last executing test programs: 3.386948457s ago: executing program 1 (id=15710): r0 = socket$kcm(0x2b, 0x1, 0x0) sendmsg$sock(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000380)='b', 0x1}], 0x1, &(0x7f0000000140)=[@timestamping={{0x14, 0x1, 0x25, 0x303}}], 0x18}, 0x400c081) recvmsg$kcm(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000240)=""/207, 0xcf}], 0x1}, 0x2102) 3.318429418s ago: executing program 1 (id=15711): perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x8, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000480)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5d31, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x3}, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0xa0800, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000007c0)) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8914, &(0x7f0000000080)) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) 3.015338726s ago: executing program 2 (id=15718): r0 = perf_event_open(&(0x7f00000001c0)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_config_ext={0x2537d940, 0x66c}, 0x104101, 0x4, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0x5, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = socket$kcm(0xa, 0x5, 0x0) r3 = socket$kcm(0xa, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="000000000000000000e8ffffffffffff05000000", @ANYRES32=0x1], 0x48) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x8916, &(0x7f0000000000)={r3}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x8916, &(0x7f0000000000)) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x8936, &(0x7f0000000000)={r3}) 2.975847937s ago: executing program 0 (id=15720): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22ffe6) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) 2.758335542s ago: executing program 3 (id=15723): perf_event_open(&(0x7f0000000680)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5a1c, 0x10001, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x20, 0x400000, 0xb9, 0x0, 0x0, 0xf}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000002c0)={r0, 0x4, 0x29, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0}, 0x50) perf_event_open(&(0x7f00000004c0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0xa16ae, 0x9, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_config_ext={0xd, 0x6}, 0x90, 0xa4, 0x2, 0x1, 0xa1, 0x9b9b, 0x8, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f00000004c0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0xa16ae, 0x9, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_config_ext={0xd, 0x6}, 0x90, 0xa4, 0x2, 0x1, 0xa1, 0x9b9b, 0x8, 0x0, 0x0, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(&(0x7f00000001c0)={0x1, 0x80, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x94e4, 0x4, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0xfffffffa, 0x1, @perf_bp={0x0, 0x6}, 0x19183, 0x1, 0x5, 0xb, 0xa, 0x904813a5, 0x4, 0x0, 0x0, 0x0, 0xffffffffffff0000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_clone(0x21140200, 0x0, 0x0, 0x0, 0x0, 0x0) 2.504493698s ago: executing program 3 (id=15724): r0 = socket$kcm(0x10, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xd, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="720ac4ff000000007110c3000000000095"], &(0x7f0000000480)='GPL\x00', 0x6}, 0x94) sendmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000340)="2e00000010008188e6b62aa7377206001ba1f848160000005e140602000300000e000a001300000002900000121f", 0x2e}], 0x1}, 0x4004084) 820.53305ms ago: executing program 2 (id=15725): r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x8, 0x95c8, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800003ff, 0x2, @perf_config_ext={0x76, 0xdcee}, 0x6, 0x4, 0x0, 0x0, 0x2, 0xfffff271, 0xfff8, 0x0, 0x0, 0x0, 0x4000000000020}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r3, &(0x7f0000000080)={&(0x7f0000000140)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x78, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000100)=[{0x18, 0x110, 0x1, "dc"}], 0x18}, 0x0) 803.55034ms ago: executing program 3 (id=15726): r0 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xeb, 0x0, 0x0, 0x0, 0x0, 0x69, 0x4080, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb, 0x0, @perf_config_ext={0x800000d, 0x6}, 0x10cd23, 0x4, 0x0, 0x7, 0x77fe, 0x4, 0x3}, 0x0, 0x1, 0xffffffffffffffff, 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000500)={r2, 0x0, 0x0}, 0x10) 716.467982ms ago: executing program 0 (id=15727): socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = perf_event_open(&(0x7f0000000640)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x480000000000000b, 0x954b, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, @perf_config_ext={0x76, 0x81ef7}, 0x116da, 0x4, 0x98, 0x1, 0x2, 0xfffff271, 0x7ff7, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r3) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0x3, &(0x7f0000000000)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x1, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180)) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x2420, 0x0, 0x0, 0x3, 0x3, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000480)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x80002, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x5, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000001200000000000000000095"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) perf_event_open(&(0x7f0000000380)={0x0, 0x80, 0x0, 0xf, 0x2, 0xff, 0x0, 0x0, 0x2, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x1, @perf_bp={0x0, 0x1}, 0x80000, 0xca, 0x0, 0x5, 0xdf1d, 0x400000, 0x0, 0x0, 0xe, 0x0, 0x8}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) recvmsg$unix(r0, &(0x7f00000013c0)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x1c0) write$cgroup_subtree(r5, &(0x7f0000000000)=ANY=[@ANYRES8=r1, @ANYBLOB="3eca", @ANYRES8=r4], 0x9a) 716.217982ms ago: executing program 1 (id=15728): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, 0x0, &(0x7f0000000180)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xf, 0x0, &(0x7f0000000240)="723ffc93ac89418045f9ca4d192806", 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 658.864844ms ago: executing program 1 (id=15729): sendmsg$inet(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f00000000c0)={0x2, 0x4001, @empty}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x20044818) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000380)='b', 0x1}], 0x1, &(0x7f0000000140)=[@timestamping={{0x14, 0x1, 0x25, 0x303}}], 0x18}, 0x400c081) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000240)=""/207, 0xcf}], 0x1}, 0x2102) 570.889376ms ago: executing program 3 (id=15730): perf_event_open(&(0x7f0000000200)={0x2, 0x80, 0x9d, 0x1, 0x0, 0x0, 0x0, 0x5, 0x40200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) socketpair(0x8, 0x1, 0xffffffff, &(0x7f0000000740)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x122}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) perf_event_open(&(0x7f00000000c0)={0x1, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x800000000009, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) 468.528458ms ago: executing program 1 (id=15731): perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_config_ext={0x0, 0xc}, 0x0, 0x0, 0x0, 0x8, 0x3fe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x40047459, 0x0) 468.409978ms ago: executing program 2 (id=15732): perf_event_open(&(0x7f0000000080)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8020, 0x90024, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x2, @perf_bp={0x0, 0xe}, 0x1a386, 0x2, 0x3ff, 0x0, 0x5, 0x0, 0x2, 0x0, 0x0, 0x0, 0xfffffffffffffff8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) perf_event_open(0x0, 0x0, 0xefffffffffffffff, 0xffffffffffffffff, 0x3) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) 441.921569ms ago: executing program 2 (id=15733): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x7, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x18, 0x0, 0x0, 0x0, 0x40}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0xb, 0x9, 0x0, 0x1, 0xf0ff}}, [@snprintf={{0x5, 0x0, 0xb, 0x9, 0x0, 0x0, 0x2}, {0x3, 0x0, 0x3, 0xa, 0x9, 0xfe04}, {0x5, 0x0, 0xb, 0x9}, {0x3, 0x0, 0x6, 0xa, 0x9, 0xfe04, 0x41}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r0}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000380)='syzkaller\x00', 0xe, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 432.490409ms ago: executing program 0 (id=15734): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000100)="5c00000011006bec9e3be35c6e17aa31076b876c0d000000ba090000160af3653c001ac00400020208000200030001002c000000eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0000300000000000000ffffc6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x2000c090) 336.554412ms ago: executing program 3 (id=15735): r0 = getpid() r1 = perf_event_open(&(0x7f0000000100)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0xa}, 0x11c266, 0x0, 0xafe8, 0x4, 0x7fff, 0x7fffffff}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000f80)={0x5, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="1808000000000000000000000000000018000000e5020000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r1, 0x40042408, r2) r3 = socket$kcm(0x2, 0x5, 0x84) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.stat\x00', 0x26e1, 0x0) setsockopt$sock_attach_bpf(r3, 0x84, 0x78, &(0x7f00000000c0)=r4, 0x4) 336.393162ms ago: executing program 2 (id=15736): r0 = socket$kcm(0x11, 0x200000000000003, 0x300) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000040), 0x4) sendmsg$kcm(r0, &(0x7f0000000600)={&(0x7f0000000140)=@hci={0x1f, 0x4, 0x2}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000280)="a384499a3f81f583df285d", 0xb}], 0x1, &(0x7f00000003c0)=[{0x10, 0x10e, 0x6e33a9ed}], 0x10}, 0x80000c1) 311.553942ms ago: executing program 0 (id=15737): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, 0x0, &(0x7f0000000180)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x18000000000002a0, 0xf, 0x0, &(0x7f0000000240)="723ffc93ac89418045f9ca4d192806", 0x0, 0x8, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 299.723783ms ago: executing program 1 (id=15738): r0 = perf_event_open(&(0x7f0000000540)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_bp={0x0, 0xd}, 0x114905, 0x4, 0x0, 0x7, 0x0, 0x8, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000018c0)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETDEBUG(r3, 0x400454c9, &(0x7f00000007c0)=0x2) close(r4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$cgroup_devices(r3, &(0x7f0000000840)=ANY=[@ANYBLOB="1e0308004d6b71ef288563"], 0xffdd) 204.233065ms ago: executing program 0 (id=15739): sendmsg$inet(0xffffffffffffffff, &(0x7f00000009c0)={&(0x7f00000000c0)={0x2, 0x4001, @empty}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x20044818) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000380)='b', 0x1}], 0x1, &(0x7f0000000140)=[@timestamping={{0x14, 0x1, 0x25, 0x303}}], 0x18}, 0x400c081) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000240)=""/207, 0xcf}], 0x1}, 0x2102) 204.116365ms ago: executing program 2 (id=15740): perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext={0x8, 0x7fffffffffffffff}, 0x828, 0x0, 0x0, 0x3, 0x9, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x7c00, &(0x7f00000001c0)=[{&(0x7f0000000200)="d8000000180081054e81f782db4cb904021d0800fe007c05e8fe55a10a0015000200142603600e12080005007f370401a8001600200006000418027c035c0461c1d67f6f94007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2e98a61e284ce5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e970392", 0xd8}], 0x1}, 0x0) 98.612107ms ago: executing program 3 (id=15741): perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0x13, 0x80000000, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext={0x4612, 0xffffffffffffffff}, 0x114105, 0x6, 0x9, 0x1, 0x0, 0x40000, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0xa) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) r3 = perf_event_open(&(0x7f0000000040)={0x2, 0x80, 0xec, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0, 0xa}, 0x10670b, 0x4, 0x0, 0x1, 0x1ff, 0x0, 0x1}, 0x0, 0x1, 0xffffffffffffffff, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x5, 0x5, &(0x7f0000000180)=ANY=[@ANYBLOB="180800000000000000000000000000001800000000000000000000000000000095"], &(0x7f0000000280)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x48, '\x00', 0x0, @fallback=0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$PERF_EVENT_IOC_SET_BPF(r3, 0x40042408, r4) 0s ago: executing program 0 (id=15742): r0 = socket$kcm(0xf, 0x3, 0x2) perf_event_open(&(0x7f0000000180)={0x2, 0x80, 0x4c, 0x1, 0x0, 0x0, 0x0, 0x0, 0x4000, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, @perf_bp={0x0, 0xc}, 0x1080, 0x0, 0x0, 0x8, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) sendmsg$inet(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="02", 0x33fe0}], 0x1}, 0x0) kernel console output (not intermixed with test programs): tributes in process `syz.2.13451'. [ 1871.038479][T11516] netlink: 'syz.3.13463': attribute type 2 has an invalid length. [ 1871.361810][T11531] syzkaller1: tun_chr_ioctl cmd 1074025673 [ 1871.433014][T11525] netlink: 132 bytes leftover after parsing attributes in process `syz.3.13467'. [ 1872.223690][T11553] netlink: 'syz.0.13475': attribute type 21 has an invalid length. [ 1875.727221][T11566] netlink: 132 bytes leftover after parsing attributes in process `syz.1.13480'. [ 1875.772382][T11577] netlink: 'syz.3.13482': attribute type 10 has an invalid length. [ 1875.839418][T11577] bridge_slave_1: left allmulticast mode [ 1875.865232][T11577] bridge_slave_1: left promiscuous mode [ 1875.899129][T11577] bridge0: port 2(bridge_slave_1) entered disabled state [ 1875.936118][ T9867] Bluetooth: hci0: command 0x0406 tx timeout [ 1875.965002][T11577] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 1876.661973][ T5787] Bluetooth: hci5: ISO packet for unknown connection handle 30 [ 1876.799226][T11601] netlink: 4595 bytes leftover after parsing attributes in process `syz.2.13490'. [ 1876.939049][T11604] netlink: 132 bytes leftover after parsing attributes in process `syz.0.13491'. [ 1877.570328][T11633] netlink: 'syz.3.13500': attribute type 11 has an invalid length. [ 1877.582633][T11633] netlink: 140 bytes leftover after parsing attributes in process `syz.3.13500'. [ 1877.676515][T11637] netlink: 'syz.0.13501': attribute type 17 has an invalid length. [ 1877.913134][T11644] syzkaller0: entered promiscuous mode [ 1877.933067][T11644] syzkaller0: entered allmulticast mode [ 1877.969823][T11644] PF_CAN: dropped non conform CAN FD skbuff: dev type 280, len 65487 [ 1879.486879][T11684] netlink: 'syz.0.13516': attribute type 21 has an invalid length. [ 1879.575353][T11684] netlink: 156 bytes leftover after parsing attributes in process `syz.0.13516'. [ 1879.759133][T11676] netlink: 'syz.1.13518': attribute type 10 has an invalid length. [ 1880.127191][T11676] team0: Port device ÿÿÿÿÿÿ added [ 1880.449750][T11690] netlink: 'syz.3.13522': attribute type 5 has an invalid length. [ 1880.606045][T11676] syz.1.13518 (11676) used greatest stack depth: 17704 bytes left [ 1881.319163][T11701] netlink: 'syz.1.13527': attribute type 2 has an invalid length. [ 1881.356209][T11701] netlink: 1045 bytes leftover after parsing attributes in process `syz.1.13527'. [ 1882.700719][T11739] netlink: 763 bytes leftover after parsing attributes in process `syz.3.13541'. [ 1882.720732][T11739] netlink: 'syz.3.13541': attribute type 21 has an invalid length. [ 1882.729357][T11739] netlink: 128 bytes leftover after parsing attributes in process `syz.3.13541'. [ 1882.739141][T11739] netlink: 'syz.3.13541': attribute type 4 has an invalid length. [ 1882.747386][T11739] netlink: 3 bytes leftover after parsing attributes in process `syz.3.13541'. [ 1882.786782][T11739] netlink: 156 bytes leftover after parsing attributes in process `syz.3.13541'. [ 1883.151718][T11755] netlink: 830 bytes leftover after parsing attributes in process `syz.3.13546'. [ 1883.413385][T11757] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.13546'. [ 1883.446631][T11755] netlink: 16402 bytes leftover after parsing attributes in process `syz.3.13546'. [ 1883.545697][T11761] netlink: 'syz.1.13547': attribute type 21 has an invalid length. [ 1883.554829][T11761] netlink: 156 bytes leftover after parsing attributes