last executing test programs: 6.888086324s ago: executing program 0 (id=3263): bpf$TOKEN_CREATE(0x24, &(0x7f0000000280), 0x8) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x5, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x80000000}, [@ldst={0x1, 0x0, 0x2, 0x0, 0x1, 0x37}, @alu={0x0, 0x0, 0x7, 0xa, 0xd, 0x6}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0xe}, 0x94) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f0000000140)=ANY=[@ANYRESDEC=r0], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3a}, 0x94) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r0, 0x50009418, &(0x7f0000000600)={{r1}, 0x0, 0x0, @inherit={0x58, &(0x7f0000001600)={0x0, 0x2, 0xffffffff, 0x80000000, {0x1, 0x3, 0x6, 0x0, 0x5}, [0x10, 0x4]}}, @subvolid=0x8}) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(r3, 0x8933, &(0x7f00000001c0)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_SET_LBT_MODE(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x24, r4, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@NL802154_ATTR_LBT_MODE={0x5, 0x13, 0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r5}]}, 0x24}}, 0x4) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_LEVEL(r2, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000440)={&(0x7f0000000240)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002bbd7000ffdbdf252000000008000300", @ANYRES32=r6, @ANYBLOB="08e001008fabfb", @ANYRES32=0x0, @ANYBLOB], 0x24}, 0x1, 0x0, 0x0, 0x20000800}, 0x10) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001680)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\r+/\x00\x00', @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xd, 0x8, &(0x7f0000000040)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r7}, {}, {0x85, 0x0, 0x0, 0x7a}}]}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r9 = socket(0x10, 0x3, 0x0) r10 = syz_genetlink_get_family_id$tipc(&(0x7f0000000580), r9) sendmsg$TIPC_CMD_SET_NETID(r9, &(0x7f0000001740)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001700)={&(0x7f00000005c0)={0x24, r10, 0x8, 0x70bd27, 0x25dfdbfc, {{}, {}, {0x8, 0x2, 0x9}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x240048a0}, 0x90) setsockopt$netlink_NETLINK_TX_RING(r9, 0x10e, 0xc, &(0x7f0000000040)={0x802}, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x18, 0x52, 0x1, 0x0, 0x0, {0xa}, [@typed={0x4, 0x1}]}, 0x18}}, 0x0) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000040)={'erspan0\x00', &(0x7f0000000000)=@ethtool_channels={0x1, 0x4, 0x4, 0x1ff, 0x3, 0x7fffffff, 0x80, 0x101, 0x8}}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 6.685458672s ago: executing program 0 (id=3265): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xa2f01, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0xa}, 0x10) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x20044004) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="0a006002bbbbbbbbbbbbbbbbbbbbbbbb8100290086dd6aee854a001011ff"], 0x4e) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="4647b4f310d036b398bd576db787e7b4202ee128ae26c942fc41e537802686e83e6a0af1563bf3b021ec13c349eb6c1ed386de2085218c1cc9fb2decdb2a5f89154999df0aeebf9b9c41add84afb988eeb8fee205f4c", 0x56}, {&(0x7f0000000280)="af4c42680bee64c57b0c7748a3924e8e5599e0238057", 0x16}, {&(0x7f0000000140)="d6f12351876d5702fb64018cc67dcb307616eafb60", 0x15}], 0x3) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x7, 0x10012, r4, 0x0) 6.093215452s ago: executing program 0 (id=3271): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x7, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000005feffff720af0fff8ffffff71a4f0ff000000002d030000000000001d400500000000004704000001ed000072030200000000001d440000000000006b0a00fe000000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f1ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c107571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d1abf3cb17b40ac9b10968f38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d61f3b39c64307f9c82b2807c9ff4a269841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67a41b9e320146ee9f566a28"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x20, 0x10, &(0x7f0000000000)={0x0, 0x5}, 0xfffffffffffffd00}, 0x48) (async) socket(0x1a, 0x80000, 0x7) (async) r1 = socket$alg(0x26, 0x5, 0x0) (async) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, &(0x7f0000000100)=[{{0x0, 0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x1}}, {{0x3, 0x0, 0x0, 0x1}, {0x4, 0x0, 0x1}}], 0x10) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_raw(r2, &(0x7f0000000080)={0x1d, r3}, 0x10) close(r2) bind$alg(r1, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) (async) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x2, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfe}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @local}}]}, 0x50}, 0x1, 0x7}, 0x0) (async, rerun: 64) r5 = accept4$alg(r1, 0x0, 0x0, 0x0) (rerun: 64) sendmmsg(r5, &(0x7f000000db40)=[{{0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000180)="e3a222d9ea29a90a8e09584a2e9d5ccc71", 0x11}], 0x1}}], 0x1, 0x800) read$alg(r5, &(0x7f0000002300)=""/4128, 0x1020) (async, rerun: 32) r6 = socket$rds(0x15, 0x5, 0x0) (rerun: 32) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r6, 0x114, 0xa, &(0x7f0000000240)={0x1, "89"}, 0x2) (async) sendmmsg$alg(r5, &(0x7f0000007e40)=[{0x0, 0x0, &(0x7f0000003740)=[{&(0x7f00000002c0)="4a895703cd17bcedc1666306831c5c5864ffa418ac198f0265d77afca35e38f139b2cf0be1badc10d8cec9dd66449d939643effb514ece9c54c3a48cb71e9dacb4d9daf0705c904f94c08f6c446468930f4ca4313b2d50287be8b9ca790b1161d1131312cb2be667de8247d6f019f3f303c5d97f7e581a1bc5c1c5e16dba7bb3857c21d6de441f58c8548c1657cbab43f1d0535cdc45b1a4024dae285e8a9cc4548a40eaf9679353bf28382bd9a5c5e78ef8920da23b70977b487a0fcd11d9478dfd4d79be5eed791f01fa456cc8c08dbb35a090622d8369f5004bb9197ebc47ad0cb54d5c542242510f9d882928786a87b08daf2acb81b17ab509ec15c585d2006b36c21f6e81046ae16898ef797e0544581fcec801e889686f1b80fbd12a373099966e76f03d9b9e097806d23f8f7102282ad4f721ded9bfdbf406ffb3e6a6467dd909b66112e29d073a37fb6e077ad638cb8f28bfe888fe6c009ad37d368ad0c4a34a70c1a795110e63c41bdca93473f3b74127e35634cc05d5bdd55c5f5f658617d5dc911ef5d5b117d6dec9849636850ff9bf25ffd0fe09b81c653be1ce231c96dfd5514e7967c5ac79fedc4dae746bdb11725be5650a825c178356db68d31e155b20114105a3e902555f329448ca577a1a3be792d396e10c84fcc52c43f25efd40730b23db6f4cca8ab196b5a201184f4b7b4cec7ef64a325ff3fbcbc51dc46466209b4781ecbc943e33a20a9b2a290434279b09ee3911e2ce54ffbb634db216096f9b6d7cd1b093d05d0f03f7df64e2670c9336c7bf27d0da73d81498bf0572661225ab62f0f4b2bce327927c1d4b923cc3db422354e389c81749dd51042d3c98a7e5acaaef627283b630d59a8a75dc506400c40d6c8c0a062254cde2e643fe99fb03f42f0396e23b0273f0f5a354826824ab2d72b8793dcff47c75387011767f554f7594918d76fc80cecef01ac74dd10d257ac962209026850f3e1ec2877ea63c59c3c4e751594c31774ade2eac9e94b33b2d06c668cb700fdbe61ac4ec2d595f5a3f5b2722f7644fa8081d1445bada8624b025291d7528144d5a092d410249b20f9faba62f760c05b9e25abdafd107a29033c3ca67cb62500ce9979878a2c293151528ef33574e96148c7798ee427936f205627c1d6aad4e1956b10495b23ebb2fd687d75cb0f9faec439c494cb59c3293d62617f9e0c88168f993e8540db1ab44dfad05bd7c7841954f21a923fc049a8f6e141a0ae26e55e167063421e35340a19c6316e593dc46b2c5d00b1118f5badadcb30af89ce2efe81937727c5d38c9368ecb79f3b1393dfbf74b713ca09f3e3ed774019227497ab6599fb4be12be93b4ba8cd7c5e5ab022e43b11179c9a58a938e8fc9bd0f2ea990d6af6545827b25d23002b8de3faa3994711d9fd4e5ec7e5f2b3e64df3e5d9f31762c39aa25902bd49e17ebd597730461fbcf75095375a49775a92e0246f963e021b678d30bf218e495d6acccbc2b94e555b4ef1392dea925e9ab0afcb85314c3577fd5962fb6845ace74af46a71b4304bc58c953e02e8aa7adccd209bca4f5c6b16161aeb3d5377a15c3e2ac38136b8b0424bdec89354cb53319bee78cd078fcf99dd3c02d6b9f070c40c5adda3f7d58d8476b1688f0e776695b8ae6b807b55a4a84d67d772a1b663ccca7bdb47f098265378205b921140c5ae3ae03bbc8821a4cfb79add44884ebe9c7d67415de7a4f51e315910f77be57c12718e1cc0700d0112af51013c4a87ec39226abf811a19a857a04e7ada6265345e87bf5ad3327afcde22e16543b3cf4f4bdccdbdcbf2b6e2291f4877b32b5a69e00387bfb1c824380bd57f3af90cf685b5cfb874f7870adbf50621768bf2d45eb5c3f783dcc067b001aa01c6cf239e98010cd016108fb1de06cc59070b5db347ff892246fbb699e0ee999cc9c923e2a5354fb4816c15dd8206f1033b556666b3ddf2aae0e892055239d9c5faf1c4b61de224d153623e40574918b1639635ea46a895d2f5a2958d409dddc1e55441fbdfe40b83ae0b3f3f8f694d18b19a9bef18c54c6888636e803154d8c8fb66566f4ba5fa02a7bfd5ed23cf61f75b26fd7f3ff03d1b9e26ac0e2568604f9e550185abad80dacbe12bac5a01c3b0d06cd9f8532ce8ac28ee8fabbd1f8f6622077dcb41ebedc2c2eeb2e1efa3f1ecfb5937a1368f54ff4255676840dd65006460ee6703275c51d27fe4bc6f5923720983a235df824190ab6f908475d2496e5928e915d48a33a7e2277617898a0ee8609eb526528e5f00c5f003972491a16ea209c8a794b6acd2997731d656d83f2ec41412ab3d48256424279a27f8e99431c25ce3afb42eaace7daa26e760912b02f3e5842340ce81f05694ae63c854928bacdbdbe2d1919d0044b9e2d142cd330bc4cdfeccd89d14974ded579a559584384615123d3b56f00ff9bf1c2ec28d23a15c5031a990d79462cfbf4fa576f10b74ce05276e433c4b1acf95fc29929c29c8de9ccc781b644bec6b3736c054a7699b3372133dc52da8b3e42976a5ff354fdb08335843698cdc198f5b1067b1a73ecf317397e64db3f6965d29fa6c76822685f7e0566a8984b57912527ce5df0eaa24ae441b9e7f01ed0121c58938dc1620c448bb9e1d746c499e8b249262e5bc7b642c245e04623f4c0cccc8a6e5c043da2921cd642287984e6c94619b79d23c576a27d10a9850fcf09a6bab32761cff1b0abdb521426588162e9b4e11e6e90aa2e1d227842c245daea800e6567c6a94ada996fa8f23d25ab3d3fbfb53d3bfec69fcd4f8a0a3f21851960363bad9a156a8bf8dac7bc61b3df1e0f88bc46e589c432e9321165f8bc5a8e7c4fdff96ee9fa27f1b03ff6e16d90f40bd55234cc7606e0f2d10889c5c26e7f9e79a76c63991b02b35df613c030186211742a9b80ad7fe4b415e9293f9638f83d95548442723ae89f62ef2c7e68acf94ccf9281fc4d6d1b4db097602080a5f715a3dfec6f792cf7a81884c6ebb57ae05ffa16146586b8c42dbc686e009522f0c8d4e168206d79966bd53d59483c73e8e522420f7c325444e8a10346749e3fa20dc892e0ac305ae50fdca06ea1aa29dac09fc2fa848565d643396db05cca93008560155ab60e7f31380974dd6aa735e7498148d7b1e1bf35fa35fa213da8f3d4d4b3dc1aabbff1b2e00e793ddec178c85cd9d8ba3b335887b0c715c3fe4b5fc7f8b2f63250f73af47142744572e1db60f8c7361c7fb811b5f4af6e6c10fb3d9440aa0367609fa6c32dd1bdd613970be35d74f34cc5bbdc9f630480c9c82f3118fe033617c353e795a9b7308336b8dc65f3328fabf4532a87c9f1d9d35f431959f2ab922cabbfeafa051a771916653f6bab8910e437e613e02fca4c6019c640b822f6657607b983694862409f06ce57bae67ada5d83945a6caea554a13488a6d8bb85c80a779e9bb4c2ed07abdec0f6d0c83497efd096d3a5ca5095885ebf7b3cf7183350bce692aa62fc1b45f620647bb2cf8744b57dc5c1f47de9bb005e6802b3d3efa4dcee835252d178239bc28fbd1bee6a7a3d70359330f1b7ff4daecb1f820f00398a2ce4046202db3c1b80ae497bd9d065c2fb265716e984378b4ccb5b6f5d2ffcc5c992aa259ca1ac92bb387c53f5e73e65263e7312b7dbfdf799b06c1999218d613046d57a2bc1e27ca84d41a0bb4a1ba08786d0c8ba1c293f914659b5d32cfd95ef7a1b3709e8ba41f037242e44df5fa2b1a0dccb0ea43ddb85e5dde552f5747e52e8c73d25dd0c903229522c4d91e523879d377f318b7f353ec6954f3aff1dd0bd7cface9dd2d209e181f2a74e07c557e4bae9645a4d282c84b70c74a8210669fd8e7cbe4e17813dd8a0da360d2c99d675abbf66ca6a1cdb18112c509338a7b22e14309732d732f873474e25f5e36bd730336cf35517ecc2da649c85adce16aa98554470d16058aa77898bbe450a85bff003273ed0b23806af8034aa91348774412d5f608bc7efdec13414dcb735e0de85ff8de01fbedf5585900d2f301092fd57d91f828cf5babf70610d45f1545dc0bab7f69c90efbf2edc6f46f397ed9a13da7cf7123d008f0a1af23f20ebefabb5a7a46ecaa675f8b57e8478cf31ac40fe4874cdae89e4b8d4e7684252d89fbb2f5bf24bcbbeefa53cc24a2856636454390a1d47efafb4c23712a4b9c8dfe6f370fa4446eba7703215233a749e3a7ab28542dfbf03db73648e6bf06395858d59ec7dddbe460aae30487e91c2d19c8334525adef322a66a70ea32d2f8a72bf1bb3b0d9bc2d6ebd40bba9e4c02d3ee005a0a72e5f65afb01f6adb8ab2cd11d9c9fad7e3e1f950659bf1826b380a4f296c76c529a65235a15a9596a2a330431d5e905390321dc4a47c84e47c3e8e8cc5b11cf62d7515e584359a1e442abfc9aab4d0233eb0911398c43688a8fe41d462bde8aa4be1af978cc0b40dc25ea20c3fdb0953a3293e197748cdcd576619c4fe8b5754851c90b6b5207b3eefbd86eb67012663dbc87858a86dc51855381dc746501eb76316d778da06c4d8a03ebe3a07f05dcbfdbe6020bd8f4547e6b598cf4dc7be2ea167c4fd362b2224d4869b97d991c64251faacea7184ee97349d5b68af90bacd5441ae423173f6271d1be106381a7bcf0925d25ae26a0afb1c82232a648c178b8076a5fa8bedeec3c90f450dbb3573fc45c2d7b65c420d4f323069d3cfafc6dac879698b801ea8dd18b6d3c171200308e76f0c16a977bc73cd88818196a9b54b47c3f3c9595e8ddcb38334202cecba7764505340680c858cab156e658785bda719237baf1164e2927ccebcf8dccfcebacb0d3bac011cf7c544b71f1c399931ea886524d10e95319d12fc63b74d532e9c94aa78d43fc2b097e496e69405d3e147a45454cb292987330d126bba36dcefe664cce49bcd0f782d03a93e059b7ee23039ae30e47be8c457ca092238659e022c5cc1830a6c6179a65be9865d9f2ce34b25fed3551b69bae554528679e2110d9d4c85302ad99272174b8bbb2da37810cda715eb2536a91011999b9bbbdfff212d0dbd40126b12f2ecb8d389a1e845f25c30cb2986cc85aa5614c10837afa40061cddcf14297bd2861106dec71a0b34a79afe612394633ea6b8f71495b3db408728bf37de889768d6dd2642a627f928c6a86df2bedf3352e5f56a5ed424770d613331aa5d6e71bb40bfef383d69f3ef570156093ee4f31500513e50abf5e576dd6571d59910f8d21f75e2fe2913c6348a2c23ec8bcfeef8c5b4cb4ca254496e78a0beadcfdb96afdf9f0f5ccb7abe6746cb718dab6ea7f0ba8080d0ce12ec9985978f76b885a85adc2e3115db7450644c75cd80062c7f34cd0b7824d621607759ba8eb17289d3920f1356319e980c989d794016dd05987cc8a17a947a8dc0398de5cec6dd1eadf685de957ca4d1394fc67482fd22498f6aacc8e7f25ebac952073e12f526e1427ee49e6df9e5c895df631e5b4041e6e88b3508b8c3ce597830e2ce3aad12ecb696e5ef7970cd9c1e3be94506ac746f7ce8438a356507027149d0ebd6e95783ff084609fc079ace20e5bae9cac9625f58ff8ccb2c2b50506a237ecdf21774d560ba51d9d956691590392a5aa5ad6a2ff9d69d58a82401f7de6daacf3257f20c9847c3760ab1a41ab024df0ad8789fe629c0d7ab8adeea9777a914f79e2b4dbc3e234505f1729467a60b410ceadc87a2d8c12c0cf46c8ab0a7392e971d5ac3035788b2177ae165336074f29effda63042146c2e13a12d50b67", 0xffc}, {&(0x7f00000000c0)="4789d3aefc1a4d03345aed327be33c28c8dc0d", 0x13}], 0x2, 0x0, 0x0, 0x20000000}], 0x1, 0x20040894) (async, rerun: 32) r7 = socket(0x400000000010, 0x3, 0x0) (rerun: 32) ioctl$sock_SIOCETHTOOL(r7, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000000)=@ethtool_eeprom={0xb, 0x0, 0xffff0000}}) (async, rerun: 32) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="030000000400000003fff2004700000050fb50fa", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async, rerun: 32) bpf$ENABLE_STATS(0x20, &(0x7f0000000500), 0x62) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000400004803c0001800b00010065787468647200002c000280050002000000000008000340000000000800014000000013080004400000000008000540000002"], 0x94}}, 0x0) 5.882454006s ago: executing program 0 (id=3273): syz_emit_ethernet(0x2d7, &(0x7f0000000700)={@empty, @broadcast, @void, {@ipv6={0x86dd, @dccp_packet={0x4, 0x6, "518db3", 0x2a1, 0x21, 0xff, @local, @dev={0xfe, 0x80, '\x00', 0x20}, {[@srh={0x87, 0x10, 0x4, 0x8, 0x0, 0x28, 0xff, [@empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @empty, @remote, @private1={0xfc, 0x1, '\x00', 0x1}, @remote, @private2={0xfc, 0x2, '\x00', 0x1}, @private1={0xfc, 0x1, '\x00', 0x1}]}, @hopopts={0x21, 0x6, '\x00', [@enc_lim={0x4, 0x1, 0x6}, @jumbo={0xc2, 0x4, 0xe}, @generic={0x4, 0x26, "ecfc20aae4709d449f7ff08840f187b944be94e685751f9a386e48800a8cd136f99470342b81"}]}, @dstopts={0x73, 0x0, '\x00', [@pad1]}, @routing={0xbb, 0x4, 0x2, 0x3, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private1={0xfc, 0x1, '\x00', 0x1}]}, @fragment={0xff, 0x0, 0xf7, 0x1, 0x0, 0x19, 0x67}, @dstopts={0x87, 0xc, '\x00', [@enc_lim={0x4, 0x1, 0xf8}, @hao={0xc9, 0x10, @local}, @calipso={0x7, 0x40, {0x1, 0xe, 0x0, 0x8, [0x8000, 0x3, 0x0, 0x7, 0x3, 0x1, 0x7]}}, @enc_lim={0x4, 0x1, 0x2}, @jumbo={0xc2, 0x4, 0x1}, @ra={0x5, 0x2, 0x4}]}, @hopopts={0x33, 0x7, '\x00', [@pad1, @ra={0x5, 0x2, 0xa4}, @pad1, @jumbo={0xc2, 0x4, 0x6}, @calipso={0x7, 0x28, {0x9d9e5f9106412942, 0x8, 0x6, 0x9, [0xfff, 0x6, 0x2, 0x6]}}]}, @fragment={0x32, 0x0, 0x1, 0x1, 0x0, 0x8, 0x68}], {{0x4e20, 0x4e23, 0x4, 0x1, 0x0, 0x0, 0x0, 0xa, 0x4, "0e1d77", 0x0, "2cf028"}, "b82fd609280651fc3fd1365ad8df8e4a51c2c3f4146520a0193d47cc311f3375eff6333e95af6baacfa2a2f71740c653963b7ee00e1b559889870cb2b89eaba9442a12e32bedfde8995f559b30463b2ff7395b2aae64add69a11af8f470c51266fbc0a643ba2396ab6e7ce6ebc0c17ede8774fd0ce825f14e991738878fe94ff772f4b6f800511c40ccc9f02164d2993b691864685ca61098a4ce1a9da41c1ef65f51a66f6c6e58b60791ff07a4febd06a98159fa85048b935cdfd5afad2ad8243e342c87936ef5800"}}}}}}, &(0x7f0000000000)={0x1, 0x3, [0xa3, 0x554, 0x68d, 0x974]}) r0 = socket$inet6(0xa, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r1) syz_open_procfs$namespace(0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x40) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r4, &(0x7f0000000400)=ANY=[@ANYBLOB="000086dd0001110004000000a60c6eec00be00442ffffe8000000000000000000000d178000000aaff"], 0xfdef) ioctl$sock_netrom_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) sendmsg$DEVLINK_CMD_RATE_SET(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x34, r2, 0x1, 0x0, 0x0, {0x2a}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4001}, 0x0) sendmmsg$inet(r0, &(0x7f0000001800)=[{{&(0x7f0000000040)={0x2, 0x4e21, @multicast1}, 0x10, 0x0, 0x0, &(0x7f00000006c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x41}, @empty}}}], 0x20}}, {{&(0x7f0000000280)={0x2, 0x4e24, @broadcast}, 0x10, 0x0}}], 0x2, 0x0) 5.552129261s ago: executing program 0 (id=3276): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x5e) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r1 = socket(0x1a, 0x3, 0x8000) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000080)={'wg2\x00', 0x0}) r3 = socket(0x400000000010, 0x3, 0x0) (async) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x2, 0x3, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_GET(r1, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000100)={&(0x7f00000002c0)={0xd0, 0x0, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x7c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nicvf0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r5}]}]}, 0xd0}}, 0xc080) (async) r6 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x10000860) (async) syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r6) (async) write$nbd(r6, &(0x7f0000000180)={0x67446698, 0x1, 0x4, 0x4, 0x3, "2ff6fb41716bb488bde81320e730ab9a2203ec5255ff1a87d8b4b8044dac8fb4a1485f89034dada09a7dcb4d3fcbd0a095fac4d0bc673d565019e281bf3ed7c49af271930e68db94da847f62167d5a3ac9fe8fa3148540b04b461c5e2f4ce95a66b0220b91ec84d53ec05f6d16af7c21521c92b579dd0edddd31f88d9e70c34392207de9e7a463a39b7419b5e194851ae3d5724d61dc8e25e03c55921ff2893e5fbc23f8fc09b288c479b28569217b746dc73b95f84b3a05f02538475b4fc8a6cf07d3f7f6b7"}, 0xd6) 5.375564873s ago: executing program 0 (id=3278): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000000)={0x1d, r2, 0xffffffffffffffff, {0x1, 0xff, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r1, &(0x7f00000001c0)={&(0x7f0000000100)={0x1d, r2, 0x0, {0x2}, 0xfd}, 0x18, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x24000880}, 0x40020) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) recvmmsg(r3, &(0x7f0000004380), 0x0, 0xc0000000, &(0x7f0000004580)={0x77359400}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x38}, [@initr0]}, 0x0}, 0x94) r4 = socket$inet6(0xa, 0x1, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x2, 0x9, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2b}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xffe0}, {0xf, 0x9}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) r7 = socket$inet6(0xa, 0x805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x1c, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1}]}, &(0x7f00000002c0)=0x10) getsockopt$bt_hci(r7, 0x84, 0x82, &(0x7f0000000080)=""/4076, &(0x7f0000000040)=0xfec) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.236607141s ago: executing program 2 (id=3315): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@gettaction={0x50, 0x32, 0x20, 0x70bd25, 0x25dfdbfe, {}, [@action_gd=@TCA_ACT_TAB={0x1c, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}, {0xc, 0x1d, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0x10, 0xc, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}, {0xc, 0x17, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x40}}]}]}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x4048840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800000010000d0428bd7000fcdbff2500008000", @ANYRES32=0x0, @ANYBLOB="1000000000000000280012800b0001006272696467650000180002"], 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000000)=@newlink={0x6c, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x35288}, [@IFLA_LINKINFO={0x4c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x3c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @IFLA_IPTUN_LINK={0x8}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @remote}, @IFLA_IPTUN_FLAGS={0x8, 0x8, 0x8}]}}}]}, 0x6c}}, 0x4000080) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca6dc15}, 0x400884c) r1 = socket$netlink(0x10, 0x3, 0x0) socket$kcm(0x29, 0xde74a09a9062cc15, 0x0) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.838567883s ago: executing program 2 (id=3318): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f00000004c0)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000000c0)="33d702f6741d64298eab3dc282428f8a", 0x10}], 0x1, 0x0, 0x0, 0x18800}], 0x1, 0x20044000) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f00000000c0)={r2}) setsockopt$inet_sctp6_SCTP_RTOINFO(r6, 0x84, 0x0, &(0x7f0000000100)={r5, 0x7, 0x7, 0x975e}, 0x10) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000080)={r5}, &(0x7f00000001c0)=0x8) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800c0001006d6163766c616e001400028008000300000000040800010001"], 0x44}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=0x0, @ANYRES64=r4, @ANYRES32, @ANYBLOB="08001b000000000008000a00", @ANYRES32=0x0, @ANYBLOB], 0x3c}}, 0x40) socket$alg(0x26, 0x5, 0x0) (async) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash\x00'}, 0x58) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) (async) accept4(r0, 0x0, 0x0, 0x0) (async) sendmmsg$alg(r1, &(0x7f00000004c0)=[{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000000c0)="33d702f6741d64298eab3dc282428f8a", 0x10}], 0x1, 0x0, 0x0, 0x18800}], 0x1, 0x20044000) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x2, 