. [ 458.217794][T20846] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4198'. [ 458.377259][T20850] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4200'. [ 458.382509][T20851] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4199'. [ 458.572055][T20823] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 458.584493][T20823] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 458.612437][T20861] netlink: 'syz.4.4204': attribute type 12 has an invalid length. [ 458.626063][T20861] netlink: 'syz.4.4204': attribute type 29 has an invalid length. [ 458.635903][T20861] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4204'. [ 458.646073][T20861] netlink: 'syz.4.4204': attribute type 1 has an invalid length. [ 458.668472][T20823] tipc: Resetting bearer [ 458.892749][T20823] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 458.902909][T20823] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 458.946312][T20881] netlink: 'syz.0.4207': attribute type 1 has an invalid length. [ 459.146642][T20889] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4212'. [ 459.148044][T20823] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 459.167376][T20889] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4212'. [ 459.186115][T20823] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 459.202351][T20891] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4213'. [ 459.355289][T20823] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 459.384675][T20823] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 459.431006][T20904] netlink: 'syz.3.4218': attribute type 1 has an invalid length. [ 459.662404][T20914] netlink: 'syz.2.4221': attribute type 10 has an invalid length. [ 459.692014][T20914] syz_tun: entered promiscuous mode [ 459.730432][T20914] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 459.901328][T20925] vxcan1: tx address claim with dlc 0 [ 460.928527][T20980] ipvlan2: entered promiscuous mode [ 461.091554][T20988] netlink: 'syz.4.4246': attribute type 4 has an invalid length. [ 461.157183][T20989] bond0: (slave syz_tun): Releasing backup interface [ 461.324747][T20989] bridge_slave_0: left allmulticast mode [ 461.330573][T20989] bridge_slave_0: left promiscuous mode [ 461.370793][T20989] bridge0: port 1(bridge_slave_0) entered disabled state [ 461.412623][T20989] bridge_slave_1: left allmulticast mode [ 461.419290][T20989] bridge_slave_1: left promiscuous mode [ 461.437494][T20989] bridge0: port 2(bridge_slave_1) entered disabled state [ 461.460203][T20989] bond0: (slave bond_slave_0): Releasing backup interface [ 461.477221][T20989] bond0: (slave bond_slave_1): Releasing backup interface [ 461.502115][T20989] team0: Port device team_slave_0 removed [ 461.519925][T20989] team0: Port device team_slave_1 removed [ 461.528027][T20989] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 461.536636][T20989] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 461.561233][T20989] bond0: (slave wlan1): Releasing backup interface [ 461.575594][ T9249] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.592566][T21000] tipc: Enabled bearer , priority 10 [ 461.639772][T21017] netlink: 'syz.0.4253': attribute type 11 has an invalid length. [ 461.784962][ T9249] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 461.843411][T21022] tipc: Enabling of bearer rejected, failed to enable media [ 461.853352][T21026] tipc: Enabling of bearer rejected, failed to enable media [ 461.894417][T21029] __nla_validate_parse: 12 callbacks suppressed [ 461.894439][T21029] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4259'. [ 462.112763][T21043] netlink: 'syz.3.4261': attribute type 83 has an invalid length. [ 462.349709][T21057] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 462.564076][T21071] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4270'. [ 462.705136][ T9238] tipc: Node number set to 3412341189 [ 462.842890][T21071] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4270'. [ 463.215191][T21106] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4281'. [ 463.478544][T21117] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 463.523465][T21120] ipvlan0: entered promiscuous mode [ 463.543431][T21120] ipvlan0: entered allmulticast mode [ 463.579642][T21120] veth0_vlan: entered allmulticast mode [ 463.606219][T21120] tipc: Resetting bearer [ 463.624972][T21129] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4287'. [ 463.667351][T21129] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4287'. [ 463.677115][T21120] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4285'. [ 463.941122][T21145] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4288'. [ 464.018876][T21145] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4288'. [ 464.251847][T21157] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4294'. [ 464.284962][T21157] netlink: 'syz.0.4294': attribute type 14 has an invalid length. [ 464.325044][T21157] netlink: 'syz.0.4294': attribute type 13 has an invalid length. [ 464.482643][T21174] IPVS: set_ctl: invalid protocol: 98 172.20.20.170:20003 [ 464.559899][T21168] hsr_slave_1 (unregistering): left promiscuous mode [ 464.754791][T21186] netlink: 'syz.0.4303': attribute type 1 has an invalid length. [ 464.763290][T21186] netlink: 'syz.0.4303': attribute type 1 has an invalid length. [ 465.362509][T21228] sctp: [Deprecated]: syz.4.4317 (pid 21228) Use of int in max_burst socket option. [ 465.362509][T21228] Use struct sctp_assoc_value instead [ 466.105335][T21271] bridge0: port 1(ipvlan2) entered blocking state [ 466.120169][T21271] bridge0: port 1(ipvlan2) entered disabled state [ 466.138839][T21271] ipvlan2: entered allmulticast mode [ 466.160653][T21271] ipvlan2: left allmulticast mode [ 466.452520][T21293] syzkaller1: entered promiscuous mode [ 466.459390][T21293] syzkaller1: entered allmulticast mode [ 466.679784][T21311] syz_tun: entered allmulticast mode [ 466.711288][T21311] syz_tun: left allmulticast mode [ 466.967567][T21326] __nla_validate_parse: 39 callbacks suppressed [ 466.967588][T21326] netlink: 14 bytes leftover after parsing attributes in process `syz.1.4347'. [ 467.188857][T21340] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4350'. [ 467.279721][T21326] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 467.292882][T21326] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 467.305932][T21326] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 467.323049][T21326] bond0 (unregistering): Released all slaves [ 467.632848][T21360] netlink: 'syz.1.4354': attribute type 4 has an invalid length. [ 467.797822][T21365] netlink: 196 bytes leftover after parsing attributes in process `syz.1.4355'. [ 467.813667][T21365] netlink: 196 bytes leftover after parsing attributes in process `syz.1.4355'. [ 467.827497][T21365] netlink: 19 bytes leftover after parsing attributes in process `syz.1.4355'. [ 467.847790][T21368] tipc: Enabled bearer , priority 0 [ 467.885575][T21368] syzkaller0: entered promiscuous mode [ 467.891619][T21368] syzkaller0: entered allmulticast mode [ 467.940238][T21368] tipc: Resetting bearer [ 467.976054][T21368] tipc: Enabling of bearer rejected, already enabled [ 468.071617][T21380] tipc: Resetting bearer [ 468.133222][T21380] tipc: Disabling bearer [ 468.148739][T21385] netlink: 4528 bytes leftover after parsing attributes in process `syz.2.4360'. [ 468.148766][T21384] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4361'. [ 468.783578][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 468.819377][T21419] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4369'. [ 468.849125][T21419] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4369'. [ 468.850358][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 468.916423][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 468.937631][T21419] veth3: entered allmulticast mode [ 468.939039][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 468.965849][T21421] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4370'. [ 469.016415][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.047022][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.067405][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.119534][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.169551][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.222543][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.260158][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.397224][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.442195][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.523653][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.545321][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.586845][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.611450][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.638732][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.691103][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.716495][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.750678][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.778900][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.792397][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.848674][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.919553][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 469.965002][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 470.036590][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 470.051542][T21416] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 470.164429][ T5905] IPVS: starting estimator thread 0... [ 470.274828][T21476] IPVS: using max 28 ests per chain, 67200 per kthread [ 471.040608][T10824] dummy0: left allmulticast mode [ 471.047799][T10824] bridge0: port 3(dummy0) entered disabled state [ 471.065906][T10824] bridge_slave_1: left allmulticast mode [ 471.073149][T10824] bridge_slave_1: left promiscuous mode [ 471.079872][T10824] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.163469][T10824] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.237508][T10824] tipc: Resetting bearer [ 471.292860][T21538] netlink: 'syz.1.4400': attribute type 4 has an invalid length. [ 471.410288][T21547] delete_channel: no stack [ 471.720404][T10824] tipc: Disabling bearer [ 471.857363][T10824] dvmrp1 (unregistering): left allmulticast mode [ 472.393180][T10824] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 472.408266][T10824] bond0 (unregistering): Released all slaves [ 472.536269][T10824] bond1 (unregistering): Released all slaves [ 472.659571][T10824] team0: Port device bond2 removed [ 472.667758][T10824] bond2 (unregistering): Released all slaves [ 472.687720][T10824] bond3 (unregistering): Released all slaves [ 472.702630][T10824] bond4 (unregistering): Released all slaves [ 472.729766][T10824] bond5 (unregistering): Released all slaves [ 472.750024][T10824] bond6 (unregistering): Released all slaves [ 472.877374][T10824] bond7 (unregistering): Released all slaves [ 472.896875][T10824] bond8 (unregistering): Released all slaves [ 473.159289][T10824] tipc: Disabling bearer [ 473.179493][T10824] tipc: Disabling bearer [ 473.244674][T10824] tipc: Left network mode [ 473.244807][T21567] netlink: 'syz.2.4410': attribute type 12 has an invalid length. [ 473.342852][T21574] sock: sock_timestamping_bind_phc: sock not bind to device [ 473.429651][T21581] netlink: 'syz.4.4411': attribute type 9 has an invalid length. [ 473.497142][T21586] __nla_validate_parse: 9 callbacks suppressed [ 473.497164][T21586] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4416'. [ 473.827550][T21609] netlink: 'syz.0.4421': attribute type 6 has an invalid length. [ 473.860124][T21614] x_tables: ip6_tables: quota.0 match: invalid size 24 (kernel) != (user) 144 [ 474.448220][T21640] netlink: 'syz.0.4428': attribute type 1 has an invalid length. [ 474.457422][T21637] sctp: [Deprecated]: syz.3.4429 (pid 21637) Use of int in max_burst socket option deprecated. [ 474.457422][T21637] Use struct sctp_assoc_value instead [ 474.538907][T21641] sctp: [Deprecated]: syz.3.4429 (pid 21641) Use of int in max_burst socket option deprecated. [ 474.538907][T21641] Use struct sctp_assoc_value instead [ 474.571080][T21640] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4428'. [ 474.632787][T21645] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4430'. [ 475.001503][T10824] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 475.012715][T21654] IPVS: dh: SCTP 172.20.20.187:0 - no destination available [ 475.048719][T10824] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 475.075046][T10824] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 475.195598][T10824] veth1_macvtap: left promiscuous mode [ 475.205006][T21616] mpoa:atm_mpoa_vcc_attach: mpoa:Short read (missed 12 bytes) from userland [ 475.209396][T10824] veth1_vlan: left promiscuous mode [ 475.433147][T21676] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.4438'. [ 475.461639][T21677] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.4438'. [ 476.047878][T10824] team0 (unregistering): Port device team_slave_1 removed [ 476.116997][T10824] team0 (unregistering): Port device team_slave_0 removed [ 476.512315][T21662] veth0: entered promiscuous mode [ 476.556537][T21662] veth0: left promiscuous mode [ 476.752578][T21694] lo speed is unknown, defaulting to 1000 [ 476.785544][T21698] tipc: Enabling of bearer rejected, already enabled [ 476.831373][T21700] netlink: 'syz.4.4443': attribute type 12 has an invalid length. [ 476.848293][T21700] netlink: 'syz.4.4443': attribute type 29 has an invalid length. [ 476.880091][T21700] netlink: 148 bytes leftover after parsing attributes in process `syz.4.4443'. [ 476.909146][T21700] netlink: 'syz.4.4443': attribute type 1 has an invalid length. [ 477.157481][T21711] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4446'. [ 477.236159][T21694] lo speed is unknown, defaulting to 1000 [ 477.258401][T21694] hsr0 speed is unknown, defaulting to 1000 [ 477.456883][T10824] IPVS: stop unused estimator thread 0... [ 477.949897][T21747] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4455'. [ 478.149568][ T5905] IPVS: starting estimator thread 0... [ 478.201290][T21750] IPVS: set_ctl: invalid protocol: 20 36.0.121.99:65023 [ 478.285213][T21758] IPVS: using max 26 ests per chain, 62400 per kthread [ 478.377688][T21757] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4457'. [ 478.413075][T21754] team0: Device gtp0 is up. Set it down before adding it as a team port [ 478.525753][T21765] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4459'. [ 478.621694][T21769] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4460'. [ 478.673667][T21773] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 478.682445][T21774] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4462'. [ 478.705109][T21773] sit0: entered promiscuous mode [ 478.726407][T21773] netlink: 'syz.3.4461': attribute type 1 has an invalid length. [ 478.746122][T21773] netlink: 1 bytes leftover after parsing attributes in process `syz.3.4461'. [ 478.955322][T21784] netlink: 'syz.1.4465': attribute type 1 has an invalid length. [ 479.022396][T21784] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4465'. [ 479.026688][T21783] netlink: 'syz.2.4464': attribute type 1 has an invalid length. [ 479.033185][T21784] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4465'. [ 479.062662][T21783] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 479.200457][T21796] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4468'. [ 479.248824][T21799] netlink: 191164 bytes leftover after parsing attributes in process `syz.1.4469'. [ 479.283184][T21801] netlink: 68 bytes leftover after parsing attributes in process `syz.0.4470'. [ 479.285943][T21799] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4469'. [ 479.325076][T21805] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 479.632039][T21825] geneve2: entered promiscuous mode [ 479.638347][T21825] geneve2: entered allmulticast mode [ 481.695260][T21932] C: renamed from team_slave_0 (while UP) [ 481.767204][T21932] netlink: 'syz.4.4506': attribute type 1 has an invalid length. [ 481.801148][T21932] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 481.857522][T21940] sch_fq: defrate 0 ignored. [ 481.894193][T21943] sch_fq: defrate 0 ignored. [ 482.183094][T21962] sock: sock_timestamping_bind_phc: sock not bind to device [ 482.292286][T21969] netlink: 'syz.0.4515': attribute type 2 has an invalid length. [ 482.404969][T21968] vcan0 (unregistering): left allmulticast mode [ 483.103548][T22013] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 483.381955][T22030] netlink: 'syz.1.4535': attribute type 9 has an invalid length. [ 483.419180][ T78] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 483.430185][T22030] netlink: 'syz.1.4535': attribute type 9 has an invalid length. [ 483.439090][ T78] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 483.460510][ T78] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 483.481158][ T78] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 483.949022][T22057] __nla_validate_parse: 28 callbacks suppressed [ 483.949043][T22057] netlink: 244 bytes leftover after parsing attributes in process `syz.3.4545'. [ 484.055119][T22062] tipc: Enabling of bearer rejected, already enabled [ 484.246357][T22066] openvswitch: netlink: VXLAN extension 1 has unexpected len 0 expected 4 [ 484.277736][T22066] netlink: 'syz.3.4548': attribute type 39 has an invalid length. [ 484.286409][T22070] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4549'. [ 484.315898][T22070] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4549'. [ 484.638241][T22092] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4555'. [ 484.716789][T22094] veth0_to_bridge: entered promiscuous mode [ 484.897375][T22094] veth0_to_bridge: left promiscuous mode [ 485.151201][T22107] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4561'. [ 485.350733][T22114] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 485.496336][T22133] tipc: Enabling of bearer rejected, failed to enable media [ 485.738007][T22146] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.4572'. [ 485.756526][T22151] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4575'. [ 485.758153][T22148] netlink: 288 bytes leftover after parsing attributes in process `syz.0.4573'. [ 485.794782][T22151] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4575'. [ 485.931139][T22154] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4577'. [ 485.982553][T22154] netlink: 'syz.1.4577': attribute type 1 has an invalid length. [ 486.089440][T22163] 8021q: adding VLAN 0 to HW filter on device bond2 [ 486.099948][T22163] bond0: (slave bond2): making interface the new active one [ 486.108706][T22163] bond0: (slave bond2): Enslaving as an active interface with an up link [ 486.161215][T22154] bond0: (slave gretap3): Enslaving as a backup interface with an up link [ 486.213548][T22154] 8021q: adding VLAN 0 to HW filter on device bond0 [ 486.526007][T22192] delete_channel: no stack [ 486.758790][ T51] block nbd1: Receive control failed (result -32) [ 487.028695][T22227] netlink: 'syz.3.4595': attribute type 3 has an invalid length. [ 487.092251][T22224] batadv_slave_1 (unregistering): left promiscuous mode [ 487.165445][T22230] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 487.307379][T22234] dvmrp0: entered allmulticast mode [ 501.666055][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 