in process `syz.1.13547'. [ 1883.615276][T11755] netlink: 14568 bytes leftover after parsing attributes in process `syz.3.13546'. [ 1884.483994][T11769] netlink: 'syz.0.13550': attribute type 2 has an invalid length. [ 1884.510468][T11769] netlink: 'syz.0.13550': attribute type 8 has an invalid length. [ 1884.743364][T11789] netlink: 'syz.0.13554': attribute type 22 has an invalid length. [ 1884.953052][T11799] bridge_slave_0: left allmulticast mode [ 1884.959188][T11799] bridge_slave_0: left promiscuous mode [ 1884.965370][T11799] bridge0: port 1(bridge_slave_0) entered disabled state [ 1885.014526][T11799] bond0: (slave bridge0): Releasing backup interface [ 1885.192050][T11796] netlink: 'syz.2.13558': attribute type 21 has an invalid length. [ 1886.686608][T11816] netlink: 'syz.1.13563': attribute type 2 has an invalid length. [ 1886.709121][T11816] netlink: 'syz.1.13563': attribute type 8 has an invalid length. [ 1886.721790][T11816] __nla_validate_parse: 4 callbacks suppressed [ 1886.721820][T11816] netlink: 132 bytes leftover after parsing attributes in process `syz.1.13563'. [ 1886.774535][T11817] netlink: 132 bytes leftover after parsing attributes in process `syz.1.13563'. [ 1887.013842][T11833] netlink: 'syz.1.13569': attribute type 11 has an invalid length. [ 1887.021926][T11833] netlink: 140 bytes leftover after parsing attributes in process `syz.1.13569'. [ 1887.363171][T11831] syzkaller0: entered promiscuous mode [ 1887.370126][T11831] syzkaller0: entered allmulticast mode [ 1889.792787][T11851] validate_nla: 1 callbacks suppressed [ 1889.792802][T11851] netlink: 'syz.1.13577': attribute type 2 has an invalid length. [ 1889.807707][T11851] netlink: 'syz.1.13577': attribute type 8 has an invalid length. [ 1889.815558][T11851] netlink: 132 bytes leftover after parsing attributes in process `syz.1.13577'. [ 1889.833958][T11857] netlink: 132 bytes leftover after parsing attributes in process `syz.1.13577'. [ 1890.180760][T11879] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13587'. [ 1890.213204][T11879] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13587'. [ 1890.242128][T11879] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13587'. [ 1890.580884][T11883] netlink: 'syz.3.13589': attribute type 2 has an invalid length. [ 1890.706273][T11883] netlink: 'syz.3.13589': attribute type 8 has an invalid length. [ 1890.714449][T11883] netlink: 132 bytes leftover after parsing attributes in process `syz.3.13589'. [ 1890.744320][T11888] netlink: 132 bytes leftover after parsing attributes in process `syz.3.13589'. [ 1890.971059][T11902] mac80211_hwsim hwsim104 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1891.096407][T11910] netlink: 'syz.3.13599': attribute type 10 has an invalid length. [ 1894.108911][T11910] team0: Port device geneve1 added [ 1894.193362][T11919] netlink: 60 bytes leftover after parsing attributes in process `syz.0.13601'. [ 1894.210910][T11919] netlink: 60 bytes leftover after parsing attributes in process `syz.0.13601'. [ 1894.244162][T11919] netlink: 60 bytes leftover after parsing attributes in process `syz.0.13601'. [ 1894.262830][T11924] netlink: 'syz.2.13603': attribute type 11 has an invalid length. [ 1894.274049][T11924] netlink: 140 bytes leftover after parsing attributes in process `syz.2.13603'. [ 1894.296064][T11925] netlink: 'syz.3.13604': attribute type 10 has an invalid length. [ 1894.436990][T11931] netlink: 'syz.3.13606': attribute type 7 has an invalid length. [ 1894.637861][T11938] veth1_macvtap: left promiscuous mode [ 1894.650487][T11938] macsec0: entered promiscuous mode [ 1896.095470][T11984] netlink: 60 bytes leftover after parsing attributes in process `syz.1.13625'. [ 1896.108561][T11984] netlink: 60 bytes leftover after parsing attributes in process `syz.1.13625'. [ 1896.120899][T11984] netlink: 60 bytes leftover after parsing attributes in process `syz.1.13625'. [ 1896.429750][T11999] netlink: 'syz.1.13629': attribute type 9 has an invalid length. [ 1896.452808][T11999] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.13629'. [ 1896.467363][T12001] FAULT_INJECTION: forcing a failure. [ 1896.467363][T12001] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1896.482255][T12001] CPU: 0 PID: 12001 Comm: syz.3.13630 Not tainted syzkaller #0 [ 1896.489849][T12001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1896.499917][T12001] Call Trace: [ 1896.503193][T12001] [ 1896.506129][T12001] dump_stack_lvl+0x18c/0x250 [ 1896.510831][T12001] ? show_regs_print_info+0x20/0x20 [ 1896.516045][T12001] ? load_image+0x420/0x420 [ 1896.520548][T12001] ? __might_fault+0xaa/0x120 [ 1896.525221][T12001] ? __lock_acquire+0x7d80/0x7d80 [ 1896.530258][T12001] should_fail_ex+0x394/0x4c0 [ 1896.534970][T12001] _copy_from_user+0x2f/0xe0 [ 1896.539565][T12001] ___sys_sendmsg+0x1c7/0x360 [ 1896.544249][T12001] ? get_pid_task+0x20/0x1e0 [ 1896.548846][T12001] ? __sys_sendmsg+0x2b0/0x2b0 [ 1896.553627][T12001] ? __lock_acquire+0x7d80/0x7d80 [ 1896.558668][T12001] __se_sys_sendmsg+0x1d0/0x2c0 [ 1896.563620][T12001] ? __x64_sys_sendmsg+0x80/0x80 [ 1896.568576][T12001] ? lockdep_hardirqs_on+0x98/0x150 [ 1896.573789][T12001] do_syscall_64+0x55/0xb0 [ 1896.578305][T12001] ? clear_bhb_loop+0x40/0x90 [ 1896.582983][T12001] ? clear_bhb_loop+0x40/0x90 [ 1896.587700][T12001] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1896.593635][T12001] RIP: 0033:0x7f976839e0d9 [ 1896.598050][T12001] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1896.617668][T12001] RSP: 002b:00007f97691e9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1896.626089][T12001] RAX: ffffffffffffffda RBX: 00007f9768625fa0 RCX: 00007f976839e0d9 [ 1896.634077][T12001] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 1896.642129][T12001] RBP: 00007f97691e9090 R08: 0000000000000000 R09: 0000000000000000 [ 1896.650105][T12001] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1896.658105][T12001] R13: 00007f9768626038 R14: 00007f9768625fa0 R15: 00007ffff3dad698 [ 1896.666111][T12001] [ 1896.682422][T12003] netlink: 'syz.0.13631': attribute type 2 has an invalid length. [ 1896.691467][T12003] netlink: 'syz.0.13631': attribute type 8 has an invalid length. [ 1896.699751][T12003] netlink: 132 bytes leftover after parsing attributes in process `syz.0.13631'. [ 1896.714937][T12004] netlink: 'syz.0.13631': attribute type 21 has an invalid length. [ 1896.737139][T12004] netlink: 'syz.0.13631': attribute type 30 has an invalid length. [ 1896.764480][T12006] netlink: 'syz.1.13632': attribute type 9 has an invalid length. [ 1896.784941][T12006] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.13632'. [ 1897.121669][T12021] netlink: 'syz.0.13637': attribute type 10 has an invalid length. [ 1897.323760][T12028] FAULT_INJECTION: forcing a failure. [ 1897.323760][T12028] name failslab, interval 1, probability 0, space 0, times 0 [ 1897.336799][T12028] CPU: 1 PID: 12028 Comm: syz.2.13641 Not tainted syzkaller #0 [ 1897.344385][T12028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1897.354467][T12028] Call Trace: [ 1897.357762][T12028] [ 1897.360716][T12028] dump_stack_lvl+0x18c/0x250 [ 1897.365428][T12028] ? show_regs_print_info+0x20/0x20 [ 1897.370661][T12028] ? load_image+0x420/0x420 [ 1897.375206][T12028] should_fail_ex+0x394/0x4c0 [ 1897.379913][T12028] should_failslab+0x9/0x20 [ 1897.384438][T12028] slab_pre_alloc_hook+0x59/0x300 [ 1897.389494][T12028] kmem_cache_alloc+0x5a/0x2c0 [ 1897.394283][T12028] ? radix_tree_node_alloc+0x7e/0x3a0 [ 1897.399695][T12028] radix_tree_node_alloc+0x7e/0x3a0 [ 1897.404933][T12028] idr_get_free+0x28f/0xa10 [ 1897.409479][T12028] idr_alloc_cyclic+0x28a/0x610 [ 1897.414367][T12028] ? idr_alloc+0x2e0/0x2e0 [ 1897.418813][T12028] ? do_raw_spin_lock+0x11f/0x2b0 [ 1897.423878][T12028] ? __radix_tree_preload+0x82/0x880 [ 1897.429201][T12028] ? btf_alloc_id+0x30/0x2d0 [ 1897.433818][T12028] btf_alloc_id+0x4f/0x2d0 [ 1897.438260][T12028] btf_new_fd+0x80a/0x9e0 [ 1897.442632][T12028] ? bpf_btf_show_fdinfo+0x80/0x80 [ 1897.447779][T12028] ? capable+0x88/0xe0 [ 1897.451922][T12028] __sys_bpf+0x670/0x890 [ 1897.456198][T12028] ? bpf_link_show_fdinfo+0x390/0x390 [ 1897.461620][T12028] ? lock_chain_count+0x20/0x20 [ 1897.466521][T12028] __x64_sys_bpf+0x7c/0x90 [ 1897.470956][T12028] do_syscall_64+0x55/0xb0 [ 1897.475374][T12028] ? clear_bhb_loop+0x40/0x90 [ 1897.480048][T12028] ? clear_bhb_loop+0x40/0x90 [ 1897.484734][T12028] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1897.490624][T12028] RIP: 0033:0x7fe16c79e0d9 [ 1897.495038][T12028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1897.514647][T12028] RSP: 002b:00007fe16d5da028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1897.523057][T12028] RAX: ffffffffffffffda RBX: 00007fe16ca25fa0 RCX: 00007fe16c79e0d9 [ 1897.531022][T12028] RDX: 0000000000000020 RSI: 0000200000000240 RDI: 0000000000000012 [ 1897.538992][T12028] RBP: 00007fe16d5da090 R08: 0000000000000000 R09: 0000000000000000 [ 1897.546958][T12028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1897.554921][T12028] R13: 00007fe16ca26038 R14: 00007fe16ca25fa0 R15: 00007fff1845d0a8 [ 1897.562899][T12028] [ 1898.275671][T12062] netlink: 'syz.2.13657': attribute type 11 has an invalid length. [ 1898.573339][T12068] netlink: 'syz.2.13658': attribute type 10 has an invalid length. [ 1900.299495][T12101] __nla_validate_parse: 4 callbacks suppressed [ 1900.299556][T12101] netlink: 6 bytes leftover after parsing attributes in process `syz.3.13671'. [ 1900.388515][T12101] net_ratelimit: 42 callbacks suppressed [ 1900.388576][T12101] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1900.594007][T12105] netlink: 'syz.0.13673': attribute type 9 has an invalid length. [ 1900.620521][T12109] FAULT_INJECTION: forcing a failure. [ 1900.620521][T12109] name failslab, interval 1, probability 0, space 0, times 0 [ 1900.638931][T12105] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.13673'. [ 1900.653992][T12109] CPU: 0 PID: 12109 Comm: syz.3.13675 Not tainted syzkaller #0 [ 1900.661616][T12109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1900.671736][T12109] Call Trace: [ 1900.675042][T12109] [ 1900.678008][T12109] dump_stack_lvl+0x18c/0x250 [ 1900.682723][T12109] ? show_regs_print_info+0x20/0x20 [ 1900.687954][T12109] ? load_image+0x420/0x420 [ 1900.692504][T12109] ? __might_sleep+0xe0/0xe0 [ 1900.697138][T12109] ? __lock_acquire+0x7d80/0x7d80 [ 1900.702190][T12109] ? perf_trace_lock+0xfc/0x3b0 [ 1900.707077][T12109] should_fail_ex+0x394/0x4c0 [ 1900.711805][T12109] should_failslab+0x9/0x20 [ 1900.716346][T12109] slab_pre_alloc_hook+0x59/0x300 [ 1900.721412][T12109] ? __get_vm_area_node+0x125/0x370 [ 1900.726655][T12109] __kmem_cache_alloc_node+0x53/0x250 [ 1900.732085][T12109] ? __get_vm_area_node+0x125/0x370 [ 1900.737327][T12109] kmalloc_node_trace+0x26/0xe0 [ 1900.742222][T12109] __get_vm_area_node+0x125/0x370 [ 1900.747311][T12109] __vmalloc_node_range+0x36f/0x1320 [ 1900.752640][T12109] ? netlink_sendmsg+0x602/0xbf0 [ 1900.757618][T12109] ? netlink_insert+0x1094/0x1390 [ 1900.762692][T12109] ? netlink_insert+0x2ba/0x1390 [ 1900.767682][T12109] ? free_vm_area+0x50/0x50 [ 1900.772238][T12109] ? netlink_sendmsg+0x602/0xbf0 [ 1900.777210][T12109] vmalloc+0x79/0x90 [ 1900.781139][T12109] ? netlink_sendmsg+0x602/0xbf0 [ 1900.786109][T12109] netlink_sendmsg+0x602/0xbf0 [ 1900.791012][T12109] ? netlink_getsockopt+0x590/0x590 [ 1900.796247][T12109] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1900.801836][T12109] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1900.807163][T12109] ? security_socket_sendmsg+0x80/0xa0 [ 1900.812658][T12109] ? netlink_getsockopt+0x590/0x590 [ 1900.817890][T12109] ____sys_sendmsg+0x61b/0x980 [ 1900.822697][T12109] ? __asan_memset+0x22/0x40 [ 1900.827322][T12109] ? __sys_sendmsg_sock+0x30/0x30 [ 1900.832372][T12109] ? __import_iovec+0x5f2/0x850 [ 1900.837267][T12109] ? import_iovec+0x73/0xa0 [ 1900.841801][T12109] ___sys_sendmsg+0x2a6/0x360 [ 1900.846514][T12109] ? __sys_sendmsg+0x2b0/0x2b0 [ 1900.851349][T12109] ? __lock_acquire+0x7d80/0x7d80 [ 1900.856434][T12109] __se_sys_sendmsg+0x1d0/0x2c0 [ 1900.861326][T12109] ? __x64_sys_sendmsg+0x80/0x80 [ 1900.866315][T12109] ? lockdep_hardirqs_on+0x98/0x150 [ 1900.871560][T12109] do_syscall_64+0x55/0xb0 [ 1900.876005][T12109] ? clear_bhb_loop+0x40/0x90 [ 1900.880719][T12109] ? clear_bhb_loop+0x40/0x90 [ 1900.885431][T12109] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1900.891358][T12109] RIP: 0033:0x7f976839e0d9 [ 1900.895808][T12109] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1900.915542][T12109] RSP: 002b:00007f97691e9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1900.923989][T12109] RAX: ffffffffffffffda RBX: 00007f9768625fa0 RCX: 00007f976839e0d9 [ 1900.931993][T12109] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 1900.939995][T12109] RBP: 00007f97691e9090 R08: 0000000000000000 R09: 0000000000000000 [ 1900.947999][T12109] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1900.956000][T12109] R13: 00007f9768626038 R14: 00007f9768625fa0 R15: 00007ffff3dad698 [ 1900.964027][T12109] [ 1901.026118][T12109] syz.3.13675: vmalloc error: size 213312, vm_struct allocation failed, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=syz3,mems_allowed=0-1 [ 1901.059690][T12109] CPU: 1 PID: 12109 Comm: syz.3.13675 Not tainted syzkaller #0 [ 1901.067374][T12109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1901.077463][T12109] Call Trace: [ 1901.080764][T12109] [ 1901.083715][T12109] dump_stack_lvl+0x18c/0x250 [ 1901.088431][T12109] ? show_regs_print_info+0x20/0x20 [ 1901.093659][T12109] ? load_image+0x420/0x420 [ 1901.098197][T12109] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1901.104647][T12109] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 1901.111175][T12109] warn_alloc+0x246/0x340 [ 1901.115536][T12109] ? __get_vm_area_node+0x125/0x370 [ 1901.120792][T12109] ? zone_watermark_ok_safe+0x230/0x230 [ 1901.126373][T12109] ? rcu_is_watching+0x15/0xb0 [ 1901.131174][T12109] ? __get_vm_area_node+0x356/0x370 [ 1901.136416][T12109] __vmalloc_node_range+0x394/0x1320 [ 1901.141737][T12109] ? netlink_insert+0x1094/0x1390 [ 1901.146901][T12109] ? netlink_insert+0x2ba/0x1390 [ 1901.151878][T12109] ? free_vm_area+0x50/0x50 [ 1901.156459][T12109] ? netlink_sendmsg+0x602/0xbf0 [ 1901.161460][T12109] vmalloc+0x79/0x90 [ 1901.165395][T12109] ? netlink_sendmsg+0x602/0xbf0 [ 1901.170365][T12109] netlink_sendmsg+0x602/0xbf0 [ 1901.175193][T12109] ? netlink_getsockopt+0x590/0x590 [ 1901.180437][T12109] ? apparmor_socket_sendmsg+0x8e/0x330 [ 1901.186034][T12109] ? bpf_lsm_socket_sendmsg+0x9/0x10 [ 1901.191370][T12109] ? security_socket_sendmsg+0x80/0xa0 [ 1901.196868][T12109] ? netlink_getsockopt+0x590/0x590 [ 1901.202112][T12109] ____sys_sendmsg+0x61b/0x980 [ 1901.206917][T12109] ? __asan_memset+0x22/0x40 [ 1901.211552][T12109] ? __sys_sendmsg_sock+0x30/0x30 [ 1901.216613][T12109] ? __import_iovec+0x5f2/0x850 [ 1901.221519][T12109] ? import_iovec+0x73/0xa0 [ 1901.226055][T12109] ___sys_sendmsg+0x2a6/0x360 [ 1901.230768][T12109] ? __sys_sendmsg+0x2b0/0x2b0 [ 1901.235575][T12109] ? __lock_acquire+0x7d80/0x7d80 [ 1901.240654][T12109] __se_sys_sendmsg+0x1d0/0x2c0 [ 1901.245546][T12109] ? __x64_sys_sendmsg+0x80/0x80 [ 1901.250546][T12109] ? lockdep_hardirqs_on+0x98/0x150 [ 1901.255780][T12109] do_syscall_64+0x55/0xb0 [ 1901.260223][T12109] ? clear_bhb_loop+0x40/0x90 [ 1901.264925][T12109] ? clear_bhb_loop+0x40/0x90 [ 1901.269635][T12109] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1901.275556][T12109] RIP: 0033:0x7f976839e0d9 [ 1901.279998][T12109] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1901.299725][T12109] RSP: 002b:00007f97691e9028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1901.308179][T12109] RAX: ffffffffffffffda RBX: 00007f9768625fa0 RCX: 00007f976839e0d9 [ 1901.316187][T12109] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 1901.324190][T12109] RBP: 00007f97691e9090 R08: 0000000000000000 R09: 0000000000000000 [ 1901.332368][T12109] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1901.340369][T12109] R13: 00007f9768626038 R14: 00007f9768625fa0 R15: 00007ffff3dad698 [ 1901.348394][T12109] [ 1901.359015][T12109] Mem-Info: [ 1901.365276][T12109] active_anon:7595 inactive_anon:0 isolated_anon:0 [ 1901.365276][T12109] active_file:19433 inactive_file:40687 isolated_file:0 [ 1901.365276][T12109] unevictable:768 dirty:175 writeback:0 [ 1901.365276][T12109] slab_reclaimable:11104 