0x80805, 0x0) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) (async) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) (async) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x89e2, &(0x7f00000000c0)={r2}) (async) setsockopt$inet_sctp6_SCTP_RTOINFO(r6, 0x84, 0x0, &(0x7f0000000100)={r5, 0x7, 0x7, 0x975e}, 0x10) (async) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000080)={r5}, &(0x7f00000001c0)=0x8) (async) socket$nl_route(0x10, 0x3, 0x0) (async) sendmsg$nl_route(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000840)=ANY=[@ANYBLOB="4400000010000100"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800c0001006d6163766c616e001400028008000300000000040800010001"], 0x44}}, 0x0) (async) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=0x0, @ANYRES64=r4, @ANYRES32, @ANYBLOB="08001b000000000008000a00", @ANYRES32=0x0, @ANYBLOB], 0x3c}}, 0x40) (async) 1.574348112s ago: executing program 2 (id=3321): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000700000aa4000000060a0b0400000000000000000200000078000480740001800a0001006d617463680000006400028008000240000000000c00010072617465657374004c0003007e6b92c43235dc7e977221f83c3f179e65022fc067b787cd67b6d9983b1bddaf0200000000000000d2ee94b31d2ec330ce34cc676c0783a4bcc1e966554b0470582e870b81e92a630900010073797a30000000000900020073797a32"], 0xcc}, 0x1, 0x0, 0x0, 0x4008011}, 0x4000800) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000080), 0xffffffffffffffff) pread64(0xffffffffffffffff, 0x0, 0x0, 0xfffffffffffffffc) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_WPAN_PHY(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x14, r1, 0xb15, 0x70bd2a, 0x25dfdbfd}, 0x14}}, 0x4) 1.460088073s ago: executing program 4 (id=3322): bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x6) getsockopt$ax25_int(r1, 0x101, 0xf, &(0x7f0000000080), &(0x7f00000000c0)=0x4) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000140)=@mgmt_frame=@action={{{0x0, 0x0, 0xd, 0x0, 0x0, 0x1, 0x0, 0x1}, {0x2}, @broadcast, @device_a, @random="86d51fbfdcc2", {0x0, 0x2}}, @tdls_setup_req={0xc, 0x0, "", 0xff, @void, @void, @val={0x2d, 0x1a, {0x10, 0x1, 0x2, 0x0, {0x9, 0x8, 0x0, 0xf, 0x0, 0x1, 0x1, 0x1, 0x1}, 0x8}}, @void}}, 0x37) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x12001, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'vlan0\x00', 0x8000}) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback, 0x2}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) r4 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r4, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x0, 0x0, 0x0) 1.459624602s ago: executing program 3 (id=3323): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="d8000000140081044e81f782db46b904021d000025000000040000a118000200ff02000100000e1208000f0100810401a80316ea1f000b40032a5f54c92011148ed08734843cb12b00000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5e835913b06218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f52eb4edbb57a5025ccca9e00360d8bcc0000000000000080bb9ad809d5e1cace81b341139fe3cd4032ecedb12d1d2eb0c0ed0bffa29954e5413f017fe491", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) 1.411513028s ago: executing program 2 (id=3324): socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/uts\x00') pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket(0x8, 0x0, 0x8000) ioctl$sock_netrom_SIOCADDRT(r0, 0x6180, 0x0) ppoll(&(0x7f0000000080)=[{r0, 0xc}, {0xffffffffffffffff, 0x2000}], 0x2, 0x0, 0x0, 0x0) sendmsg$kcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000005c0)=[{0x0}, {0x0}, {&(0x7f0000000040)="8abf3da3d40a7e47a3166755efcd6d20723535cabe9c6247005c18", 0x1b}, {&(0x7f0000001380)="567e5546468b893160da3ccae3ef9541ae39a717cc5e87ac2f442d440cae468e80466e32ae46c068112e42e74949e14b42c9b14ca0134786ef9bec3e2b1760126fd570bd9c23240f3d8c34d1f793a707706b51a27b6f2a69d3cf536ab60022e58517fcd0fb58cc2d98b82a7d7730f69b604d9894b2d3cf07171e50600032db6b43c07d658b92c78a4734bff1899d8a6cd9ead3bc25ec3a269893277c4849e9f4136e371ce4566208c2fa8a71e6aaa9c0cd823a48358b2e81e841565091143296817c143d4b80e69376fa2f6799eb93eb90bbac17c1ca722b16cb42cad80ebc38e08b215f9226bd7c2d2899d305499f819ae9fb2c2fd68dcf93316c3e6afb9186246be7ec1c57e3947328cd412987b21d8c901b08c12d322a338dde330d15ca570c393a3b4bf9348a67e1669e1c3bef8bf095aa9d2d5611bb82b42c9249b9a388c6c7817b9b9ba3678835971992410545d2d45a7f95c4c10aac8069e2b86ec5f45fbc7579c51fe7243563883c3942e6c81c92ba8dce333b2903ade83a7d7218e4165a4337b067c82384179991538bc92022837ccfaed629273189844096ece6a6d6928ecf6e74d308d040c2b1b2a03cfa2e94267eb0807e8b5bb859f4ead965c2476d20a709113d9740b3c87fa9285e2cdc8c17deb5b05b1fe55b3864ae35dd4bce8a03bb3e7d05bec29fa019fbf578dfe64d98ab2f1545969a8915405f1b6785aaf2980b0eaff01ec878bfd479a54200bd7a2599ecd2a5b6e73c41aa1ad8c46d094c02e7e729ef9fcc83eac2169f4ac93a78c7fdbdb5923b0e0e20aec822b66650b5c82b71316211227174504f3b9c77c2", 0x251}, {0x0}], 0x5}, 0x4044880) 1.22788487s ago: executing program 3 (id=3326): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180200000500000000000000000000008500000041000000850000000700000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000001c0)={r0, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x4000500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r1 = socket(0x10, 0x803, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0xfffffffffffffe3d, &(0x7f0000000180)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELSET={0x0, 0xb, 0xa, 0x3, 0x0, 0x0, {0x4, 0x0, 0x1}, [@NFTA_SET_DATA_LEN={0x0, 0x7, 0x1, 0x0, 0x28}, @NFTA_SET_DATA_TYPE={0x0, 0x6, 0x1, 0x0, 0xffffff00}, @NFTA_SET_USERDATA={0x0, 0xd, 0x1, 0x0, "d52570c72818d8329a1b2dc4b24f1b38b6f13d9dfb95d16d15bb733ee2d28762de159a90ccf0507453e69d7c5fa83f89247f7c763be08bfe97a1ddca144942f9bdb60bc28085e0bd55ae7711484d50e718f08a0befda2dfc13a4c3bd6bf020529f5912b07fb79fdeb46bfced1326f49292cf9990d3c12d0acbc6ca6cbbb8226f4191c94f7c3e435f69b3e257292a5dadca47ba9a7ea375d0a87d57e565532f00f4b447a06845c238770283c0f70feec9b9051d2850808a60b0fcee7c9d5b3dc20c3f320b2aee226f627b22e2ae67d5b8d69f9813b2b06e20d6a6fb527997"}, @NFTA_SET_HANDLE={0x0, 0x10, 0x1, 0x0, 0x1}, @NFTA_SET_EXPR={0x0, 0x11, 0x0, 0x1, @numgen={{}, @val={0x0, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x0, 0x3, 0x1, 0x0, 0x1}, @NFTA_NG_OFFSET={0x0, 0x4, 0x1, 0x0, 0x5}, @NFTA_NG_OFFSET={0x0, 0x4, 0x1, 0x0, 0x8}, @NFTA_NG_OFFSET={0x0, 0x4, 0x1, 0x0, 0x4}, @NFTA_NG_OFFSET={0x0, 0x4, 0x1, 0x0, 0xffffffff}, @NFTA_NG_TYPE={0x0, 0x3, 0x1, 0x0, 0x1}]}}}]}, @NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x7}, @NFT_OBJECT_CT_HELPER=@NFTA_OBJ_TYPE={0x8}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x58}, 0x1, 0x0, 0x0, 0x24000850}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x208000, 0x0) write$tun(r3, &(0x7f0000000300)={@val={0x0, 0x6004}, @void, @x25={0x3, 0x4, 0x1c, "bd013afc2d26f1abba76e8a0792fd69aafabbd89d544de3b1601538cd67d6381911d63431cee24000c1dd787c20013ecf072174e6e8a7237dfd8ef1bbe4c5692f076718fd1dcd9ed3a53b027c58e2a6d0e4161e4f96dbd308e92f8fabc84b5e0f286cd895fdac3092bae3598516a1a94dc3576c470b3e36428a7eedc752fc788e88d0f9822d28d2814"}}, 0x90) close(r2) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000280)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0xfffffffe}}) 1.107227465s ago: executing program 1 (id=3327): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_REQ_SET_REG(r0, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x34, r1, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}, @NL80211_ATTR_USER_REG_HINT_TYPE={0x8, 0x9a, 0x2}, @NL80211_ATTR_DFS_REGION={0x5, 0x92, 0xb}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x1404e081}, 0x8000) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f00000004c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x55}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$BATADV_CMD_SET_MESH(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x24, r4, 0x11, 0x0, 0xffffffff, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r3}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x24}}, 0x0) 1.057193666s ago: executing program 3 (id=3328): mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) (async, rerun: 32) r1 = socket$unix(0x1, 0x5, 0x0) (async, rerun: 32) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async, rerun: 32) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (rerun: 32) r4 = openat$cgroup_ro(r3, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) preadv(r4, &(0x7f0000000140)=[{&(0x7f0000000540)=""/72, 0x48}], 0x1, 0x9, 0x0) (async) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMP(r5, 0x1, 0x3f, &(0x7f0000000340)=0x7e, 0x4) (async) r6 = socket$inet6(0xa, 0x1, 0x6) getsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000000840), &(0x7f0000000880)=0x4) close(0x3) (async) socket(0x400000000010, 0x3, 0x0) (async) r7 = socket$kcm(0x11, 0x3, 0x0) (async, rerun: 32) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (rerun: 32) close(r8) (async) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (async, rerun: 64) setsockopt$sock_attach_bpf(r7, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r7, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r9, 0x3e}, 0x80, &(0x7f00000001c0)=[{&(0x7f0000000180)="27030200000214000e00", 0xa}], 0x1}, 0x5) (async) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[], 0x4c}, 0x1, 0x0, 0x0, 0x885}, 0x44008800) (async) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$bt_hci(r10, 0x84, 0x76, &(0x7f0000001f00)=""/4062, &(0x7f00000004c0)=0x744) (async) r11 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt(r11, 0x8, 0x7, &(0x7f00000002c0)="c1841d67", 0x4) (async, rerun: 32) ioctl$F2FS_IOC_COMPRESS_FILE(r10, 0xf518, 0x0) (rerun: 32) 900.36463ms ago: executing program 1 (id=3329): socket$kcm(0xa, 0x3, 0x87) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0x22, 0x0, &(0x7f00000008c0)="f6f4e9a1000000000000000d0800c32a8bc678bbd404fcd535fdc8a75167efec52a9", 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)="0102", 0x0}, 0x50) sendmsg$IPVS_CMD_FLUSH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="14000000", @ANYRES16=r2, @ANYBLOB="010029bd7000fedbdf25110000006d89f0aea65d0a15dc3296b348375a3d63cbf60c867ffe4c1ddf60a19eb56447428c240a71146ed691b3b228e956f41e1b8912e1c09503415bc40a6a01c55de1a15854"], 0x14}}, 0x44800) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[], 0x3c}}, 0x4000000) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'rose0\x00', @link_local}) write$tun(r0, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 781.396439ms ago: executing program 4 (id=3330): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0xffffffffffffffa4, &(0x7f00000002c0)={&(0x7f0000000340)=@updsa={0x180, 0x10, 0x1, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@dev={0xfe, 0x80, '\x00', 0x28}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x20, 0x5c}, {@in6=@loopback, 0x0, 0x33}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, {0x0, 0xffffffffffffffff, 0x5}, {0x0, 0xfffffffffffffffd, 0x1900000000000000, 0x8}, {}, 0x0, 0x0, 0xa, 0x4, 0x80}, [@algo_auth_trunc={0x8d, 0x14, {{'sm3\x00'}, 0x208, 0x0, "a8841ff973ad4a7ffa45a84ae2540cfadba6d51b9b26bae4ce7c99365983d06d1ccd6bb6054247be71e404b434ebca103d267b7b4d5886028daf42a66adf39ff27"}}]}, 0x180}}, 0x0) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0xffffffffffffffa4, &(0x7f00000002c0)={&(0x7f0000000340)=@updsa={0x180, 0x10, 0x1, 0x0, 0x0, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@dev={0xfe, 0x80, '\x00', 0x28}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x20, 0x5c}, {@in6=@loopback, 0x0, 0x33}, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, {0x0, 0xffffffffffffffff, 0x5}, {0x0, 0xfffffffffffffffd, 0x1900000000000000, 0x8}, {}, 0x0, 0x0, 0xa, 0x4, 0x80}, [@algo_auth_trunc={0x8d, 0x14, {{'sm3\x00'}, 0x208, 0x0, "a8841ff973ad4a7ffa45a84ae2540cfadba6d51b9b26bae4ce7c99365983d06d1ccd6bb6054247be71e404b434ebca103d267b7b4d5886028daf42a66adf39ff27"}}]}, 0x180}}, 0x0) 711.135542ms ago: executing program 3 (id=3331): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="1800000024"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x2, 0x2, 0x1}, 0x50) ioctl$F2FS_IOC_GET_FEATURES(r0, 0x8004f50c, &(0x7f00000000c0)) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000000100)=ANY=[@ANYBLOB="340000002e0003050000000000000000200000f8ffffffffffffff0008000000", @ANYRES32, @ANYBLOB="0c000f"], 0x34}], 0x1}, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r0, &(0x7f0000000080), &(0x7f0000000200)=""/176}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000380)={r0, &(0x7f0000000300), &(0x7f0000000340)=""/55}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000980)={0x18, 0xd, &(0x7f0000000000)=@raw=[@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xe95b}}], &(0x7f0000000800)='syzkaller\x00', 0xfffffffb, 0x0, 0x0, 0x41000, 0x2c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) 612.593211ms ago: executing program 4 (id=3332): setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x5c, @multicast1, 0x4e20, 0x4, 'rr\x00', 0x30, 0x101, 0x24}, {@local, 0x4e23, 0x2, 0x8, 0x200, 0x9}}, 0x44) r0 = socket(0x10, 0x3, 0x0) r1 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r1) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000001c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000640)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x100005}, 0x50) setsockopt$CAIFSO_REQ_PARAM(0xffffffffffffffff, 0x116, 0x80, 0x0, 0x11) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5c00000014006b04000000d86e6c1d0002887ea6ea65670000000000000090f9c3dc90f8f41f8ecff32c6e020075e300250045586c8da718ad4b4460bc24eab55600000000000000bf9367b4fa51f60a64c9f4d4938037e786a6d0bd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) socket$netlink(0x10, 0x3, 0x7) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f00000002c0)=@newqdisc={0x70, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x3c, 0x2, [@TCA_FQ_CODEL_TARGET={0x8, 0x1, 0x6}, @TCA_FQ_CODEL_TARGET={0x8, 0x1, 0x474c}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x6}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x7}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5}, @TCA_FQ_CODEL_ECN={0x8}, @TCA_FQ_CODEL_LIMIT={0x6}]}}]}, 0x70}}, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000)={{0x5c, @multicast1, 0x4e20, 0x4, 'rr\x00', 0x30, 0x101, 0x24}, {@local, 0x4e23, 0x2, 0x8, 0x200, 0x9}}, 0x44) (async) socket(0x10, 0x3, 0x0) (async) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) (async) close(r1) (async) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') (async) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000001c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) (async) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000640)={r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x100005}, 0x50) (async) setsockopt$CAIFSO_REQ_PARAM(0xffffffffffffffff, 0x116, 0x80, 0x0, 0x11) (async) socket$kcm(0x10, 0x2, 0x4) (async) sendmsg$inet(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000240)="5c00000014006b04000000d86e6c1d0002887ea6ea65670000000000000090f9c3dc90f8f41f8ecff32c6e020075e300250045586c8da718ad4b4460bc24eab55600000000000000bf9367b4fa51f60a64c9f4d4938037e786a6d0bd", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) (async) socket$packet(0x11, 0x2, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) (async) socket$netlink(0x10, 0x3, 0x7) (async) sendmsg$nl_route_sched(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000004640)={&(0x7f00000002c0)=@newqdisc={0x70, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x3c, 0x2, [@TCA_FQ_CODEL_TARGET={0x8, 0x1, 0x6}, @TCA_FQ_CODEL_TARGET={0x8, 0x1, 0x474c}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5, 0xb, 0x6}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x7}, @TCA_FQ_CODEL_CE_THRESHOLD_MASK={0x5}, @TCA_FQ_CODEL_ECN={0x8}, @TCA_FQ_CODEL_LIMIT={0x6}]}}]}, 0x70}}, 0x0) (async) 611.344602ms ago: executing program 1 (id=3333): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r0, 0x0) r1 = socket$packet(0x11, 0x4000000000002, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@newtaction={0x48, 0x30, 0x1, 0x0, 0x0, {}, [{0x34, 0x1, [@m_mpls={0x30, 0x1, 0x0, 0x0, {{0x9}, {0x4}, {0x4, 0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0) 541.783816ms ago: executing program 3 (id=3334): r0 = socket$inet6(0xa, 0x1, 0x8010000000000084) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private0}, 0x1c) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x25, &(0x7f00000003c0)={0x0, @in={{0x2, 0x0, @empty}}}, &(0x7f0000000140)=0x9c) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)={0x14, 0x26, 0x9, 0x80004, 0x80, {0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x48010}, 0x4000000) 462.400046ms ago: executing program 1 (id=3335): r0 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r0, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) bind$tipc(r2, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=@getrule={0x14, 0x22, 0x100, 0x70bd28, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x14}}, 0x0) sendmsg$tipc(r3, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) socket$nl_route(0x10, 0x3, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00008feff0)={0x0, 0x193}}, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="020d0000100000002f3144e90000000003000600eb1f00000200403fe0000001000000f500000000080012000200010000000000000a000030006c100201009f6eae02000000adb20200000000152c000000ffffffff00010a0014bb7acde1b8e96408d700000000030005000020000012de6ffd8fe0985513d0b70dbb5f94a5fbc11b3aa695e968f2d5087fe627d52eac202b3acd582de29f493e1e61fb66374d760e3ddfdbcd34ecd4892f9dd6044c78efd15235b94a14de7aede48041dc922f6729c8402ebeb893eb84f739a5e439fdc4680cf01f"], 0x80}}, 0x4000) r6 = socket$key(0xf, 0x3, 0x2) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f00000080c0)=@newtaction={0x18, 0x31, 0x901, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) sendmmsg(r6, &(0x7f00000000c0), 0x2c8, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r8, &(0x7f00000002c0), 0x40000000000009f, 0x0) sendmsg$nl_route(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="242deb098a475da5"], 0x24}}, 0x20000054) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x50) r9 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$IPVS_CMD_ZERO(r9, 0x0, 0xc114) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvmmsg(0xffffffffffffffff, &(0x7f0000001340)=[{{0x0, 0x0, 0x0}, 0x400000}], 0x1, 0x20010060, 0x0) 376.010768ms ago: executing program 2 (id=3336): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) unshare(0xc040480) unshare(0xc040480) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000b40), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r2, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x14, r3, 0x1}, 0x14}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000980)=@security={'security\x00', 0xe, 0x4, 0x448, 0xffffffff, 0x278, 0x0, 0x118, 0xffffffff, 0xffffffff, 0x378, 0x378, 0x378, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0xd8, 0x118, 0x0, {}, [@common=@frag={{0x30}, {[0x8, 0x1ff], 0x3, 0x10, 0x1}}]}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0xa067, 0x8, 0x80000001, 0x1ff, 0x0, 0x52, 0x0, 0x5]}}}, {{@uncond, 0x0, 0x118, 0x160, 0x0, {}, [@common=@icmp6={{0x28}, {0x11, "4dd4", 0x1}}, @common=@hbh={{0x48}, {0x6043, 0x2, 0x1, [0x2, 0x4, 0x4f, 0x0, 0x3, 0x5, 0x7ff, 0x1, 0x6, 0x401, 0x9, 0x7, 0x3ff, 0x3, 0x0, 0x800], 0x3}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x7, 'syz1\x00', {0xfffffffffffffffe}}}}, {{@uncond, 0x0, 0xd0, 0x100, 0x0, {}, [@common=@hl={{0x28}, {0x2, 0x3}}]}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0x3, 0x4, 0x2}, {0x1, 0x4, 0x5}, 0x6f17, 0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4a8) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r1, @ANYRESOCT, @ANYRES64=r0, @ANYRES64=0x0], 0x24}}, 0x10000055) 375.60858ms ago: executing program 4 (id=3337): bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x6, 0x4, 0xfff, 0x7, 0x0, 0xffffffffffffffff, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x40}, 0x50) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x44, 0x0, 0x0, 0x116}, {0x6}]}, 0x10) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={r0, &(0x7f0000000380)='G', 0x0}, 0x20) 362.741102ms ago: executing program 3 (id=3338): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r1, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x4, 0xfff7ff1f, 0x1}}, 0x20) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00', 0x0}) r4 = socket(0x10, 0x3, 0x0) r5 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) listen(r5, 0x0) accept$ax25(r5, 0x0, 0x0) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000003c0)='sys_enter\x00', r6}, 0x18) nanosleep(&(0x7f0000000bc0)={0x0, 0x3938700}, 0x0) socket$inet6(0xa, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000840)=@newqdisc={0x138, 0x24, 0xf0b, 0x0, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}, {0xd}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x108, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "851d68029db9c236ceb7404b81779bbcff2572e815408e5a3a55972d338f95b8141cd365d2d3ceae779ee54a912aadf204a9c6c240497a126db1f3d14e9b42f1ef5bcaea7c28aafec6c1b43ef4a76d871c412740a76a940a5bc74015d2e5fe537fc9b53324a2a6bd25c341e17d544adfb7ee84677b148b0581064a39a107257c1c981615eaa991c3ddd969d8361ed4f054a500c7df768878278eab5d08788f2b678083c1450296dcb33ee5981b30ee88b5b9ab2e32554ea9aeba7cf12406743311f9d0fb5d66cf835fa600bbb465fa5e3e1510ede6042c3682118828bb3a049cc3931334e56bd7ce3365dbc47c4a8165d36fd3eef4c6e3896e3a2285df2ccb5d"}]}}]}, 0x138}}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a00)={0x6, 0x1a, &(0x7f0000000400)=@raw=[@alu={0x7, 0x0, 0x9, 0x1, 0x2, 0x6}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0x8, 0x0, 0x0, 0x0, 0x2}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xf}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_idx_val={0x18, 0x0, 0x6, 0x0, 0x7, 0x0, 0x0, 0x0, 0x1}, @ringbuf_output={{}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @call={0x85, 0x0, 0x0, 0xab}, @cb_func={0x18, 