501.677025][ T1305] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 532.011562][T22238] __nla_validate_parse: 7 callbacks suppressed [ 532.011581][T22238] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4602'. [ 532.236988][T22255] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4604'. [ 532.376618][T22257] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 532.623361][T22274] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4610'. [ 532.755466][T22284] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.4613'. [ 532.850873][T22291] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4614'. [ 532.850873][T22290] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4614'. [ 532.851537][T22291] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4614'. [ 532.951440][T22294] netlink: 104 bytes leftover after parsing attributes in process `syz.4.4616'. [ 533.222728][T22306] netlink: 'syz.4.4620': attribute type 1 has an invalid length. [ 533.231267][T22306] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4620'. [ 533.497367][T22318] netlink: 'syz.2.4624': attribute type 1 has an invalid length. [ 533.510404][T22316] can: request_module (can-proto-0) failed. [ 533.533149][T22316] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4623'. [ 534.045253][T22330] netlink: 'syz.2.4628': attribute type 2 has an invalid length. [ 534.090988][ C0] vcan0: j1939_tp_rxtimer: 0xffff8880422a7000: rx timeout, send abort [ 534.100266][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff8880422a7000: 0x3ff02: (3) A timeout occurred and this is the connection abort to close the session. [ 534.114784][ C0] vcan0: j1939_tp_rxtimer: 0xffff888057f31000: rx timeout, send abort [ 534.124098][ C0] vcan0: j1939_xtp_rx_abort_one: 0xffff888057f31000: 0x3fe02: (3) A timeout occurred and this is the connection abort to close the session. [ 535.311885][T22409] netlink: 'syz.2.4651': attribute type 1 has an invalid length. [ 535.403318][T22406] vlan2: entered allmulticast mode [ 535.408801][T22406] veth1: entered allmulticast mode [ 535.575165][T22415] netlink: 'syz.1.4654': attribute type 14 has an invalid length. [ 535.891445][T22439] sctp: [Deprecated]: syz.2.4662 (pid 22439) Use of int in maxseg socket option. [ 535.891445][T22439] Use struct sctp_assoc_value instead [ 535.941499][T22442] netlink: 'syz.1.4664': attribute type 7 has an invalid length. [ 535.943493][T22444] netlink: 'syz.1.4664': attribute type 7 has an invalid length. [ 536.257111][T22443] vlan0 (unregistering): left allmulticast mode [ 536.263546][T22443] veth0_vlan (unregistering): left allmulticast mode [ 536.272979][T22443] vlan0 (unregistering): left promiscuous mode [ 537.089448][T22485] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20001 [ 537.132186][T22485] __nla_validate_parse: 9 callbacks suppressed [ 537.132207][T22485] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4676'. [ 537.208014][T22485] vxcan2: entered promiscuous mode [ 537.364912][T22497] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4680'. [ 537.435290][T22499] IPv6: sit2: Disabled Multicast RS [ 537.445176][T22499] sit2: entered allmulticast mode [ 537.724948][T22507] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 538.238755][T22542] netlink: 80 bytes leftover after parsing attributes in process `syz.3.4693'. [ 538.520229][T22552] tipc: Resetting bearer [ 538.529314][T22569] netlink: 'syz.0.4699': attribute type 1 has an invalid length. [ 538.539817][T22569] netlink: 244 bytes leftover after parsing attributes in process `syz.0.4699'. [ 538.552318][T22552] tipc: Disabling bearer [ 538.608804][T22573] netlink: 'syz.0.4699': attribute type 1 has an invalid length. [ 538.638257][T22573] netlink: 244 bytes leftover after parsing attributes in process `syz.0.4699'. [ 538.697174][T22570] syzkaller0: entered promiscuous mode [ 538.703318][T22570] syzkaller0: entered allmulticast mode [ 538.722333][T22567] tipc: Started in network mode [ 538.740464][T22567] tipc: Node identity 86387fdb2c21, cluster identity 4711 [ 538.806279][T22567] tipc: Enabled bearer , priority 0 [ 538.849555][T22560] tipc: Resetting bearer [ 538.907834][T22557] tipc: Resetting bearer [ 539.009434][T22557] tipc: Disabling bearer [ 539.022572][T22588] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4702'. [ 539.066308][T22589] syz.0.4703: vmalloc error: size 6291456, failed to allocated page array size 12288, mode:0x400dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 539.134564][T22589] CPU: 1 UID: 0 PID: 22589 Comm: syz.0.4703 Not tainted 6.17.0-rc1-syzkaller-00127-g715c7a36d59f #0 PREEMPT(full) [ 539.134596][T22589] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 539.134611][T22589] Call Trace: [ 539.134620][T22589] [ 539.134630][T22589] dump_stack_lvl+0x189/0x250 [ 539.134665][T22589] ? __pfx_dump_stack_lvl+0x10/0x10 [ 539.134700][T22589] ? __pfx__printk+0x10/0x10 [ 539.134731][T22589] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 539.134757][T22589] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 539.134783][T22589] ? cpuset_print_current_mems_allowed+0x2ee/0x360 [ 539.134811][T22589] warn_alloc+0x214/0x310 [ 539.134850][T22589] ? __pfx_warn_alloc+0x10/0x10 [ 539.134891][T22589] ? __get_vm_area_node+0x28f/0x300 [ 539.134928][T22589] ? hash_netport_create+0x358/0xfe0 [ 539.134953][T22589] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 539.134988][T22589] ? do_syscall_64+0xfa/0x3b0 [ 539.135052][T22589] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 539.135089][T22589] ? rcu_is_watching+0x15/0xb0 [ 539.135111][T22589] ? hash_netport_create+0x358/0xfe0 [ 539.135128][T22589] ? hash_netport_create+0x358/0xfe0 [ 539.135145][T22589] __kvmalloc_node_noprof+0x3b8/0x5f0 [ 539.135175][T22589] ? hash_netport_create+0x358/0xfe0 [ 539.135195][T22589] ? hash_netport_create+0x2fe/0xfe0 [ 539.135219][T22589] hash_netport_create+0x358/0xfe0 [ 539.135249][T22589] ? __nla_parse+0x40/0x60 [ 539.135280][T22589] ? __pfx_hash_netport_create+0x10/0x10 [ 539.135303][T22589] ip_set_create+0xa97/0x1940 [ 539.135328][T22589] ? ip_set_create+0x4a2/0x1940 [ 539.135365][T22589] ? __pfx_ip_set_create+0x10/0x10 [ 539.135431][T22589] nfnetlink_rcv_msg+0xb4d/0x1130 [ 539.135459][T22589] ? nfnetlink_rcv_msg+0x20d/0x1130 [ 539.135506][T22589] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 539.135530][T22589] ? kasan_save_free_info+0x46/0x50 [ 539.135609][T22589] netlink_rcv_skb+0x208/0x470 [ 539.135640][T22589] ? __pfx_nfnetlink_rcv_msg+0x10/0x10 [ 539.135668][T22589] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 539.135729][T22589] ? bpf_lsm_capable+0x9/0x20 [ 539.135757][T22589] ? security_capable+0x7e/0x2e0 [ 539.135796][T22589] nfnetlink_rcv+0x26a/0x2520 [ 539.135826][T22589] ? __dev_queue_xmit+0x1d79/0x3b50 [ 539.135861][T22589] ? __dev_queue_xmit+0x27b/0x3b50 [ 539.135899][T22589] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 539.135924][T22589] ? __pfx___dev_queue_xmit+0x10/0x10 [ 539.135964][T22589] ? ref_tracker_free+0x63a/0x7d0 [ 539.135994][T22589] ? __asan_memcpy+0x40/0x70 [ 539.136016][T22589] ? __pfx_ref_tracker_free+0x10/0x10 [ 539.136064][T22589] ? skb_clone+0x246/0x3a0 [ 539.136090][T22589] ? __netlink_deliver_tap+0x807/0x850 [ 539.136119][T22589] ? netlink_deliver_tap+0x2e/0x1b0 [ 539.136155][T22589] ? netlink_deliver_tap+0x2e/0x1b0 [ 539.136194][T22589] netlink_unicast+0x82c/0x9e0 [ 539.136231][T22589] ? __pfx_netlink_unicast+0x10/0x10 [ 539.136260][T22589] ? netlink_sendmsg+0x642/0xb30 [ 539.136287][T22589] ? skb_put+0x11b/0x210 [ 539.136309][T22589] netlink_sendmsg+0x805/0xb30 [ 539.136350][T22589] ? __pfx_netlink_sendmsg+0x10/0x10 [ 539.136384][T22589] ? aa_sock_msg_perm+0xf1/0x1d0 [ 539.136418][T22589] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 539.136441][T22589] ? __pfx_netlink_sendmsg+0x10/0x10 [ 539.136472][T22589] __sock_sendmsg+0x219/0x270 [ 539.136502][T22589] ____sys_sendmsg+0x505/0x830 [ 539.136528][T22589] ? __pfx_____sys_sendmsg+0x10/0x10 [ 539.136558][T22589] ? import_iovec+0x74/0xa0 [ 539.136584][T22589] ___sys_sendmsg+0x21f/0x2a0 [ 539.136608][T22589] ? __pfx____sys_sendmsg+0x10/0x10 [ 539.136670][T22589] ? __fget_files+0x2a/0x420 [ 539.136699][T22589] ? __fget_files+0x3a0/0x420 [ 539.136730][T22589] __x64_sys_sendmsg+0x19b/0x260 [ 539.136755][T22589] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 539.136789][T22589] ? rcu_is_watching+0x15/0xb0 [ 539.136815][T22589] ? do_syscall_64+0xbe/0x3b0 [ 539.136858][T22589] do_syscall_64+0xfa/0x3b0 [ 539.136885][T22589] ? lockdep_hardirqs_on+0x9c/0x150 [ 539.136913][T22589] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.136934][T22589] ? clear_bhb_loop+0x60/0xb0 [ 539.136960][T22589] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 539.136980][T22589] RIP: 0033:0x7f57ccd8ebe9 [ 539.137000][T22589] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 539.137017][T22589] RSP: 002b:00007f57cdb87038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 539.137039][T22589] RAX: ffffffffffffffda RBX: 00007f57ccfb5fa0 RCX: 00007f57ccd8ebe9 [ 539.137054][T22589] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 000000000000000c [ 539.137067][T22589] RBP: 00007f57cce11e19 R08: 0000000000000000 R09: 0000000000000000 [ 539.137080][T22589] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 539.137092][T22589] R13: 00007f57ccfb6038 R14: 00007f57ccfb5fa0 R15: 00007ffdcb3a13f8 [ 539.137127][T22589] [ 539.137135][T22589] Mem-Info: [ 539.689551][T22589] active_anon:9136 inactive_anon:0 isolated_anon:0 [ 539.689551][T22589] active_file:2700 inactive_file:39991 isolated_file:0 [ 539.689551][T22589] unevictable:768 dirty:75 writeback:0 [ 539.689551][T22589] slab_reclaimable:12426 slab_unreclaimable:123786 [ 539.689551][T22589] mapped:36154 shmem:6871 pagetables:1313 [ 539.689551][T22589] sec_pagetables:0 bounce:0 [ 539.689551][T22589] kernel_misc_reclaimable:0 [ 539.689551][T22589] free:1291090 free_pcp:14161 free_cma:0 [ 539.752142][T22589] Node 0 active_anon:37444kB inactive_anon:0kB active_file:10800kB inactive_file:159764kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:138116kB dirty:300kB writeback:0kB shmem:26748kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14184kB pagetables:5120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 539.786248][T22589] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 539.830803][T22589] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 539.861146][T22589] lowmem_reserve[]: 0 2497 2499 2499 2499 [ 539.867553][T22589] Node 0 DMA32 free:1256176kB boost:0kB min:34248kB low:42808kB high:51368kB reserved_highatomic:0KB free_highatomic:0KB active_anon:37396kB inactive_anon:0kB active_file:10800kB inactive_file:158196kB unevictable:1536kB writepending:300kB present:3129332kB managed:2557476kB mlocked:0kB bounce:0kB free_pcp:40376kB local_pcp:22044kB free_cma:0kB [ 539.915420][T22598] netlink: 'syz.3.4701': attribute type 1 has an invalid length. [ 539.942180][T22589] lowmem_reserve[]: 0 0 1 1 1 [ 539.947751][T22589] Node 0 Normal free:12kB boost:0kB min:20kB low:24kB high:28kB reserved_highatomic:0KB free_highatomic:0KB active_anon:48kB inactive_anon:0kB active_file:0kB inactive_file:1568kB unevictable:0kB writepending:0kB present:1048580kB managed:1644kB mlocked:0kB bounce:0kB free_pcp:16kB local_pcp:8kB free_cma:0kB [ 539.978032][T22589] lowmem_reserve[]: 0 0 0 0 0 [ 539.982902][T22589] Node 1 Normal free:3891812kB boost:0kB min:55632kB low:69540kB high:83448kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:16416kB local_pcp:10176kB free_cma:0kB [ 540.016724][T22589] lowmem_reserve[]: 0 0 0 0 0 [ 540.021591][T22589] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 540.038450][T22589] Node 0 DMA32: 1284*4kB (UME) 573*8kB (U) 194*16kB (UME) 1763*32kB (UE) 254*64kB (UE) 543*128kB (UM) 753*256kB (UME) 276*512kB (UME) 101*1024kB (UM) 8*2048kB (UME) 158*4096kB (UM) = 1256056kB [ 540.076702][T22589] Node 0 Normal: 1*4kB (M) 1*8kB (M) 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 12kB [ 540.090739][T22589] Node 1 Normal: 177*4kB (UE) 46*8kB (UME) 31*16kB (UME) 104*32kB (UME) 37*64kB (UME) 12*128kB (UME) 2*256kB (M) 3*512kB (UM) 2*1024kB (ME) 2*2048kB (UE) 946*4096kB (M) = 3891812kB [ 540.151304][T22589] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 540.167277][T22589] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 540.234962][T22589] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 540.268105][T22589] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 540.291429][T22608] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4706'. [ 540.291595][T22589] 46250 total pagecache pages [ 540.365380][T22589] 0 pages in swap cache [ 540.369656][T22589] Free swap = 124996kB [ 540.375603][T22611] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4707'. [ 540.386722][T22611] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 540.454659][T22589] Total swap = 124996kB [ 540.462274][T22589] 2097051 pages RAM [ 540.494502][T22589] 0 pages HighMem/MovableOnly [ 540.499425][T22589] 425656 pages reserved [ 540.503616][T22589] 0 pages cma reserved [ 540.705762][T22624] Bluetooth: MGMT ver 1.23 [ 540.721994][T22629] 8021q: adding VLAN 0 to HW filter on device ipvlan0 [ 540.892202][T22632] bond0: option mode: unable to set because the bond device is up [ 541.002858][T22645] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4715'. [ 541.118778][T22651] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4718'. [ 541.152595][T22649] netlink: 'syz.0.4717': attribute type 83 has an invalid length. [ 541.172357][T22649] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 541.179789][T22649] IPv6: NLM_F_CREATE should be set when creating new route [ 541.382105][T22661] syz_tun: entered allmulticast mode [ 541.452458][T22661] syz_tun: left allmulticast mode [ 541.527746][T22671] geneve1: mtu less than device minimum [ 541.853138][T22691] netlink: 'syz.3.4731': attribute type 21 has an invalid length. [ 542.032235][T22698] netlink: 'syz.4.4733': attribute type 1 has an invalid length. [ 542.366270][T22725] IPVS: set_ctl: invalid protocol: 43 127.0.0.1:20000 [ 542.637279][T22739] : entered promiscuous mode [ 542.749765][T22747] netlink: 'syz.4.4748': attribute type 2 has an invalid length. [ 542.796511][T22749] __nla_validate_parse: 6 callbacks suppressed [ 542.796532][T22749] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4749'. [ 542.886953][T22749] netlink: 'syz.0.4749': attribute type 5 has an invalid length. [ 542.933313][T22749] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4749'. [ 543.113217][T22763] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4752'. [ 543.137559][T22763] openvswitch: netlink: nsh attr 8196 is out of range max 3 [ 543.153869][T22763] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 543.191419][T22763] sctp: [Deprecated]: syz.4.4752 (pid 22763) Use of struct sctp_assoc_value in delayed_ack socket option. [ 543.191419][T22763] Use struct sctp_sack_info instead [ 543.562976][T22786] netlink: 81 bytes leftover after parsing attributes in process `syz.4.4759'. [ 543.975379][T22805] netlink: 'syz.1.4763': attribute type 1 has an invalid length. [ 543.994959][T22805] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4763'. [ 544.068948][T22807] netlink: 'syz.4.4767': attribute type 10 has an invalid length. [ 544.117112][T22810] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4766'. [ 544.131449][T22812] netlink: 'syz.4.4767': attribute type 10 has an invalid length. [ 544.147679][T22807] team0: Device dummy0 failed to register rx_handler [ 544.283348][T22820] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4769'. [ 544.340416][T22820] netlink: 'syz.2.4769': attribute type 11 has an invalid length. [ 544.491688][T22827] netlink: 1044 bytes leftover after parsing attributes in process `syz.3.4771'. [ 544.502598][T22829] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4773'. [ 544.512623][T22830] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4773'. [ 544.867134][ T9238] page_pool_release_retry() stalled pool shutdown: id 102, 1 inflight 60 sec [ 544.894386][T22845] veth0: entered promiscuous mode [ 544.969089][T22856] netlink: 'syz.4.4782': attribute type 1 has an invalid length. [ 545.182640][T22867] netlink: 'syz.4.4787': attribute type 3 has an invalid length. [ 545.307441][T22875] Unsupported ieee802154 address type: 0 [ 545.382628][T22870] lo speed is unknown, defaulting to 1000 [ 545.726157][T22844] veth0: left promiscuous mode [ 545.980575][T22870] lo speed is unknown, defaulting to 1000 [ 546.002502][T22870] hsr0 speed is unknown, defaulting to 1000 [ 546.726812][T22919] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 546.949879][T22928] tipc: Trying to set illegal importance in message [ 547.230666][T22935] lo speed is unknown, defaulting to 1000 [ 547.970740][T22975] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 548.282829][T22935] lo speed is unknown, defaulting to 1000 [ 548.297274][T22935] hsr0 speed is unknown, defaulting to 1000 [ 548.481573][T22991] __nla_validate_parse: 13 callbacks suppressed [ 548.481594][T22991] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4820'. [ 549.543905][T23036] netlink: 'syz.3.4833': attribute type 2 has an invalid length. [ 549.554004][T23036] netlink: 'syz.3.4833': attribute type 1 has an invalid length. [ 549.561771][T23036] netlink: 'syz.3.4833': attribute type 1 has an invalid length. [ 549.670996][T23039] netlink: 'syz.2.4835': attribute type 1 has an invalid length. [ 549.738771][T23046] openvswitch: netlink: Unknown key attributes 2 [ 550.060130][T23065] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4842'. [ 550.218499][T23068] lo speed is unknown, defaulting to 1000 [ 550.378194][T23083] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4849'. [ 550.543422][T23083] syzkaller0: entered promiscuous mode [ 550.557666][T23083] syzkaller0: entered allmulticast mode [ 550.698214][T23092] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4852'. [ 550.750183][T23094] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4852'. [ 552.452761][T23068] lo speed is unknown, defaulting to 1000 [ 552.460488][T23092] xfrm1: entered promiscuous mode [ 552.466738][T23092] xfrm1: entered allmulticast mode [ 552.493783][T23068] hsr0 speed is unknown, defaulting to 1000 [ 552.688567][T23111] netlink: 72 bytes leftover after parsing attributes in process `syz.0.4856'. [ 552.755181][T23107] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4855'. [ 553.160197][T23129] netlink: 212376 bytes leftover after parsing attributes in process `syz.0.4860'. [ 553.608292][T23147] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4867'. [ 553.630783][T23148] netlink: 48 bytes leftover after parsing attributes in process `syz.4.4867'. [ 553.803223][T23156] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4870'. [ 553.988802][T23163] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4872'. [ 554.240251][T23174] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4874'. [ 554.359285][T23182] tipc: Enabled bearer , priority 0 [ 554.378714][T23182] syzkaller0: entered promiscuous mode [ 554.400600][T23182] syzkaller0: entered allmulticast mode [ 554.430511][T23182] tipc: Resetting bearer [ 554.443495][T23181] tipc: Resetting bearer [ 554.473663][T23181] tipc: Disabling bearer [ 554.622978][T23190] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4879'. [ 554.988948][T23205] veth1_macvtap: left promiscuous mode [ 555.401364][T23218] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 555.432921][T23225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4889'. [ 555.460577][T23218] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 555.503652][T23225] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4889'. [ 555.504319][T23227] netlink: 'syz.2.4889': attribute type 8 has an invalid length. [ 555.593748][T23225] netlink: 'syz.2.4889': attribute type 6 has an invalid length. [ 556.206901][T23254] netlink: 144 bytes leftover after parsing attributes in process `syz.0.4896'. [ 556.657358][T23281] netlink: 65047 bytes leftover after parsing attributes in process `syz.4.4904'. [ 556.681019][T23281] tipc: Enabling of bearer rejected, failed to enable media [ 557.048365][T23301] (unnamed net_device) (uninitialized): option packets_per_slave: invalid value (18446744073709551615) [ 557.067533][T23301] (unnamed net_device) (uninitialized): option packets_per_slave: allowed values 0 - 65535 [ 557.649145][T23327] workqueue: Failed to create a rescuer kthread for wq "nfc5_nci_rx_wq": -EINTR [ 557.862682][T23358] netlink: 'syz.0.4925': attribute type 1 has an invalid length. [ 557.945132][T23358] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 558.639813][T23392] __nla_validate_parse: 3 callbacks suppressed [ 558.639837][T23392] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4936'. [ 558.685662][T23394] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 558.717061][T23402] netlink: 'syz.4.4938': attribute type 1 has an invalid length. [ 558.787070][T23405] bond6: (slave bridge6): making interface the new active one [ 558.797125][T23405] bond6: (slave bridge6): Enslaving as an active interface with an up link [ 558.839495][T23407] netlink: 'syz.1.4940': attribute type 2 has an invalid length. [ 558.848258][T23407] netlink: 'syz.1.4940': attribute type 8 has an invalid length. [ 558.856640][T23407] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4940'. [ 558.925999][ C1] vcan0: j1939_tp_rxtimer: 0xffff88802dfa8c00: rx timeout, send abort [ 558.935304][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88802dfa8c00: 0x3fe02: (3) A timeout occurred and this is the connection abort to close the session. [ 559.027286][T23415] netlink: 'syz.1.4942': attribute type 1 has an invalid length. [ 559.088763][T23423] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4944'. [ 559.158915][T23415] macvlan3: entered promiscuous mode [ 559.165951][T23415] macvlan3: entered allmulticast mode [ 559.172710][T23415] bond3: entered promiscuous mode [ 559.192454][T23415] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 559.241091][T23415] bond3: left promiscuous mode [ 559.562128][T23443] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4950'. [ 559.594888][T23446] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4952'. [ 559.604800][T23443] netlink: 'syz.1.4950': attribute type 7 has an invalid length. [ 559.604825][T23443] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4950'. [ 559.688201][T23451] netlink: 100 bytes leftover after parsing attributes in process `syz.2.4952'. [ 559.878448][T23460] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4954'. [ 560.202228][T23473] netlink: 188 bytes leftover after parsing attributes in process `syz.0.4957'. [ 560.497851][T23479] lo speed is unknown, defaulting to 1000 [ 560.790256][T23479] lo speed is unknown, defaulting to 1000 [ 560.798798][T23479] hsr0 speed is unknown, defaulting to 1000 [ 560.817968][T23497] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4964'. [ 561.276752][T23520] netlink: 'syz.4.4972': attribute type 1 has an invalid length. [ 561.428752][T23520] netlink: 'syz.4.4972': attribute type 5 has an invalid length. [ 561.610950][T23524] bond7: (slave bridge8): making interface the new active one [ 561.650385][T23524] bond7: (slave bridge8): Enslaving as an active interface with an up link [ 561.688715][T23532] netlink: 'syz.3.4975': attribute type 1 has an invalid length. [ 562.055028][T23552] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 562.055028][T23554] openvswitch: netlink: nsh attribute has unmatched MD type 0. [ 562.055069][T23554] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 562.062670][T23552] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 562.104524][T23557] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 1 [ 562.241741][T23563] sysfs: cannot create duplicate filename '/class/ieee80211/!寿$ULvyآDUDw}z' [ 562.303403][T23563] CPU: 1 UID: 0 PID: 23563 Comm: syz.1.4986 Not tainted 6.17.0-rc1-syzkaller-00127-g715c7a36d59f #0 PREEMPT(full) [ 562.303437][T23563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 562.303451][T23563] Call Trace: [ 562.303460][T23563] [ 562.303470][T23563] dump_stack_lvl+0x189/0x250 [ 562.303507][T23563] ? __pfx_dump_stack_lvl+0x10/0x10 [ 562.303534][T23563] ? __pfx__printk+0x10/0x10 [ 562.303570][T23563] ? kernfs_path_from_node+0x2f/0x290 [ 562.303594][T23563] ? kernfs_path_from_node+0x250/0x290 [ 562.303616][T23563] ? kernfs_path_from_node+0x2f/0x290 [ 562.303645][T23563] sysfs_warn_dup+0x8e/0xa0 [ 562.303672][T23563] sysfs_do_create_link_sd+0xc0/0x110 [ 562.303697][T23563] device_add_class_symlinks+0x1cf/0x240 [ 562.303724][T23563] device_add+0x475/0xb50 [ 562.303751][T23563] wiphy_register+0x1ba6/0x28d0 [ 562.303801][T23563] ? __pfx_wiphy_register+0x10/0x10 [ 562.303829][T23563] ? minstrel_ht_alloc+0x6dd/0x7e0 [ 562.303861][T23563] ? ieee80211_init_rate_ctrl_alg+0x56d/0x5f0 [ 562.303902][T23563] ieee80211_register_hw+0x3425/0x4080 [ 562.303946][T23563] ? ieee80211_register_hw+0x1451/0x4080 [ 562.303979][T23563] ? __pfx_ieee80211_register_hw+0x10/0x10 [ 562.304007][T23563] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 562.304044][T23563] ? __hrtimer_setup+0x187/0x210 [ 562.304063][T23563] ? __pfx_mac80211_hwsim_beacon+0x10/0x10 [ 562.304106][T23563] mac80211_hwsim_new_radio+0x2f0e/0x5340 [ 562.304168][T23563] ? __pfx_mac80211_hwsim_new_radio+0x10/0x10 [ 562.304193][T23563] ? trace_kmalloc+0x1f/0xd0 [ 562.304218][T23563] ? __kmalloc_node_track_caller_noprof+0x28e/0x4e0 [ 562.304248][T23563] ? kstrndup+0xbf/0x160 [ 562.304282][T23563] hwsim_new_radio_nl+0xea4/0x1b10 [ 562.304313][T23563] ? __pfx___nla_validate_parse+0x10/0x10 [ 562.304363][T23563] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 562.304407][T23563] ? __nla_parse+0x40/0x60 [ 562.304443][T23563] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 562.304480][T23563] genl_family_rcv_msg_doit+0x215/0x300 [ 562.304513][T23563] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 562.304555][T23563] ? bpf_lsm_capable+0x9/0x20 [ 562.304583][T23563] ? security_capable+0x7e/0x2e0 [ 562.304622][T23563] genl_rcv_msg+0x60e/0x790 [ 562.304654][T23563] ? __pfx_genl_rcv_msg+0x10/0x10 [ 562.304676][T23563] ? __pfx_hwsim_new_radio_nl+0x10/0x10 [ 562.304721][T23563] netlink_rcv_skb+0x208/0x470 [ 562.304749][T23563] ? __lock_acquire+0xab9/0xd20 [ 562.304781][T23563] ? __pfx_genl_rcv_msg+0x10/0x10 [ 562.304806][T23563] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 562.304861][T23563] ? down_read+0x1ad/0x2e0 [ 562.304897][T23563] genl_rcv+0x28/0x40 [ 562.304918][T23563] netlink_unicast+0x82c/0x9e0 [ 562.304957][T23563] ? __pfx_netlink_unicast+0x10/0x10 [ 562.304987][T23563] ? netlink_sendmsg+0x642/0xb30 [ 562.305015][T23563] ? skb_put+0x11b/0x210 [ 562.305039][T23563] netlink_sendmsg+0x805/0xb30 [ 562.305089][T23563] ? __pfx_netlink_sendmsg+0x10/0x10 [ 562.305125][T23563] ? aa_sock_msg_perm+0xf1/0x1d0 [ 562.305161][T23563] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 562.305184][T23563] ? __pfx_netlink_sendmsg+0x10/0x10 [ 562.305216][T23563] __sock_sendmsg+0x219/0x270 [ 562.305248][T23563] ____sys_sendmsg+0x505/0x830 [ 562.305278][T23563] ? __pfx_____sys_sendmsg+0x10/0x10 [ 562.305311][T23563] ? import_iovec+0x74/0xa0 [ 562.305341][T23563] ___sys_sendmsg+0x21f/0x2a0 [ 562.305365][T23563] ? __pfx____sys_sendmsg+0x10/0x10 [ 562.305433][T23563] ? __fget_files+0x2a/0x420 [ 562.305451][T23563] ? __fget_files+0x3a0/0x420 [ 562.305482][T23563] __x64_sys_sendmsg+0x19b/0x260 [ 562.305508][T23563] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 562.305553][T23563] ? do_syscall_64+0xbe/0x3b0 [ 562.305588][T23563] do_syscall_64+0xfa/0x3b0 [ 562.305616][T23563] ? lockdep_hardirqs_on+0x9c/0x150 [ 562.305644][T23563] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.305665][T23563] ? clear_bhb_loop+0x60/0xb0 [ 562.305692][T23563] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.305712][T23563] RIP: 0033:0x7f926e58ebe9 [ 562.305730][T23563] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 562.305749][T23563] RSP: 002b:00007f926f34e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 562.305772][T23563] RAX: ffffffffffffffda RBX: 00007f926e7b5fa0 RCX: 00007f926e58ebe9 [ 562.305788][T23563] RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000005 [ 562.305802][T23563] RBP: 00007f926e611e19 R08: 0000000000000000 R09: 0000000000000000 [ 562.305815][T23563] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 562.305828][T23563] R13: 00007f926e7b6038 R14: 00007f926e7b5fa0 R15: 00007ffc460bcab8 [ 562.305864][T23563] [ 563.110438][ T1305] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 563.624150][T23613] syz_tun: entered allmulticast mode [ 563.698288][T23606] syz_tun: left allmulticast mode [ 563.807336][T23619] __nla_validate_parse: 5 callbacks suppressed [ 563.807358][T23619] netlink: 52 bytes leftover after parsing attributes in process `syz.1.5000'. [ 563.853380][T23619] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5000'. [ 563.905418][T23624] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 564.019302][T23632] netlink: 