slab_unreclaimable:104604 [ 1901.365276][T12109] mapped:30124 shmem:1361 pagetables:522 [ 1901.365276][T12109] sec_pagetables:0 bounce:0 [ 1901.365276][T12109] kernel_misc_reclaimable:0 [ 1901.365276][T12109] free:1319739 free_pcp:2795 free_cma:0 [ 1901.420023][T12109] Node 0 active_anon:30480kB inactive_anon:0kB active_file:77732kB inactive_file:162548kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:120496kB dirty:700kB writeback:0kB shmem:3908kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12356kB pagetables:2088kB sec_pagetables:0kB all_unreclaimable? no [ 1901.457355][T12109] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 1901.489153][T12109] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1901.571170][T12109] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 1901.585946][T12109] Node 0 DMA32 free:1353776kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:30140kB inactive_anon:0kB active_file:77732kB inactive_file:161720kB unevictable:1536kB writepending:700kB present:3129332kB managed:2586840kB mlocked:0kB bounce:0kB free_pcp:26636kB local_pcp:13088kB free_cma:0kB [ 1901.630246][T12109] lowmem_reserve[]: 0 0 0 0 0 [ 1901.635348][T12109] Node 0 Normal free:4kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:828kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1901.686131][T12109] lowmem_reserve[]: 0 0 0 0 0 [ 1901.690931][T12109] Node 1 Normal free:3910104kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:8096kB local_pcp:8096kB free_cma:0kB [ 1901.722301][T12109] lowmem_reserve[]: 0 0 0 0 0 [ 1901.727357][T12109] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1901.750586][T12109] Node 0 DMA32: 752*4kB (ME) 856*8kB (UME) 983*16kB (UME) 1572*32kB (UME) 660*64kB (UME) 516*128kB (UME) 331*256kB (UME) 111*512kB (UME) 48*1024kB (UM) 20*2048kB (UM) 229*4096kB (UM) = 1353840kB [ 1901.762377][T12124] netlink: 207684 bytes leftover after parsing attributes in process `syz.0.13680'. [ 1901.782601][T12109] Node 0 Normal: 1*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 4kB [ 1901.801221][T12109] Node 1 Normal: 230*4kB (UME) 40*8kB (UME) 36*16kB (UME) 242*32kB (UME) 82*64kB (UME) 18*128kB (UME) 7*256kB (UME) 0*512kB 2*1024kB (UE) 1*2048kB (E) 949*4096kB (M) = 3910104kB [ 1901.815801][T12124] netlink: 'syz.0.13680': attribute type 1 has an invalid length. [ 1901.825547][T12109] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1901.846772][T12125] netlink: 751 bytes leftover after parsing attributes in process `syz.0.13680'. [ 1901.849701][T12109] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1901.865982][T12124] netlink: 'syz.0.13680': attribute type 2 has an invalid length. [ 1901.880973][T12109] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1901.905020][T12109] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1901.925822][T12109] 61481 total pagecache pages [ 1901.931690][T12109] 0 pages in swap cache [ 1901.942722][T12109] Free swap = 124996kB [ 1901.948990][T12109] Total swap = 124996kB [ 1901.953384][T12109] 2097051 pages RAM [ 1901.962857][T12109] 0 pages HighMem/MovableOnly [ 1901.969091][T12109] 416955 pages reserved [ 1901.973554][T12109] 0 pages cma reserved [ 1901.998390][T12129] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.13689'. [ 1901.998608][T12130] netlink: 4595 bytes leftover after parsing attributes in process `syz.1.13689'. [ 1902.044948][T12129] bridge_slave_1: default FDB implementation only supports local addresses [ 1902.298626][T12141] netlink: 'syz.0.13686': attribute type 9 has an invalid length. [ 1902.317748][T12141] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.13686'. [ 1902.582836][T12139] syzkaller0: entered promiscuous mode [ 1902.600693][T12139] syzkaller0: entered allmulticast mode [ 1902.692462][T12153] FAULT_INJECTION: forcing a failure. [ 1902.692462][T12153] name failslab, interval 1, probability 0, space 0, times 0 [ 1902.727632][T12153] CPU: 1 PID: 12153 Comm: syz.0.13690 Not tainted syzkaller #0 [ 1902.735331][T12153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1902.745435][T12153] Call Trace: [ 1902.748729][T12153] [ 1902.751678][T12153] dump_stack_lvl+0x18c/0x250 [ 1902.756496][T12153] ? show_regs_print_info+0x20/0x20 [ 1902.761803][T12153] ? load_image+0x420/0x420 [ 1902.766333][T12153] ? __might_sleep+0xe0/0xe0 [ 1902.770943][T12153] ? __lock_acquire+0x7d80/0x7d80 [ 1902.775997][T12153] should_fail_ex+0x394/0x4c0 [ 1902.780697][T12153] should_failslab+0x9/0x20 [ 1902.785215][T12153] slab_pre_alloc_hook+0x59/0x300 [ 1902.790270][T12153] kmem_cache_alloc_lru+0x4d/0x2b0 [ 1902.795412][T12153] ? __d_alloc+0x31/0x710 [ 1902.799766][T12153] __d_alloc+0x31/0x710 [ 1902.803941][T12153] d_alloc_pseudo+0x1d/0x70 [ 1902.808470][T12153] alloc_file_pseudo+0xe4/0x210 [ 1902.813339][T12153] ? fput+0x1a0/0x1a0 [ 1902.817337][T12153] ? _raw_spin_unlock+0x28/0x40 [ 1902.822238][T12153] ? alloc_fd+0x590/0x640 [ 1902.826602][T12153] anon_inode_getfd+0xca/0x1c0 [ 1902.831394][T12153] btf_new_fd+0x848/0x9e0 [ 1902.835750][T12153] ? bpf_btf_show_fdinfo+0x80/0x80 [ 1902.840928][T12153] ? capable+0x88/0xe0 [ 1902.845038][T12153] __sys_bpf+0x670/0x890 [ 1902.849300][T12153] ? bpf_link_show_fdinfo+0x390/0x390 [ 1902.854709][T12153] ? lock_chain_count+0x20/0x20 [ 1902.859590][T12153] __x64_sys_bpf+0x7c/0x90 [ 1902.864027][T12153] do_syscall_64+0x55/0xb0 [ 1902.868462][T12153] ? clear_bhb_loop+0x40/0x90 [ 1902.873168][T12153] ? clear_bhb_loop+0x40/0x90 [ 1902.877868][T12153] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1902.883783][T12153] RIP: 0033:0x7f77e139e0d9 [ 1902.888216][T12153] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1902.907842][T12153] RSP: 002b:00007f77e2279028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1902.916250][T12153] RAX: ffffffffffffffda RBX: 00007f77e1625fa0 RCX: 00007f77e139e0d9 [ 1902.924224][T12153] RDX: 0000000000000020 RSI: 0000200000000240 RDI: 0000000000000012 [ 1902.932219][T12153] RBP: 00007f77e2279090 R08: 0000000000000000 R09: 0000000000000000 [ 1902.940185][T12153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1902.948168][T12153] R13: 00007f77e1626038 R14: 00007f77e1625fa0 R15: 00007ffeea16ced8 [ 1902.956169][T12153] [ 1905.056171][T12160] tap0: tun_chr_ioctl cmd 1074025692 [ 1905.267492][T12171] netlink: 'syz.2.13696': attribute type 17 has an invalid length. [ 1905.276276][T12171] A link change request failed with some changes committed already. Interface ip_vti0 may have been left with an inconsistent configuration, please check. [ 1905.316177][T12172] netlink: 'syz.2.13696': attribute type 17 has an invalid length. [ 1905.640564][T12178] netlink: 'syz.0.13699': attribute type 2 has an invalid length. [ 1905.668343][T12178] netlink: 'syz.0.13699': attribute type 8 has an invalid length. [ 1905.707276][T12178] netlink: 132 bytes leftover after parsing attributes in process `syz.0.13699'. [ 1905.768256][T12178] netlink: 132 bytes leftover after parsing attributes in process `syz.0.13699'. [ 1905.822886][T12196] netlink: 'syz.3.13706': attribute type 9 has an invalid length. [ 1905.848179][T12196] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.13706'. [ 1906.442798][T12216] netlink: 'syz.1.13715': attribute type 9 has an invalid length. [ 1906.474793][T12216] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.13715'. [ 1907.014500][T12218] netlink: 'syz.2.13716': attribute type 2 has an invalid length. [ 1907.040616][T12218] netlink: 'syz.2.13716': attribute type 8 has an invalid length. [ 1907.060311][T12218] netlink: 132 bytes leftover after parsing attributes in process `syz.2.13716'. [ 1907.264025][T12221] netlink: 132 bytes leftover after parsing attributes in process `syz.2.13716'. [ 1907.496866][T12251] FAULT_INJECTION: forcing a failure. [ 1907.496866][T12251] name failslab, interval 1, probability 0, space 0, times 0 [ 1907.535853][T12251] CPU: 1 PID: 12251 Comm: syz.1.13728 Not tainted syzkaller #0 [ 1907.543473][T12251] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1907.553558][T12251] Call Trace: [ 1907.556849][T12251] [ 1907.559789][T12251] dump_stack_lvl+0x18c/0x250 [ 1907.564489][T12251] ? show_regs_print_info+0x20/0x20 [ 1907.569704][T12251] ? load_image+0x420/0x420 [ 1907.574214][T12251] ? __might_sleep+0xe0/0xe0 [ 1907.578819][T12251] ? __lock_acquire+0x7d80/0x7d80 [ 1907.583862][T12251] should_fail_ex+0x394/0x4c0 [ 1907.588555][T12251] should_failslab+0x9/0x20 [ 1907.593063][T12251] slab_pre_alloc_hook+0x59/0x300 [ 1907.598092][T12251] ? d_instantiate+0x6f/0x90 [ 1907.602709][T12251] kmem_cache_alloc+0x5a/0x2c0 [ 1907.607475][T12251] ? alloc_empty_file+0x9e/0x1d0 [ 1907.612433][T12251] alloc_empty_file+0x9e/0x1d0 [ 1907.617235][T12251] alloc_file+0x5b/0x600 [ 1907.621477][T12251] alloc_file_pseudo+0x184/0x210 [ 1907.626412][T12251] ? fput+0x1a0/0x1a0 [ 1907.630384][T12251] ? _raw_spin_unlock+0x28/0x40 [ 1907.635240][T12251] anon_inode_getfd+0xca/0x1c0 [ 1907.640193][T12251] btf_new_fd+0x848/0x9e0 [ 1907.644533][T12251] ? bpf_btf_show_fdinfo+0x80/0x80 [ 1907.649646][T12251] ? capable+0x88/0xe0 [ 1907.653715][T12251] __sys_bpf+0x670/0x890 [ 1907.657956][T12251] ? bpf_link_show_fdinfo+0x390/0x390 [ 1907.663334][T12251] ? lock_chain_count+0x20/0x20 [ 1907.668185][T12251] __x64_sys_bpf+0x7c/0x90 [ 1907.672598][T12251] do_syscall_64+0x55/0xb0 [ 1907.677012][T12251] ? clear_bhb_loop+0x40/0x90 [ 1907.681686][T12251] ? clear_bhb_loop+0x40/0x90 [ 1907.686376][T12251] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1907.692267][T12251] RIP: 0033:0x7f19c579e0d9 [ 1907.696680][T12251] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1907.716456][T12251] RSP: 002b:00007f19c65b2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1907.724892][T12251] RAX: ffffffffffffffda RBX: 00007f19c5a25fa0 RCX: 00007f19c579e0d9 [ 1907.732861][T12251] RDX: 0000000000000020 RSI: 0000200000000240 RDI: 0000000000000012 [ 1907.740826][T12251] RBP: 00007f19c65b2090 R08: 0000000000000000 R09: 0000000000000000 [ 1907.748791][T12251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1907.756754][T12251] R13: 00007f19c5a26038 R14: 00007f19c5a25fa0 R15: 00007ffc7845d538 [ 1907.764733][T12251] [ 1907.827397][T12260] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13731'. [ 1907.904625][T12260] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13731'. [ 1907.917295][T12261] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13731'. [ 1907.929927][T12260] netlink: 60 bytes leftover after parsing attributes in process `syz.2.13731'. [ 1908.075871][T12271] netlink: 'syz.0.13736': attribute type 11 has an invalid length. [ 1908.264410][T12280] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1908.296141][T12275] IPv6: pim6reg1: Disabled Multicast RS [ 1908.377356][T12270] netlink: 'syz.1.13735': attribute type 2 has an invalid length. [ 1908.412111][T12270] netlink: 'syz.1.13735': attribute type 8 has an invalid length. [ 1908.528410][T12285] tap0: tun_chr_ioctl cmd 1074025692 [ 1908.987912][ T1195] bond0: (slave wlan1): Releasing backup interface [ 1909.313996][ T1195] hsr_slave_0: left promiscuous mode [ 1909.346238][ T1195] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1909.355871][ T1195] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1909.381855][ T1195] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1909.407172][ T1195] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1909.567841][ T1195] veth1_macvtap: left promiscuous mode [ 1909.585973][ T1195] veth0_macvtap: left promiscuous mode [ 1909.616097][ T1195] veth1_vlan: left promiscuous mode [ 1910.942307][ T1195] team0 (unregistering): Port device team_slave_1 removed [ 1911.029010][ T1195] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1911.109584][ T1195] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1911.558912][ T1195] bond0 (unregistering): (slave team0): Releasing backup interface [ 1911.598873][ T1195] bond0 (unregistering): Released all slaves [ 1911.930196][T12336] netlink: 'syz.2.13758': attribute type 9 has an invalid length. [ 1911.939743][T12336] __nla_validate_parse: 4 callbacks suppressed [ 1911.939759][T12336] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.13758'. [ 1911.960862][T12324] netlink: 'syz.3.13753': attribute type 2 has an invalid length. [ 1911.984239][T12324] netlink: 'syz.3.13753': attribute type 8 has an invalid length. [ 1912.027259][T12324] netlink: 132 bytes leftover after parsing attributes in process `syz.3.13753'. [ 1912.055999][T12339] netlink: 132 bytes leftover after parsing attributes in process `syz.3.13753'. [ 1912.115006][T12341] netlink: 64535 bytes leftover after parsing attributes in process `syz.1.13759'. [ 1912.558369][T12360] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 1912.596131][T12360] syzkaller1: Linktype set failed because interface is up [ 1912.660049][ T5817] syzkaller1: tun_net_xmit 90 [ 1912.759522][T12362] netlink: 65039 bytes leftover after parsing attributes in process `syz.2.13768'. [ 1912.870155][T12368] netlink: 'syz.0.13771': attribute type 21 has an invalid length. [ 1913.491712][T12401] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13785'. [ 1913.511915][T12401] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13785'. [ 1913.610573][T12401] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13785'. [ 1913.625124][T12409] netlink: 60 bytes leftover after parsing attributes in process `syz.3.13785'. [ 1913.698468][T12411] FAULT_INJECTION: forcing a failure. [ 1913.698468][T12411] name failslab, interval 1, probability 0, space 0, times 0 [ 1913.724103][T12411] CPU: 1 PID: 12411 Comm: syz.0.13787 Not tainted syzkaller #0 [ 1913.731714][T12411] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1913.741797][T12411] Call Trace: [ 1913.745091][T12411] [ 1913.748038][T12411] dump_stack_lvl+0x18c/0x250 [ 1913.752731][T12411] ? show_regs_print_info+0x20/0x20 [ 1913.757936][T12411] ? load_image+0x420/0x420 [ 1913.762476][T12411] ? __might_sleep+0xe0/0xe0 [ 1913.767099][T12411] ? __lock_acquire+0x7d80/0x7d80 [ 1913.772149][T12411] should_fail_ex+0x394/0x4c0 [ 1913.776851][T12411] should_failslab+0x9/0x20 [ 1913.781376][T12411] slab_pre_alloc_hook+0x59/0x300 [ 1913.786435][T12411] kmem_cache_alloc+0x5a/0x2c0 [ 1913.791225][T12411] ? security_file_alloc+0x34/0x120 [ 1913.796441][T12411] security_file_alloc+0x34/0x120 [ 1913.801485][T12411] init_file+0x94/0x1f0 [ 1913.805649][T12411] alloc_empty_file+0xb7/0x1d0 [ 1913.810414][T12411] alloc_file+0x5b/0x600 [ 1913.814654][T12411] alloc_file_pseudo+0x184/0x210 [ 1913.819590][T12411] ? fput+0x1a0/0x1a0 [ 1913.823563][T12411] ? _raw_spin_unlock+0x28/0x40 [ 1913.828425][T12411] anon_inode_getfd+0xca/0x1c0 [ 1913.833188][T12411] btf_new_fd+0x848/0x9e0 [ 1913.837521][T12411] ? bpf_btf_show_fdinfo+0x80/0x80 [ 1913.842631][T12411] ? capable+0x88/0xe0 [ 1913.846697][T12411] __sys_bpf+0x670/0x890 [ 1913.850933][T12411] ? bpf_link_show_fdinfo+0x390/0x390 [ 1913.856311][T12411] ? lock_chain_count+0x20/0x20 [ 1913.861161][T12411] __x64_sys_bpf+0x7c/0x90 [ 1913.865571][T12411] do_syscall_64+0x55/0xb0 [ 1913.869985][T12411] ? clear_bhb_loop+0x40/0x90 [ 1913.874658][T12411] ? clear_bhb_loop+0x40/0x90 [ 1913.879329][T12411] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1913.885215][T12411] RIP: 0033:0x7f77e139e0d9 [ 1913.889627][T12411] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1913.909251][T12411] RSP: 002b:00007f77e2279028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1913.917663][T12411] RAX: ffffffffffffffda RBX: 00007f77e1625fa0 RCX: 00007f77e139e0d9 [ 1913.925628][T12411] RDX: 0000000000000020 RSI: 0000200000000240 RDI: 0000000000000012 [ 1913.933595][T12411] RBP: 00007f77e2279090 R08: 0000000000000000 R09: 0000000000000000 [ 1913.941561][T12411] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1913.949530][T12411] R13: 00007f77e1626038 R14: 00007f77e1625fa0 R15: 00007ffeea16ced8 [ 1913.957508][T12411] [ 1914.113206][T12419] netlink: 'syz.3.13791': attribute type 1 has an invalid length. [ 1914.146620][T12419] netlink: 112860 bytes leftover after parsing attributes in process `syz.3.13791'. [ 1914.164790][T12421] netlink: 'syz.2.13792': attribute type 11 has an invalid length. [ 1914.186770][T12419] netlink: 'syz.3.13791': attribute type 1 has an invalid length. [ 1914.401100][T12430] netlink: 'syz.2.13795': attribute type 39 has an invalid length. [ 1914.836348][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1914.838822][T12438] syz.0.13797[12438] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 