0xb, 0x4, 0x0, 0x4}], &(0x7f00000001c0)='GPL\x00', 0x80000000, 0x75, &(0x7f0000000340)=""/117, 0x41000, 0x2, '\x00', r7, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0x3, 0x1}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000780)=[0x1, 0xffffffffffffffff, r5, 0x1], &(0x7f0000000980)=[{0x4, 0x1, 0x6, 0x4}, {0x0, 0x3, 0x1, 0xc}, {0x0, 0x5, 0x5, 0xa}, {0x5, 0x4, 0x10, 0x2}, {0x1, 0x4, 0xd, 0x8}, {0x0, 0x5, 0x0, 0x4}, {0x5, 0x3, 0x1, 0x1}], 0x10, 0x6}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000800)={r9, r3, 0x25, 0x19, @void}, 0x10) r10 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r11 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005000000000000008000000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b702000003000000850000008600000018010000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000050000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r8, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x44, r12, 0x1, 0x70bd29, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r13}, @void}}, [@NL80211_ATTR_STA_SUPPORTED_RATES={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x185}, @NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5, 0xe4, 0x1}]}, 0x44}, 0x1, 0x0, 0x0, 0x45}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ASSOCIATE(r4, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="d8010000", @ANYRES16=r12, @ANYBLOB="100029bd7000fddbdf2526000000080003000e95878fe25ff9a331bfdcbd99f0c381f5f0cc7cfdd2ea32add32887942ab5926840833a09abfb3ad4f8a32b694cbfb5ed6a613fc5fd1b3114bebe010833a175d936c60ecd56f14de5f182f9a31c", @ANYRES32=r14, @ANYBLOB="94012a00651267ecca53ab36080211000001080211000001ddc7d1c3b1247ff56e3cfc2fc9ddcc4b933ff669e196951b9733dccfbde7f645a815cca711d9590e6a4aa8c56ed81b293b43c9b7dcf811298d2bd1a8f70b2ffaeeafa8de8ceac25ea2af63eecc7ecae1df7fb3c47ddc3e340471867fafde2f6090771d3c60b80cbb1a753d6337352cb248d6f8d2384923864bbe65e5ef2285eea7eda7ed826a20d02784a55826e5903b54055813aa412bd4aad11abce6036e1733a5e70c929a77df6631040cdf6fdf58f1b3901ceda6f6015f1ba16ab32cf40f13080cb09385c86afc37b10406a80126c725bbec82fc2ab798ff31091e5db0ce5074100851904eaceface6ce56a560463ef25bfc960245919078a1be929bd3411220950cd42b319109460e01cf408cd552f340237552aed2bfca7e736801228edc20144ce35ea10e7b1cd97c5c03b0c71aad9c79100ec0f137c6c30ff46a72f2ed0105476e395831040fb6f2d2ff049d56a3f3c367dea6781e011c905b6871dd0b7217442e9e68ea1166fadbe1c80ef2f2ba7df798f40603014d02000a00340002020202020200000400d0000a00060068c56e952b6400000a0034000202020202020000"], 0x1d8}, 0x1, 0x0, 0x0, 0x4}, 0x77d52553336e4356) sendto$packet(r0, &(0x7f0000000180)="10030600e0ff020004004788aa96a13bb100001100007fca1a00", 0x10608, 0x0, &(0x7f0000000140)={0x11, 0x0, r3}, 0x14) 272.184987ms ago: executing program 4 (id=3339): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0xffff, @multicast2}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYRESHEX, @ANYRES32=r0, @ANYRESOCT=r0], 0x50) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'vlan0\x00'}) bpf$MAP_LOOKUP_BATCH(0x1a, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000001840), 0xfffffff7, r1}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x2, r1}, 0x38) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@ipv4_newroute={0x30, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@RTA_ENCAP={0x14, 0x9, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_VXLAN={0xc, 0x3, 0x0, 0x1, @LWTUNNEL_IP_OPT_VXLAN_GBP={0x8, 0x5}}}}]}, 0x30}}, 0x0) sendmmsg(r0, &(0x7f0000007fc0), 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000000)={0x100000011, @multicast2, 0x0, 0x0, 'ovf\x00', 0x17, 0x1003, 0x62}, 0x2c) 200.772722ms ago: executing program 1 (id=3340): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmmsg(r2, &(0x7f0000000600)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000001340)=""/4094, 0xffe}, {&(0x7f0000000040)=""/114, 0x72}, {&(0x7f00000005c0)=""/53, 0x35}, {&(0x7f0000000200)=""/144, 0x90}, {&(0x7f0000000680)=""/178, 0xb2}], 0x5}}, {{0x0, 0x0, 0x0}}], 0x2, 0x10160, 0x0) r3 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)={0x1c, r3, 0x0, 0x70bd2a, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008800}, 0x40000) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000001540)=@newqdisc={0x30, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0xc0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r7, 0x891d, 0x0) sendmsg$NLBL_UNLABEL_C_STATICADD(r6, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB, @ANYRES16=r3, @ANYBLOB="00032dbd7000ffdbdf25030000001400020000000000000000000000000000000001080005000a010102"], 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x4000804) r8 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_FREE_MR(r8, 0x114, 0x3, &(0x7f00000007c0), 0x10) syz_emit_ethernet(0x112, &(0x7f0000000380)=ANY=[], 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000000), r9) sendmsg$NL802154_CMD_NEW_INTERFACE(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000001280)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01012dbd7000f90f002507000000080001000120000008000300", @ANYRES32=r9], 0x34}, 0x1, 0x0, 0x0, 0x4000000}, 0xa8c4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$netlink(0x10, 0x3, 0xc) setsockopt$sock_int(r11, 0x1, 0x8, &(0x7f0000000200), 0x4) r12 = socket$nl_netfilter(0x10, 0x3, 0xc) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x64, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast2}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x5}]}, 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r12, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) r14 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r14, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000340)={0x14, 0x7, 0x6, 0x101, 0x0, 0x0, {0x5, 0x0, 0xa}}, 0x14}, 0x1, 0x0, 0x0, 0x20040000}, 0x10) 199.697631ms ago: executing program 2 (id=3341): syz_genetlink_get_family_id$devlink(&(0x7f0000000200), 0xffffffffffffffff) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000380)=ANY=[@ANYBLOB="380100001000330603000000fdffffffffffffff0000000000000000000000006401010100000000000000000000000000000000000000000200806000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8800000000000000000000000000010000000032000000fc00000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000026bd7000000000000a"], 0x138}}, 0x4000000) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NUM_RX_QUEUES={0x8, 0x20, 0x9}]}, 0x3c}}, 0x0) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_1\x00', 0x0}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000580)={0x101, 0xe8, 0x2, 0x6, 0x9, 0x0, [{0x668b12bf, 0x7, 0x18, '\x00', 0x808}, {0x1, 0x14000000000000, 0x23896d40, '\x00', 0x80}, {0x6, 0x1e276dc4, 0xc, '\x00', 0x1000}, {0xf6, 0x0, 0x1, '\x00', 0x88}, {0x7, 0x4, 0x2, '\x00', 0x8}, {0xc, 0x9, 0x5, '\x00', 0x1102}, {0x4, 0x8, 0x2, '\x00', 0x1}, {0x4, 0x5, 0xd, '\x00', 0x80}, {0x9, 0x0, 0x6, '\x00', 0x400}]}) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000240)={&(0x7f0000000080), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x74, r3, 0x504, 0x70bd26, 0x25dfdbfc, {}, [@ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0xfffffffa}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x8000}, @ETHTOOL_A_CHANNELS_HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'rose0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x6}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x3}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x2}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0xf}]}, 0x74}, 0x1, 0x0, 0x0, 0x1}, 0x20000001) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x8800}, 0x4055) 109.535575ms ago: executing program 4 (id=3342): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000040)={'ip6_vti0\x00', 0x0, 0x2f, 0x8a, 0x7f, 0xffffffff, 0x14, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x20, 0x8000, 0x4, 0x6}}) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@bridge_dellink={0x38, 0x11, 0x100, 0x70bd29, 0x25dfdbfe, {0x7, 0x0, 0x0, r1, 0x204b4, 0x40c}, [@IFLA_LINK_NETNSID={0x8, 0x25, 0x4}, @IFLA_LINKMODE={0x5, 0x11, 0x40}, @IFLA_TXQLEN={0x8, 0xd, 0x3}]}, 0x38}, 0x1, 0x0, 0x0, 0x4080}, 0x4000800) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r2, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6gre0\x00', r1, 0x29, 0x4, 0xcf, 0x80000001, 0x62, @loopback, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x20, 0x20, 0x8, 0x7}}) r3 = accept$nfc_llcp(0xffffffffffffffff, &(0x7f0000000280), &(0x7f0000000300)=0x60) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000340), r5) r6 = epoll_create1(0x80000) ioctl$FS_IOC_READ_VERITY_METADATA(r6, 0xc0286687, &(0x7f0000000480)={0x2, 0x80000001, 0xd4, &(0x7f0000000380)=""/212}) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000500), r4) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f0000000540)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000580)={'wpan3\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r4, 0x8933, &(0x7f00000005c0)={'wpan3\x00', 0x0}) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r5, &(0x7f00000006c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x10820000}, 0xc, &(0x7f0000000680)={&(0x7f0000000600)={0x70, r7, 0x2, 0x70bd2a, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r10}]}, 0x70}, 0x1, 0x0, 0x0, 0x40001}, 0x44) r11 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000740), r4) sendmsg$NL802154_CMD_SET_BACKOFF_EXPONENT(r4, &(0x7f0000000800)={&(0x7f0000000700)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f00000007c0)={&(0x7f0000000780)={0x14, r11, 0x200, 0x70bd2c, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) r12 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000880), r5) sendmsg$IEEE802154_LLSEC_LIST_KEY(r5, &(0x7f0000000940)={&(0x7f0000000840), 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x14, r12, 0x2, 0x70bd25, 0x25dfdbfc, {}, ["", ""]}, 0x14}}, 0x800) sendmsg$IEEE802154_ASSOCIATE_RESP(r5, &(0x7f0000000a40)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000a00)={&(0x7f00000009c0)={0x24, r12, 0x400, 0x70bd27, 0x25dfdbfb, {}, [@IEEE802154_ATTR_STATUS={0x5, 0x3, 0x6}, @IEEE802154_ATTR_COORD_SHORT_ADDR={0x6, 0x8, 0xaaa0}]}, 0x24}, 0x1, 0x0, 0x0, 0x20004000}, 0x4) r13 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000ac0), r5) sendmsg$NLBL_CIPSOV4_C_REMOVE(r4, &(0x7f0000000c00)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0xac, r13, 0xe21, 0x70bd25, 0x25dfdbfb, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x90, 0x8, 0x0, 0x1, [{0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1cf8daba}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3114a44c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x35}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1259a88a}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x78021a3d}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xb7}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1ec9bf8f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x36fcd1f9}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2b580dda}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x3f20aa93}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe2}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x1bf46811}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}]}, 0xac}, 0x1, 0x0, 0x0, 0x4000040}, 0x4000000) r14 = socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000c80), r6) sendmsg$MPTCP_PM_CMD_REMOVE(r14, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000cc0)={0x24, r15, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4004840}, 0x2000010) sendmsg$NLBL_CALIPSO_C_ADD(r4, &(0x7f0000000e40)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000e00)={&(0x7f0000000dc0)={0x1c, 0x0, 0x10, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_CALIPSO_A_DOI={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4010}, 0x4000845) ioctl$sock_SIOCGIFVLAN_SET_VLAN_NAME_TYPE_CMD(r3, 0x8982, &(0x7f0000000e80)={0x6, 'tunl0\x00', {0x2}, 0x4}) r16 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000ec0), r16) 0s ago: executing program 1 (id=3343): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32, @ANYBLOB="fbff4e01"], 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x40004) kernel console output (not intermixed with test programs): 21 has an invalid length. [ 247.409296][T11984] netlink: 'syz.2.1672': attribute type 21 has an invalid length. [ 247.933361][T12014] sctp: [Deprecated]: syz.0.1680 (pid 12014) Use of int in max_burst socket option. [ 247.933361][T12014] Use struct sctp_assoc_value instead [ 248.426875][T12029] 8021q: adding VLAN 0 to HW filter on device bond4 [ 248.435900][T12029] bond3: (slave bond4): Enslaving as an active interface with an up link [ 248.704685][ T5842] Bluetooth: hci1: command 0x0406 tx timeout [ 249.048498][T12058] __nla_validate_parse: 132 callbacks suppressed [ 249.048527][T12058] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1689'. [ 249.287640][T12072] netlink: 9 bytes leftover after parsing attributes in process `syz.0.1696'. [ 249.311740][T12071] tipc: Enabled bearer , priority 0 [ 249.362678][T12071] tipc: Disabling bearer [ 249.422193][T12080] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 249.449900][T12081] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1697'. [ 249.718841][T12098] netlink: zone id is out of range [ 249.724123][T12098] netlink: zone id is out of range [ 249.742900][T12098] netlink: zone id is out of range [ 249.754597][T12098] netlink: del zone limit has 4 unknown bytes [ 250.785349][ T5842] Bluetooth: hci1: command 0x0406 tx timeout [ 250.830701][T12153] netlink: 112 bytes leftover after parsing attributes in process `syz.4.1718'. [ 250.923268][T12158] validate_nla: 57 callbacks suppressed [ 250.923287][T12158] netlink: 'syz.4.1720': attribute type 10 has an invalid length. [ 251.144416][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 251.152664][ C0] lec:lec_tx_timeout: lec0 [ 251.157598][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 251.390359][T12180] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1726'. [ 251.600666][T12191] netlink: 'syz.4.1730': attribute type 9 has an invalid length. [ 251.633826][T12191] delete_channel: no stack [ 251.670970][T12196] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1733'. [ 251.687774][T12201] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1733'. [ 251.734681][T12197] netlink: 7 bytes leftover after parsing attributes in process `syz.2.1732'. [ 251.888301][T12210] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1736'. [ 251.925767][T12210] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1736'. [ 252.098363][T12225] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:0 [ 252.197591][T12228] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 252.446200][T12237] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 252.494452][T12239] macsec1: entered promiscuous mode [ 252.516910][T12239] bridge0: entered promiscuous mode [ 252.539530][T12239] macsec1: entered allmulticast mode [ 252.575089][T12239] bridge0: entered allmulticast mode [ 252.585582][T12239] bridge0: port 1(macsec1) entered blocking state [ 252.592525][T12239] bridge0: port 1(macsec1) entered disabled state [ 252.609088][T12239] bridge0: left allmulticast mode [ 252.620028][T12239] bridge0: left promiscuous mode [ 253.087849][T12267] tipc: Enabling of bearer rejected, media not registered [ 253.213157][T12275] v: renamed from vlan0 [ 253.242088][T12275] tipc: Disabling bearer [ 254.137193][T12318] __nla_validate_parse: 10 callbacks suppressed [ 254.137213][T12318] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1767'. [ 254.399304][T12327] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1768'. [ 254.417923][T12327] netlink: 'syz.1.1768': attribute type 1 has an invalid length. [ 254.430663][T12327] netlink: 'syz.1.1768': attribute type 1 has an invalid length. [ 254.441139][T12327] netlink: 'syz.1.1768': attribute type 2 has an invalid length. [ 254.449769][T12327] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1768'. [ 254.711188][T12338] netlink: 256 bytes leftover after parsing attributes in process `syz.2.1772'. [ 254.878904][T12350] x_tables: unsorted underflow at hook 1 [ 255.388349][T12368] netlink: 'syz.3.1781': attribute type 13 has an invalid length. [ 255.628812][T12380] IPVS: length: 239 != 24 [ 255.678650][T12388] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1785'. [ 255.697844][T12388] netlink: 43 bytes leftover after parsing attributes in process `syz.4.1785'. [ 255.717845][T12388] netlink: 'syz.4.1785': attribute type 6 has an invalid length. [ 255.737847][T12388] netlink: 'syz.4.1785': attribute type 5 has an invalid length. [ 255.760847][T12388] netlink: 43 bytes leftover after parsing attributes in process `syz.4.1785'. [ 256.150064][T12413] netlink: 'syz.0.1791': attribute type 22 has an invalid length. [ 256.164394][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 256.172508][ C0] lec:lec_tx_timeout: lec0 [ 256.176601][T12413] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1791'. [ 256.178440][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 256.192615][T12411] syzkaller0: entered promiscuous mode [ 256.201710][T12411] syzkaller0: entered allmulticast mode [ 256.217460][T12413] netlink: 'syz.0.1791': attribute type 22 has an invalid length. [ 256.229141][T12411] openvswitch: netlink: Tunnel attr 195 out of range max 16 [ 256.254946][T12413] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1791'. [ 256.475161][T12422] C: renamed from team_slave_0 [ 256.511965][T12422] netlink: 'syz.3.1796': attribute type 1 has an invalid length. [ 256.544665][T12422] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 256.596391][T12422] netlink: 60 bytes leftover after parsing attributes in process `syz.3.1796'. [ 256.698313][T12433] netlink: 'syz.2.1800': attribute type 1 has an invalid length. [ 256.708739][T12434] netlink: 'syz.4.1797': attribute type 1 has an invalid length. [ 256.734460][T12434] netlink: 'syz.4.1797': attribute type 2 has an invalid length. [ 256.940649][T12445] netlink: 'syz.2.1804': attribute type 19 has an invalid length. [ 257.098993][T12458] netlink: 'syz.4.1806': attribute type 83 has an invalid length. [ 257.125090][T12460] IPVS: set_ctl: invalid protocol: 115 172.20.20.54:20003 [ 257.156770][T12460] IPVS: length: 103 != 8 [ 257.162683][T12460] IPVS: set_ctl: invalid protocol: 0 224.0.0.1:20000 [ 257.457154][T12479] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 257.473701][T12479] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 257.533299][T12480] 8021q: adding VLAN 0 to HW filter on device ipvlan2 [ 257.542277][T12480] bond0: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 257.559643][T12486] netlink: 'syz.3.1816': attribute type 9 has an invalid length. [ 257.585621][T12437] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 257.598073][T12437] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 257.906167][T12506] netlink: 'syz.2.1822': attribute type 1 has an invalid length. [ 259.283650][T12587] __nla_validate_parse: 19 callbacks suppressed [ 259.283670][T12587] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1846'. [ 259.489417][T12600] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1849'. [ 259.507780][T12592] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1846'. [ 259.528198][T12602] syz.1.1850: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 259.564652][T12602] CPU: 0 UID: 0 PID: 12602 Comm: syz.1.1850 Not tainted syzkaller #0 PREEMPT(full) [ 259.564687][T12602] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 259.564709][T12602] Call Trace: [ 259.564718][T12602] [ 259.564728][T12602] dump_stack_lvl+0x189/0x250 [ 259.564760][T12602] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 259.564784][T12602] ? __pfx_dump_stack_lvl+0x10/0x10 [ 259.564811][T12602] ? __pfx__printk+0x10/0x10 [ 259.564843][T12602] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 259.564868][T12602] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 259.564900][T12602] warn_alloc+0x214/0x310 [ 259.564924][T12602] ? stack_trace_save+0x9c/0xe0 [ 259.564959][T12602] ? __pfx_warn_alloc+0x10/0x10 [ 259.564990][T12602] ? kasan_save_track+0x4f/0x80 [ 259.565010][T12602] ? kasan_save_track+0x3e/0x80 [ 259.565028][T12602] ? __kasan_kmalloc+0x93/0xb0 [ 259.565049][T12602] ? __kmalloc_cache_noprof+0x3e2/0x700 [ 259.565069][T12602] ? xskq_create+0x56/0x170 [ 259.565100][T12602] ? xsk_setsockopt+0x4dc/0x8d0 [ 259.565126][T12602] ? do_sock_setsockopt+0x17c/0x1b0 [ 259.565150][T12602] ? __x64_sys_setsockopt+0x13f/0x1b0 [ 259.565172][T12602] ? do_syscall_64+0xfa/0xf80 [ 259.565199][T12602] __vmalloc_node_range_noprof+0x134/0x16a0 [ 259.565261][T12602] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 259.565293][T12602] ? __kasan_kmalloc+0x93/0xb0 [ 259.565334][T12602] vmalloc_user_noprof+0xad/0xf0 [ 259.565356][T12602] ? xskq_create+0xbf/0x170 [ 259.565388][T12602] xskq_create+0xbf/0x170 [ 259.565424][T12602] xsk_init_queue+0xb0/0x110 [ 259.565459][T12602] xsk_setsockopt+0x4dc/0x8d0 [ 259.565492][T12602] ? __pfx_xsk_setsockopt+0x10/0x10 [ 259.565526][T12602] ? __pfx_aa_sk_perm+0x10/0x10 [ 259.565554][T12602] ? aa_sock_opt_perm+0xff/0x1a0 [ 259.565587][T12602] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 259.565606][T12602] ? __pfx_xsk_setsockopt+0x10/0x10 [ 259.565639][T12602] do_sock_setsockopt+0x17c/0x1b0 [ 259.565669][T12602] __x64_sys_setsockopt+0x13f/0x1b0 [ 259.565701][T12602] do_syscall_64+0xfa/0xf80 [ 259.565724][T12602] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 259.565745][T12602] ? clear_bhb_loop+0x60/0xb0 [ 259.565771][T12602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 259.565792][T12602] RIP: 0033:0x7f04ad38f749 [ 259.565811][T12602] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 259.565828][T12602] RSP: 002b:00007f04ae248038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 259.565851][T12602] RAX: ffffffffffffffda RBX: 00007f04ad5e5fa0 RCX: 00007f04ad38f749 [ 