'syz.2.5005': attribute type 1 has an invalid length. [ 564.130646][T23635] 8021q: adding VLAN 0 to HW filter on device bond5 [ 564.142330][T23635] bond4: (slave bond5): making interface the new active one [ 564.151734][T23635] bond4: (slave bond5): Enslaving as an active interface with an up link [ 564.328293][ T5959] hsr0 speed is unknown, defaulting to 1000 [ 564.507099][T23662] netlink: 16 bytes leftover after parsing attributes in process `syz.0.5012'. [ 564.539015][T10792] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 564.561815][T10792] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 564.571107][ T9235] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 564.621864][T23667] tipc: Enabling of bearer rejected, failed to enable media [ 564.715157][ T9235] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 564.974530][ T9234] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 565.131064][T23681] netlink: 16 bytes leftover after parsing attributes in process `syz.2.5019'. [ 565.221485][T23684] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5020'. [ 565.666628][T23702] netlink: 40 bytes leftover after parsing attributes in process `syz.2.5026'. [ 565.692377][T23705] IPVS: set_ctl: invalid protocol: 255 172.20.20.0:0 [ 565.720701][T23705] netlink: 36 bytes leftover after parsing attributes in process `syz.3.5027'. [ 565.762785][T23707] syzkaller0: entered promiscuous mode [ 565.769551][T23707] syzkaller0: entered allmulticast mode [ 565.783155][T23712] netlink: 'syz.3.5027': attribute type 10 has an invalid length. [ 565.816140][T23713] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5029'. [ 565.835139][T23715] netlink: 40 bytes leftover after parsing attributes in process `syz.1.5028'. [ 565.860720][T23712] 8021q: adding VLAN 0 to HW filter on device team0 [ 565.912599][T23712] bond0: (slave team0): Enslaving as an active interface with an up link [ 566.219496][T23728] netlink: 56 bytes leftover after parsing attributes in process `syz.0.5031'. [ 566.264894][T23728] netlink: 'syz.0.5031': attribute type 2 has an invalid length. [ 566.318255][T23728] netlink: 'syz.0.5031': attribute type 1 has an invalid length. [ 566.425270][T23731] netlink: 'syz.2.5032': attribute type 10 has an invalid length. [ 566.602531][T23737] syzkaller1: entered promiscuous mode [ 566.622083][T23737] syzkaller1: entered allmulticast mode [ 566.728708][T23741] (unnamed net_device) (uninitialized): option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-tlb(5) [ 566.877717][T23747] netlink: 'syz.4.5039': attribute type 9 has an invalid length. [ 566.892216][T23747] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 567.182237][T23765] netlink: 'syz.1.5043': attribute type 1 has an invalid length. [ 567.227836][T23765] netlink: 'syz.1.5043': attribute type 1 has an invalid length. [ 567.338373][T23748] RDS: rds_bind could not find a transport for 2001::2, load rds_tcp or rds_rdma? [ 567.415144][T23778] (unnamed net_device) (uninitialized): option lp_interval: invalid value (0) [ 567.443379][T23778] (unnamed net_device) (uninitialized): option lp_interval: allowed values 1 - 2147483647 [ 567.569922][T23785] netlink: 'syz.4.5047': attribute type 1 has an invalid length. [ 567.620853][T23788] netlink: 'syz.4.5047': attribute type 1 has an invalid length. [ 567.812401][T23798] lo speed is unknown, defaulting to 1000 [ 567.974795][T23804] tipc: Enabled bearer , priority 0 [ 567.983031][T23807] netlink: 'syz.2.5053': attribute type 1 has an invalid length. [ 568.022476][T23804] syzkaller0: entered promiscuous mode [ 568.042504][T23804] syzkaller0: entered allmulticast mode [ 568.150525][T23806] syzkaller1: entered promiscuous mode [ 568.169939][T23806] syzkaller1: entered allmulticast mode [ 568.200148][T23810] bond6: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 568.212218][T23798] lo speed is unknown, defaulting to 1000 [ 568.221513][T23798] hsr0 speed is unknown, defaulting to 1000 [ 568.272711][T23817] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 568.272879][T23814] veth5: entered promiscuous mode [ 568.301901][T23814] bond6: (slave veth5): Enslaving as a backup interface with a down link [ 568.340219][T23809] tipc: Resetting bearer [ 568.469530][T23800] tipc: Resetting bearer [ 568.528629][T23800] tipc: Disabling bearer [ 568.651600][T23835] netlink: 'syz.2.5058': attribute type 4 has an invalid length. [ 568.708748][T23827] netlink: 'syz.2.5058': attribute type 4 has an invalid length. [ 568.864276][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 569.419287][T23862] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 569.862058][T23882] bridge0: port 1(bridge_slave_0) entered disabled state [ 569.893589][T23882] bridge0: port 2(bridge_slave_1) entered disabled state [ 570.078272][T23891] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 570.127640][T23903] __nla_validate_parse: 13 callbacks suppressed [ 570.127661][T23903] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5073'. [ 570.213043][T23883] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5070'. [ 570.213271][T23906] netlink: 12 bytes leftover after parsing attributes in process `syz.0.5073'. [ 570.306829][ T51] Bluetooth: hci0: command tx timeout [ 570.801380][T23936] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5082'. [ 570.821844][T23935] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5082'. [ 571.105366][T23948] siw: device registration error -23 [ 571.162170][T23948] lo speed is unknown, defaulting to 1000 [ 571.197535][T23953] netlink: zone id is out of range [ 571.384840][T23957] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5088'. [ 571.405914][T23960] tipc: Enabling of bearer rejected, already enabled [ 571.416673][T23962] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5088'. [ 571.439181][T23960] sch_tbf: burst 127 is lower than device syzkaller0 mtu (313) ! [ 571.714019][T23976] netlink: 20 bytes leftover after parsing attributes in process `syz.3.5093'. [ 571.805755][T23948] lo speed is unknown, defaulting to 1000 [ 571.836593][T23948] hsr0 speed is unknown, defaulting to 1000 [ 572.190489][T24003] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5095'. [ 572.210190][T24007] validate_nla: 4 callbacks suppressed [ 572.210211][T24007] netlink: 'syz.1.5099': attribute type 1 has an invalid length. [ 572.232186][T24007] netlink: 'syz.1.5099': attribute type 1 has an invalid length. [ 572.272279][T24009] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 572.993505][T24031] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5108'. [ 573.175190][T24036] netlink: 'syz.4.5109': attribute type 11 has an invalid length. [ 573.515613][T24045] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap4 [ 573.532598][T24045] gretap4: default qdisc (pfifo_fast) fail, fallback to noqueue [ 573.542730][T24045] gretap4: entered promiscuous mode [ 573.563308][T24045] gretap4: entered allmulticast mode [ 573.997000][T24071] netlink: 'syz.4.5119': attribute type 83 has an invalid length. [ 574.291927][T24089] xfrm1: entered allmulticast mode [ 574.562248][T24110] block nbd2: Unsupported socket: shutdown callout must be supported. [ 574.938489][T24126] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 575.106835][T24138] nbd: must specify at least one socket [ 575.511571][T24150] __nla_validate_parse: 10 callbacks suppressed [ 575.511593][T24150] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5141'. [ 575.549038][T24152] netlink: 20 bytes leftover after parsing attributes in process `syz.0.5140'. [ 575.593086][T24152] tipc: Started in network mode [ 575.593121][T24156] netlink: 4 bytes leftover after parsing attributes in process `syz.3.5141'. [ 575.605932][T24152] tipc: Node identity aaaaaaaaaa3, cluster identity 4711 [ 575.620656][T24152] tipc: Enabled bearer , priority 10 [ 575.639301][T24152] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5140'. [ 575.922155][T24169] netlink: 8 bytes leftover after parsing attributes in process `syz.0.5145'. [ 576.137397][T24184] netlink: 32 bytes leftover after parsing attributes in process `syz.4.5149'. [ 576.188226][T24189] openvswitch: netlink: Geneve option length err (len 256, max 255). [ 576.195914][T24171] "syz.1.5147" (24171) uses obsolete ecb(arc4) skcipher [ 576.200056][T24189] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.5146'. [ 576.237193][T24184] dvmrp1: entered allmulticast mode [ 576.451180][T24202] netlink: 'syz.1.5153': attribute type 11 has an invalid length. [ 576.460163][T24202] netlink: 224 bytes leftover after parsing attributes in process `syz.1.5153'. [ 576.579582][T24206] netlink: 165 bytes leftover after parsing attributes in process `syz.4.5156'. [ 576.608277][T24212] netlink: 32 bytes leftover after parsing attributes in process `syz.1.5159'. [ 576.626673][T24208] team0: Device ip6gre2 is up. Set it down before adding it as a team port [ 576.691210][T24212] veth1_macvtap: mtu less than device minimum [ 576.746266][ T5923] tipc: Node number set to 10136234 [ 576.826119][T24222] netlink: 'syz.2.5161': attribute type 12 has an invalid length. [ 576.861798][T24222] netlink: 'syz.2.5161': attribute type 11 has an invalid length. [ 576.991445][T24233] netlink: 'syz.4.5165': attribute type 1 has an invalid length. [ 577.072174][T24233] 8021q: adding VLAN 0 to HW filter on device bond8 [ 577.081930][T24237] bond8: (slave wlan0): Opening slave failed [ 577.191745][T24239] !: renamed from bond_slave_0 [ 577.471233][T24262] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 577.726258][T24272] netlink: 'syz.1.5176': attribute type 1 has an invalid length. [ 577.823975][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 577.859726][T24272] 8021q: adding VLAN 0 to HW