1914.842791][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1914.948710][T12444] netlink: 'syz.3.13800': attribute type 4 has an invalid length. [ 1915.077622][T12444] netlink: 'syz.3.13800': attribute type 2 has an invalid length. [ 1915.089088][T12444] netlink: 'syz.3.13800': attribute type 4 has an invalid length. [ 1915.532999][T12465] netlink: 'syz.0.13809': attribute type 10 has an invalid length. [ 1915.643932][T12468] syzkaller0: entered promiscuous mode [ 1915.650532][T12468] syzkaller0: entered allmulticast mode [ 1915.681543][T12468] netlink: 'syz.2.13810': attribute type 64 has an invalid length. [ 1918.253430][T12480] netlink: 'syz.0.13815': attribute type 39 has an invalid length. [ 1918.544155][T12507] __nla_validate_parse: 3 callbacks suppressed [ 1918.544182][T12507] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.13824'. [ 1918.569927][T12507] netlink: 'syz.1.13824': attribute type 21 has an invalid length. [ 1918.581973][T12507] netlink: 132 bytes leftover after parsing attributes in process `syz.1.13824'. [ 1918.759495][T12513] netlink: 'syz.0.13828': attribute type 11 has an invalid length. [ 1918.791105][T12513] netlink: 140 bytes leftover after parsing attributes in process `syz.0.13828'. [ 1918.831050][T12511] netlink: 'syz.3.13827': attribute type 1 has an invalid length. [ 1918.848726][T12511] netlink: 16150 bytes leftover after parsing attributes in process `syz.3.13827'. [ 1918.987499][T12517] netlink: 'syz.1.13829': attribute type 39 has an invalid length. [ 1920.409513][T12558] netlink: 14463 bytes leftover after parsing attributes in process `syz.0.13846'. [ 1920.567590][T12571] netlink: 10 bytes leftover after parsing attributes in process `syz.0.13850'. [ 1921.226206][ T5787] Bluetooth: hci0: ISO packet for unknown connection handle 2622 [ 1921.816889][T12614] netlink: 'syz.2.13867': attribute type 11 has an invalid length. [ 1921.824880][T12614] netlink: 140 bytes leftover after parsing attributes in process `syz.2.13867'. [ 1922.480097][T12650] netlink: 'syz.2.13877': attribute type 5 has an invalid length. [ 1923.657353][T12675] netlink: 'syz.2.13887': attribute type 21 has an invalid length. [ 1923.677518][T12675] netlink: 'syz.2.13887': attribute type 1 has an invalid length. [ 1923.688890][T12675] netlink: 132 bytes leftover after parsing attributes in process `syz.2.13887'. [ 1924.149532][T12694] netlink: 'syz.2.13892': attribute type 10 has an invalid length. [ 1924.539308][T12708] netlink: 129384 bytes leftover after parsing attributes in process `syz.0.13902'. [ 1924.723897][T12714] netlink: 128 bytes leftover after parsing attributes in process `syz.0.13905'. [ 1924.741640][T12714] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1924.786503][T12716] netlink: 'syz.1.13906': attribute type 11 has an invalid length. [ 1924.804703][T12716] netlink: 140 bytes leftover after parsing attributes in process `syz.1.13906'. [ 1925.961451][T12739] netlink: 'syz.0.13916': attribute type 2 has an invalid length. [ 1925.970534][T12739] netlink: 'syz.0.13916': attribute type 8 has an invalid length. [ 1926.002486][T12739] netlink: 132 bytes leftover after parsing attributes in process `syz.0.13916'. [ 1926.674074][T12766] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1927.543278][T12782] netlink: 'syz.3.13931': attribute type 2 has an invalid length. [ 1927.579738][T12782] netlink: 'syz.3.13931': attribute type 8 has an invalid length. [ 1927.611232][T12782] netlink: 132 bytes leftover after parsing attributes in process `syz.3.13931'. [ 1928.535986][T12811] netlink: 36 bytes leftover after parsing attributes in process `syz.0.13941'. [ 1928.571115][T12811] : renamed from caif0 [ 1928.629764][T12811] A link change request failed with some changes committed already. Interface  may have been left with an inconsistent configuration, please check. [ 1928.984625][T12825] netlink: 'syz.0.13946': attribute type 10 has an invalid length. [ 1929.074266][T12821] netlink: 'syz.2.13944': attribute type 2 has an invalid length. [ 1929.177924][T12821] netlink: 'syz.2.13944': attribute type 8 has an invalid length. [ 1929.200312][T12821] netlink: 132 bytes leftover after parsing attributes in process `syz.2.13944'. [ 1929.482512][T12844] netlink: 'syz.0.13954': attribute type 11 has an invalid length. [ 1929.539563][T12844] netlink: 140 bytes leftover after parsing attributes in process `syz.0.13954'. [ 1929.704412][T12845] netlink: 'syz.1.13952': attribute type 2 has an invalid length. [ 1929.752672][T12845] netlink: 'syz.1.13952': attribute type 8 has an invalid length. [ 1929.771449][T12845] netlink: 132 bytes leftover after parsing attributes in process `syz.1.13952'. [ 1930.424821][T12870] netlink: 'syz.2.13963': attribute type 9 has an invalid length. [ 1930.448982][T12870] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.13963'. [ 1930.727790][T12876] netlink: 14 bytes leftover after parsing attributes in process `syz.0.13964'. [ 1930.862993][T12876] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1930.910463][T12876] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1930.954634][T12876] bond0 (unregistering): Released all slaves [ 1931.545012][T12897] netlink: 'syz.1.13967': attribute type 2 has an invalid length. [ 1931.571833][T12897] netlink: 'syz.1.13967': attribute type 8 has an invalid length. [ 1931.583577][T12897] netlink: 132 bytes leftover after parsing attributes in process `syz.1.13967'. [ 1931.700526][T12902] netlink: 64 bytes leftover after parsing attributes in process `syz.1.13973'. [ 1931.739610][T12904] netlink: 128 bytes leftover after parsing attributes in process `syz.2.13972'. [ 1931.760941][T12904] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1932.586172][T12934] netlink: 'syz.3.13985': attribute type 10 has an invalid length. [ 1932.781239][T12947] netlink: 140 bytes leftover after parsing attributes in process `syz.2.13990'. [ 1933.133796][T12974] netlink: 128 bytes leftover after parsing attributes in process `syz.1.13999'. [ 1933.144565][T12974] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1933.447032][T12982] syzkaller0: entered promiscuous mode [ 1933.461232][T12982] syzkaller0: entered allmulticast mode [ 1934.174305][T12997] validate_nla: 1 callbacks suppressed [ 1934.174323][T12997] netlink: 'syz.1.14006': attribute type 9 has an invalid length. [ 1934.939632][T13012] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1935.001138][T13014] __nla_validate_parse: 1 callbacks suppressed [ 1935.001177][T13014] netlink: 14 bytes leftover after parsing attributes in process `syz.1.14014'. [ 1935.179638][T13020] mac80211_hwsim hwsim107 wlan1: (WE) : Wireless Event (cmd=0x8B1A) too big (33) [ 1935.341739][T13034] netlink: 140 bytes leftover after parsing attributes in process `syz.1.14022'. [ 1935.519701][T13042] netlink: 'syz.0.14026': attribute type 11 has an invalid length. [ 1935.598955][T13046] netlink: 60 bytes leftover after parsing attributes in process `syz.1.14028'. [ 1936.713031][T13070] netlink: 'syz.2.14035': attribute type 2 has an invalid length. [ 1936.768659][T13070] netlink: 'syz.2.14035': attribute type 8 has an invalid length. [ 1936.810522][T13070] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14035'. [ 1936.913019][T13081] netlink: 'syz.3.14038': attribute type 9 has an invalid length. [ 1936.921288][T13081] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.14038'. [ 1937.248249][T13099] netlink: 'syz.3.14044': attribute type 5 has an invalid length. [ 1937.361894][T13103] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1937.720009][T13118] netlink: 'syz.0.14050': attribute type 2 has an invalid length. [ 1937.734282][T13118] netlink: 'syz.0.14050': attribute type 8 has an invalid length. [ 1937.745452][T13118] netlink: 132 bytes leftover after parsing attributes in process `syz.0.14050'. [ 1938.833879][T13137] netlink: 'syz.2.14057': attribute type 10 has an invalid length. [ 1939.340160][T13147] netlink: 'syz.3.14062': attribute type 2 has an invalid length. [ 1939.348597][T13147] netlink: 'syz.3.14062': attribute type 8 has an invalid length. [ 1939.357184][T13147] netlink: 132 bytes leftover after parsing attributes in process `syz.3.14062'. [ 1939.531084][T13163] netlink: 209836 bytes leftover after parsing attributes in process `syz.1.14065'. [ 1939.906528][T13173] netlink: 'syz.0.14071': attribute type 9 has an invalid length. [ 1939.914620][T13173] netlink: 209836 bytes leftover after parsing attributes in process `syz.0.14071'. [ 1940.379041][T13188] netlink: 'syz.0.14075': attribute type 2 has an invalid length. [ 1940.401956][T13188] netlink: 'syz.0.14075': attribute type 8 has an invalid length. [ 1940.424227][T13188] netlink: 132 bytes leftover after parsing attributes in process `syz.0.14075'. [ 1941.176343][T13218] netlink: 'syz.2.14088': attribute type 2 has an invalid length. [ 1941.199399][T13218] netlink: 'syz.2.14088': attribute type 8 has an invalid length. [ 1941.245901][T13218] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14088'. [ 1941.390996][T13226] €Â0: renamed from batadv_slave_1 (while UP) [ 1941.570440][ T9867] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1941.580356][ T9867] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1941.589150][ T9867] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1941.616771][ T9867] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1941.641985][ T9867] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 1941.649841][ T9867] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1941.725039][ T1195] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1941.813554][T13243] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1941.837968][ T1195] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1941.934069][ T1195] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1942.073794][ T1195] team0: Port device ÿÿÿÿÿÿ removed [ 1942.086782][ T1195] netdevsim netdevsim1 ÿÿÿÿÿÿ (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1942.112591][T13254] netlink: 168 bytes leftover after parsing attributes in process `syz.0.14101'. [ 1942.195068][T13251] netlink: 'syz.3.14100': attribute type 2 has an invalid length. [ 1942.203328][T13251] netlink: 'syz.3.14100': attribute type 8 has an invalid length. [ 1942.213942][T13251] netlink: 132 bytes leftover after parsing attributes in process `syz.3.14100'. [ 1942.402192][T13233] chnl_net:caif_netlink_parms(): no params data found [ 1942.422380][T13264] netlink: 'syz.3.14102': attribute type 11 has an invalid length. [ 1942.431094][T13264] netlink: 140 bytes leftover after parsing attributes in process `syz.3.14102'. [ 1942.671734][T13233] bridge0: port 1(bridge_slave_0) entered blocking state [ 1942.679813][T13233] bridge0: port 1(bridge_slave_0) entered disabled state [ 1942.694396][T13233] bridge_slave_0: entered allmulticast mode [ 1942.701987][T13233] bridge_slave_0: entered promiscuous mode [ 1942.754168][T13233] bridge0: port 2(bridge_slave_1) entered blocking state [ 1942.772407][T13233] bridge0: port 2(bridge_slave_1) entered disabled state [ 1942.780901][T13233] bridge_slave_1: entered allmulticast mode [ 1942.800266][T13233] bridge_slave_1: entered promiscuous mode [ 1943.045487][T13233] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1943.188708][T13233] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1943.335486][T13233] team0: Port device team_slave_0 added [ 1943.424941][T13233] team0: Port device team_slave_1 added [ 1943.598467][T13298] netlink: 132 bytes leftover after parsing attributes in process `syz.3.14109'. [ 1943.654117][T13233] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1943.661979][T13233] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1943.689778][T13233] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1943.709762][ T9867] Bluetooth: hci1: command tx timeout [ 1943.738301][T13233] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1943.755847][T13233] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1943.806018][T13233] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1943.948322][ T9867] Bluetooth: hci0: unexpected subevent 0x0a length: 150 > 30 [ 1943.991877][T13233] hsr_slave_0: entered promiscuous mode [ 1944.016417][T13233] hsr_slave_1: entered promiscuous mode [ 1944.331058][ T1195] bond0: (slave wlan1): Releasing backup interface [ 1944.380847][T13319] -1: renamed from syzkaller0 [ 1944.672419][ T1195] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1944.688544][ T1195] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1944.709293][ T1195] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1944.720101][ T1195] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1944.731572][ T1195] bridge_slave_0: left allmulticast mode [ 1944.741929][ T1195] bridge_slave_0: left promiscuous mode [ 1944.753030][ T1195] bridge0: port 1(bridge_slave_0) entered disabled state [ 1944.793513][ T1195] veth1_macvtap: left promiscuous mode [ 1944.803621][ T1195] veth0_macvtap: left promiscuous mode [ 1944.813189][ T1195] veth1_vlan: left promiscuous mode [ 1944.831046][ T1195] veth0_vlan: left promiscuous mode [ 1945.777068][ T5787] Bluetooth: hci1: command tx timeout [ 1945.894355][ T1195] team0 (unregistering): Port device team_slave_1 removed [ 1945.948395][ T1195] team0 (unregistering): Port device team_slave_0 removed [ 1945.994232][ T1195] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1946.019006][ T5787] Bluetooth: hci0: command 0x0406 tx timeout [ 1947.865842][ T5787] Bluetooth: hci1: command tx timeout [ 1948.885237][ T1195] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1948.941291][ T1195] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1948.973142][ T1195] bond0 (unregistering): (slave veth1_to_bridge): Releasing backup interface [ 1949.276969][ T1195] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 1949.285642][ T1195] bond0 (unregistering): Released all slaves [ 1949.433564][T13342] validate_nla: 3 callbacks suppressed [ 1949.433582][T13342] netlink: 'syz.3.14119': attribute type 2 has an invalid length. [ 1949.460975][T13342] netlink: 'syz.3.14119': attribute type 8 has an invalid length. [ 1949.469174][T13342] netlink: 132 bytes leftover after parsing attributes in process `syz.3.14119'. [ 1949.940046][ T5787] Bluetooth: hci1: command tx timeout [ 1950.302747][T13233] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1950.314786][T13233] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1950.326424][T13233] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1950.337495][T13233] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1950.429988][T13233] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1950.455047][T13233] 8021q: adding VLAN 0 to HW filter on device team0 [ 1950.471761][ T8252] bridge0: port 1(bridge_slave_0) entered blocking state [ 1950.478983][ T8252] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1950.498514][ T1195] bridge0: port 2(bridge_slave_1) entered blocking state [ 1950.505743][ T1195] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1950.892535][T13233] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1951.072768][T13407] -1: renamed from syzkaller0 [ 1951.301332][T13233] veth0_vlan: entered promiscuous mode [ 1951.348613][T13233] veth1_vlan: entered promiscuous mode [ 1951.504080][T13233] veth0_macvtap: entered promiscuous mode [ 1951.553814][T13233] veth1_macvtap: entered promiscuous mode [ 1951.646296][T13233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1951.694668][T13233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1951.726875][T13233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1951.737921][T13233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1951.753189][T13233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1951.768643][T13233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1951.781318][T13233] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1951.794358][T13425] netlink: 'syz.3.14131': attribute type 2 has an invalid length. [ 1951.835357][T13425] netlink: 'syz.3.14131': attribute type 8 has an invalid length. [ 1951.861494][T13425] netlink: 132 bytes leftover after parsing attributes in process `syz.3.14131'. [ 1951.929671][T13233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1951.951782][T13233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1951.976263][T13233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: €Â0 [ 