259.565865][T12602] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 259.565878][T12602] RBP: 00007f04ad413f91 R08: 0000000000000004 R09: 0000000000000000 [ 259.565891][T12602] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 259.565903][T12602] R13: 00007f04ad5e6038 R14: 00007f04ad5e5fa0 R15: 00007fffeb13c0e8 [ 259.565937][T12602] [ 259.566050][T12602] Mem-Info: [ 259.581132][T12600] 8021q: adding VLAN 0 to HW filter on device bond7 [ 259.609486][T12604] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1849'. [ 259.627663][T12602] active_anon:5394 inactive_anon:0 isolated_anon:0 [ 259.627663][T12602] active_file:3086 inactive_file:39945 isolated_file:0 [ 259.627663][T12602] unevictable:773 dirty:59 writeback:0 [ 259.627663][T12602] slab_reclaimable:11254 slab_unreclaimable:124994 [ 259.627663][T12602] mapped:29258 shmem:1360 pagetables:1145 [ 259.627663][T12602] sec_pagetables:0 bounce:0 [ 259.627663][T12602] kernel_misc_reclaimable:0 [ 259.627663][T12602] free:1296789 free_pcp:15013 free_cma:0 [ 259.627785][T12602] Node 0 active_anon:21576kB inactive_anon:0kB active_file:12344kB inactive_file:159580kB unevictable:1556kB isolated(anon):0kB isolated(file):0kB mapped:117032kB dirty:236kB writeback:0kB shmem:3904kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:14140kB pagetables:4332kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 259.627843][T12602] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:32kB pagetables:148kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 259.627897][T12602] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 259.627963][T12602] lowmem_reserve[]: 0 2499 2501 2501 2501 [ 259.628013][T12602] Node 0 DMA32 free:1288992kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:21576kB inactive_anon:0kB active_file:12344kB inactive_file:159580kB unevictable:1556kB writepending:236kB zspages:0kB present:3129332kB managed:2559356kB mlocked:20kB bounce:0kB free_pcp:40012kB local_pcp:20700kB free_cma:0kB [ 259.628081][T12602] lowmem_reserve[]: 0 0 1 1 1 [ 259.628128][T12602] Node 0 Normal free:0kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 259.930619][T12608] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1851'. [ 259.960216][T12604] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1849'. [ 260.113995][T12608] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1851'. [ 260.123787][T12602] lowmem_reserve[]: 0 0 0 0 0 [ 260.123848][T12602] Node 1 Normal free:3882804kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:20064kB local_pcp:6944kB free_cma:0kB [ 260.123928][T12602] lowmem_reserve[]: 0 0 0 0 0 [ 260.123975][T12602] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 260.225002][T12608] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1851'. [ 260.293560][T12602] Node 0 DMA32: 4196*4kB (UME) 2510*8kB (UM) 1160*16kB (UME) 363*32kB (UME) 75*64kB (UE) 127*128kB (UM) 205*256kB (UME) 147*512kB (UM) 66*1024kB (UME) 25*2048kB (UME) 233*4096kB (M) = 1288992kB [ 260.350312][T12612] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1851'. [ 260.384642][T12602] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 260.397560][T12602] Node 1 Normal: 201*4kB (UE) 48*8kB (UME) 41*16kB (UME) 68*32kB (UME) 18*64kB (UME) 8*128kB (UME) 5*256kB (UME) 3*512kB (ME) 1*1024kB (M) 1*2048kB (E) 945*4096kB (UM) = 3882804kB [ 260.431616][T12602] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 260.463085][T12602] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 260.473204][T12602] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 260.518314][T12602] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 260.567529][T12602] 44387 total pagecache pages [ 260.572299][T12602] 0 pages in swap cache [ 260.594503][T12602] Free swap = 124996kB [ 260.603641][T12602] Total swap = 124996kB [ 260.616512][T12602] 2097051 pages RAM [ 260.628245][T12602] 0 pages HighMem/MovableOnly [ 260.637703][T12602] 425122 pages reserved [ 260.642620][T12602] 0 pages cma reserved [ 260.680830][T12625] tipc: Cannot configure node identity twice [ 260.937636][T12642] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1859'. [ 260.951514][T12633] 8021q: adding VLAN 0 to HW filter on device bond5 [ 261.000043][T12633] 8021q: adding VLAN 0 to HW filter on device bond5 [ 261.026339][T12633] bond5: (slave vxcan1): The slave device specified does not support setting the MAC address [ 261.040272][T12633] bond5: (slave vxcan1): Error -95 calling set_mac_address [ 261.118622][T12642] veth5: entered promiscuous mode [ 261.158778][T12643] bond0: (slave rose0): Error: Device can not be enslaved while up [ 261.181973][ T5911] IPVS: starting estimator thread 0... [ 261.194401][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 261.202461][ C0] lec:lec_tx_timeout: lec0 [ 261.214477][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 261.227743][T12658] IPVS: dh: SCTP 172.20.20.187:0 - no destination available [ 261.314476][T12659] IPVS: using max 27 ests per chain, 64800 per kthread [ 261.426731][T12670] bond0: entered promiscuous mode [ 261.444850][T12670] bond_slave_0: entered promiscuous mode [ 261.451372][T12670] bond_slave_1: entered promiscuous mode [ 261.457450][T12670] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 261.483771][T12670] batadv0: entered promiscuous mode [ 261.502016][T12670] bond0: left promiscuous mode [ 261.507446][T12670] bond_slave_0: left promiscuous mode [ 261.516574][T12670] bond_slave_1: left promiscuous mode [ 261.541651][T12670] mac80211_hwsim hwsim5 wlan1: left promiscuous mode [ 261.560393][T12670] batadv0: left promiscuous mode [ 261.800929][T12684] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 261.913488][T12691] validate_nla: 1 callbacks suppressed [ 261.913507][T12691] netlink: 'syz.3.1876': attribute type 11 has an invalid length. [ 261.952322][T12692] syzkaller0: entered promiscuous mode [ 261.952756][T12691] netlink: 'syz.3.1876': attribute type 7 has an invalid length. [ 261.976961][T12692] syzkaller0: entered allmulticast mode [ 262.169329][T12708] netlink: 'syz.3.1882': attribute type 7 has an invalid length. [ 262.184675][T12708] netlink: 'syz.3.1882': attribute type 8 has an invalid length. [ 262.414268][T12724] team0: Caught tx_queue_len zero misconfig [ 262.673295][T12733] team_slave_1: mtu less than device minimum [ 263.049617][T12766] syzkaller0: entered promiscuous mode [ 263.055473][T12766] syzkaller0: entered allmulticast mode [ 263.521947][T10937] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 263.545171][T10937] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 263.564525][T10937] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 263.585776][T10937] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 263.757350][T12807] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 263.818195][T12807] netlink: 'syz.1.1911': attribute type 9 has an invalid length. [ 263.838692][T12807] netlink: 'syz.1.1911': attribute type 11 has an invalid length. [ 263.857894][T12807] netlink: 'syz.1.1911': attribute type 12 has an invalid length. [ 264.111507][T12820] netlink: 'syz.1.1915': attribute type 8 has an invalid length. [ 264.292340][T12840] : renamed from hsr0 [ 264.477415][T12850] __nla_validate_parse: 52 callbacks suppressed [ 264.477438][T12850] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1924'. [ 264.610876][T12859] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1924'. [ 264.970594][T12871] IPv6: NLM_F_CREATE should be specified when creating new route [ 264.979807][T12869] netlink: 'syz.2.1927': attribute type 3 has an invalid length. [ 265.076493][T12873] netlink: 27 bytes leftover after parsing attributes in process `syz.0.1930'. [ 265.302640][T12887] macvtap0: Device is already in use. [ 265.361532][T12891] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1936'. [ 265.376616][T12891] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1936'. [ 265.397373][T12891] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1936'. [ 265.422280][ T5911] IPVS: starting estimator thread 0... [ 265.430823][T12888] IPVS: dh: SCTP 172.20.20.187:0 - no destination available [ 265.524251][T12893] IPVS: using max 24 ests per chain, 57600 per kthread [ 265.760018][T12913] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1942'. [ 265.791111][T12916] netlink: 'syz.2.1944': attribute type 8 has an invalid length. [ 265.966284][T12933] x_tables: unsorted underflow at hook 3 [ 266.137399][T12943] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1953'. [ 266.184602][T12950] netlink: 44 bytes leftover after parsing attributes in process `syz.1.1955'. [ 266.202595][T12950] netlink: 43 bytes leftover after parsing attributes in process `syz.1.1955'. [ 266.349873][T12965] SET target dimension over the limit! [ 266.378379][T12964] SET target dimension over the limit! [ 266.385729][T12965] netem: change failed [ 266.448663][T12968] x_tables: duplicate underflow at hook 1 [ 266.563210][T12977] 8021q: VLANs not supported on ip6_vti0 [ 266.789993][T12996] bridge_slave_0: left allmulticast mode [ 266.797191][T12996] bridge_slave_0: left promiscuous mode [ 266.804496][T12996] bridge0: port 1(bridge_slave_0) entered disabled state [ 267.064139][T13009] bond6: option arp_all_targets: invalid value (18446744073709551613) [ 267.136379][T13009] bond6 (unregistering): Released all slaves [ 267.344366][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6130 ms [ 267.352478][ C0] lec:lec_tx_timeout: lec0 [ 267.357753][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 267.492770][T13039] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 268.851032][T13125] validate_nla: 3 callbacks suppressed [ 268.851053][T13125] netlink: 'syz.1.2006': attribute type 4 has an invalid length. [ 269.584051][T13156] netlink: 'syz.4.2015': attribute type 2 has an invalid length. [ 269.620237][T13156] __nla_validate_parse: 47 callbacks suppressed [ 269.620260][T13156] netlink: 244 bytes leftover after parsing attributes in process `syz.4.2015'. [ 269.676492][T13160] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2014'. [ 269.770690][T13171] syzkaller0: entered promiscuous mode [ 269.777006][T13171] syzkaller0: entered allmulticast mode [ 269.793937][T13170] sch_tbf: burst 4 is lower than device syzkaller0 mtu (1514) ! [ 269.871717][T13174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2019'. [ 270.065159][T13191] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2025'. [ 270.074385][T13190] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2025'. [ 270.196794][T13193] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2026'. [ 270.531874][T13227] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2038'. [ 270.619237][T13234] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2040'. [ 270.751866][T13238] sch_tbf: burst 512 is lower than device syzkaller0 mtu (1500) ! [ 271.272314][T13268] sctp: [Deprecated]: syz.2.2051 (pid 13268) Use of struct sctp_assoc_value in delayed_ack socket option. [ 271.272314][T13268] Use struct sctp_sack_info instead [ 271.337023][T13275] tipc: Enabled bearer , priority 0 [ 271.437207][T13280] netlink: 'syz.1.2055': attribute type 1 has an invalid length. [ 271.516032][T13287] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2055'. [ 271.535982][T13287] netlink: 3 bytes leftover after parsing attributes in process `syz.1.2055'. [ 271.561543][T13288] netlink: 'syz.0.2056': attribute type 1 has an invalid length. [ 271.601380][T13268] syzkaller0: entered promiscuous mode [ 271.619591][T13268] syzkaller0: entered allmulticast mode [ 271.637549][T13268] tipc: Resetting bearer [ 271.705501][T13298] netlink: 'syz.3.2058': attribute type 10 has an invalid length. [ 271.747652][T13280] 8021q: adding VLAN 0 to HW filter on device bond6 [ 271.829331][T13288] 8021q: adding VLAN 0 to HW filter on device bond5 [ 271.897487][T13290] s5ÿÿø: renamed from vlan1 [ 271.927807][T13266] tipc: Resetting bearer [ 273.104881][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5750 ms [ 273.113030][ C0] lec:lec_tx_timeout: lec0 [ 273.119395][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 273.277514][T13266] tipc: Disabling bearer [ 273.301599][T13297] bond5: (slave veth5): Enslaving as an active interface with a down link [ 273.315186][T13298] geneve0: entered promiscuous mode [ 273.322176][T13298] team0: Port device geneve0 added [ 273.377651][T13301] bond5: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 273.416329][T13284] bond5: entered promiscuous mode [ 273.421396][T13284] bond5: entered allmulticast mode [ 273.450489][ T2986] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 273.474590][T13323] lo: entered allmulticast mode [ 273.485341][ T2986] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 273.505378][T13325] lo: left allmulticast mode [ 273.540627][ T2986] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 273.555044][ T2986] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 273.592670][T13327] batadv_slave_0: Caught tx_queue_len zero misconfig [ 273.772773][T13344] netlink: 'syz.1.2070': attribute type 1 has an invalid length. [ 273.893865][T13344] bond7: entered promiscuous mode [ 273.901269][T13344] bond7: entered allmulticast mode [ 273.907705][T13344] 8021q: adding VLAN 0 to HW filter on device bond7 [ 273.998933][T13356] netlink: Conntrack attr has 4 unknown bytes [ 274.005777][T13353] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 274.021185][T13355] netlink: Conntrack attr has 4 unknown bytes [ 274.211722][T13368] macvlan0: entered promiscuous mode [ 274.247575][T13378] unsupported nla_type 58 [ 274.401874][T13381] delete_channel: no stack [ 274.606573][T13396] bond8: option resend_igmp: invalid value (32767) [ 274.631867][T13396] bond8: option resend_igmp: allowed values 0 - 255 [ 274.658531][T13396] bond8 (unregistering): Released all slaves [ 274.691309][T13406] ip6t_REJECT: ECHOREPLY is not supported [ 274.747107][T13409] __nla_validate_parse: 18 callbacks suppressed [ 274.747130][T13409] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2087'. [ 274.998611][T13424] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2095'. [ 275.286190][T13443] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2097'. [ 275.295505][T13443] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2097'. [ 275.306882][T13443] netlink: 'syz.4.2097': attribute type 64 has an invalid length. [ 275.315108][T13443] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2097'. [ 275.822440][T13441] netlink: 1 bytes leftover after parsing attributes in process `syz.4.2097'. [ 276.289946][ T30] audit: type=1107 audit(1766988686.636:74): pid=13476 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='HaÅ"¸®g0‚;\ê—7÷J‹»›”°£½†­íP'oëãt#ó´óÈD§aC„©Œ™ˆ‘C  Â×Ûüxta“<æÿMÂVÿWU¶ØÞ*Ko,_Ó­ý}c:"#×%¥‚âü1YÈ—à|¨swŸ?×2¹2Ì+ýiú…+N¾€­)…$' [ 276.398462][T13482] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2109'. [ 276.429696][T13483] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2108'. [ 276.539539][T13486] macvtap0: Device is already in use. [ 276.578873][T13490] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2113'. [ 276.608169][T13492] netlink: 'syz.3.2114': attribute type 1 has an invalid length. [ 276.625013][T13492] netlink: 'syz.3.2114': attribute type 2 has an invalid length. [ 276.632841][T13492] netlink: 'syz.3.2114': attribute type 1 has an invalid length. [ 276.658418][T13492] netlink: 'syz.3.2114': attribute type 3 has an invalid length. [ 276.666847][T13492] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2114'. [ 276.916382][T13511] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 277.118845][T13520] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 277.148243][T13520] netlink: 'syz.4.2123': attribute type 33 has an invalid length. [ 277.414561][T13535] syzkaller0: entered promiscuous mode [ 277.420192][T13535] syzkaller0: entered allmulticast mode [ 277.510832][T13537] bridge0: port 1(ipvlan2) entered blocking state [ 277.517752][T13537] bridge0: port 1(ipvlan2) entered disabled state [ 277.525814][T13537] ipvlan2: entered allmulticast mode [ 277.531312][T13537] bridge0: entered allmulticast mode [ 277.539703][T13537] ipvlan2: left allmulticast mode [ 277.546471][T13535] openvswitch: netlink: IP tunnel TTL not specified. [ 277.553848][T13537] bridge0: left allmulticast mode [ 277.572204][T13538] bridge0: port 1(ipvlan2) entered blocking state [ 277.578964][T13538] bridge0: port 1(ipvlan2) entered disabled state [ 277.587610][T13538] ipvlan2: entered allmulticast mode [ 277.593033][T13538] bridge0: entered allmulticast mode [ 277.603094][T13538] ipvlan2: left allmulticast mode [ 277.608785][T13538] bridge0: left allmulticast mode [ 277.760133][T13544] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 277.808587][T13548] netlink: 'syz.2.2130': attribute type 27 has an invalid length. [ 278.134511][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 278.142616][ C0] lec:lec_tx_timeout: lec0 [ 278.150293][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 278.275414][T13579] netlink: 'syz.4.2138': attribute type 1 has an invalid length. [ 278.401927][T13579] 8021q: adding VLAN 0 to HW filter on device bond3 [ 278.437690][T13580] vlan0: entered allmulticast mode [ 278.442986][T13580] bond3: entered allmulticast mode [ 279.151966][T13634] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 279.402978][T13648] netlink: 'syz.1.2156': attribute type 2 has an invalid length. [ 279.666654][T13656] netlink: 'syz.1.2160': attribute type 10 has an invalid length. [ 279.725693][T13656] bridge_slave_1: left allmulticast mode [ 279.740014][T13656] bridge_slave_1: left promiscuous mode [ 279.747337][T13656] bridge0: port 2(bridge_slave_1) entered disabled state [ 279.830891][T13656] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 279.871282][T13669] __nla_validate_parse: 7 callbacks suppressed [ 279.871304][T13669] netlink: 164 bytes leftover after parsing attributes in process `syz.0.2163'. [ 280.032190][T13679] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2168'. [ 280.077803][T13676] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2168'. [ 280.170932][T13680] bridge5: port 1(veth7) entered blocking state [ 280.180730][T13680] bridge5: port 1(veth7) entered disabled state [ 280.187857][T13680] veth7: entered allmulticast mode [ 280.195926][T13680] veth7: entered promiscuous mode [ 280.220691][T13690] vlan0: entered promiscuous mode [ 280.226337][T13690] bridge0: entered promiscuous mode [ 280.274948][T13676] veth0_to_bond: left allmulticast mode [ 280.294949][T13676] bridge5: port 2(veth0_to_bond) entered blocking state [ 280.302073][T13676] bridge5: port 2(veth0_to_bond) entered disabled state [ 280.322079][T13676] veth0_to_bond: entered allmulticast mode [ 280.373186][T13676] veth0_to_bond: entered promiscuous mode [ 280.565209][T13700] netlink: 'syz.3.2172': attribute type 83 has an invalid length. [ 280.971139][T13715] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2178'. [ 281.010710][T13716] tipc: Enabling of bearer rejected, failed to enable media [ 281.092263][T13715] netlink: 'syz.4.2178': attribute type 1 has an invalid length. [ 281.378382][T13733] ip6gre2: entered allmulticast mode [ 281.898090][T13768] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2193'. [ 281.925341][T13768] syzkaller1: entered promiscuous mode [ 281.931721][T13768] syzkaller1: entered allmulticast mode [ 282.186436][T13781] syzkaller0: entered promiscuous mode [ 282.197522][T13780] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2197'. [ 282.206044][T13781] syzkaller0: entered allmulticast mode [ 282.212711][T13780] netlink: 116 bytes leftover after parsing attributes in process `syz.1.2197'. [ 282.233587][T13784] netlink: 1 bytes leftover after parsing attributes in process `syz.4.2195'. [ 282.570135][T13804] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2201'. [ 282.713800][T13804] bond8 (unregistering): Released all slaves [ 283.086565][T13833] netlink: 112 bytes leftover after parsing attributes in process `syz.1.2209'. [ 283.164574][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 283.172724][ C0] lec:lec_tx_timeout: lec0 [ 283.177823][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 283.379652][T13858] netlink: 'syz.1.2214': attribute type 1 has an invalid length. [ 283.560427][T13861] sock: sock_timestamping_bind_phc: sock not bind to device [ 283.576601][T13864] netlink: 'syz.4.2216': attribute type 7 has an invalid length. [ 283.593165][T13864] netlink: 'syz.4.2216': attribute type 8 has an invalid length. [ 283.738728][T13875] netlink: 'syz.3.2219': attribute type 5 has an invalid length. [ 283.829646][T13875] geneve3: entered promiscuous mode [ 283.844733][T13875] geneve3: entered allmulticast mode [ 283.859183][ T6034] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 283.963629][ T6034] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 283.994631][ T6034] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 256 - 0 [ 284.003525][ T6034] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 256 - 0 [ 284.112385][T13896] netlink: 'syz.0.2227': attribute type 1 has an invalid length. [ 284.126292][T13896] tipc: Enabled bearer , priority 0 [ 284.134004][T13896] syzkaller0: entered promiscuous mode [ 284.140238][T13896] syzkaller0: entered allmulticast mode [ 284.199506][T13896] tipc: Resetting bearer [ 284.226415][T13896] tipc: Disabling bearer [ 284.647658][T13924] syzkaller1: entered promiscuous mode [ 284.667508][T13924] syzkaller1: entered allmulticast mode [ 284.710310][T13915] netlink: 'syz.2.2235': attribute type 13 has an invalid length. [ 284.728315][T13926] netlink: 'syz.0.2240': attribute type 3 has an invalid length. [ 285.314259][T13945] __nla_validate_parse: 16 callbacks suppressed [ 285.314281][T13945] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2247'. [ 285.401904][T13948] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2248'. [ 285.731422][T13973] syzkaller0: entered promiscuous mode [ 285.744853][T13973] syzkaller0: entered allmulticast mode [ 