filter on device bond4 [ 577.895442][T24281] 8021q: adding VLAN 0 to HW filter on device bond4 [ 577.935416][T24281] bond4: (slave vxcan3): The slave device specified does not support setting the MAC address [ 577.989304][T24281] bond4: (slave vxcan3): Error -95 calling set_mac_address [ 578.321773][T24272] veth1: entered promiscuous mode [ 578.360100][T24272] bond4: (slave veth1): Enslaving as an active interface with a down link [ 578.601980][T24316] netlink: 'syz.4.5190': attribute type 10 has an invalid length. [ 578.632983][T24320] netlink: 'syz.2.5192': attribute type 7 has an invalid length. [ 578.716669][T24320] netlink: 'syz.2.5192': attribute type 8 has an invalid length. [ 578.815263][T24332] netlink: 'syz.4.5194': attribute type 26 has an invalid length. [ 578.871637][T24331] can: request_module (can-proto-4) failed. [ 579.032900][T24342] netlink: 'syz.4.5198': attribute type 1 has an invalid length. [ 579.128180][T24349] IPv6: sit1: Disabled Multicast RS [ 579.149561][T24349] sit1: entered allmulticast mode [ 579.183177][T24353] netlink: 'syz.2.5200': attribute type 1 has an invalid length. [ 579.571038][T24374] lo speed is unknown, defaulting to 1000 [ 579.627096][T24377] tipc: Enabling of bearer rejected, failed to enable media [ 579.657764][T24377] syzkaller0: entered promiscuous mode [ 579.673300][T24377] syzkaller0: entered allmulticast mode [ 580.106737][T24404] dvmrp0: left allmulticast mode [ 581.088162][T24458] netlink: 'syz.1.5229': attribute type 10 has an invalid length. [ 581.485530][T24476] __nla_validate_parse: 18 callbacks suppressed [ 581.485552][T24476] netlink: 44 bytes leftover after parsing attributes in process `syz.3.5236'. [ 581.692066][T24483] team0: Device vti0 is of different type [ 581.931195][T24493] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 582.739385][T24542] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5255'. [ 582.771171][T24540] netlink: 28 bytes leftover after parsing attributes in process `syz.3.5253'. [ 582.878690][T24548] netlink: 28 bytes leftover after parsing attributes in process `syz.4.5256'. [ 582.891750][T24548] netlink: 12 bytes leftover after parsing attributes in process `syz.4.5256'. [ 582.901614][T24548] tc_dump_action: action bad kind [ 583.068173][T24558] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5259'. [ 583.125139][T24564] netlink: 'syz.1.5260': attribute type 1 has an invalid length. [ 583.139027][T24564] netlink: 228 bytes leftover after parsing attributes in process `syz.1.5260'. [ 583.166039][T24565] tipc: MTU too low for tipc bearer [ 583.186966][T24565] netlink: 64 bytes leftover after parsing attributes in process `syz.4.5261'. [ 583.288710][T24571] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5263'. [ 583.328470][T24571] bridge_slave_1 (unregistering): left allmulticast mode [ 583.337839][T24571] bridge_slave_1 (unregistering): left promiscuous mode [ 583.345704][T24571] bridge0: port 2(bridge_slave_1) entered disabled state [ 583.409729][T24573] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5264'. [ 583.621053][T24583] tc_dump_action: action bad kind [ 583.788103][T24591] netlink: 'syz.4.5272': attribute type 1 has an invalid length. [ 583.805103][T24591] nbd: couldn't find device at index 1048576 [ 583.995160][T24606] netlink: 'syz.2.5273': attribute type 1 has an invalid length. [ 584.274485][T24608] bond9: entered promiscuous mode [ 584.279660][T24608] bond9: entered allmulticast mode [ 584.290288][T24608] 8021q: adding VLAN 0 to HW filter on device bond9 [ 584.322656][T24621] netlink: 'syz.2.5278': attribute type 2 has an invalid length. [ 584.450317][T24608] bond9 (unregistering): Released all slaves [ 584.472594][T24619] veth0: entered promiscuous mode [ 584.516128][T24617] veth0: left promiscuous mode [ 584.838429][T24643] netlink: 'syz.1.5285': attribute type 1 has an invalid length. [ 584.956751][T24650] dummy0: entered promiscuous mode [ 584.965057][T24650] dummy0: left promiscuous mode [ 585.190691][T24667] netlink: 'syz.4.5291': attribute type 11 has an invalid length. [ 586.076900][T24710] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 586.125374][T24713] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 586.143437][T24713] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 586.289100][T24724] openvswitch: netlink: Invalid MD length 0 for MD type 0 [ 586.300253][T24724] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 586.671368][T24740] __nla_validate_parse: 18 callbacks suppressed [ 586.671391][T24740] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5314'. [ 587.011043][T24750] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5317'. [ 587.021243][T24750] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5317'. [ 587.048062][T24750] dvmrp1: entered allmulticast mode [ 587.257091][T24767] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 587.258219][T24766] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 587.486273][T24774] netlink: 4 bytes leftover after parsing attributes in process `syz.1.5324'. [ 587.540285][T24780] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5325'. [ 587.584746][T24780] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5325'. [ 587.616120][T24780] netlink: 4 bytes leftover after parsing attributes in process `syz.4.5325'. [ 587.697153][T24775] netlink: 'syz.2.5323': attribute type 5 has an invalid length. [ 587.834911][T24798] netlink: 28 bytes leftover after parsing attributes in process `syz.1.5329'. [ 588.108674][T24802] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5330'. [ 588.149137][T24802] netlink: 24 bytes leftover after parsing attributes in process `syz.3.5330'. [ 588.882552][T24837] gtp0: entered promiscuous mode [ 588.894961][T24837] gtp0: entered allmulticast mode [ 588.916191][T24841] netlink: 'syz.4.5347': attribute type 2 has an invalid length. [ 589.160546][T24863] netlink: 'syz.2.5353': attribute type 10 has an invalid length. [ 589.180462][T24863] bond0: (slave wlan1): Opening slave failed [ 589.229878][T24863] bond4: (slave bond5): Releasing backup interface [ 589.246600][ T9235] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 589.277681][T24863] bond6: (slave ip6gretap1): Releasing backup interface [ 589.287575][T24863] bond6: (slave ip6gretap1): the permanent HWaddr of slave - b2:46:ad:fb:10:94 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 589.346206][T24863] bond6: (slave veth5): Releasing backup interface [ 589.507282][ T5923] IPVS: starting estimator thread 0... [ 589.558678][T24880] openvswitch: netlink: IP tunnel attribute has 16 unknown bytes. [ 589.634829][T24879] IPVS: using max 26 ests per chain, 62400 per kthread [ 590.072222][ T9234] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 590.322944][T24886] syzkaller1: entered allmulticast mode [ 590.835320][T24919] netlink: 'syz.3.5367': attribute type 1 has an invalid length. [ 590.855493][T10813] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 590.879184][T10813] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 590.931420][T10813] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 590.963497][T10813] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 591.120905][T24937] netlink: 'syz.4.5373': attribute type 1 has an invalid length. [ 591.199262][T24937] netlink: 'syz.4.5373': attribute type 4 has an invalid length. [ 591.214726][T24941] netlink: 'syz.1.5374': attribute type 38 has an invalid length. [ 591.230705][T24942] sch_tbf: burst 8 is lower than device ip6tnl0 mtu (1452) ! [ 591.298835][T24945] netlink: 'syz.3.5375': attribute type 2 has an invalid length. [ 591.327049][T24941] netlink: 'syz.1.5374': attribute type 38 has an invalid length. [ 591.331474][T24945] nbd: must specify a device to reconfigure [ 591.383157][T24941] netlink: 'syz.1.5374': attribute type 38 has an invalid length. [ 591.410655][T24941] netlink: 'syz.1.5374': attribute type 38 has an invalid length. [ 591.537338][T24955] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 591.590415][T24955] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 591.747756][T24961] pim6reg1: entered promiscuous mode [ 591.759759][T24961] pim6reg1: entered allmulticast mode [ 591.783486][T24966] __nla_validate_parse: 81 callbacks suppressed [ 591.783506][T24966] netlink: 132 bytes leftover after parsing attributes in process `syz.0.5382'. [ 591.852710][T24968] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 592.127764][T24978] pimreg: entered allmulticast mode [ 592.132010][T24980] netlink: 8 bytes leftover after parsing attributes in process `syz.4.5389'. [ 592.156898][T24978] netlink: 12 bytes leftover after parsing attributes in process `syz.1.5388'. [ 592.337699][T24992] Bluetooth: hci1: Opcode 0x0401 failed: -4 Connection to 10.128.1.146 closed by remote host. [ 593.003417][T10821] netdevsim netdevsim0 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 593.064358][T10821] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.275803][T10821] netdevsim netdevsim0 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 593.334717][T10821] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.618201][T10821] netdevsim netdevsim0 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 593.651918][T10821] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.774293][T10821] netdevsim netdevsim0 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 593.788608][T10821] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.312840][T10821] dvmrp0 (unregistering): left allmulticast mode [ 594.955103][T10821] bond0 (unregistering): Released all slaves [ 594.972162][T10821] bond1 (unregistering): Released all slaves [ 594.989853][T10821] bond2 (unregistering): Released all slaves [ 595.142656][T10821] tipc: Disabling bearer [ 595.166115][T10821] tipc: Left network mode [ 595.187356][T10821] IPVS: stopping backup sync thread 18216 ... [ 595.638453][T10821] hsr_slave_0: left promiscuous mode [ 595.663047][T10821] vlan0: left allmulticast mode [ 595.669970][T10821] veth0_vlan: left allmulticast mode [ 595.676631][T10821] vlan0: left promiscuous mode [ 595.681878][T10821] veth1_macvtap: left promiscuous mode [ 595.688157][T10821] veth0_macvtap: left promiscuous mode [ 595.696339][T10821] veth1_vlan: left promiscuous mode [ 595.701724][T10821] veth0_vlan: left promiscuous mode [ 596.861867][T10821] vcan0 (unregistering): left allmulticast mode [ 596.883255][ T9226] hsr0 speed is unknown, defaulting to 1000 [ 596.890638][ T9226] infiniband syz1: ib_query_port failed (-19) [ 597.182505][T10821] IPVS: stop unused estimator thread 0... [ 597.259470][T10821] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 597.271525][T10821] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.346950][T10821] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 597.359045][T10821] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.456028][T10821] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 597.467228][T10821] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.525421][T10821] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 597.536683][T10821] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.665613][T10821] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 597.678284][T10821] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.760694][T10821] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 597.772500][T10821] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.851381][T10821] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 597.862627][T10821] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 597.945602][T10821] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 597.956946][T10821] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.125669][T10821] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 598.137793][T10821] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.208430][T10821] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 598.219770][T10821] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.297774][T10821] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 598.309764][T10821] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.395588][T10821] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 598.406908][T10821] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 598.535518][T10821] bridge_slave_0: left allmulticast mode [ 598.541606][T10821] bridge_slave_0: left promiscuous mode [ 598.548339][T10821] bridge0: port 1(bridge_slave_0) entered disabled state [ 598.573197][T10821] bridge_slave_1: left allmulticast mode [ 598.580154][T10821] bridge_slave_1: left promiscuous mode [ 598.586386][T10821] bridge0: port 2(bridge_slave_1) entered disabled state [ 598.602040][T10821] bridge_slave_0: left allmulticast mode [ 598.608824][T10821] bridge_slave_0: left promiscuous mode [ 598.615255][T10821] bridge0: port 1(bridge_slave_0) entered disabled state [ 599.169349][T10821] dvmrp0 (unregistering): left allmulticast mode [ 599.190879][T10821] dvmrp1 (unregistering): left allmulticast mode [ 599.346364][T10821] bond4 (unregistering): (slave bridge2): Releasing active interface [ 599.576972][T10821] bond6 (unregistering): (slave bridge6): Releasing active interface [ 599.677748][T10821] bond7 (unregistering): (slave bridge8): Releasing active interface [ 599.729133][T10821] bond1 (unregistering): Released all slaves [ 599.844828][T10821] bond2 (unregistering): Released all slaves [ 599.957695][T10821] bond3 (unregistering): Released all slaves [ 599.974941][T10821] bond4 (unregistering): Released all slaves [ 599.990972][T10821] bond5 (unregistering): Released all slaves [ 600.018473][T10821] team0: Port device bond0 removed [ 600.025480][T10821] bond0 (unregistering): Released all slaves [ 600.043880][T10821] bond6 (unregistering): Released all slaves [ 600.059823][T10821] bond7 (unregistering): Released all slaves [ 600.176836][T10821] bond8 (unregistering): Released all slaves [ 600.361617][T10821] bond0 (unregistering): (slave gretap3): Releasing backup interface [ 601.740649][T10821] bond1 (unregistering): Released all slaves [ 601.875575][T10821] bond0 (unregistering): (slave bond2): Releasing backup interface [ 601.885005][T10821] bond0 (unregistering): Released all slaves [ 601.994949][T10821] bond2 (unregistering): Released all slaves [ 602.009586][T10821] bond3 (unregistering): Released all slaves [ 602.126230][T10821] bond4 (unregistering): (slave veth1): Releasing active interface [ 602.137380][T10821] bond4 (unregistering): Released all slaves [ 602.202833][T10821] bond4 (unregistering): (slave ip6gretap1): Releasing backup interface [ 602.211997][T10821] bond4 (unregistering): (slave ip6gretap1): the permanent HWaddr of slave - 9a:bf:2b:33:1d:f9 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 602.262586][T10821] Oops: general protection fault, probably for non-canonical address 0xdffffc001fffe000: 0000 [#1] SMP KASAN PTI [ 602.274610][T10821] KASAN: probably user-memory-access in range [0x00000000ffff0000-0x00000000ffff0007] [ 602.284362][T10821] CPU: 0 UID: 0 PID: 10821 Comm: kworker/u8:43 Not tainted 6.17.0-rc1-syzkaller-00127-g715c7a36d59f #0 PREEMPT(full) [ 602.296712][T10821] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 602.306775][T10821] Workqueue: netns cleanup_net [ 602.311645][T10821] RIP: 0010:mld_clear_delrec+0x3a5/0x660 [ 602.317290][T10821] Code: ff ff ff e8 9d 2c 41 01 89 c5 31 ff 89 c6 e8 72 81 87 f7 85 ed 74 40 e8 29 7d 87 f7 eb 05 e8 22 7d 87 f7 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 5c e6 ea f7 4d 8b 27 49 8d 7f 30 [ 602.336992][T10821] RSP: 0018:ffffc900046df4b0 EFLAGS: 00010206 [ 602.343075][T10821] RAX: 000000001fffe000 RBX: ffff8880290ae538 RCX: ffff8880592c8000 [ 602.351055][T10821] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 602.359305][T10821] RBP: 0000000000000001 R08: ffffffff8fa37e37 R09: 1ffffffff1f46fc6 [ 602.367295][T10821] R10: dffffc0000000000 R11: fffffbfff1f46fc7 R12: ffff88805789ac28 [ 602.375280][T10821] R13: dffffc0000000000 R14: ffff88805789ac00 R15: 00000000ffff0000 [ 602.383358][T10821] FS: 0000000000000000(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 [ 602.392394][T10821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 602.399003][T10821] CR2: 00007f78733f84c0 CR3: 000000000df36000 CR4: 00000000003526f0 [ 602.407070][T10821] Call Trace: [ 602.410436][T10821] [ 602.413387][T10821] ? ipv6_mc_down+0x2a3/0x360 [ 602.418075][T10821] ipv6_mc_destroy_dev+0x45/0x5a0 [ 602.423214][T10821] ? addrconf_ifdown+0x1396/0x1880 [ 602.428342][T10821] addrconf_ifdown+0x139e/0x1880 [ 602.433286][T10821] ? tls_dev_event+0x717/0xec0 [ 602.438059][T10821] ? __pfx_addrconf_ifdown+0x10/0x10 [ 602.443352][T10821] addrconf_notify+0x1bc/0x1010 [ 602.448213][T10821] notifier_call_chain+0x1b6/0x3e0 [ 602.453333][T10821] unregister_netdevice_many_notify+0x14d7/0x1ff0 [ 602.459866][T10821] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 602.466646][T10821] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 602.472894][T10821] ? net_generic+0x1e/0x240 [ 602.477402][T10821] ? net_generic+0x1e/0x240 [ 602.481917][T10821] ops_undo_list+0x3dc/0x990 [ 602.486976][T10821] ? __pfx_ops_undo_list+0x10/0x10 [ 602.492114][T10821] ? do_raw_spin_unlock+0x122/0x240 [ 602.497347][T10821] cleanup_net+0x4c5/0x800 [ 602.501785][T10821] ? __pfx_cleanup_net+0x10/0x10 [ 602.506828][T10821] ? _raw_spin_unlock_irq+0x23/0x50 [ 602.512122][T10821] ? process_scheduled_works+0x9ef/0x17b0 [ 602.517849][T10821] ? process_scheduled_works+0x9ef/0x17b0 [ 602.523596][T10821] process_scheduled_works+0xade/0x17b0 [ 602.529161][T10821] ? __pfx_process_scheduled_works+0x10/0x10 [ 602.535172][T10821] worker_thread+0x8a0/0xda0 [ 602.539794][T10821] kthread+0x70e/0x8a0 [ 602.543895][T10821] ? __pfx_worker_thread+0x10/0x10 [ 602.549038][T10821] ? __pfx_kthread+0x10/0x10 [ 602.553647][T10821] ? _raw_spin_unlock_irq+0x23/0x50 [ 602.558870][T10821] ? lockdep_hardirqs_on+0x9c/0x150 [ 602.564081][T10821] ? __pfx_kthread+0x10/0x10 [ 602.568704][T10821] ret_from_fork+0x3f9/0x770 [ 602.573297][T10821] ? __pfx_ret_from_fork+0x10/0x10 [ 602.578424][T10821] ? __switch_to_asm+0x39/0x70 [ 602.583213][T10821] ? __switch_to_asm+0x33/0x70 [ 602.587990][T10821] ? __pfx_kthread+0x10/0x10 [ 602.592761][T10821] ret_from_fork_asm+0x1a/0x30 [ 602.597556][T10821] [ 602.600596][T10821] Modules linked in: [ 602.605452][T10821] ---[ end trace 0000000000000000 ]--- [ 602.611138][T10821] RIP: 0010:mld_clear_delrec+0x3a5/0x660 [ 602.617772][T10821] Code: ff ff ff e8 9d 2c 41 01 89 c5 31 ff 89 c6 e8 72 81 87 f7 85 ed 74 40 e8 29 7d 87 f7 eb 05 e8 22 7d 87 f7 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 5c e6 ea f7 4d 8b 27 49 8d 7f 30 [ 602.638285][T10821] RSP: 0018:ffffc900046df4b0 EFLAGS: 00010206 [ 602.645714][T10821] RAX: 000000001fffe000 RBX: ffff8880290ae538 RCX: ffff8880592c8000 [ 602.654275][T10821] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 [ 602.662357][T10821] RBP: 0000000000000001 R08: ffffffff8fa37e37 R09: 1ffffffff1f46fc6 [ 602.670899][T10821] R10: dffffc0000000000 R11: fffffbfff1f46fc7 R12: ffff88805789ac28 [ 602.679711][T10821] R13: dffffc0000000000 R14: ffff88805789ac00 R15: 00000000ffff0000 [ 602.688025][T10821] FS: 0000000000000000(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 [ 602.697216][T10821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 602.704025][T10821] CR2: 00007f78733f84c0 CR3: 000000000df36000 CR4: 00000000003526f0 [ 602.712181][T10821] Kernel pa