1952.005877][T13233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1952.041894][T13233] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1952.053310][T13442] netlink: 'syz.2.14139': attribute type 9 has an invalid length. [ 1952.065159][T13233] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1952.067234][T13442] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.14139'. [ 1952.116081][T13233] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1952.141601][T13233] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1952.164028][T13233] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1952.186100][T13233] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1952.194909][T13233] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1952.443602][ T8253] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1952.485794][ T8253] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1952.553190][ T1182] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1952.576847][T13461] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1952.608494][ T1182] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1953.048508][T13473] netlink: 'syz.2.14145': attribute type 2 has an invalid length. [ 1953.096191][T13473] netlink: 'syz.2.14145': attribute type 8 has an invalid length. [ 1953.108477][T13473] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14145'. [ 1954.104452][T13517] veth1_to_bond: entered allmulticast mode [ 1954.443947][T13530] netlink: 'syz.2.14159': attribute type 2 has an invalid length. [ 1954.455479][T13530] netlink: 'syz.2.14159': attribute type 8 has an invalid length. [ 1954.471787][T13530] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14159'. [ 1954.539998][T13543] netlink: 192436 bytes leftover after parsing attributes in process `syz.3.14162'. [ 1954.578175][T13543] openvswitch: netlink: Message has 20476 unknown bytes. [ 1954.632387][T13546] netlink: 'syz.0.14163': attribute type 11 has an invalid length. [ 1954.680190][T13546] netlink: 140 bytes leftover after parsing attributes in process `syz.0.14163'. [ 1955.024998][T13564] netlink: 132 bytes leftover after parsing attributes in process `syz.3.14169'. [ 1955.337572][T13586] netlink: 140 bytes leftover after parsing attributes in process `syz.1.14174'. [ 1955.395872][T13586] netlink: 10 bytes leftover after parsing attributes in process `syz.1.14174'. [ 1955.422116][T13586] bond0: (slave bond_slave_0): Releasing backup interface [ 1955.504067][T13586] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1955.566112][T13589] netlink: 'syz.3.14177': attribute type 10 has an invalid length. [ 1955.619329][T13576] netlink: 'syz.2.14173': attribute type 2 has an invalid length. [ 1955.652023][T13576] netlink: 'syz.2.14173': attribute type 8 has an invalid length. [ 1955.669510][T13576] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14173'. [ 1955.880837][T13602] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1956.956178][T13634] netlink: 'syz.3.14188': attribute type 2 has an invalid length. [ 1956.964222][T13634] netlink: 'syz.3.14188': attribute type 8 has an invalid length. [ 1956.986991][T13634] netlink: 132 bytes leftover after parsing attributes in process `syz.3.14188'. [ 1957.341111][T13652] netlink: 'syz.0.14189': attribute type 9 has an invalid length. [ 1957.403429][T13652] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.14189'. [ 1957.528909][T13650] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1959.136559][T13669] netlink: 'syz.0.14200': attribute type 2 has an invalid length. [ 1959.230735][T13669] netlink: 132 bytes leftover after parsing attributes in process `syz.0.14200'. [ 1959.429186][T13696] netlink: 140 bytes leftover after parsing attributes in process `syz.1.14210'. [ 1960.044704][T13713] netlink: 140 bytes leftover after parsing attributes in process `syz.3.14217'. [ 1960.076529][T13713] netlink: 10 bytes leftover after parsing attributes in process `syz.3.14217'. [ 1960.115763][T13713] bond0: (slave bond_slave_0): Releasing backup interface [ 1960.142325][T13713] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1960.194347][T13718] validate_nla: 2 callbacks suppressed [ 1960.194369][T13718] netlink: 'syz.2.14221': attribute type 10 has an invalid length. [ 1960.400336][T13724] netlink: 128 bytes leftover after parsing attributes in process `syz.0.14219'. [ 1960.474119][T13723] netlink: 'syz.1.14222': attribute type 2 has an invalid length. [ 1960.505925][T13723] netlink: 'syz.1.14222': attribute type 8 has an invalid length. [ 1960.514123][T13723] netlink: 132 bytes leftover after parsing attributes in process `syz.1.14222'. [ 1961.877085][T13754] netlink: 'syz.2.14232': attribute type 2 has an invalid length. [ 1961.885125][T13754] netlink: 'syz.2.14232': attribute type 8 has an invalid length. [ 1961.925899][T13754] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14232'. [ 1962.148437][T13767] netlink: 1047 bytes leftover after parsing attributes in process `syz.1.14237'. [ 1962.392112][T13775] netlink: 140 bytes leftover after parsing attributes in process `syz.0.14235'. [ 1962.572402][T13770] netlink: 'syz.2.14246': attribute type 2 has an invalid length. [ 1962.591713][T13770] netlink: 'syz.2.14246': attribute type 8 has an invalid length. [ 1962.600478][T13770] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14246'. [ 1962.868368][T13782] netlink: 16186 bytes leftover after parsing attributes in process `syz.3.14240'. [ 1963.360184][T13791] netlink: 'syz.3.14245': attribute type 39 has an invalid length. [ 1963.658286][T13802] netlink: 'syz.0.14250': attribute type 2 has an invalid length. [ 1963.679921][T13802] netlink: 'syz.0.14250': attribute type 8 has an invalid length. [ 1963.701819][T13802] netlink: 132 bytes leftover after parsing attributes in process `syz.0.14250'. [ 1964.684339][T13841] can: request_module (can-proto-0) failed. [ 1965.918643][T13878] validate_nla: 5 callbacks suppressed [ 1965.918679][T13878] netlink: 'syz.2.14279': attribute type 2 has an invalid length. [ 1965.963308][T13878] netlink: 'syz.2.14279': attribute type 8 has an invalid length. [ 1965.977853][T13878] __nla_validate_parse: 2 callbacks suppressed [ 1965.977887][T13878] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14279'. [ 1966.474632][T13908] netlink: 'syz.1.14287': attribute type 11 has an invalid length. [ 1966.497055][T13908] netlink: 140 bytes leftover after parsing attributes in process `syz.1.14287'. [ 1967.559943][T13919] netlink: 'syz.3.14292': attribute type 2 has an invalid length. [ 1967.591845][T13919] netlink: 'syz.3.14292': attribute type 8 has an invalid length. [ 1967.640186][T13919] netlink: 132 bytes leftover after parsing attributes in process `syz.3.14292'. [ 1967.699616][T13931] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1968.166847][T13941] netlink: 144 bytes leftover after parsing attributes in process `syz.1.14301'. [ 1968.297082][T13941] team0: Port device team_slave_0 removed [ 1968.313623][T13941] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1969.140124][T13969] netlink: 'syz.0.14311': attribute type 2 has an invalid length. [ 1969.158864][T13969] netlink: 'syz.0.14311': attribute type 8 has an invalid length. [ 1969.185835][T13969] netlink: 132 bytes leftover after parsing attributes in process `syz.0.14311'. [ 1969.434059][T13978] netlink: 'syz.3.14314': attribute type 10 has an invalid length. [ 1969.775128][T13985] netlink: 144 bytes leftover after parsing attributes in process `syz.2.14317'. [ 1969.865348][T13985] team0: Port device team_slave_0 removed [ 1969.877761][T13985] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1969.969501][T13997] netlink: 'syz.0.14319': attribute type 2 has an invalid length. [ 1969.977404][T14000] netlink: 'syz.3.14321': attribute type 9 has an invalid length. [ 1969.977454][T14000] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.14321'. [ 1970.025478][T13997] netlink: 132 bytes leftover after parsing attributes in process `syz.0.14319'. [ 1970.085040][T14006] netlink: 140 bytes leftover after parsing attributes in process `syz.1.14323'. [ 1970.320402][T14010] netlink: 14548 bytes leftover after parsing attributes in process `syz.3.14327'. [ 1971.002210][T14038] validate_nla: 5 callbacks suppressed [ 1971.002297][T14038] netlink: 'syz.0.14336': attribute type 9 has an invalid length. [ 1971.055136][T14038] __nla_validate_parse: 1 callbacks suppressed [ 1971.055157][T14038] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.14336'. [ 1971.119511][T14040] netlink: 'syz.1.14338': attribute type 2 has an invalid length. [ 1971.131874][T14040] netlink: 'syz.1.14338': attribute type 8 has an invalid length. [ 1971.164125][T14040] netlink: 132 bytes leftover after parsing attributes in process `syz.1.14338'. [ 1971.435669][T14052] netlink: 'syz.1.14344': attribute type 21 has an invalid length. [ 1971.466307][T14052] netlink: 14548 bytes leftover after parsing attributes in process `syz.1.14344'. [ 1972.542598][T14077] syzkaller0: entered promiscuous mode [ 1972.548616][T14077] syzkaller0: entered allmulticast mode [ 1972.571232][T14075] netlink: 'syz.1.14352': attribute type 2 has an invalid length. [ 1972.583174][T14075] netlink: 'syz.1.14352': attribute type 8 has an invalid length. [ 1972.605763][T14075] netlink: 132 bytes leftover after parsing attributes in process `syz.1.14352'. [ 1972.634055][T14077] netlink: 'syz.3.14354': attribute type 63 has an invalid length. [ 1972.704067][T14077] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14354'. [ 1972.726246][T14077] netlink: 'syz.3.14354': attribute type 63 has an invalid length. [ 1972.776017][T14077] netlink: 4 bytes leftover after parsing attributes in process `syz.3.14354'. [ 1972.817545][T14087] netlink: 'syz.2.14353': attribute type 2 has an invalid length. [ 1972.831305][T14087] netlink: 'syz.2.14353': attribute type 8 has an invalid length. [ 1972.839643][T14087] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14353'. [ 1972.936283][ T5787] Bluetooth: hci0: unexpected event 0x16 length: 15 > 6 [ 1975.044219][T14093] netlink: 14556 bytes leftover after parsing attributes in process `syz.0.14359'. [ 1975.157661][T14103] netlink: 763 bytes leftover after parsing attributes in process `syz.2.14364'. [ 1975.191926][T14103] netlink: 126588 bytes leftover after parsing attributes in process `syz.2.14364'. [ 1975.543589][T14109] team0: Port device team_slave_0 removed [ 1975.559509][T14109] A link change request failed with some changes committed already. Interface team_slave_0 may have been left with an inconsistent configuration, please check. [ 1975.688177][T14120] tun0: tun_chr_ioctl cmd 1074025675 [ 1975.693734][T14120] tun0: persist enabled [ 1976.272212][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1976.279309][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1976.480968][T14137] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1977.027387][T14145] validate_nla: 4 callbacks suppressed [ 1977.027421][T14145] netlink: 'syz.0.14377': attribute type 2 has an invalid length. [ 1977.071652][T14145] netlink: 'syz.0.14377': attribute type 8 has an invalid length. [ 1977.110629][T14145] __nla_validate_parse: 2 callbacks suppressed [ 1977.110667][T14145] netlink: 132 bytes leftover after parsing attributes in process `syz.0.14377'. [ 1977.766477][T14166] netlink: 'syz.1.14385': attribute type 10 has an invalid length. [ 1978.140728][T14179] netlink: 'syz.2.14390': attribute type 11 has an invalid length. [ 1978.152537][T14179] netlink: 140 bytes leftover after parsing attributes in process `syz.2.14390'. [ 1980.513575][ T9867] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1980.534637][ T9867] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1980.543525][ T9867] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1980.582685][ T9867] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1980.594266][ T9867] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1980.602142][ T9867] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1981.285547][T14227] chnl_net:caif_netlink_parms(): no params data found [ 1981.556839][T14227] bridge0: port 1(bridge_slave_0) entered blocking state [ 1981.564031][T14227] bridge0: port 1(bridge_slave_0) entered disabled state [ 1981.603409][T14227] bridge_slave_0: entered allmulticast mode [ 1981.652201][T14227] bridge_slave_0: entered promiscuous mode [ 1981.680860][T14227] bridge0: port 2(bridge_slave_1) entered blocking state [ 1981.698164][T14227] bridge0: port 2(bridge_slave_1) entered disabled state [ 1981.716323][T14227] bridge_slave_1: entered allmulticast mode [ 1981.728242][T14227] bridge_slave_1: entered promiscuous mode [ 1982.008527][T14261] netlink: 'syz.0.14420': attribute type 9 has an invalid length. [ 1982.026946][T14261] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.14420'. [ 1982.160427][T21620] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1982.311977][T14259] netlink: 'syz.0.14420': attribute type 10 has an invalid length. [ 1982.432211][T14259] team0: Device gre0 is of different type [ 1982.599024][T21620] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1982.657558][ T5787] Bluetooth: hci2: command tx timeout [ 1982.702403][T14227] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1982.802652][T21620] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1982.842563][T14227] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1983.009285][T21620] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1983.041771][T14227] team0: Port device team_slave_0 added [ 1983.060982][T14227] team0: Port device team_slave_1 added [ 1983.134889][T14227] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1983.154611][T14227] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1983.265895][T14227] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1983.436567][T14227] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1983.470070][T14227] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1983.562805][T14227] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1983.892133][T14227] hsr_slave_0: entered promiscuous mode [ 1983.914869][T14227] hsr_slave_1: entered promiscuous mode [ 1983.949802][T14227] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1983.957587][T14227] Cannot create hsr debugfs directory [ 1984.273630][T14313] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1984.746443][ T5787] Bluetooth: hci2: command tx timeout [ 1984.887525][T14337] netlink: 188 bytes leftover after parsing attributes in process `syz.0.14443'. [ 1984.976848][T14340] netlink: 'syz.0.14443': attribute type 10 has an invalid length. [ 1985.041094][T14340] geneve0: entered promiscuous mode [ 1985.626967][ T1195] tipc: Subscription rejected, illegal request [ 1985.863862][T14227] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1985.929373][T14227] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1985.969934][T14227] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1986.064073][T21620] bond0: (slave wlan1): Releasing backup interface [ 1986.119777][T14227] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1986.594728][T21620] vlan0: left allmulticast mode [ 1986.625806][T21620] veth0_vlan: left allmulticast mode [ 1986.631224][T21620] vlan0: left promiscuous mode [ 1986.660362][T21620] À: port 1(vlan0) entered disabled state [ 1986.726837][T21620] hsr_slave_0: left promiscuous mode [ 1986.757342][T21620] hsr_slave_1: left promiscuous mode [ 1986.793930][T21620] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1986.815989][T21620] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1986.825749][ T5787] Bluetooth: hci2: command tx timeout [ 1986.839899][T21620] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1986.848684][T21620] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1986.889516][T21620] hsr0: left allmulticast mode [ 1986.910504][T21620] bridge0: port 2(hsr0) entered disabled state [ 1986.950923][T21620] bridge_slave_0: left allmulticast mode [ 1986.965942][T21620] bridge_slave_0: left promiscuous mode [ 1986.971719][T21620] bridge0: port 1(bridge_slave_0) entered disabled state [ 1987.246010][T21620] veth0_macvtap: left promiscuous mode [ 1987.251741][T21620] veth1_vlan: left allmulticast mode [ 1987.275999][T21620] veth1_vlan: left promiscuous mode [ 1987.281534][T21620] veth0_vlan: left promiscuous mode [ 1987.961925][T21620] team0 (unregistering): Port device geneve1 removed [ 1988.245124][T21620] bond0 (unregistering): (slave