285.930680][T13986] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 285.987527][T13986] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 286.017109][T13986] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 286.304869][T13997] netlink: 272 bytes leftover after parsing attributes in process `syz.2.2263'. [ 286.450913][T14006] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2266'. [ 286.472557][T14005] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2266'. [ 286.736709][T14016] veth1_to_bond: entered allmulticast mode [ 286.753656][T14016] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2269'. [ 286.838794][T14023] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2269'. [ 286.958715][T14023] bond0: (slave bond_slave_1): Releasing backup interface [ 287.067522][T14031] x_tables: duplicate underflow at hook 2 [ 287.133307][T14023] veth1_to_bond (unregistering): left allmulticast mode [ 287.395774][T14051] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2278'. [ 287.453410][T14058] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2277'. [ 287.666304][T14062] bond8: option all_slaves_active: invalid value (222) [ 287.677044][T14062] bond8 (unregistering): Released all slaves [ 287.710399][T14066] tipc: Enabling of bearer rejected, failed to enable media [ 287.721719][T14069] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2281'. [ 288.184452][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 288.192573][ C0] lec:lec_tx_timeout: lec0 [ 288.197330][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 288.213187][T14091] netlink: 'syz.0.2286': attribute type 1 has an invalid length. [ 288.260920][T14095] block nbd0: NBD_DISCONNECT [ 288.269058][T14095] block nbd0: Send disconnect failed -32 [ 288.358667][T14096] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 288.369827][T14096] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 288.410660][T14093] macsec2: entered promiscuous mode [ 288.416217][T14093] macsec2: entered allmulticast mode [ 288.421528][T14093] bridge0: entered allmulticast mode [ 288.427578][T14093] bridge0: port 1(macsec2) entered blocking state [ 288.434228][T14093] bridge0: port 1(macsec2) entered disabled state [ 288.447076][T14093] bridge0: left allmulticast mode [ 288.471357][T14102] macvlan2: entered promiscuous mode [ 288.477335][T14102] macvlan2: entered allmulticast mode [ 288.507513][T14101] ip6gre1: entered promiscuous mode [ 288.513187][T14101] ip6gre1: entered allmulticast mode [ 288.535405][T14100] syz_tun: entered allmulticast mode [ 288.597621][T14103] syz_tun: left allmulticast mode [ 289.154881][T14151] netlink: 'syz.2.2303': attribute type 24 has an invalid length. [ 289.268727][T14157] smc: net device team0 applied user defined pnetid SYZ2 [ 289.721931][T14188] netlink: 'syz.0.2315': attribute type 39 has an invalid length. [ 290.473659][T14230] __nla_validate_parse: 16 callbacks suppressed [ 290.473679][T14230] netlink: 212368 bytes leftover after parsing attributes in process `syz.0.2328'. [ 290.518732][T14232] netlink: 'syz.4.2329': attribute type 15 has an invalid length. [ 290.528396][T14232] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2329'. [ 290.547786][ T13] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 2816 - 0 [ 290.557202][T14232] netlink: 'syz.4.2329': attribute type 15 has an invalid length. [ 290.565442][ T13] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 2816 - 0 [ 290.574464][ T13] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 2816 - 0 [ 290.586162][T14232] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2329'. [ 290.604542][ T13] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 2816 - 0 [ 290.641261][T14232] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2329'. [ 290.668454][T14232] openvswitch: netlink: Flow actions attr not present in new flow. [ 290.737601][T14241] gretap0: refused to change device tx_queue_len [ 290.744175][T14241] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 290.814997][T14249] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2333'. [ 290.841400][T14245] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2331'. [ 290.855815][T14249] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2333'. [ 290.986129][T14259] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2336'. [ 290.997186][T14259] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2336'. [ 291.020252][T14259] netlink: 'syz.2.2336': attribute type 17 has an invalid length. [ 291.030371][T14259] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2336'. [ 291.159209][T14272] bridge: RTM_NEWNEIGH with invalid state 0x8 [ 291.170885][T14272] xt_time: unknown flags 0xf4 [ 291.299863][T14277] syzkaller1: entered promiscuous mode [ 291.316898][T14277] syzkaller1: entered allmulticast mode [ 291.447665][T14290] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 291.749931][T14287] netlink: 'syz.1.2344': attribute type 11 has an invalid length. [ 291.891330][T14293] syzkaller0: entered promiscuous mode [ 291.897082][T14293] syzkaller0: entered allmulticast mode [ 291.943869][T14298] netlink: 'syz.1.2347': attribute type 4 has an invalid length. [ 292.200799][T14309] netlink: 'syz.3.2351': attribute type 10 has an invalid length. [ 292.236965][T14309] veth0_macvtap: left promiscuous mode [ 292.264215][T14309] team0: Device veth0_macvtap failed to register rx_handler [ 292.428609][T14325] IPVS: set_ctl: invalid protocol: 4 172.20.20.47:20004 [ 292.525514][T14329] netlink: 'syz.3.2354': attribute type 10 has an invalid length. [ 292.531736][T14325] syzkaller0: entered promiscuous mode [ 292.539156][T14325] syzkaller0: entered allmulticast mode [ 293.984378][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5790 ms [ 293.992499][ C0] lec:lec_tx_timeout: lec0 [ 293.997158][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 294.282192][T14364] bond8: option arp_interval: mode dependency failed, not supported in mode balance-tlb(5) [ 294.297180][T14368] netlink: 'syz.3.2365': attribute type 58 has an invalid length. [ 294.317105][T14364] bond8 (unregistering): Released all slaves [ 294.359513][T14376] netlink: 'syz.3.2365': attribute type 1 has an invalid length. [ 294.376106][T14362] dvmrp0: entered allmulticast mode [ 294.434170][T14380] sctp: [Deprecated]: syz.2.2368 (pid 14380) Use of int in max_burst socket option. [ 294.434170][T14380] Use struct sctp_assoc_value instead [ 294.506542][T14368] gretap2: entered promiscuous mode [ 294.581992][T14386] netlink: 'syz.4.2369': attribute type 1 has an invalid length. [ 294.702039][T14395] netlink: 'syz.0.2371': attribute type 12 has an invalid length. [ 294.762915][T14395] bond7: option primary_reselect: invalid value (255) [ 294.777329][T14395] bond7 (unregistering): Released all slaves [ 294.817985][T14401] netlink: 'syz.1.2373': attribute type 10 has an invalid length. [ 294.830868][T14401] team0: Port device geneve0 added [ 294.958997][T14410] bond0: entered promiscuous mode [ 294.974705][T14410] bond_slave_0: entered promiscuous mode [ 294.994711][T14410] bond_slave_1: entered promiscuous mode [ 295.026086][T14410] mac80211_hwsim hwsim5 wlan1: entered promiscuous mode [ 295.049237][T14410] batadv0: entered promiscuous mode [ 295.084661][T14410] bridge_slave_1: entered promiscuous mode [ 295.092451][T14418] netlink: 'syz.0.2378': attribute type 27 has an invalid length. [ 295.102621][T14416] lo speed is unknown, defaulting to 1000 [ 295.139304][T14416] lo speed is unknown, defaulting to 1000 [ 295.165568][T14416] lo speed is unknown, defaulting to 1000 [ 295.199219][T14422] netlink: 'syz.4.2381': attribute type 30 has an invalid length. [ 295.615084][T14446] veth0_to_hsr: default FDB implementation only supports local addresses [ 295.657386][T14446] __nla_validate_parse: 16 callbacks suppressed [ 295.657407][T14446] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2390'. [ 295.694230][T14446] IPv6: NLM_F_CREATE should be specified when creating new route [ 295.702760][T14449] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2387'. [ 295.749168][T14446] netlink: 120 bytes leftover after parsing attributes in process `syz.4.2390'. [ 295.893315][T14461] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2393'. [ 295.913070][T14416] infiniband syz2: set down [ 295.917754][T10087] lo speed is unknown, defaulting to 1000 [ 295.926484][T14416] infiniband syz2: added lo [ 295.933274][T14416] workqueue: Failed to create a rescuer kthread for wq "ib_mad1": -EINTR [ 295.960771][T14416] infiniband syz2: Couldn't open port 1 [ 296.044665][T14466] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2394'. [ 296.066563][T14465] lo: left allmulticast mode [ 296.071450][T14465] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 296.081930][T14416] RDS/IB: syz2: added [ 296.105396][T14476] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2395'. [ 296.119973][T14416] smc: adding ib device syz2 with port count 1 [ 296.144602][T14416] smc: ib device syz2 port 1 has no pnetid [ 296.166686][T10087] lo speed is unknown, defaulting to 1000 [ 296.178516][T14416] lo speed is unknown, defaulting to 1000 [ 296.395017][T14496] netlink: 'syz.2.2401': attribute type 1 has an invalid length. [ 296.507399][T14496] 8021q: adding VLAN 0 to HW filter on device bond9 [ 296.670840][T14416] lo speed is unknown, defaulting to 1000 [ 296.690702][T14511] netlink: 44 bytes leftover after parsing attributes in process `syz.3.2404'. [ 296.892305][T14517] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2405'. [ 297.016373][T14522] netlink: 212340 bytes leftover after parsing attributes in process `syz.4.2407'. [ 297.044565][T14522] openvswitch: netlink: Port 167772160 exceeds max allowable 65535 [ 297.143611][T14416] lo speed is unknown, defaulting to 1000 [ 297.182162][T14528] tipc: Can't bind to reserved service type 1 [ 297.239815][T14531] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2410'. [ 297.309182][T14533] 0ªî{X¹¦: renamed from gretap0 [ 297.342260][T14533] A link change request failed with some changes committed already. Interface 30ªî{X¹¦ may have been left with an inconsistent configuration, please check. [ 297.436999][T14533] syzkaller1: entered promiscuous mode [ 297.483280][T14533] syzkaller1: entered allmulticast mode [ 297.753336][T14416] lo speed is unknown, defaulting to 1000 [ 297.826378][T14566] netlink: 'syz.2.2421': attribute type 1 has an invalid length. [ 297.940631][T14574] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 298.181683][T14584] netlink: 'syz.4.2428': attribute type 1 has an invalid length. [ 298.286510][T14416] lo speed is unknown, defaulting to 1000 [ 298.780178][T14615] 8021q: adding VLAN 0 to HW filter on device bond5 [ 298.853799][T14618] 8021q: adding VLAN 0 to HW filter on device bond5 [ 298.862495][T14618] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 298.874278][T14618] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 299.024375][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 299.032516][ C0] lec:lec_tx_timeout: lec0 [ 299.037435][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 299.194614][T14647] bridge0: port 2(batadv1) entered blocking state [ 299.201348][T14647] bridge0: port 2(batadv1) entered disabled state [ 299.230877][T14647] batadv1: entered allmulticast mode [ 299.245242][T14647] batadv1: entered promiscuous mode [ 299.307470][T14652] syzkaller0: entered promiscuous mode [ 299.334426][T14652] syzkaller0: entered allmulticast mode [ 299.341948][T14649] 8021q: VLANs not supported on ipvlan0 [ 299.377302][T14652] tipc: Enabled bearer , priority 0 [ 299.388794][T14651] tipc: Resetting bearer [ 299.421996][T14651] tipc: Disabling bearer [ 299.535498][T14659] bond7: Unable to set peer notification delay as MII monitoring is disabled [ 299.563505][T14659] bond7 (unregistering): Released all slaves [ 299.674707][ T3555] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 299.684397][ T3555] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 300.040032][T14680] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 300.294159][T14707] openvswitch: netlink: IP tunnel dst address not specified [ 300.313953][T14707] pimreg3: entered allmulticast mode [ 300.379795][T10956] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20002 - 0 [ 300.389614][T10956] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20002 - 0 [ 300.413650][T10956] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20002 - 0 [ 300.424057][T10956] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20002 - 0 [ 300.453003][T14715] tc_dump_action: action bad kind [ 300.571984][T14721] validate_nla: 4 callbacks suppressed [ 300.572004][T14721] netlink: 'syz.1.2466': attribute type 3 has an invalid length. [ 300.590179][T14719] netlink: 'syz.0.2467': attribute type 12 has an invalid length. [ 300.598185][T14719] netlink: 'syz.0.2467': attribute type 11 has an invalid length. [ 300.731331][T14733] openvswitch: netlink: IP tunnel dst address not specified [ 300.747312][T14734] bond0: Caught tx_queue_len zero misconfig [ 300.916516][T14742] __nla_validate_parse: 13 callbacks suppressed [ 300.916537][T14742] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.2476'. [ 301.345543][T14768] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2483'. [ 301.421879][T14781] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2485'. [ 301.551451][T14773] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2485'. [ 301.658486][T14767] lo speed is unknown, defaulting to 1000 [ 302.005771][T14801] netlink: 'syz.4.2493': attribute type 1 has an invalid length. [ 302.123039][T14801] 8021q: adding VLAN 0 to HW filter on device bond4 [ 302.350761][T14816] netlink: 'syz.0.2496': attribute type 1 has an invalid length. [ 302.388647][T14816] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 302.613238][T14826] lo: entered allmulticast mode [ 302.630722][T14826] tunl0: entered allmulticast mode [ 302.645912][T14826] gre0: entered allmulticast mode [ 302.661962][T14826] erspan0: entered allmulticast mode [ 302.682208][T14826] ip_vti0: entered allmulticast mode [ 302.700783][T14826] ip6_vti0: entered allmulticast mode [ 302.718952][T14826] sit0: entered allmulticast mode [ 302.742521][T14826] ip6tnl0: entered allmulticast mode [ 302.760265][T14826] ip6gre0: entered allmulticast mode [ 302.766058][T14826] ip6gretap0: entered allmulticast mode [ 302.771984][T14826] vcan0: entered allmulticast mode [ 302.787124][T14826] bond0: entered allmulticast mode [ 302.792538][T14826] bond_slave_0: entered allmulticast mode [ 302.798850][T14826] team0: entered allmulticast mode [ 302.804292][T14826] team_slave_0: entered allmulticast mode [ 302.810455][T14826] team_slave_1: entered allmulticast mode [ 302.816662][T14826] dummy0: entered allmulticast mode [ 302.845528][T14826] nlmon0: entered allmulticast mode [ 302.851146][T14826] caif0: entered allmulticast mode [ 302.874758][T14826] vxcan0: entered allmulticast mode [ 302.889320][T14826] vxcan1: entered allmulticast mode [ 302.895952][T14826] veth0: entered allmulticast mode [ 302.901813][T14826] veth1: entered allmulticast mode [ 302.908200][T14826] wg0: entered allmulticast mode [ 302.913509][T14826] wg1: entered allmulticast mode [ 302.918882][T14826] wg2: entered allmulticast mode [ 302.924247][T14826] veth0_to_bridge: entered allmulticast mode [ 302.930752][T14826] bridge_slave_0: entered allmulticast mode [ 302.937080][T14826] veth0_to_bond: entered allmulticast mode [ 302.943434][T14826] veth0_to_team: entered allmulticast mode [ 302.961331][T14826] veth1_to_team: entered allmulticast mode [ 302.967809][T14826] veth0_to_batadv: entered allmulticast mode [ 302.974199][T14826] batadv_slave_0: entered allmulticast mode [ 302.980604][T14826] veth1_to_batadv: entered allmulticast mode [ 302.987259][T14826] batadv_slave_1: entered allmulticast mode [ 302.993561][T14826] xfrm0: entered allmulticast mode [ 302.999147][T14826] veth0_to_hsr: entered allmulticast mode [ 303.005306][T14826] hsr_slave_0: entered allmulticast mode [ 303.013383][T14826] veth1_to_hsr: entered allmulticast mode [ 303.019721][T14826] hsr_slave_1: entered allmulticast mode [ 303.025895][T14826] : entered allmulticast mode [ 303.031102][T14826] veth1_virt_wifi: entered allmulticast mode [ 303.037642][T14826] veth0_virt_wifi: entered allmulticast mode [ 303.044114][T14826] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 303.051953][T14826] veth1_vlan: entered allmulticast mode [ 303.058474][T14826] veth0_vlan: entered allmulticast mode [ 303.064694][T14826] v: entered allmulticast mode [ 303.069914][T14826] s5ÿÿø: entered allmulticast mode [ 303.082931][T14826] macvlan0: left promiscuous mode [ 303.088383][T14826] macvlan0: entered allmulticast mode [ 303.095554][T14826] macvlan1: entered allmulticast mode [ 303.101428][T14826] ipvlan0: entered allmulticast mode [ 303.113223][T14826] ipvlan1: entered allmulticast mode [ 303.119079][T14826] veth1_macvtap: entered allmulticast mode [ 303.125652][T14826] veth0_macvtap: entered allmulticast mode [ 303.131889][T14826] macvtap0: entered allmulticast mode [ 303.137885][T14826] macsec0: entered allmulticast mode [ 303.143573][T14826] geneve0: entered allmulticast mode [ 303.149488][T14826] geneve1: entered allmulticast mode [ 303.155447][T14826] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 303.166700][T14826] netdevsim netdevsim2 netdevsim1: entered allmulticast mode [ 303.180541][T14826] netdevsim netdevsim2 netdevsim2: entered allmulticast mode [ 303.189809][T14826] netdevsim netdevsim2 netdevsim3: entered allmulticast mode [ 303.199059][T14826] mac80211_hwsim hwsim11 wlan1: entered allmulticast mode [ 303.207063][T14826] vxlan0: entered allmulticast mode [ 303.212587][T14826] sit1: entered allmulticast mode [ 303.217875][T14826] bridge1: entered allmulticast mode [ 303.223460][T14826] wireguard0: entered allmulticast mode [ 303.229345][T14826] ipip0: entered allmulticast mode [ 303.235082][T14826] veth2: entered allmulticast mode [ 303.240411][T14826] veth3: entered allmulticast mode [ 303.245854][T14826] vxlan1: entered allmulticast mode [ 303.251183][T14826] mac80211_hwsim hwsim18 wlan2: entered allmulticast mode [ 303.258663][T14826] bond1: entered allmulticast mode [ 303.264120][T14826] ipip1: entered allmulticast mode [ 303.270335][T14826] 9: entered allmulticast mode [ 303.276047][T14826] syztnl1: entered allmulticast mode [ 303.281534][T14826] veth4: entered allmulticast mode [ 303.287545][T14826] veth5: entered allmulticast mode [ 303.292838][T14826] bond2: entered allmulticast mode [ 303.298065][T14826] bond3: entered allmulticast mode [ 303.305322][T14826] syztnl0: entered allmulticast mode [ 303.312211][T14826] bond4: entered allmulticast mode [ 303.318259][T14826] geneve4: entered allmulticast mode [ 303.323769][T14826] macsec1: entered allmulticast mode [ 303.329886][T14826] bond5: left promiscuous mode [ 303.334734][T14826] bridge2: left promiscuous mode [ 303.339868][T14826] bond5: entered allmulticast mode [ 303.345119][T14826] bridge2: entered allmulticast mode [ 303.355510][T14826] bond6: entered allmulticast mode [ 303.360833][T14826] ip6tnl1: entered allmulticast mode [ 303.367025][T14826] bond7: entered allmulticast mode [ 303.372957][T14826] ip6erspan0: entered allmulticast mode [ 303.379140][T14826] macsec2: entered allmulticast mode [ 303.387530][T14826] bridge0: entered allmulticast mode [ 303.393022][T14826] bond8: entered allmulticast mode [ 303.399181][T14826] ip6gre1: left promiscuous mode [ 303.407013][T14826] gre1: entered allmulticast mode [ 303.414275][T14826] bridge3: entered allmulticast mode [ 303.421858][T14826] ip6tnl2: entered allmulticast mode [ 303.428368][T14826] bond9: entered allmulticast mode [ 303.576383][T14841] sctp: [Deprecated]: syz.4.2500 (pid 14841) Use of struct sctp_assoc_value in delayed_ack socket option. [ 303.576383][T14841] Use struct sctp_sack_info instead [ 303.739802][T14854] netlink: 'syz.3.2505': attribute type 10 has an invalid length. [ 303.762404][T14854] geneve0: left promiscuous mode [ 304.044399][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 304.052467][ C0] lec:lec_tx_timeout: lec0 [ 304.057499][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 304.982176][T14937] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2527'. [ 305.029102][T14928] macsec0: entered promiscuous mode [ 305.037292][T14928] macsec0: entered allmulticast mode [ 305.043072][T14942] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2528'. [ 305.054057][T14935] mac80211_hwsim hwsim2 wlan0: entered allmulticast mode [ 305.167922][T14949] openvswitch: netlink: Key 9 has unexpected len 2 expected 4 [ 305.516449][T14977] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2536'. [ 305.619171][T14984] netlink: 'syz.0.2539': attribute type 13 has an invalid length. [ 305.632437][T14983] tipc: Enabled bearer , priority 0 [ 305.639317][T14984] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2539'. [ 305.659297][T14984] netlink: 'syz.0.2539': attribute type 13 has an invalid length. [ 305.667468][T14983] syzkaller0: entered allmulticast mode [ 305.678732][T14984] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2539'. [ 305.730538][T14983] tipc: Resetting bearer [ 305.764786][T14991] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2540'. [ 305.785601][T14982] tipc: Resetting bearer [ 305.832608][T14982] tipc: Disabling bearer [ 305.951731][T15006] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2545'. [ 305.968967][T15006] netlink: 1038 bytes leftover after parsing attributes in process `syz.0.2545'. [ 305.981273][T15006] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2545'. [ 305.991131][T15006] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2545'. [ 306.001389][T15006] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2545'. [ 306.010737][T15006] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2545'. [ 306.023650][T15006] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2545'. [ 306.033116][T15006] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2545'. [ 306.045947][T15006] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2545'. [ 306.331156][T15029] syzkaller1: entered promiscuous mode [ 306.347807][T15029] syzkaller1: entered allmulticast mode [ 306.490350][T15038] vlan0: entered promiscuous mode [ 306.496609][T15038] vlan0: entered allmulticast mode [ 306.501848][T15038] hsr_slave_1: entered allmulticast mode [ 306.791909][T15053] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 306.861046][T15056] xt_l2tp: v2 tid > 0xffff: 1114244 [ 306.886738][T15057] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2565'. [ 306.969768][T15057] 8021q: adding VLAN 0 to HW filter on device bond6 [ 307.356035][T15089] netlink: 'syz.3.2578': attribute type 20 has an invalid length. [ 307.375516][T15089] netlink: 'syz.3.2578': attribute type 20 has an invalid length. [ 307.554683][T15112] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 307.821204][T15134] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 308.980311][T15196] netlink: 'syz.0.2612': attribute type 9 has an invalid length. [ 308.989146][T15196] netlink: 'syz.0.2612': attribute type 11 has an invalid length. [ 309.014445][T15196] netlink: 'syz.0.2612': attribute type 12 has an invalid length. [ 309.064415][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 309.072709][ C0] lec:lec_tx_timeout: lec0 [ 309.077297][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 309.227995][T15209] atomic_op ffff888030780198 conn xmit_atomic 0000000000000000 [ 309.420622][T15219] bridge0: port 1(batadv1) entered blocking state [ 309.440679][T15219] bridge0: port 1(batadv1) entered disabled state [ 309.457620][T15219] batadv1: entered allmulticast mode [ 309.483549][T15219] batadv1: entered promiscuous mode [ 309.546557][T15226] tc_dump_action: action bad kind [ 309.933317][T15256] netlink: 'syz.3.2631': attribute type 20 has an invalid length. [ 309.941345][T10936] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 309.950687][T10936] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 309.960865][T15256] IPv6: NLM_F_CREATE should be specified when creating new route [ 310.448295][T15283] netlink: 'syz.2.2640': attribute type 3 has an invalid length. [ 310.993132][T15313] __nla_validate_parse: 90 callbacks suppressed [ 310.993156][T15313] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2650'. [ 311.201976][T15327] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2655'. [ 311.450823][T15345] netlink: 'syz.1.2660': attribute type 4 has an invalid length. [ 311.777343][T15373] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 311.796777][T15376] netlink: 'syz.4.2671': attribute type 6 has an invalid length. [ 311.832790][T15376] netlink: 'syz.4.2671': attribute type 6 has an invalid length. [ 311.879752][T15379] tipc: Enabled bearer , priority 0 [ 311.912175][T15380] syzkaller0: entered promiscuous mode [ 311.934626][T15380] syzkaller0: entered allmulticast mode [ 311.962783][T15379] tipc: Resetting bearer [ 312.116392][T15397] netlink: 'syz.3.2676': attribute type 11 has an invalid length. [ 312.145128][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 312.165688][T15397] netlink: 64 bytes leftover after parsing attributes in process `syz.3.2676'. [ 312.229019][T15392] tipc: Resetting bearer [ 312.264207][T15392] tipc: Disabling bearer [ 312.408315][T15415] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2681'. [ 312.901029][T15431] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2686'. [ 312.998509][T15436] netlink: 256 bytes leftover after parsing attributes in process `syz.4.2688'. [ 313.067062][T15440] netlink: 7 bytes leftover after parsing attributes in process `syz.2.2691'. [ 313.379685][T15459] sctp: [Deprecated]: syz.4.2695 (pid 15459) Use of int in max_burst socket option deprecated. [ 313.379685][T15459] Use struct sctp_assoc_value instead [ 313.547140][T15463] netlink: 'syz.3.2697': attribute type 10 has an invalid length. [ 313.585927][T15463] bond0: (slave wlan1): Opening slave failed [ 313.828142][T15478] netlink: 'syz.3.2702': attribute type 33 has an invalid length. [ 313.880802][T15478] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 314.084400][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 314.092457][ C0] lec:lec_tx_timeout: lec0 [ 314.097281][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 314.479497][T15519] : entered promiscuous mode [ 314.590679][T15522] netlink: 'syz.1.2713': attribute type 1 has an invalid length. [ 314.976250][T15550] netlink: 144 bytes leftover after parsing attributes in process `syz.3.2718'. [ 315.362607][T15578] IPVS: ovf: FWM 3 0x00000003 - no destination available [ 315.436487][T15578] netlink: 'syz.2.2726': attribute type 63 has an invalid length. [ 315.458598][T15583] netlink: 'syz.2.2726': attribute type 63 has an invalid length. [ 315.468512][T15586] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 315.510681][T15587] syzkaller1: entered promiscuous mode [ 315.535424][T15587] syzkaller1: entered allmulticast mode [ 315.556541][T15578] netlink: 'syz.2.2726': attribute type 63 has an invalid length. [ 315.929612][T15613] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2734'. [ 316.136632][T15627] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2739'. [ 316.171080][T15629] bridge: RTM_NEWNEIGH with invalid ether address [ 316.474520][T15646] validate_nla: 127 callbacks suppressed [ 316.474543][T15646] netlink: 'syz.0.2743': attribute type 24 has an invalid length. [ 316.544215][T15654] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2746'. [ 316.860151][T15666] bond0: (slave caif0): Error: Device type is different from other slaves [ 317.349184][T15682] IPVS: dh: SCTP 172.20.20.187:0 - no destination available [ 317.426984][T15686] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2752'. [ 317.644621][T15691] netlink: 'syz.0.2758': attribute type 1 has an invalid length. [ 317.670214][T15694] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2758'. [ 317.717038][T15700] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2760'. [ 317.776873][T15691] bond7: entered promiscuous mode [ 317.781995][T15691] bond7: entered allmulticast mode [ 317.808190][T15691] 8021q: adding VLAN 0 to HW filter on device bond7 [ 317.883122][T15699] netlink: 280 bytes leftover after parsing attributes in process `syz.1.2759'. [ 318.181939][T15718] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2763'. [ 318.405756][T15734] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2767'. [ 318.824245][T15764] netlink: 'syz.1.2775': attribute type 13 has an invalid length. [ 318.878863][T15764] syzkaller1: entered promiscuous mode [ 318.900778][T15764] syzkaller1: entered allmulticast mode [ 318.925736][T15771] netlink: 180 bytes leftover after parsing attributes in process `syz.4.2777'. [ 319.104746][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 319.112859][ C0] lec:lec_tx_timeout: lec0 [ 319.117835][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 319.185384][T15786] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2781'. [ 319.223578][T15785] wlan0 speed is unknown, defaulting to 1000 [ 319.248629][T15785] wlan0 speed is unknown, defaulting to 1000 [ 319.258086][T15785] wlan0 speed is unknown, defaulting to 1000 [ 319.326969][T15785] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 319.461597][T15785] wlan0 speed is unknown, defaulting to 1000 [ 319.487877][T15785] wlan0 speed is unknown, defaulting to 1000 [ 319.527582][T15785] wlan0 speed is unknown, defaulting to 1000 [ 319.546401][T15785] wlan0 speed is unknown, defaulting to 1000 [ 319.561050][T15785] wlan0 speed is unknown, defaulting to 1000 [ 319.631664][T15803] FAULT_INJECTION: forcing a failure. [ 319.631664][T15803] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 319.661353][T15803] CPU: 0 UID: 0 PID: 15803 Comm: syz.2.2787 Not tainted syzkaller #0 PREEMPT(full) [ 319.661383][T15803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 319.661397][T15803] Call Trace: [ 319.661405][T15803] [ 319.661415][T15803] dump_stack_lvl+0x189/0x250 [ 319.661446][T15803] ? __pfx____ratelimit+0x10/0x10 [ 319.661467][T15803] ? __pfx_dump_stack_lvl+0x10/0x10 [ 319.661493][T15803] ? __pfx__printk+0x10/0x10 [ 319.661525][T15803] ? __might_fault+0xb0/0x130 [ 319.661569][T15803] should_fail_ex+0x414/0x560 [ 319.661607][T15803] _copy_from_user+0x2d/0xb0 [ 319.661633][T15803] ___sys_sendmsg+0x158/0x2a0 [ 319.661663][T15803] ? __pfx____sys_sendmsg+0x10/0x10 [ 319.661696][T15803] ? rcu_read_lock_any_held+0xb3/0x120 [ 319.661754][T15803] ? __fget_files+0x2a/0x420 [ 319.661779][T15803] ? __fget_files+0x3a0/0x420 [ 319.661817][T15803] __x64_sys_sendmsg+0x19b/0x260 [ 319.661845][T15803] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 319.661882][T15803] ? __pfx_ksys_write+0x10/0x10 [ 319.661907][T15803] ? do_syscall_64+0xbe/0xf80 [ 319.661933][T15803] do_syscall_64+0xfa/0xf80 [ 319.661956][T15803] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.661976][T15803] ? clear_bhb_loop+0x60/0xb0 [ 319.662002][T15803] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.662022][T15803] RIP: 0033:0x7f2f0b38f749 [ 319.662041][T15803] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 319.662059][T15803] RSP: 002b:00007f2f0c197038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 319.662082][T15803] RAX: ffffffffffffffda RBX: 00007f2f0b5e5fa0 RCX: 00007f2f0b38f749 [ 319.662098][T15803] RDX: 0000000004000800 RSI: 0000200000000640 RDI: 0000000000000004 [ 319.662111][T15803] RBP: 00007f2f0c197090 R08: 0000000000000000 R09: 0000000000000000 [ 319.662131][T15803] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 319.662143][T15803] R13: 00007f2f0b5e6038 R14: 00007f2f0b5e5fa0 R15: 00007ffc46da5f38 [ 319.662179][T15803] [ 320.391900][T15830] A link change request failed with some changes committed already. Interface erspan0 may have been left with an inconsistent configuration, please check. [ 320.487008][T15835] netem: change failed [ 321.277976][T15886] __nla_validate_parse: 6 callbacks suppressed [ 321.278006][T15886] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2815'. [ 321.304162][T15886] netlink: 'syz.3.2815': attribute type 5 has an invalid length. [ 321.315295][T15886] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2815'. [ 321.339933][T15891] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2818'. [ 321.359090][T15886] geneve4: entered promiscuous mode [ 321.381507][T15886] geneve4: entered allmulticast mode [ 321.396319][T15891] tipc: New replicast peer: 255.255.83.7 [ 321.413196][T15891] tipc: Enabled bearer , priority 10 [ 321.433155][T15891] netlink: 'syz.0.2818': attribute type 10 has an invalid length. [ 321.441732][T15891] netlink: 2 bytes leftover after parsing attributes in process `syz.0.2818'. [ 321.451924][T15891] team0: entered promiscuous mode [ 321.458134][T15891] 8021q: adding VLAN 0 to HW filter on device team0 [ 321.465816][T15891] bridge0: port 1(team0) entered blocking state [ 321.472454][T15891] bridge0: port 1(team0) entered disabled state [ 321.479223][T15891] team0: entered allmulticast mode [ 321.494815][T15901] netlink: 'syz.4.2820': attribute type 10 has an invalid length. [ 321.752347][T15906] bond8: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 321.885472][T15906] bond8 (unregistering): Released all slaves [ 322.181338][T15940] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2827'. [ 322.200783][T15940] team0: left allmulticast mode [ 322.211762][T15942] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2828'. [ 322.232237][T15940] bridge0: port 1(team0) entered disabled state [ 322.261906][T15940] batadv1: left allmulticast mode [ 322.281189][T15945] xt_ecn: cannot match TCP bits for non-tcp packets [ 322.285455][T15951] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2828'. [ 322.307100][T15940] batadv1: left promiscuous mode [ 322.315076][T15940] bridge0: port 3(batadv1) entered disabled state [ 322.532116][T10087] tipc: Node number set to 3958937463 [ 322.596598][T15964] veth0: entered promiscuous mode [ 322.630177][T15962] veth0: left promiscuous mode [ 322.874992][T15977] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2839'. [ 322.920992][T15979] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 323.160058][T15987] netlink: 104 bytes leftover after parsing attributes in process `syz.0.2840'. [ 323.328143][T15998] x_tables: ip6_tables: policy.0 match: invalid size 312 (kernel) != (user) 0 [ 323.338042][T15998] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2841'. [ 323.529184][T16012] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 323.923080][T16027] siw: device registration error -23 [ 323.955294][T16027] siw: device registration error -23 [ 324.098693][ T5839] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 324.119870][ T5839] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 324.132151][ T5839] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 324.134471][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 324.147311][ C0] lec:lec_tx_timeout: lec0 [ 324.154363][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 324.181355][ T5839] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 324.194793][T16040] netlink: 'syz.2.2852': attribute type 1 has an invalid length. [ 324.206831][ T5839] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 324.336349][T16040] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 324.607077][T16051] xt_hashlimit: size too large, truncated to 1048576 [ 324.967651][T16034] lo speed is unknown, defaulting to 1000 [ 324.979524][T16079] xt_cgroup: xt_cgroup: no path or classid specified [ 325.262616][T16088] syzkaller1: entered promiscuous mode [ 325.268531][T16088] syzkaller1: entered allmulticast mode [ 325.428533][T16034] wlan0 speed is unknown, defaulting to 1000 [ 325.687361][T16106] syzkaller0: entered promiscuous mode [ 325.692917][T16106] syzkaller0: entered allmulticast mode [ 325.732835][T16034] chnl_net:caif_netlink_parms(): no params data found [ 326.194221][T16034] bridge0: port 1(bridge_slave_0) entered blocking state [ 326.217600][T16034] bridge0: port 1(bridge_slave_0) entered disabled state [ 326.236224][T16034] bridge_slave_0: entered allmulticast mode [ 326.247899][T16034] bridge_slave_0: entered promiscuous mode [ 326.274511][T16034] bridge0: port 2(bridge_slave_1) entered blocking state [ 326.282243][T16034] bridge0: port 2(bridge_slave_1) entered disabled state [ 326.289887][T16034] bridge_slave_1: entered allmulticast mode [ 326.297001][T16150] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 326.303476][T16034] bridge_slave_1: entered promiscuous mode [ 326.312367][ T5842] Bluetooth: hci5: command tx timeout [ 326.351436][T16143] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 326.396244][T16155] __nla_validate_parse: 7 callbacks suppressed [ 326.396264][T16155] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2883'. [ 326.435290][T16034] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 326.464598][T16034] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 326.500520][T16142] delete_channel: no stack [ 326.629416][T16034] team0: Port device team_slave_0 added [ 326.648176][T16034] team0: Port device team_slave_1 added [ 326.737527][T16165] netlink: 'syz.0.2887': attribute type 1 has an invalid length. [ 326.757810][T16165] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2887'. [ 326.767925][T16034] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 326.775210][T16034] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 326.802087][T16034] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 326.821881][T16034] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 326.829713][T16034] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 326.858052][T16034] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 327.058818][T16034] hsr_slave_0: entered promiscuous mode [ 327.082933][T16034] hsr_slave_1: entered promiscuous mode [ 327.090810][T16034] debugfs: 'hsr0' already exists in 'hsr' [ 327.102816][T16034] Cannot create hsr debugfs directory [ 327.123998][T16179] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2892'. [ 327.138637][T16181] bridge8: entered promiscuous mode [ 327.144011][T16181] bridge8: entered allmulticast mode [ 327.157811][T16181] team0: Port device bridge8 added [ 327.164687][T16183] wg1: entered promiscuous mode [ 327.180461][T16186] bridge0: port 3(team0) entered blocking state [ 327.198331][T16186] bridge0: port 3(team0) entered disabled state [ 327.210175][T16186] team0: entered allmulticast mode [ 327.216798][T16186] team_slave_0: entered allmulticast mode [ 327.222766][T16186] team_slave_1: entered allmulticast mode [ 327.228706][T16186] geneve0: entered allmulticast mode [ 327.236938][T16186] team0: entered promiscuous mode [ 327.242042][T16186] team_slave_0: entered promiscuous mode [ 327.250734][T16186] team_slave_1: entered promiscuous mode [ 327.257362][T16186] geneve0: entered promiscuous mode [ 327.266869][T16187] tipc: Enabling of bearer rejected, media not registered [ 327.288105][T16191] netlink: 248 bytes leftover after parsing attributes in process `syz.4.2896'. [ 327.297721][T16191] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2896'. [ 327.317239][T16194] netlink: 248 bytes leftover after parsing attributes in process `syz.4.2896'. [ 327.333619][T16194] netlink: 52 bytes leftover after parsing attributes in process `syz.4.2896'. [ 327.589102][T16202] PF_CAN: dropped non conform CAN XL skbuff: dev type 65534, len 40 [ 327.692223][T16205] netlink: 'syz.1.2901': attribute type 12 has an invalid length. [ 327.700430][T16205] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2901'. [ 327.706582][T16207] netlink: 'syz.4.2902': attribute type 9 has an invalid length. [ 327.719962][T16208] ipt_REJECT: ECHOREPLY no longer supported. [ 327.818519][T16034] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 327.829475][T16034] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 327.846516][T16034] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 327.982040][T16211] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 328.051279][T16221] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 328.091468][T10087] lo speed is unknown, defaulting to 1000 [ 328.107610][T10087] syz2: Port: 1 Link ACTIVE [ 328.117786][T16034] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 328.136928][T16034] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.158662][T16227] netlink: 'syz.1.2909': attribute type 1 has an invalid length. [ 328.162202][T16034] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 328.216975][T16232] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2909'. [ 328.244010][ T5945] lo speed is unknown, defaulting to 1000 [ 328.256303][T16234] netlink: 'syz.0.2911': attribute type 10 has an invalid length. [ 328.264267][T16234] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2911'. [ 328.309917][T16232] bond8 (unregistering): Released all slaves [ 328.361412][T16234] !: entered promiscuous mode [ 328.378623][T16234] A link change request failed with some changes committed already. Interface 0! may have been left with an inconsistent configuration, please check. [ 328.394842][ T5842] Bluetooth: hci5: command 0x041b tx timeout [ 328.410845][T16034] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 328.421723][T16034] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.461180][T16034] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 328.538430][T16245] block nbd0: not configured, cannot reconfigure [ 328.559235][T16245] nbd: must specify an index to disconnect [ 328.792137][T16034] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 328.804676][T16034] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 328.820986][T16034] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 329.080848][T16268] netlink: 'syz.2.2920': attribute type 1 has an invalid length. [ 329.164439][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 329.172654][ C0] lec:lec_tx_timeout: lec0 [ 329.177225][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 329.188483][T16269] syzkaller0: entered promiscuous mode [ 329.204172][T16269] syzkaller0: entered allmulticast mode [ 329.211805][T16275] netlink: 'syz.0.2921': attribute type 4 has an invalid length. [ 329.262694][T16274] netlink: 'syz.0.2921': attribute type 4 has an invalid length. [ 329.299636][T16034] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 329.326026][T10088] lo speed is unknown, defaulting to 1000 [ 329.331967][T10092] lo speed is unknown, defaulting to 1000 [ 329.338686][T16034] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 329.374735][T10088] lo speed is unknown, defaulting to 1000 [ 329.375201][T16034] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 329.400964][T16034] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 329.409287][T16259] lo speed is unknown, defaulting to 1000 [ 329.753388][T16259] wlan0 speed is unknown, defaulting to 1000 [ 329.773748][T16034] 8021q: adding VLAN 0 to HW filter on device bond0 [ 330.007864][T16307] xt_NFQUEUE: number of queues (27568) out of range (got 68779) [ 330.017366][T16034] 8021q: adding VLAN 0 to HW filter on device team0 [ 330.062668][T10956] bridge0: port 1(bridge_slave_0) entered blocking state [ 330.069978][T10956] bridge0: port 1(bridge_slave_0) entered forwarding state [ 330.113875][T10956] bridge0: port 2(bridge_slave_1) entered blocking state [ 330.121140][T10956] bridge0: port 2(bridge_slave_1) entered forwarding state [ 330.467695][ T5839] Bluetooth: hci5: command 0x041b tx timeout [ 330.679495][T16034] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 330.789303][T16034] veth0_vlan: entered promiscuous mode [ 330.806861][T16034] veth1_vlan: entered promiscuous mode [ 330.916744][T16034] veth0_macvtap: entered promiscuous mode [ 330.928412][ T30] audit: type=1800 audit(1766988741.276:75): pid=16328 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2933" name="memory.events" dev="tmpfs" ino=3199 res=0 errno=0 [ 330.964793][T16034] veth1_macvtap: entered promiscuous mode [ 331.022288][T16034] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 331.080180][T16034] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 331.149572][ T1007] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.193436][ T1007] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.222476][ T1007] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.249325][ T1007] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 331.364731][T16341] Cannot find add_set index 0 as target [ 331.682810][T16366] IPVS: set_ctl: invalid protocol: 22198 172.20.20.35:20001 [ 331.709714][T10957] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 331.736758][T10957] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 331.818883][ T9081] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 331.840192][ T9081] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 331.973534][T16373] __nla_validate_parse: 7 callbacks suppressed [ 331.973556][T16373] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2945'. [ 332.194602][T16403] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2952'. [ 332.291900][T16408] openvswitch: netlink: Missing key (keys=40, expected=80) [ 332.544709][ T5839] Bluetooth: hci5: command 0x041b tx timeout [ 333.045681][ T5842] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 333.056187][ T5842] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 333.064491][ T5842] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 333.074751][ T5842] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 333.082596][ T5842] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 334.187777][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 334.195867][ C0] lec:lec_tx_timeout: lec0 [ 334.200507][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 334.637120][ T5842] Bluetooth: hci5: command 0x041b tx timeout [ 334.695868][T16450] netlink: 'syz.0.2967': attribute type 21 has an invalid length. [ 334.717525][T16450] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2967'. [ 335.143277][T16481] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2976'. [ 335.166747][T16428] lo speed is unknown, defaulting to 1000 [ 335.184533][ T5842] Bluetooth: hci4: command tx timeout [ 335.205076][T16481] netlink: 184 bytes leftover after parsing attributes in process `syz.1.2976'. [ 335.440894][T16495] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 335.649166][T16428] wlan0 speed is unknown, defaulting to 1000 [ 335.717718][T16515] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2987'. [ 335.786745][T16515] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2987'. [ 335.979871][T16531] netlink: 108 bytes leftover after parsing attributes in process `syz.2.2991'. [ 336.069872][T16536] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2990'. [ 336.081669][T16536] netlink: 'syz.1.2990': attribute type 3 has an invalid length. [ 336.172926][T16428] chnl_net:caif_netlink_parms(): no params data found [ 336.215138][T16544] netlink: 96 bytes leftover after parsing attributes in process `syz.0.2994'. [ 336.532835][T16428] bridge0: port 1(bridge_slave_0) entered blocking state [ 336.548432][T16428] bridge0: port 1(bridge_slave_0) entered disabled state [ 336.574627][T16428] bridge_slave_0: entered allmulticast mode [ 336.591829][T16428] bridge_slave_0: entered promiscuous mode [ 336.632265][T16428] bridge0: port 2(bridge_slave_1) entered blocking state [ 336.660689][T16428] bridge0: port 2(bridge_slave_1) entered disabled state [ 336.674718][T16428] bridge_slave_1: entered allmulticast mode [ 336.682790][T16428] bridge_slave_1: entered promiscuous mode [ 336.705344][ T5842] Bluetooth: hci5: command 0x041b tx timeout [ 336.770171][T16428] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 336.783842][T16428] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 336.845784][T16428] team0: Port device team_slave_0 added [ 336.856213][T16428] team0: Port device team_slave_1 added [ 336.920754][T16428] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 336.938755][T16428] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 336.996916][T16428] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 337.038149][T16428] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 337.055010][T16428] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 337.083528][T16428] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 337.187938][T16586] netlink: 'syz.3.3003': attribute type 1 has an invalid length. [ 337.206865][T16586] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3003'. [ 337.268369][ T5842] Bluetooth: hci4: command tx timeout [ 337.281703][T16428] hsr_slave_0: entered promiscuous mode [ 337.288873][T16428] hsr_slave_1: entered promiscuous mode [ 337.296238][T16428] debugfs: 'hsr0' already exists in 'hsr' [ 337.302578][T16428] Cannot create hsr debugfs directory [ 337.419341][T16599] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3004'. [ 337.476760][T16597] netlink: 'syz.2.3007': attribute type 1 has an invalid length. [ 337.485947][T16597] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3007'. [ 337.554841][T16600] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3008'. [ 337.649536][T16608] netlink: 'syz.1.3009': attribute type 11 has an invalid length. [ 337.830550][T16618] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3013'. [ 337.872102][T16620] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 337.907597][T16428] netdevsim netdevsim4 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 338.068412][T16428] netdevsim netdevsim4 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 338.198668][T16638] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3019'. [ 338.356988][T16641] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3021'. [ 338.388219][T16428] netdevsim netdevsim4 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 338.445522][T16645] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3022'. [ 338.483998][T16652] bond0: (slave batadv0): Releasing backup interface [ 338.525866][T16652] batadv0: left promiscuous mode [ 338.541548][T16652] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3024'. [ 338.561670][T16652] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3024'. [ 338.592654][T16428] netdevsim netdevsim4 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 2816 - 0 [ 338.746495][T16665] atomic_op ffff8880310de198 conn xmit_atomic 0000000000000000 [ 338.908095][T16428] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 338.940340][T16428] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 338.972925][T16428] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 339.000976][T16428] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 339.075992][T16688] xt_hashlimit: size too large, truncated to 1048576 [ 339.182323][T16691] syzkaller0: entered promiscuous mode [ 339.195233][T16691] syzkaller0: entered allmulticast mode [ 339.344596][ T5842] Bluetooth: hci4: command tx timeout [ 339.351703][T16428] 8021q: adding VLAN 0 to HW filter on device bond0 [ 339.482378][T16428] 8021q: adding VLAN 0 to HW filter on device team0 [ 339.516063][T10936] bridge0: port 1(bridge_slave_0) entered blocking state [ 339.523305][T10936] bridge0: port 1(bridge_slave_0) entered forwarding state [ 339.590635][T10972] bridge0: port 2(bridge_slave_1) entered blocking state [ 339.597917][T10972] bridge0: port 2(bridge_slave_1) entered forwarding state [ 339.638428][T16710] netlink: 'syz.3.3039': attribute type 8 has an invalid length. [ 339.984346][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5780 ms [ 339.992500][ C0] lec:lec_tx_timeout: lec0 [ 339.997536][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 340.290790][T16428] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 340.434702][T16716] lo speed is unknown, defaulting to 1000 [ 340.787583][T16744] netlink: 'syz.2.3045': attribute type 11 has an invalid length. [ 340.941781][T16428] veth0_vlan: entered promiscuous mode [ 341.004935][T16428] veth1_vlan: entered promiscuous mode [ 341.037407][T16716] wlan0 speed is unknown, defaulting to 1000 [ 341.291468][T16428] veth0_macvtap: entered promiscuous mode [ 341.317300][T16428] veth1_macvtap: entered promiscuous mode [ 341.418766][T16428] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 341.426455][ T5842] Bluetooth: hci4: command tx timeout [ 341.540647][T16428] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 341.656385][T10960] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.674930][T10960] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.700970][T10960] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 341.709957][T16778] openvswitch: netlink: IPv4 tunnel dst address is zero [ 341.763533][T10960] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 342.016777][T16789] sch_tbf: peakrate 5 is lower than or equals to rate 16783679728848008391 ! [ 342.114458][ T9078] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 342.144649][ T9078] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 342.253124][ T1007] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 342.285015][ T1007] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 342.383901][T16805] __nla_validate_parse: 3 callbacks suppressed [ 342.383921][T16805] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3060'. [ 342.429652][T16805] team0: left allmulticast mode [ 342.436622][T16805] team_slave_0: left allmulticast mode [ 342.443161][T16805] team_slave_1: left allmulticast mode [ 342.453233][T16805] geneve0: left allmulticast mode [ 342.463949][T16805] team0: left promiscuous mode [ 342.469446][T16805] team_slave_0: left promiscuous mode [ 342.510291][T16805] team_slave_1: left promiscuous mode [ 342.526843][T16805] geneve0: left promiscuous mode [ 342.540365][T16805] bridge0: port 3(team0) entered disabled state [ 342.553392][T16805] batadv1: left allmulticast mode [ 342.559654][T16805] batadv1: left promiscuous mode [ 342.574471][T16805] bridge0: port 2(batadv1) entered disabled state [ 342.585759][T16805] bridge_slave_0: left allmulticast mode [ 342.591535][T16805] bridge_slave_0: left promiscuous mode [ 342.597558][T16805] bridge0: port 1(bridge_slave_0) entered disabled state [ 342.673349][T16815] netlink: 4872 bytes leftover after parsing attributes in process `syz.2.3063'. [ 342.868948][T16827] openvswitch: netlink: VXLAN extension 30 out of range max 1 [ 343.075931][T16835] netlink: 'syz.3.3070': attribute type 21 has an invalid length. [ 343.128653][ T5839] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 343.139814][ T5839] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 343.148130][ T5839] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 343.159921][ T5839] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 343.169453][ T5839] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 343.204900][T16829] : renamed from veth0_vlan [ 343.258379][T16835] netlink: 156 bytes leftover after parsing attributes in process `syz.3.3070'. [ 343.526687][T16849] syzkaller0: entered promiscuous mode [ 343.532358][T16849] syzkaller0: entered allmulticast mode [ 343.754843][T16855] netlink: 'syz.4.3078': attribute type 29 has an invalid length. [ 343.778482][T16856] netlink: 'syz.4.3078': attribute type 29 has an invalid length. [ 343.804746][T16862] netlink: 'syz.3.3080': attribute type 10 has an invalid length. [ 343.891402][T16862] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 343.921533][T16840] lo speed is unknown, defaulting to 1000 [ 344.068263][T16870] netlink: 1196 bytes leftover after parsing attributes in process `syz.3.3083'. [ 344.287195][T16876] ip6gre1: entered allmulticast mode [ 344.297730][T16876] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3087'. [ 344.403012][T16840] wlan0 speed is unknown, defaulting to 1000 [ 344.482431][T16888] syzkaller1: entered promiscuous mode [ 344.492924][T16888] syzkaller1: entered allmulticast mode [ 344.503534][T16888] netlink: 165 bytes leftover after parsing attributes in process `syz.3.3089'. [ 344.543709][T16894] ½: renamed from gretap0 (while UP) [ 344.702013][T16904] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3093'. [ 344.754109][T16906] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3094'. [ 344.947350][T16840] chnl_net:caif_netlink_parms(): no params data found [ 344.954639][T16918] netlink: 'syz.3.3097': attribute type 12 has an invalid length. [ 344.993626][T16919] netlink: 152 bytes leftover after parsing attributes in process `syz.1.3098'. [ 345.017272][T16919] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 345.026574][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5030 ms [ 345.026604][ C0] lec:lec_tx_timeout: lec0 [ 345.034765][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 345.182862][T16930] netlink: 'syz.4.3100': attribute type 21 has an invalid length. [ 345.264857][ T5839] Bluetooth: hci2: command tx timeout [ 345.305997][T16930] bond1: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 345.325958][T16930] bond1 (unregistering): Released all slaves [ 345.350393][T16943] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3104'. [ 345.469495][T16840] bridge0: port 1(bridge_slave_0) entered blocking state [ 345.494085][T16840] bridge0: port 1(bridge_slave_0) entered disabled state [ 345.535174][T16840] bridge_slave_0: entered allmulticast mode [ 345.566688][T16840] bridge_slave_0: entered promiscuous mode [ 345.597643][T16840] bridge0: port 2(bridge_slave_1) entered blocking state [ 345.637208][T16840] bridge0: port 2(bridge_slave_1) entered disabled state [ 345.674624][T16840] bridge_slave_1: entered allmulticast mode [ 345.682543][T16840] bridge_slave_1: entered promiscuous mode [ 345.800303][T16967] syzkaller1: entered promiscuous mode [ 345.806106][T16967] syzkaller1: entered allmulticast mode [ 345.882527][T16840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 345.917096][T16840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 346.049731][T16840] team0: Port device team_slave_0 added [ 346.069474][T16840] team0: Port device team_slave_1 added [ 346.124153][T16840] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 346.131378][T16840] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.159618][T16840] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 346.172199][T16986] netlink: 'syz.3.3115': attribute type 5 has an invalid length. [ 346.175873][T16840] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 346.220490][T16840] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 346.264214][T16840] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 346.368663][T16840] hsr_slave_0: entered promiscuous mode [ 346.375679][T16840] hsr_slave_1: entered promiscuous mode [ 346.382380][T16840] debugfs: 'hsr0' already exists in 'hsr' [ 346.393464][T16840] Cannot create hsr debugfs directory [ 347.344890][ T5839] Bluetooth: hci2: command tx timeout [ 347.368284][T16840] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 347.399856][T16840] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 347.433551][T16840] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 347.478487][T16840] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 347.627717][T17059] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 347.881453][T17070] syzkaller1: entered promiscuous mode [ 347.889669][T17070] syzkaller1: entered allmulticast mode [ 347.909671][T16840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 347.922328][T17072] __nla_validate_parse: 9 callbacks suppressed [ 347.922348][T17072] netlink: 1044 bytes leftover after parsing attributes in process `syz.3.3137'. [ 348.001689][T16840] 8021q: adding VLAN 0 to HW filter on device team0 [ 348.055907][ T1007] bridge0: port 1(bridge_slave_0) entered blocking state [ 348.063170][ T1007] bridge0: port 1(bridge_slave_0) entered forwarding state [ 348.074773][T17069] netlink: 'syz.3.3137': attribute type 1 has an invalid length. [ 348.082590][T17069] netlink: 'syz.3.3137': attribute type 3 has an invalid length. [ 348.104247][T17069] netlink: 172 bytes leftover after parsing attributes in process `syz.3.3137'. [ 348.117512][T17069] NCSI netlink: No device for ifindex 813332851 [ 348.150323][ T6034] bridge0: port 2(bridge_slave_1) entered blocking state [ 348.157584][ T6034] bridge0: port 2(bridge_slave_1) entered forwarding state [ 348.300265][T17088] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3142'. [ 348.345690][T17084] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3141'. [ 348.378688][T17088] bond0 (unregistering): Released all slaves [ 348.468533][T17090] netlink: 'syz.3.3141': attribute type 1 has an invalid length. [ 348.482124][T17084] netlink: 'syz.3.3141': attribute type 1 has an invalid length. [ 348.535085][T17082] netlink: 'syz.1.3140': attribute type 10 has an invalid length. [ 348.575943][T17082] team0: Port device 0! added [ 348.681393][T17102] netlink: 'syz.0.3145': attribute type 17 has an invalid length. [ 348.715923][T17102] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3145'. [ 348.746948][T17102] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3145'. [ 348.805525][T17102] ½: entered promiscuous mode [ 348.823303][T17102] ½: left promiscuous mode [ 348.849300][T17109] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3147'. [ 349.066427][T16840] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 349.125966][T17120] sctp: [Deprecated]: syz.4.3152 (pid 17120) Use of int in maxseg socket option. [ 349.125966][T17120] Use struct sctp_assoc_value instead [ 349.193646][T17129] siw: device registration error -23 [ 349.245676][T16840] veth0_vlan: entered promiscuous mode [ 349.288723][T16840] veth1_vlan: entered promiscuous mode [ 349.367527][T17133] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3154'. [ 349.401587][T16840] veth0_macvtap: entered promiscuous mode [ 349.411342][T17137] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3155'. [ 349.426341][ T5839] Bluetooth: hci2: command tx timeout [ 349.427612][ T5842] block nbd0: Receive control failed (result -1) [ 349.440276][T16840] veth1_macvtap: entered promiscuous mode [ 349.480660][T17145] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3154'. [ 349.545553][T16840] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 349.572214][T16840] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 349.616859][ T33] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 349.655440][ T33] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 349.720698][ T33] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 349.740010][ T33] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 349.969539][T17162] bond2: entered promiscuous mode [ 349.984483][T17162] bond2: entered allmulticast mode [ 349.990508][T17162] 8021q: adding VLAN 0 to HW filter on device bond2 [ 350.044370][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 350.052440][ C0] lec:lec_tx_timeout: lec0 [ 350.057153][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 350.091624][ T6034] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 350.128151][ T6034] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 350.220371][ T33] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 350.256363][ T33] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 350.435528][T17185] netlink: 'syz.1.3168': attribute type 2 has an invalid length. [ 350.570547][T17196] netlink: 'syz.0.3165': attribute type 29 has an invalid length. [ 351.030757][T17213] tipc: Enabling of bearer rejected, media not registered [ 351.057973][T17213] xt_CT: You must specify a L4 protocol and not use inversions on it [ 351.115105][ T5839] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 351.124905][ T5839] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 351.134271][ T5839] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 351.149029][ T5839] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 351.157076][ T5839] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 351.495104][T17230] netlink: 'syz.0.3180': attribute type 142 has an invalid length. [ 351.504480][ T5842] Bluetooth: hci2: command tx timeout [ 351.673897][T17216] lo speed is unknown, defaulting to 1000 [ 351.828455][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 351.841404][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 351.857570][ T13] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 351.919257][T17242] syzkaller0: entered promiscuous mode [ 351.965573][T17242] syzkaller0: entered allmulticast mode [ 352.101862][T17244] block nbd2: server does not support multiple connections per device. [ 352.115689][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 352.137761][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.148501][T17244] block nbd2: shutting down sockets [ 352.169045][ T13] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 352.240188][T17216] wlan0 speed is unknown, defaulting to 1000 [ 352.339036][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 352.340793][T17264] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 352.350623][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.376023][ T13] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 352.590562][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 352.616953][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 352.628052][ T13] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20002 - 0 [ 353.037819][T17292] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 353.185450][ T5842] Bluetooth: hci3: command tx timeout [ 353.391593][T17307] __nla_validate_parse: 10 callbacks suppressed [ 353.391615][T17307] netlink: 212 bytes leftover after parsing attributes in process `syz.3.3200'. [ 353.548124][T17288] netlink: 'syz.4.3197': attribute type 6 has an invalid length. [ 353.588438][T17310] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3202'. [ 353.607065][T17310] block nbd2: Unsupported socket: should be TCP or UNIX. [ 353.621850][T17297] netlink: 'syz.4.3197': attribute type 1 has an invalid length. [ 353.645318][T17297] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3197'. [ 353.856601][T17330] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 353.873373][T17330] xt_CT: You must specify a L4 protocol and not use inversions on it [ 353.890726][ T5838] IPVS: starting estimator thread 0... [ 353.984759][T17332] IPVS: using max 29 ests per chain, 69600 per kthread [ 354.044600][ T13] dvmrp0 (unregistering): left allmulticast mode [ 354.067811][T17339] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3209'. [ 354.095501][ T13] bond2 (unregistering): (slave geneve2): Releasing active interface [ 354.138146][ T13] team0: Port device geneve0 removed [ 354.381718][T17348] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.3211'. [ 354.518805][ T13] team0: Port device bridge8 removed [ 354.601878][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 354.611184][ T13] bond_slave_0: left promiscuous mode [ 354.620439][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 354.633649][ T13] bond_slave_1: left promiscuous mode [ 354.642056][ T13] bond0 (unregistering): (slave wlan1): Releasing backup interface [ 354.650619][ T13] mac80211_hwsim hwsim5 wlan1: left promiscuous mode [ 354.660199][ T13] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 354.670967][ T13] bridge_slave_1: left promiscuous mode [ 354.678089][ T13] bond0 (unregistering): Released all slaves [ 354.788904][ T13] bond1 (unregistering): Released all slaves [ 354.896577][ T13] bond2 (unregistering): Released all slaves [ 354.911859][ T13] bond3 (unregistering): Released all slaves [ 355.030684][ T13] bond4 (unregistering): Released all slaves [ 355.064429][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 355.072578][ C0] lec:lec_tx_timeout: lec0 [ 355.077614][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 355.149007][ T13] bond5 (unregistering): Released all slaves [ 355.246095][ T13] bond6 (unregistering): Released all slaves [ 355.267816][ T5842] Bluetooth: hci3: command tx timeout [ 355.351153][ T13] bond7 (unregistering): Released all slaves [ 355.402043][T17348] bridge0: port 2(bridge_slave_1) entered disabled state [ 355.409857][T17348] bridge0: port 1(bridge_slave_0) entered disabled state [ 355.502855][T17216] chnl_net:caif_netlink_parms(): no params data found [ 355.526954][T17350] sctp: [Deprecated]: syz.4.3212 (pid 17350) Use of struct sctp_assoc_value in delayed_ack socket option. [ 355.526954][T17350] Use struct sctp_sack_info instead [ 355.597409][T17350] IPVS: set_ctl: invalid protocol: 0 0.0.0.0:20000 [ 355.709252][T17361] netlink: 'syz.2.3215': attribute type 13 has an invalid length. [ 355.718465][T17361] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3215'. [ 355.768189][T17361] netlink: 'syz.2.3215': attribute type 13 has an invalid length. [ 355.791231][ T33] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 355.814654][T17361] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3215'. [ 355.817854][ T33] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 355.867773][ T33] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 355.876991][ T33] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 355.965482][T17370] sock: sock_set_timeout: `syz.4.3218' (pid 17370) tries to set negative timeout [ 356.034240][T17216] bridge0: port 1(bridge_slave_0) entered blocking state [ 356.050020][T17216] bridge0: port 1(bridge_slave_0) entered disabled state [ 356.066943][T17216] bridge_slave_0: entered allmulticast mode [ 356.082963][T17216] bridge_slave_0: entered promiscuous mode [ 356.102530][T17216] bridge0: port 2(bridge_slave_1) entered blocking state [ 356.114856][T17216] bridge0: port 2(bridge_slave_1) entered disabled state [ 356.122313][T17216] bridge_slave_1: entered allmulticast mode [ 356.130976][T17216] bridge_slave_1: entered promiscuous mode [ 356.159767][T17382] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3222'. [ 356.218623][T17385] syz.3.3223 uses old SIOCAX25GETINFO [ 356.238665][T17386] netlink: 'syz.2.3222': attribute type 10 has an invalid length. [ 356.250820][T17216] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 356.271403][T17386] bridge0: port 3(team0) entered blocking state [ 356.278789][T17386] bridge0: port 3(team0) entered disabled state [ 356.285538][T17386] team0: entered allmulticast mode [ 356.290868][T17386] team_slave_0: entered allmulticast mode [ 356.298551][T17386] team_slave_1: entered allmulticast mode [ 356.321714][T17386] team0: entered promiscuous mode [ 356.327584][T17386] team_slave_0: entered promiscuous mode [ 356.333831][T17386] team_slave_1: entered promiscuous mode [ 356.341300][T17386] bridge0: port 3(team0) entered blocking state [ 356.347777][T17386] bridge0: port 3(team0) entered forwarding state [ 356.361218][T17216] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 356.382034][T17391] netlink: 'syz.3.3225': attribute type 33 has an invalid length. [ 356.393031][T17391] netlink: 152 bytes leftover after parsing attributes in process `syz.3.3225'. [ 356.477621][T17216] team0: Port device team_slave_0 added [ 356.492530][T17216] team0: Port device team_slave_1 added [ 356.573872][T17216] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 356.581662][T17216] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 356.622853][T17216] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 356.637037][T17216] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 356.644241][T17216] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 356.672147][T17216] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 356.918762][T17426] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3233'. [ 356.928083][T17216] hsr_slave_0: entered promiscuous mode [ 356.937102][T17216] hsr_slave_1: entered promiscuous mode [ 356.944035][T17216] debugfs: 'hsr0' already exists in 'hsr' [ 356.952944][T17216] Cannot create hsr debugfs directory [ 356.982695][T17428] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 356.991629][ T13] : left promiscuous mode [ 357.005462][T17428] netlink: 'syz.4.3233': attribute type 2 has an invalid length. [ 357.023484][T17428] netlink: 'syz.4.3233': attribute type 1 has an invalid length. [ 357.066844][T17431] netlink: 'syz.4.3233': attribute type 2 has an invalid length. [ 357.076422][T17430] FAULT_INJECTION: forcing a failure. [ 357.076422][T17430] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 357.091242][T17431] netlink: 'syz.4.3233': attribute type 1 has an invalid length. [ 357.099239][T17430] CPU: 0 UID: 0 PID: 17430 Comm: syz.3.3234 Not tainted syzkaller #0 PREEMPT(full) [ 357.099267][T17430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 357.099282][T17430] Call Trace: [ 357.099291][T17430] [ 357.099301][T17430] dump_stack_lvl+0x189/0x250 [ 357.099331][T17430] ? __pfx____ratelimit+0x10/0x10 [ 357.099352][T17430] ? __pfx_dump_stack_lvl+0x10/0x10 [ 357.099377][T17430] ? __pfx__printk+0x10/0x10 [ 357.099408][T17430] ? __might_fault+0xb0/0x130 [ 357.099453][T17430] should_fail_ex+0x414/0x560 [ 357.099490][T17430] _copy_from_user+0x2d/0xb0 [ 357.099516][T17430] kstrtouint_from_user+0xc4/0x170 [ 357.099540][T17430] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 357.099580][T17430] proc_fail_nth_write+0x88/0x200 [ 357.099604][T17430] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 357.099633][T17430] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 357.099657][T17430] vfs_write+0x27e/0xb30 [ 357.099689][T17430] ? __pfx_vfs_write+0x10/0x10 [ 357.099711][T17430] ? __fget_files+0x2a/0x420 [ 357.099751][T17430] ? __fget_files+0x3a0/0x420 [ 357.099776][T17430] ? __fget_files+0x2a/0x420 [ 357.099812][T17430] ksys_write+0x145/0x250 [ 357.099836][T17430] ? __pfx_ksys_write+0x10/0x10 [ 357.099861][T17430] ? do_syscall_64+0xbe/0xf80 [ 357.099888][T17430] do_syscall_64+0xfa/0xf80 [ 357.099910][T17430] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 357.099931][T17430] ? clear_bhb_loop+0x60/0xb0 [ 357.099957][T17430] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 357.099977][T17430] RIP: 0033:0x7f146f38e1ff [ 357.099997][T17430] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 357.100014][T17430] RSP: 002b:00007f14701eb030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 357.100036][T17430] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f146f38e1ff [ 357.100050][T17430] RDX: 0000000000000001 RSI: 00007f14701eb0a0 RDI: 0000000000000004 [ 357.100061][T17430] RBP: 00007f14701eb090 R08: 0000000000000000 R09: 0000000000000000 [ 357.100073][T17430] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 357.100084][T17430] R13: 00007f146f5e6218 R14: 00007f146f5e6180 R15: 00007fffc7f89b18 [ 357.100121][T17430] [ 357.348645][ T5842] Bluetooth: hci3: command tx timeout [ 357.416792][ T13] tipc: Left network mode [ 357.833759][T17441] v: renamed from dummy0 (while UP) [ 358.290428][T17460] syzkaller1: entered promiscuous mode [ 358.297655][T17460] syzkaller1: entered allmulticast mode [ 358.612536][T17478] __nla_validate_parse: 2 callbacks suppressed [ 358.612557][T17478] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3247'. [ 358.895417][T17216] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 358.945566][T17216] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 358.972390][T17216] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 359.020182][T17216] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 359.181404][ T13] hsr_slave_0: left promiscuous mode [ 359.211704][ T13] hsr_slave_1: left promiscuous mode [ 359.221253][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 359.251200][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 359.282939][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 359.304757][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 359.371561][ T13] veth1_macvtap: left promiscuous mode [ 359.425079][ T5842] Bluetooth: hci3: command tx timeout [ 360.066814][ T13] team0 (unregistering): Port device team_slave_1 removed [ 360.084388][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 360.092511][ C0] lec:lec_tx_timeout: lec0 [ 360.097390][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 360.129484][ T13] team0 (unregistering): Port device team_slave_0 removed [ 360.399312][ T13] team0 (unregistering): Port device 0! removed [ 360.589515][T17552] validate_nla: 1 callbacks suppressed [ 360.589536][T17552] netlink: 'syz.2.3260': attribute type 10 has an invalid length. [ 360.653135][T17552] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 360.686088][T17554] x_tables: duplicate underflow at hook 1 [ 360.856555][T17563] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3263'. [ 360.918902][T17216] 8021q: adding VLAN 0 to HW filter on device bond0 [ 360.982531][ T13] IPVS: stop unused estimator thread 0... [ 360.997936][T17216] 8021q: adding VLAN 0 to HW filter on device team0 [ 361.047028][ T1007] bridge0: port 1(bridge_slave_0) entered blocking state [ 361.054417][ T1007] bridge0: port 1(bridge_slave_0) entered forwarding state [ 361.102950][ T1007] bridge0: port 2(bridge_slave_1) entered blocking state [ 361.110225][ T1007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 361.132252][T17567] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3265'. [ 361.572826][T17216] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 361.698466][T17216] veth0_vlan: entered promiscuous mode [ 361.731371][T17216] veth1_vlan: entered promiscuous mode [ 361.831884][T17216] veth0_macvtap: entered promiscuous mode [ 361.862076][T17216] veth1_macvtap: entered promiscuous mode [ 361.972830][T17602] netlink: 'syz.2.3274': attribute type 39 has an invalid length. [ 361.987617][T17216] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 362.101803][T17216] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 362.135651][ T3555] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.148199][ T3555] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.165760][ T3555] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.196049][T17615] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3277'. [ 362.209180][ T3555] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 362.230672][T17615] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3277'. [ 362.396580][ T3555] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 362.437546][ T3555] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 362.573181][T17633] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3282'. [ 362.716318][T10972] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 362.754418][T10972] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 362.892604][T17644] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3170'. [ 362.910379][T17645] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 363.271424][T17677] team0: Cannot enslave team device to itself [ 363.367506][T17678] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3295'. [ 363.563185][ T5839] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 363.587467][ T5839] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 363.598247][ T5839] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 363.611683][ T5839] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 363.620522][T17686] syzkaller0: entered promiscuous mode [ 363.627059][ T5839] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 363.715611][T17686] syzkaller0: entered allmulticast mode [ 363.960509][T17698] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3301'. [ 363.997523][T17698] geneve2: entered promiscuous mode [ 364.183825][T17702] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3303'. [ 364.400483][T17684] lo speed is unknown, defaulting to 1000 [ 364.523804][T17715] netlink: 364 bytes leftover after parsing attributes in process `syz.3.3305'. [ 364.612473][T17720] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3307'. [ 364.852754][T17684] wlan0 speed is unknown, defaulting to 1000 [ 365.104705][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 365.112832][ C0] lec:lec_tx_timeout: lec0 [ 365.117585][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 365.155579][T17684] chnl_net:caif_netlink_parms(): no params data found [ 365.198659][T17740] : entered promiscuous mode [ 365.664963][ T5842] Bluetooth: hci1: command tx timeout [ 365.686217][T17751] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 365.698472][T17751] netlink: 'syz.4.3316': attribute type 6 has an invalid length. [ 365.892692][T17684] bridge0: port 1(bridge_slave_0) entered blocking state [ 365.911442][T17762] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3318'. [ 365.927145][T17684] bridge0: port 1(bridge_slave_0) entered disabled state [ 365.939498][T17684] bridge_slave_0: entered allmulticast mode [ 365.949197][T17684] bridge_slave_0: entered promiscuous mode [ 365.967477][T17684] bridge0: port 2(bridge_slave_1) entered blocking state [ 366.011315][T17684] bridge0: port 2(bridge_slave_1) entered disabled state [ 366.023458][T17684] bridge_slave_1: entered allmulticast mode [ 366.046518][T17684] bridge_slave_1: entered promiscuous mode [ 366.179739][T17779] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 366.196198][T17781] netlink: 'syz.3.3323': attribute type 2 has an invalid length. [ 366.222985][T17684] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 366.237174][T17684] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 366.246410][T17781] netlink: 'syz.3.3323': attribute type 11 has an invalid length. [ 366.254262][T17781] netlink: 132 bytes leftover after parsing attributes in process `syz.3.3323'. [ 366.321255][T17684] team0: Port device team_slave_0 added [ 366.335000][T17785] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3325'. [ 366.354889][T17786] netlink: 64 bytes leftover after parsing attributes in process `syz.1.3325'. [ 366.417809][T17684] team0: Port device team_slave_1 added [ 366.510886][T17684] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 366.528757][T17684] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 366.573075][T17684] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 366.587307][T17684] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 366.594509][T17684] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 366.623711][T17684] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 366.751632][T17684] hsr_slave_0: entered promiscuous mode [ 366.767430][T17684] hsr_slave_1: entered promiscuous mode [ 366.783228][T17684] debugfs: 'hsr0' already exists in 'hsr' [ 366.794491][T17684] Cannot create hsr debugfs directory [ 366.977929][T17807] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3331'. [ 367.125956][T17813] netlink: 'syz.4.3332': attribute type 2 has an invalid length. [ 367.230061][T17684] netdevsim netdevsim0 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 367.274784][T17684] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 367.398527][T17684] netdevsim netdevsim0 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 367.425783][T17684] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 367.443449][T10087] IPVS: starting estimator thread 0... [ 367.460337][T17837] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3341'. [ 367.487426][T17831] IPv4: Oversized IP packet from 127.202.26.0 [ 367.535390][T17836] IPVS: using max 29 ests per chain, 69600 per kthread [ 367.567138][T17684] netdevsim netdevsim0 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 367.581364][T17684] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 367.665655][T10087] Oops: general protection fault, probably for non-canonical address 0xdffffc000000004c: 0000 [#1] SMP KASAN PTI [ 367.677615][T10087] KASAN: null-ptr-deref in range [0x0000000000000260-0x0000000000000267] [ 367.686078][T10087] CPU: 1 UID: 0 PID: 10087 Comm: kworker/1:11 Not tainted syzkaller #0 PREEMPT(full) [ 367.695658][T10087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 367.705766][T10087] Workqueue: events l2cap_info_timeout [ 367.711714][T10087] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 367.717641][T10087] Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 367.737279][T10087] RSP: 0018:ffffc90003097760 EFLAGS: 00010202 [ 367.743373][T10087] RAX: dffffc0000000000 RBX: ffffffff8930ed78 RCX: 92ab1c6038a5e600 [ 367.751466][T10087] RDX: 0000000000000000 RSI: ffffffff8930ed78 RDI: 000000000000004c [ 367.759474][T10087] RBP: ffffffff8a63eab6 R08: 0000000000000001 R09: 0000000000000000 [ 367.767556][T10087] R10: dffffc0000000000 R11: ffffffff8a63ea70 R12: 0000000000000000 [ 367.775544][T10087] R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 [ 367.783532][T10087] FS: 0000000000000000(0000) GS:ffff888125f35000(0000) knlGS:0000000000000000 [ 367.792528][T10087] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 367.799143][T10087] CR2: 00007faa45700263 CR3: 00000000787f8000 CR4: 00000000003526f0 [ 367.807133][T10087] Call Trace: [ 367.810426][T10087] [ 367.813373][T10087] __kasan_check_byte+0x12/0x40 [ 367.818248][T10087] lock_acquire+0x84/0x340 [ 367.822687][T10087] ? lockdep_hardirqs_on+0x98/0x140 [ 367.827906][T10087] ? __cancel_work+0x254/0x2c0 [ 367.832711][T10087] lock_sock_nested+0x48/0x100 [ 367.837508][T10087] ? l2cap_sock_ready_cb+0x46/0x170 [ 367.842725][T10087] l2cap_sock_ready_cb+0x46/0x170 [ 367.847770][T10087] l2cap_conn_start+0x700/0xcd0 [ 367.852647][T10087] ? __pfx_l2cap_conn_start+0x10/0x10 [ 367.858047][T10087] ? __pfx___mutex_lock+0x10/0x10 [ 367.863091][T10087] ? process_scheduled_works+0x9ef/0x1770 [ 367.868831][T10087] l2cap_info_timeout+0x68/0xa0 [ 367.873706][T10087] ? process_scheduled_works+0x9ef/0x1770 [ 367.879442][T10087] process_scheduled_works+0xad1/0x1770 [ 367.885030][T10087] ? __pfx_process_scheduled_works+0x10/0x10 [ 367.891048][T10087] worker_thread+0x8a0/0xda0 [ 367.895732][T10087] ? __kthread_parkme+0x7b/0x200 [ 367.900703][T10087] kthread+0x711/0x8a0 [ 367.904813][T10087] ? __pfx_worker_thread+0x10/0x10 [ 367.909956][T10087] ? __pfx_kthread+0x10/0x10 [ 367.914575][T10087] ? _raw_spin_unlock_irq+0x23/0x50 [ 367.919812][T10087] ? lockdep_hardirqs_on+0x98/0x140 [ 367.925043][T10087] ? __pfx_kthread+0x10/0x10 [ 367.929665][T10087] ret_from_fork+0x599/0xb30 [ 367.934277][T10087] ? __pfx_ret_from_fork+0x10/0x10 [ 367.939450][T10087] ? __switch_to_asm+0x39/0x70 [ 367.944259][T10087] ? __switch_to_asm+0x33/0x70 [ 367.949048][T10087] ? __pfx_kthread+0x10/0x10 [ 367.953667][T10087] ret_from_fork_asm+0x1a/0x30 [ 367.958462][T10087] [ 367.961519][T10087] Modules linked in: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 367.966241][ T5842] Bluetooth: hci1: command tx timeout [ 367.968047][T10087] ---[ end trace 0000000000000000 ]--- [ 368.023664][T17846] netlink: 'syz.2.3344': attribute type 9 has an invalid length. [ 368.060472][T10087] RIP: 0010:kasan_byte_accessible+0x12/0x30 [ 368.067981][T10087] Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 c1 ef 03 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 07 3c 08 0f 92 c0 c3 cc cc cc cc cc 66 66 66 66 66 66 2e [ 368.092948][T17684] netdevsim netdevsim0 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 368.105716][T17684] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 368.122612][T10087] RSP: 0018:ffffc90003097760 EFLAGS: 00010202 [ 368.129947][T10087] RAX: dffffc0000000000 RBX: ffffffff8930ed78 RCX: 92ab1c6038a5e600 [ 368.139444][T10087] RDX: 0000000000000000 RSI: ffffffff8930ed78 RDI: 000000000000004c [ 368.204478][T10087] RBP: ffffffff8a63eab6 R08: 0000000000000001 R09: 0000000000000000 [ 368.212566][T10087] R10: dffffc0000000000 R11: ffffffff8a63ea70 R12: 0000000000000000 [ 368.266047][T10087] R13: 0000000000000260 R14: 0000000000000260 R15: 0000000000000001 [ 368.294895][T10087] FS: 0000000000000000(0000) GS:ffff888125f35000(0000) knlGS:0000000000000000 [ 368.326062][T10087] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 368.332736][T10087] CR2: 000000110c24e534 CR3: 000000005332e000 CR4: 00000000003526f0 [ 368.364762][T10087] Kernel panic - not syncing: Fatal exception [ 368.371518][T10087] Kernel Offset: disabled [ 368.375853][T10087] Rebooting in 86400 seconds..