macvlan0): Releasing backup interface [ 1988.649225][T21620] team0 (unregistering): Port device team_slave_1 removed [ 1988.739632][T21620] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1988.793944][T21620] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1988.842565][T21620] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 1988.896433][ T5787] Bluetooth: hci2: command tx timeout [ 1989.178274][T21620] bond0 (unregistering): Released all slaves [ 1989.281902][T14392] bridge0: entered allmulticast mode [ 1989.288565][T14397] bridge0: port 1(bridge_slave_0) entered blocking state [ 1989.295810][T14397] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1989.303763][T14397] bridge0: entered promiscuous mode [ 1989.311982][T14408] netlink: 'syz.1.14462': attribute type 2 has an invalid length. [ 1989.349028][T14408] netlink: 'syz.1.14462': attribute type 8 has an invalid length. [ 1989.372742][T14408] netlink: 132 bytes leftover after parsing attributes in process `syz.1.14462'. [ 1989.404373][T14227] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1989.510940][T14227] 8021q: adding VLAN 0 to HW filter on device team0 [ 1989.563590][ T8253] bridge0: port 1(bridge_slave_0) entered blocking state [ 1989.570777][ T8253] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1989.658322][ T8253] bridge0: port 2(bridge_slave_1) entered blocking state [ 1989.665509][ T8253] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1989.888564][T14227] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1990.154413][T14443] netlink: 'syz.1.14471': attribute type 21 has an invalid length. [ 1991.049110][T14227] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1991.323762][T14227] veth0_vlan: entered promiscuous mode [ 1991.424429][T14227] veth1_vlan: entered promiscuous mode [ 1991.574079][T14227] veth0_macvtap: entered promiscuous mode [ 1991.588190][T14227] veth1_macvtap: entered promiscuous mode [ 1991.633386][T14227] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1991.652252][T14227] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1991.685960][T14227] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1991.704195][T14227] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1991.721959][T14227] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1991.732903][T14227] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1991.744895][T14227] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1991.763756][T14227] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: €Â0 [ 1991.774778][T14227] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1991.793395][T14227] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1991.808321][T14227] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1991.820613][T14227] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1991.832994][T14227] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1991.844526][T14227] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1991.862201][T14227] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1991.872651][T14227] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1991.889782][T14227] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1991.899671][T14227] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1992.743008][ T8244] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1992.767903][ T8244] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1992.810018][T14482] netlink: 'syz.3.14481': attribute type 9 has an invalid length. [ 1992.813119][ T8252] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1992.832189][T14482] netlink: 126588 bytes leftover after parsing attributes in process `syz.3.14481'. [ 1992.848900][ T8252] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1993.288300][T14509] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1993.479075][T14512] netlink: 'syz.2.14492': attribute type 2 has an invalid length. [ 1993.506021][T14512] netlink: 'syz.2.14492': attribute type 8 has an invalid length. [ 1993.519887][T14512] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14492'. [ 1993.629890][T14512] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14492'. [ 1993.748143][T14526] syzkaller0: entered promiscuous mode [ 1993.753709][T14526] syzkaller0: entered allmulticast mode [ 1994.293602][T14548] netlink: 'syz.0.14504': attribute type 1 has an invalid length. [ 1994.305868][T14548] netlink: 176 bytes leftover after parsing attributes in process `syz.0.14504'. [ 1994.579146][T14556] netlink: 148 bytes leftover after parsing attributes in process `syz.0.14509'. [ 1995.420041][T14572] netlink: 16399 bytes leftover after parsing attributes in process `syz.0.14515'. [ 1995.713386][T14586] netlink: 16178 bytes leftover after parsing attributes in process `syz.3.14521'. [ 1996.115615][ T5787] Bluetooth: hci5: unexpected event 0x06 length: 15 > 3 [ 1996.197891][T14606] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1996.256566][T14600] netlink: 'syz.3.14527': attribute type 21 has an invalid length. [ 1996.291963][T14610] netlink: 'syz.1.14531': attribute type 11 has an invalid length. [ 1996.300210][T14610] netlink: 140 bytes leftover after parsing attributes in process `syz.1.14531'. [ 1997.873637][T14646] netlink: 14 bytes leftover after parsing attributes in process `syz.1.14545'. [ 1998.391053][T14658] netlink: 16399 bytes leftover after parsing attributes in process `syz.1.14549'. [ 1999.161906][T14681] netlink: 'syz.3.14557': attribute type 10 has an invalid length. [ 1999.193797][T14681] netlink: 9279 bytes leftover after parsing attributes in process `syz.3.14557'. [ 1999.459108][T14690] netlink: 'syz.3.14560': attribute type 10 has an invalid length. [ 1999.752569][T14696] netlink: 16399 bytes leftover after parsing attributes in process `syz.2.14562'. [ 1999.779226][T14700] netlink: 'syz.0.14565': attribute type 21 has an invalid length. [ 2000.003894][T14711] netlink: 209820 bytes leftover after parsing attributes in process `syz.0.14565'. [ 2000.421059][T14723] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2000.755482][T14733] netlink: 'syz.0.14577': attribute type 9 has an invalid length. [ 2000.763680][T14733] netlink: 126588 bytes leftover after parsing attributes in process `syz.0.14577'. [ 2001.038608][T14736] netlink: 16399 bytes leftover after parsing attributes in process `syz.3.14578'. [ 2001.873231][T14756] netlink: 'syz.3.14584': attribute type 12 has an invalid length. [ 2001.881420][T14756] netlink: 'syz.3.14584': attribute type 15 has an invalid length. [ 2001.907784][T14756] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2001.915084][T14756] IPv6: NLM_F_CREATE should be set when creating new route [ 2001.922424][T14756] IPv6: NLM_F_CREATE should be set when creating new route [ 2001.929712][T14756] IPv6: NLM_F_CREATE should be set when creating new route [ 2002.538665][T14778] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.14595'. [ 2003.298815][T14804] netlink: 'syz.2.14605': attribute type 2 has an invalid length. [ 2003.319023][T14804] netlink: 'syz.2.14605': attribute type 8 has an invalid length. [ 2003.336355][T14804] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14605'. [ 2003.380012][T14804] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14605'. [ 2004.119956][T14842] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2004.149286][T14845] netlink: 'syz.1.14620': attribute type 2 has an invalid length. [ 2004.162494][T14845] netlink: 14 bytes leftover after parsing attributes in process `syz.1.14620'. [ 2007.060893][T14919] netlink: 'syz.0.14648': attribute type 9 has an invalid length. [ 2007.125011][T14919] netlink: 399 bytes leftover after parsing attributes in process `syz.0.14648'. [ 2007.564421][T14931] netlink: 40 bytes leftover after parsing attributes in process `syz.1.14652'. [ 2007.717293][T14931] bridge0: port 1(bridge_slave_0) entered disabled state [ 2007.858392][T14931] bridge_slave_0 (unregistering): left allmulticast mode [ 2007.887707][T14931] bridge_slave_0 (unregistering): left promiscuous mode [ 2007.894789][T14931] bridge0: port 1(bridge_slave_0) entered disabled state [ 2008.045989][T14930] netlink: 'syz.0.14654': attribute type 10 has an invalid length. [ 2008.054241][T14928] netlink: 40 bytes leftover after parsing attributes in process `syz.1.14652'. [ 2008.088028][ T9867] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2008.099710][ T9867] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2008.108104][ T9867] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2008.116461][ T9867] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2008.124179][ T9867] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 2008.131923][ T9867] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2008.556723][ T8252] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2008.714554][ T8252] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2008.838227][ T8252] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2008.856564][T14956] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2008.993040][ T8252] bond0: (slave netdevsim0): Releasing backup interface [ 2009.015199][ T8252] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2009.169202][T14939] chnl_net:caif_netlink_parms(): no params data found [ 2009.465287][T14939] bridge0: port 1(bridge_slave_0) entered blocking state [ 2009.496225][T14939] bridge0: port 1(bridge_slave_0) entered disabled state [ 2009.503484][T14939] bridge_slave_0: entered allmulticast mode [ 2009.537509][T14939] bridge_slave_0: entered promiscuous mode [ 2009.577578][T14939] bridge0: port 2(bridge_slave_1) entered blocking state [ 2009.584845][T14939] bridge0: port 2(bridge_slave_1) entered disabled state [ 2009.618353][T14939] bridge_slave_1: entered allmulticast mode [ 2009.641481][T14939] bridge_slave_1: entered promiscuous mode [ 2010.175843][ T5787] Bluetooth: hci3: command tx timeout [ 2010.197759][T14939] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2010.253479][T14939] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2010.628765][T14939] team0: Port device team_slave_0 added [ 2010.648567][T14939] team0: Port device team_slave_1 added [ 2010.882146][T14939] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2010.894768][T14939] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2010.930959][T14939] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2010.954632][T14939] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2010.964355][T14939] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2010.996607][T14939] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2011.151282][T14939] hsr_slave_0: entered promiscuous mode [ 2011.173486][T14939] hsr_slave_1: entered promiscuous mode [ 2011.185642][T14939] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 2011.197867][T14939] Cannot create hsr debugfs directory [ 2011.692603][T15020] syzkaller0: entered promiscuous mode [ 2011.698668][T15020] syzkaller0: entered allmulticast mode [ 2012.263926][ T5787] Bluetooth: hci3: command tx timeout [ 2012.992100][T15064] netlink: 198048 bytes leftover after parsing attributes in process `syz.1.14689'. [ 2013.012724][T15064] netlink: 'syz.1.14689': attribute type 2 has an invalid length. [ 2013.036836][T15064] netlink: 'syz.1.14689': attribute type 1 has an invalid length. [ 2014.348858][ T5787] Bluetooth: hci3: command tx timeout [ 2015.259034][ T8252] bond0: (slave wlan1): Releasing backup interface [ 2015.553770][ T8252] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2015.572256][ T8252] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2015.581491][ T8252] batman_adv: batadv0: Interface deactivated: €Â0 [ 2015.589770][ T8252] batman_adv: batadv0: Removing interface: €Â0 [ 2015.597829][ T8252] bridge_slave_0: left allmulticast mode [ 2015.603532][ T8252] bridge_slave_0: left promiscuous mode [ 2015.609411][ T8252] bridge0: port 1(bridge_slave_0) entered disabled state [ 2015.641772][ T8252] veth1_macvtap: left promiscuous mode [ 2015.649923][ T8252] veth0_macvtap: left promiscuous mode [ 2015.655533][ T8252] veth1_vlan: left promiscuous mode [ 2015.661018][ T8252] veth0_vlan: left promiscuous mode [ 2015.868399][ T8252] team0 (unregistering): Port device geneve1 removed [ 2016.347700][ T8252] team0 (unregistering): Port device team_slave_1 removed [ 2016.402135][ T8252] team0 (unregistering): Port device team_slave_0 removed [ 2016.422581][ T5787] Bluetooth: hci3: command tx timeout [ 2016.458763][ T8252] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2016.548438][ T8252] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 2016.872591][ T8252] bond0 (unregistering): (slave bridge0): Releasing backup interface [ 2016.881912][ T8252] bond0 (unregistering): Released all slaves [ 2017.381754][T15090] veth1_to_bond: entered allmulticast mode [ 2017.683093][T15102] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2017.784590][T14939] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 2017.804033][T14939] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 2017.834135][T14939] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 2017.866399][T14939] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 2018.045026][T14939] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2018.081262][T14939] 8021q: adding VLAN 0 to HW filter on device team0 [ 2018.109564][T21620] bridge0: port 1(bridge_slave_0) entered blocking state [ 2018.116784][T21620] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2018.160961][T21620] bridge0: port 2(bridge_slave_1) entered blocking state [ 2018.168217][T21620] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2018.681886][T14939] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2018.803907][T15141] netlink: 'syz.2.14708': attribute type 11 has an invalid length. [ 2018.826841][T15141] netlink: 140 bytes leftover after parsing attributes in process `syz.2.14708'. [ 2018.887493][T14939] veth0_vlan: entered promiscuous mode [ 2019.000459][T14939] veth1_vlan: entered promiscuous mode [ 2019.111043][T14939] veth0_macvtap: entered promiscuous mode [ 2019.139526][T14939] veth1_macvtap: entered promiscuous mode [ 2019.203606][T14939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2019.227509][T14939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2019.251139][T14939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2019.268002][T14939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2019.280567][T14939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2019.293901][T14939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2019.322565][T14939] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2019.338048][T15161] netlink: 'syz.1.14714': attribute type 11 has an invalid length. [ 2019.366342][T15161] netlink: 184116 bytes leftover after parsing attributes in process `syz.1.14714'. [ 2019.386746][T14939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2019.411353][T14939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2019.430148][T14939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2019.442943][T14939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2019.453375][T14939] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2019.465823][T14939] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2019.482143][T14939] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2019.519471][T14939] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2019.532969][T14939] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2019.548109][T14939] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2019.557189][T14939] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2019.658234][T15168] netlink: 'syz.2.14716': attribute type 21 has an invalid length. [ 2019.694499][T15168] netlink: 152 bytes leftover after parsing attributes in process `syz.2.14716'. [ 2019.774781][ T8244] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2019.801666][ T8244] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2019.821681][T15176] netlink: 'syz.1.14717': attribute type 10 has an invalid length. [ 2019.945881][T21620] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2019.969435][T21620] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2020.743327][T15202] netlink: 'syz.0.14724': attribute type 2 has an invalid length. [ 2020.765356][T15202] netlink: 'syz.0.14724': attribute type 8 has an invalid length. [ 2020.778961][T15202] netlink: 132 bytes leftover after parsing attributes in process `syz.0.14724'. [ 2020.794275][T15210] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.14722'. [ 2020.821504][T15210] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.14722'. [ 2020.848359][T15198] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.14722'. [ 2020.873301][T15210] netlink: 4083 bytes leftover after parsing attributes in process `syz.3.14722'. [ 2021.030265][T15198] netlink: 'syz.3.14722': attribute type 10 has an invalid length. [ 2021.046038][T15198] netlink: 40 bytes leftover after parsing attributes in process `syz.3.14722'. [ 2021.079154][T15198] batman_adv: batadv0: Adding interface: veth1_virt_wifi [ 2021.093542][T15198] batman_adv: batadv0: The MTU of interface veth1_virt_wifi is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2021.153557][T15198] batman_adv: batadv0: Interface activated: veth1_virt_wifi [ 2022.167016][T15259] veth0_vlan: entered allmulticast mode [ 2022.505152][T15271] netlink: 176 bytes leftover after parsing attributes in process `syz.2.14745'. [ 2022.644421][T15268] netlink: 'syz.2.14745': attribute type 21 has an invalid length. [ 2026.074813][T15375] netlink: 'syz.1.14774': attribute type 29 has an invalid length. [ 2026.102958][T15375] netlink: 'syz.1.14774': attribute type 29 has an invalid length. [ 2026.133908][T15377] netlink: 'syz.1.14774': attribute type 29 has an invalid length. [ 2026.151238][T15371] macvlan1: entered promiscuous mode [ 2026.174457][T15371] macvlan1: entered allmulticast mode [ 2026.202223][T15371] veth1_vlan: entered allmulticast mode [ 2026.238224][T15375] netlink: 'syz.1.14774': attribute type 29 has an invalid length. [ 2026.404153][T15377] netlink: 'syz.1.14774': attribute type 29 has an invalid length. [ 2027.136293][T15402] netlink: 'syz.1.14783': attribute type 10 has an invalid length. [ 2027.161065][T15403] netlink: 'syz.2.14782': attribute type 9 has an invalid length. [ 2027.210208][T15403] __nla_validate_parse: 1 callbacks suppressed [ 2027.210227][T15403] netlink: 209836 bytes leftover after parsing attributes in process `syz.2.14782'. [ 2027.424012][T15407] netlink: 'syz.2.14782': attribute type 1 has an invalid length. [ 2027.457457][T15407] netlink: 'syz.2.14782': attribute type 3 has an invalid length. [ 2027.476250][T15407] netlink: 132 bytes leftover after parsing attributes in process `syz.2.14782'. [ 2028.422700][T15440] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2029.470251][T15455] netlink: 'syz.2.14803': attribute type 21 has an invalid length. [ 2029.496068][T15455] netlink: 128 bytes leftover after parsing attributes in process `syz.2.14803'. [ 2029.529574][T15455] netlink: 3 bytes leftover after parsing attributes in process `syz.2.14803'. [ 2033.446205][ T5787] Bluetooth: hci1: ISO packet for unknown connection handle 62 [ 2033.659691][T15509] validate_nla: 3 callbacks suppressed [ 2033.659709][T15509] netlink: 'syz.0.14824': attribute type 11 has an invalid length. [ 2033.716624][T15509] netlink: 140 bytes leftover after parsing attributes in process `syz.0.14824'. [ 2034.144206][T15524] netlink: 132 bytes leftover after parsing attributes in process `syz.0.14827'. [ 2035.886892][T15584] netlink: 'syz.0.14855': attribute type 11 has an invalid length. [ 2035.898891][T15584] netlink: 140 bytes leftover after parsing attributes in process `syz.0.14855'. [ 2036.994127][T15611] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2037.198485][T15622] netlink: 'syz.2.14868': attribute type 10 has an invalid length. [ 2037.629627][T15642] netlink: 'syz.3.14878': attribute type 21 has an invalid length. [ 2037.659167][T15642] netlink: 'syz.3.14878': attribute type 1 has an invalid length. [ 2037.688596][T15642] netlink: 'syz.3.14878': attribute type 2 has an invalid length. [ 2037.702210][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 2037.708691][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 2037.723159][T15642] netlink: 9062 bytes leftover after parsing attributes in process `syz.3.14878'. [ 2037.796374][T15646] netlink: 132 bytes leftover after parsing attributes in process `syz.3.14878'. [ 2038.201001][T15655] netlink: 'syz.3.14884': attribute type 11 has an invalid length. [ 2038.247380][T15655] netlink: 140 bytes leftover after parsing attributes in process `syz.3.14884'. [ 2038.798279][T15661] netlink: 132 bytes leftover after parsing attributes in process `syz.0.14875'. [ 2039.337336][T15681] netlink: 'syz.1.14890': attribute type 2 has an invalid length. [ 2039.376030][T15681] netlink: 'syz.1.14890': attribute type 8 has an invalid length. [ 2039.396027][T15681] netlink: 132 bytes leftover after parsing attributes in process `syz.1.14890'. [ 2039.448225][T15681] netlink: 132 bytes leftover after parsing attributes in process `syz.1.14890'. [ 2039.754187][ T9867] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2039.771405][ T9867] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2039.780082][ T9867] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2039.810075][ T9867] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2039.820234][ T8252] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2039.831319][ T9867] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 2039.846741][ T9867] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2040.012104][ T8252] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2040.153511][ T8252] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2040.269581][ T8252] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2040.323203][T15698] chnl_net:caif_netlink_parms(): no params data found [ 2040.392293][T15720] netlink: 4 bytes leftover after parsing attributes in process `syz.1.14903'. [ 2040.458859][T15698] bridge0: port 1(bridge_slave_0) entered blocking state [ 2040.467718][T15698] bridge0: port 1(bridge_slave_0) entered disabled state [ 2040.474968][T15698] bridge_slave_0: entered allmulticast mode [ 2040.482741][T15698] bridge_slave_0: entered promiscuous mode [ 2040.491882][T15698] bridge0: port 2(bridge_slave_1) entered blocking state [ 2040.499614][T15698] bridge0: port 2(bridge_slave_1) entered disabled state [ 2040.507094][T15698] bridge_slave_1: entered allmulticast mode [ 2040.514380][T15698] bridge_slave_1: entered promiscuous mode [ 2040.590393][T15698] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2040.603933][T15698] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2040.727685][T15698] team0: Port device team_slave_0 added [ 2040.749483][T15698] team0: Port device team_slave_1 added [ 2040.787398][T15725] veth1_to_bond: entered allmulticast mode [ 2040.862964][T15698] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2040.885733][T15698] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2040.925275][T15698] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2040.965118][T15698] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2040.993872][T15698] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2041.064235][T15698] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2041.936228][ T5787] Bluetooth: hci0: command tx timeout [ 2042.580554][T15698] hsr_slave_0: entered promiscuous mode [ 2042.587275][T15698] hsr_slave_1: entered promiscuous mode [ 2042.593417][T15698] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 2042.602607][T15698] Cannot create hsr debugfs directory [ 2043.581094][T15799] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 2043.588643][T15799] IPv6: NLM_F_CREATE should be set when creating new route [ 2043.596468][T15799] IPv6: NLM_F_CREATE should be set when creating new route [ 2043.604157][T15799] IPv6: NLM_F_CREATE should be set when creating new route [ 2044.026352][ T5787] Bluetooth: hci0: command tx timeout [ 2044.184868][T15698] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 2044.195459][T15698] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 2044.217614][T15698] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 2044.246634][T15698] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 2044.295182][ T8252] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2044.327984][ T8252] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2044.348649][ T8252] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2044.366906][ T8252] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2044.403916][ T8252] veth1_macvtap: left promiscuous mode [ 2044.409707][ T8252] veth0_macvtap: left promiscuous mode [ 2044.423376][ T8252] veth1_vlan: left allmulticast mode [ 2044.430682][ T8252] veth1_vlan: left promiscuous mode [ 2044.456200][ T8252] veth0_vlan: left promiscuous mode [ 2045.624482][ T8252] team0 (unregistering): Port device team_slave_1 removed [ 2046.096047][ T5787] Bluetooth: hci0: command tx timeout [ 2046.421616][T15840] netlink: 'syz.3.14934': attribute type 10 has an invalid length. [ 2046.444787][T15831] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2046.702096][T15698] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2046.785525][T15698] 8021q: adding VLAN 0 to HW filter on device team0 [ 2046.828665][T21620] bridge0: port 1(bridge_slave_0) entered blocking state [ 2046.835919][T21620] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2046.968207][ T1182] bridge0: port 2(bridge_slave_1) entered blocking state [ 2046.975421][ T1182] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2047.691333][T15698] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2047.827924][T15698] veth0_vlan: entered promiscuous mode [ 2047.859178][T15698] veth1_vlan: entered promiscuous mode [ 2047.948797][T15698] veth0_macvtap: entered promiscuous mode [ 2048.001654][T15698] veth1_macvtap: entered promiscuous mode [ 2048.156120][T15698] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2048.178699][ T5787] Bluetooth: hci0: command tx timeout [ 2048.229953][T15698] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2048.285723][T15698] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2048.309879][T15698] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2048.350382][T15698] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 2048.371323][T15698] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2048.397877][T15698] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2048.440964][T15698] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2048.482162][T15698] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2048.505750][T15698] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2048.544012][T15698] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2048.584171][T15698] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 2048.617370][T15698] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 2048.643933][T15698] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2048.747934][T15698] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2048.779965][T15698] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2048.820424][T15698] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2048.840232][T15698] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2048.962078][T15918] netlink: 140 bytes leftover after parsing attributes in process `syz.3.14951'. [ 2049.006813][T15918] netlink: 10 bytes leftover after parsing attributes in process `syz.3.14951'. [ 2049.063644][T15918] bond0: (slave bond_slave_0): Releasing backup interface [ 2049.146778][T15918] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 2049.435429][ T8244] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2049.456992][ T8244] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2049.533455][ T8244] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2049.554784][ T8244] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2049.926733][T15941] netlink: 'syz.3.14958': attribute type 10 has an invalid length. [ 2050.518701][T15953] netlink: 'syz.3.14964': attribute type 11 has an invalid length. [ 2050.532931][T15953] netlink: 140 bytes leftover after parsing attributes in process `syz.3.14964'. [ 2050.821922][T15963] delete_channel: no stack [ 2051.255389][T15986] tap0: tun_chr_ioctl cmd 1074025677 [ 2051.264716][T15986] tap0: linktype set to 270 [ 2051.760331][T16010] netlink: 'syz.3.14984': attribute type 2 has an invalid length. [ 2051.785899][T16010] netlink: 'syz.3.14984': attribute type 8 has an invalid length. [ 2051.811101][T16010] netlink: 132 bytes leftover after parsing attributes in process `syz.3.14984'. [ 2051.840427][T16010] netlink: 132 bytes leftover after parsing attributes in process `syz.3.14984'. [ 2051.884200][T16008] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.14982'. [ 2052.262229][T16034] netlink: 140 bytes leftover after parsing attributes in process `syz.3.14993'. [ 2052.316406][T16038] netlink: 'syz.0.14994': attribute type 10 has an invalid length. [ 2052.406280][T16040] netlink: 168 bytes leftover after parsing attributes in process `syz.1.14995'. [ 2052.421053][T16040] netlink: 'syz.1.14995': attribute type 3 has an invalid length. [ 2052.446339][T16040] netlink: 'syz.1.14995': attribute type 1 has an invalid length. [ 2052.454698][T16040] netlink: 191376 bytes leftover after parsing attributes in process `syz.1.14995'. [ 2052.495237][T16042] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2053.204819][T16069] netlink: 15999 bytes leftover after parsing attributes in process `syz.3.15008'. [ 2054.041223][T16096] netlink: 'syz.3.15021': attribute type 10 has an invalid length. [ 2054.060782][T16096] __nla_validate_parse: 1 callbacks suppressed [ 2054.060846][T16096] netlink: 40 bytes leftover after parsing attributes in process `syz.3.15021'. [ 2054.145033][T16103] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2054.169905][T16096] batman_adv: batadv0: Adding interface: virt_wifi0 [ 2054.180800][T16096] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2054.209307][T16096] batman_adv: batadv0: Interface activated: virt_wifi0 [ 2054.233601][T16103] netlink: 'syz.3.15021': attribute type 39 has an invalid length. [ 2054.323503][T16107] netlink: 6 bytes leftover after parsing attributes in process `syz.2.15023'. [ 2054.395588][T16107] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2054.766861][T16121] netlink: 134736 bytes leftover after parsing attributes in process `syz.3.15030'. [ 2055.425519][T16129] netlink: 'syz.2.15032': attribute type 10 has an invalid length. [ 2055.608099][T16131] netlink: 'syz.1.15033': attribute type 10 has an invalid length. [ 2055.639777][T16131] bridge0: port 2(bridge_slave_1) entered disabled state [ 2055.669362][T16131] bridge0: port 2(bridge_slave_1) entered blocking state [ 2055.677995][T16131] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2055.715616][T16131] team0: Port device bridge0 added [ 2055.796639][T16138] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2055.872510][T16133] netlink: 'syz.2.15034': attribute type 8 has an invalid length. [ 2055.905864][T16133] netlink: 199836 bytes leftover after parsing attributes in process `syz.2.15034'. [ 2058.851012][T16164] netlink: 'syz.3.15045': attribute type 11 has an invalid length. [ 2058.859169][T16164] netlink: 140 bytes leftover after parsing attributes in process `syz.3.15045'. [ 2058.872428][T16169] veth1_to_bond: entered allmulticast mode [ 2062.272260][T16214] netlink: 'syz.3.15064': attribute type 21 has an invalid length. [ 2062.281926][T16214] netlink: 156 bytes leftover after parsing attributes in process `syz.3.15064'. [ 2062.470145][T16223] netlink: 'syz.2.15068': attribute type 10 has an invalid length. [ 2062.492411][T16216] netlink: 'syz.3.15066': attribute type 2 has an invalid length. [ 2062.515853][T16216] netlink: 'syz.3.15066': attribute type 8 has an invalid length. [ 2062.523868][T16216] netlink: 132 bytes leftover after parsing attributes in process `syz.3.15066'. [ 2062.552586][T16216] netlink: 132 bytes leftover after parsing attributes in process `syz.3.15066'. [ 2063.058632][T16248] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.15078'. [ 2064.023205][T16265] syzkaller0: entered promiscuous mode [ 2064.030991][T16265] syzkaller0: entered allmulticast mode [ 2064.054177][T16262] netlink: 'syz.1.15083': attribute type 10 has an invalid length. [ 2064.175501][T16262] bond0: (slave veth1_to_bridge): Enslaving as an active interface with an up link [ 2065.376816][ T9867] Bluetooth: hci1: command 0x0406 tx timeout [ 2066.339767][T16324] pim6reg1: entered promiscuous mode [ 2066.677400][T16328] netlink: 'syz.1.15108': attribute type 10 has an invalid length. [ 2066.688916][T16328] syz_tun: entered promiscuous mode [ 2066.768407][T16328] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 2066.806307][T16330] netlink: 'syz.1.15108': attribute type 10 has an invalid length. [ 2066.919855][T16330] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2066.940264][T16330] team0: Port device bond0 added [ 2067.688960][T16347] sit0: entered allmulticast mode [ 2067.729611][T16348] sit0: entered promiscuous mode [ 2068.365471][T16365] netlink: 9286 bytes leftover after parsing attributes in process `syz.0.15121'. [ 2068.678090][T16368] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2071.642373][T16457] netlink: 'syz.2.15158': attribute type 11 has an invalid length. [ 2071.653563][T16457] netlink: 140 bytes leftover after parsing attributes in process `syz.2.15158'. [ 2071.731072][T16453] netlink: 132 bytes leftover after parsing attributes in process `syz.1.15155'. [ 2071.788784][T16463] netlink: 'syz.3.15160': attribute type 27 has an invalid length. [ 2072.903243][T16492] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2073.079466][T16503] netlink: 4595 bytes leftover after parsing attributes in process `syz.3.15173'. [ 2073.560250][T16512] sit0: entered allmulticast mode [ 2073.621415][T16514] sit0: entered promiscuous mode [ 2073.733027][T16518] macvlan1: entered promiscuous mode [ 2073.747562][T16518] macvlan1: entered allmulticast mode [ 2073.767970][T16518] veth1_vlan: entered allmulticast mode [ 2075.386247][T16562] sit0: entered allmulticast mode [ 2075.436175][T16564] sit0: entered promiscuous mode [ 2075.612838][T16576] netlink: 'syz.1.15198': attribute type 2 has an invalid length. [ 2075.625070][T16576] netlink: 'syz.1.15198': attribute type 1 has an invalid length. [ 2075.638804][T16576] netlink: 9 bytes leftover after parsing attributes in process `syz.1.15198'. [ 2076.053439][T16596] netlink: 'syz.1.15206': attribute type 2 has an invalid length. [ 2076.065700][T16596] netlink: 'syz.1.15206': attribute type 8 has an invalid length. [ 2076.076168][T16596] netlink: 132 bytes leftover after parsing attributes in process `syz.1.15206'. [ 2076.099143][T16596] netlink: 132 bytes leftover after parsing attributes in process `syz.1.15206'. [ 2076.914614][T16624] netlink: 'syz.2.15216': attribute type 10 has an invalid length. [ 2077.416234][T16645] netlink: 'syz.1.15224': attribute type 6 has an invalid length. [ 2077.441341][T16645] netlink: 168 bytes leftover after parsing attributes in process `syz.1.15224'. [ 2079.287589][T16694] netlink: 'syz.0.15241': attribute type 16 has an invalid length. [ 2079.295596][T16694] netlink: 48 bytes leftover after parsing attributes in process `syz.0.15241'. [ 2079.315748][T16694] veth1_macvtap: entered allmulticast mode [ 2079.593475][T16702] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2080.365877][T16723] netlink: 4 bytes leftover after parsing attributes in process `syz.2.15252'. [ 2080.374186][T16719] netlink: 'syz.2.15252': attribute type 9 has an invalid length. [ 2080.415620][T16719] netlink: 'syz.2.15252': attribute type 23 has an invalid length. [ 2080.430675][T16719] netlink: 156008 bytes leftover after parsing attributes in process `syz.2.15252'. [ 2081.307439][T16737] netlink: 'syz.2.15258': attribute type 27 has an invalid length. [ 2081.345250][T16737] netlink: 2418 bytes leftover after parsing attributes in process `syz.2.15258'. [ 2081.408903][T16735] delete_channel: no stack [ 2081.933187][T16754] netlink: 10 bytes leftover after parsing attributes in process `syz.2.15264'. [ 2082.349495][T16776] netlink: 209852 bytes leftover after parsing attributes in process `syz.0.15269'. [ 2082.400405][T16776] openvswitch: netlink: Key type 29 is not supported [ 2082.428980][T16775] netlink: 'syz.3.15270': attribute type 27 has an invalid length. [ 2082.452003][T16775] netlink: 2418 bytes leftover after parsing attributes in process `syz.3.15270'. [ 2082.487607][T16774] delete_channel: no stack [ 2082.760829][T16787] netlink: 'syz.0.15274': attribute type 21 has an invalid length. [ 2082.788605][T16787] netlink: 156 bytes leftover after parsing attributes in process `syz.0.15274'. [ 2083.492833][T16818] netlink: 'syz.3.15287': attribute type 21 has an invalid length. [ 2083.507916][T16818] netlink: 156 bytes leftover after parsing attributes in process `syz.3.15287'. [ 2083.982396][T16827] netlink: 'syz.1.15289': attribute type 39 has an invalid length. [ 2084.090828][T16843] netlink: 'syz.3.15294': attribute type 11 has an invalid length. [ 2084.118722][T16843] netlink: 140 bytes leftover after parsing attributes in process `syz.3.15294'. [ 2085.606632][T16867] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2085.746505][T16870] netlink: 'syz.2.15306': attribute type 10 has an invalid length. [ 2087.834897][T16934] netlink: 'syz.1.15328': attribute type 1 has an invalid length. [ 2087.906181][T16934] netlink: 'syz.1.15328': attribute type 3 has an invalid length. [ 2087.914073][T16934] netlink: 132 bytes leftover after parsing attributes in process `syz.1.15328'. [ 2088.100762][T16943] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 2088.135869][T16943] syzkaller1: linktype set to 769 [ 2088.149211][T16942] netlink: 'syz.3.15334': attribute type 3 has an invalid length. [ 2088.199874][T16941] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 2088.206915][T16941] syzkaller1: linktype set to 769 [ 2088.237257][T16942] netlink: 201372 bytes leftover after parsing attributes in process `syz.3.15334'. [ 2088.391188][T16949] netlink: 128 bytes leftover after parsing attributes in process `syz.2.15338'. [ 2088.414710][T16949] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2090.751234][T16991] netlink: 'syz.3.15353': attribute type 11 has an invalid length. [ 2090.759690][T16991] netlink: 140 bytes leftover after parsing attributes in process `syz.3.15353'. [ 2091.253829][T17011] netlink: 'syz.3.15361': attribute type 2 has an invalid length. [ 2091.292187][T17011] netlink: 'syz.3.15361': attribute type 8 has an invalid length. [ 2091.321425][T17011] netlink: 132 bytes leftover after parsing attributes in process `syz.3.15361'. [ 2091.368608][T17014] netlink: 132 bytes leftover after parsing attributes in process `syz.3.15361'. [ 2092.244736][T17027] netlink: 'syz.2.15367': attribute type 10 has an invalid length. [ 2092.517156][T17042] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2092.860076][T17047] netlink: 'syz.1.15373': attribute type 12 has an invalid length. [ 2092.887733][T17047] netlink: 132 bytes leftover after parsing attributes in process `syz.1.15373'. [ 2093.497171][T17060] netlink: 'syz.0.15378': attribute type 2 has an invalid length. [ 2093.505319][T17060] netlink: 'syz.0.15378': attribute type 8 has an invalid length. [ 2093.513359][T17060] netlink: 132 bytes leftover after parsing attributes in process `syz.0.15378'. [ 2093.582855][T17060] netlink: 132 bytes leftover after parsing attributes in process `syz.0.15378'. [ 2094.392468][T17093] netlink: 'syz.0.15392': attribute type 11 has an invalid length. [ 2094.406015][T17093] netlink: 140 bytes leftover after parsing attributes in process `syz.0.15392'. [ 2094.568292][T17094] netlink: 65047 bytes leftover after parsing attributes in process `syz.3.15391'. [ 2095.725223][T17124] netlink: 'syz.1.15404': attribute type 2 has an invalid length. [ 2095.739014][T17124] netlink: 'syz.1.15404': attribute type 8 has an invalid length. [ 2095.761559][T17124] netlink: 132 bytes leftover after parsing attributes in process `syz.1.15404'. [ 2095.811363][T17127] netlink: 132 bytes leftover after parsing attributes in process `syz.1.15404'. [ 2095.852724][T17137] netlink: 'syz.3.15410': attribute type 10 has an invalid length. [ 2096.047441][T17145] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2096.193946][T17147] netlink: 'syz.0.15415': attribute type 10 has an invalid length. [ 2096.381660][T17147] bond0: (slave veth1_to_bridge): Enslaving as an active interface with an up link [ 2096.396733][T17150] netlink: 'syz.0.15415': attribute type 10 has an invalid length. [ 2096.421234][ T8252] bridge0: port 2(bridge_slave_1) entered disabled state [ 2097.001252][T17184] netlink: 'syz.0.15426': attribute type 2 has an invalid length. [ 2097.029113][T17184] netlink: 132 bytes leftover after parsing attributes in process `syz.0.15426'. [ 2097.069169][T17184] netlink: 132 bytes leftover after parsing attributes in process `syz.0.15426'. [ 2097.342560][T17198] netlink: 15999 bytes leftover after parsing attributes in process `syz.0.15431'. [ 2098.791990][T17209] validate_nla: 2 callbacks suppressed [ 2098.792011][T17209] netlink: 'syz.1.15435': attribute type 46 has an invalid length. [ 2099.056387][T17220] netlink: 'syz.1.15438': attribute type 22 has an invalid length. [ 2099.064394][T17220] netlink: 4 bytes leftover after parsing attributes in process `syz.1.15438'. [ 2099.117298][T17222] netlink: 'syz.1.15438': attribute type 10 has an invalid length. [ 2099.142087][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 2099.148498][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 2099.192785][T17222] netlink: 40 bytes leftover after parsing attributes in process `syz.1.15438'. [ 2099.399454][T17222] netlink: 'syz.1.15438': attribute type 10 has an invalid length. [ 2099.408508][T17222] netlink: 40 bytes leftover after parsing attributes in process `syz.1.15438'. [ 2099.483547][T17233] netlink: 'syz.2.15442': attribute type 11 has an invalid length. [ 2099.512129][T17233] netlink: 140 bytes leftover after parsing attributes in process `syz.2.15442'. [ 2100.325433][T17254] netlink: 'syz.0.15453': attribute type 10 has an invalid length. [ 2100.509986][T17260] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2100.670330][T17265] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.15459'. [ 2101.862265][T17299] netlink: 65047 bytes leftover after parsing attributes in process `syz.0.15471'. [ 2102.066478][T17306] netlink: 'syz.2.15473': attribute type 3 has an invalid length. [ 2102.088378][T17306] netlink: 130984 bytes leftover after parsing attributes in process `syz.2.15473'. [ 2105.832095][T17346] netlink: 'syz.2.15487': attribute type 21 has an invalid length. [ 2105.854723][T17342] netlink: 193500 bytes leftover after parsing attributes in process `syz.2.15487'. [ 2106.336010][ T9867] Bluetooth: hci2: command 0x0406 tx timeout [ 2107.000607][T17364] netlink: 60 bytes leftover after parsing attributes in process `syz.2.15495'. [ 2107.025359][T17364] netlink: 60 bytes leftover after parsing attributes in process `syz.2.15495'. [ 2107.059921][T17364] netlink: 60 bytes leftover after parsing attributes in process `syz.2.15495'. [ 2107.074444][T17364] netlink: 60 bytes leftover after parsing attributes in process `syz.2.15495'. [ 2107.323844][T17381] netlink: 'syz.1.15501': attribute type 10 has an invalid length. [ 2108.686274][T17453] netlink: 'syz.0.15510': attribute type 21 has an invalid length. [ 2108.700308][T17441] netlink: 193500 bytes leftover after parsing attributes in process `syz.0.15510'. [ 2108.795801][T17456] netlink: 'syz.3.15511': attribute type 4 has an invalid length. [ 2108.803814][T17456] netlink: 199836 bytes leftover after parsing attributes in process `syz.3.15511'. [ 2109.110194][T17461] netlink: 209852 bytes leftover after parsing attributes in process `syz.1.15513'. [ 2109.128692][T17461] openvswitch: netlink: Tunnel attr 0 has unexpected len 145 expected 8 [ 2109.854718][T17488] netlink: 'syz.3.15524': attribute type 10 has an invalid length. [ 2110.175572][T17491] netlink: 193500 bytes leftover after parsing attributes in process `syz.3.15525'. [ 2110.552299][T17491] netlink: 'syz.3.15525': attribute type 21 has an invalid length. [ 2110.742578][T17504] netlink: 'syz.2.15529': attribute type 3 has an invalid length. [ 2110.794385][T17504] netlink: 130984 bytes leftover after parsing attributes in process `syz.2.15529'. [ 2110.867266][T17508] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2113.082220][T17556] __nla_validate_parse: 1 callbacks suppressed [ 2113.082238][T17556] netlink: 3076 bytes leftover after parsing attributes in process `syz.2.15546'. [ 2113.151491][T17556] netlink: 209844 bytes leftover after parsing attributes in process `syz.2.15546'. [ 2114.352902][T17568] netlink: 'syz.3.15552': attribute type 11 has an invalid length. [ 2114.362173][T17568] netlink: 140 bytes leftover after parsing attributes in process `syz.3.15552'. [ 2114.538610][T17575] netlink: 'syz.1.15555': attribute type 9 has an invalid length. [ 2114.565747][T17575] netlink: 126588 bytes leftover after parsing attributes in process `syz.1.15555'. [ 2114.600468][T17575] netlink: 'syz.1.15555': attribute type 1 has an invalid length. [ 2114.622455][T17575] netlink: 'syz.1.15555': attribute type 3 has an invalid length. [ 2114.640044][T17575] netlink: 132 bytes leftover after parsing attributes in process `syz.1.15555'. [ 2114.808547][T17590] netlink: 3076 bytes leftover after parsing attributes in process `syz.0.15557'. [ 2114.823302][T17590] netlink: 209844 bytes leftover after parsing attributes in process `syz.0.15557'. [ 2120.341331][T17635] netlink: 164 bytes leftover after parsing attributes in process `syz.2.15577'. [ 2120.411874][T17647] netlink: 60 bytes leftover after parsing attributes in process `syz.3.15583'. [ 2120.435337][T17647] netlink: 60 bytes leftover after parsing attributes in process `syz.3.15583'. [ 2120.458052][T17647] netlink: 60 bytes leftover after parsing attributes in process `syz.3.15583'. [ 2120.883828][T17669] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 2120.912667][T17669] syzkaller0: entered promiscuous mode [ 2120.922737][T17669] syzkaller0: entered allmulticast mode [ 2127.264706][T17778] netlink: 'syz.1.15637': attribute type 10 has an invalid length. [ 2127.295261][T17778] bridge0: port 2(bridge_slave_1) entered disabled state [ 2127.941650][T17812] netlink: 'syz.1.15652': attribute type 29 has an invalid length. [ 2127.965925][T17812] netlink: 28 bytes leftover after parsing attributes in process `syz.1.15652'. [ 2127.984661][T17812] netlink: 'syz.1.15652': attribute type 29 has an invalid length. [ 2128.002641][T17812] netlink: 28 bytes leftover after parsing attributes in process `syz.1.15652'. [ 2128.398972][T17835] netlink: 763 bytes leftover after parsing attributes in process `syz.3.15662'. [ 2131.942327][T17867] Bluetooth: hci3: command 0x0406 tx timeout [ 2132.384120][T17900] netlink: 'syz.2.15690': attribute type 29 has an invalid length. [ 2132.396759][T17900] netlink: 'syz.2.15690': attribute type 29 has an invalid length. [ 2132.423334][T17900] netlink: 'syz.2.15690': attribute type 29 has an invalid length. [ 2132.951342][T17932] netlink: 'syz.0.15706': attribute type 10 has an invalid length. [ 2132.972052][T17932] bridge0: port 1(bridge_slave_0) entered disabled state [ 2132.992893][T17932] bridge0: port 1(bridge_slave_0) entered blocking state [ 2133.000479][T17932] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2133.036936][T17932] team0: Port device bridge0 added [ 2133.209410][T17946] netlink: 'syz.3.15713': attribute type 39 has an invalid length. [ 2133.314688][T17949] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 2133.377208][T17949] syzkaller0: entered promiscuous mode [ 2133.390791][T17949] syzkaller0: entered allmulticast mode [ 2135.603056][T17975] netlink: 'syz.3.15724': attribute type 10 has an invalid length. [ 2135.837565][ T5787] Bluetooth: hci0: unexpected subevent 0x12 length: 150 > 5 [ 2136.350996][T18008] syzkaller0: create flow: hash 1524729690 index 1 [ 2136.403279][T17450] syzkaller0: tun_net_xmit 76 [ 2136.410312][T17450] syzkaller0: tun_net_xmit 48 [ 2136.426086][ T5817] syzkaller0: tun_net_xmit 76 [ 2136.547906][ C0] [ 2136.550304][ C0] ====================================================== [ 2136.557338][ C0] WARNING: possible circular locking dependency detected [ 2136.560548][T18010] netlink: 'syz.2.15740': attribute type 21 has an invalid length. [ 2136.564363][ C0] syzkaller #0 Not tainted [ 2136.564377][ C0] ------------------------------------------------------ [ 2136.564384][ C0] syz.3.15741/18012 is trying to acquire lock: [ 2136.564396][ C0] ffff8880668ba238 (&trie->lock){-.-.}-{2:2} [ 2136.582611][T18010] netlink: 'syz.2.15740': attribute type 6 has an invalid length. [ 2136.583722][ C0] , at: trie_delete_elem+0x94/0x630 [ 2136.583757][ C0] [ 2136.583757][ C0] but task is already holding lock: [ 2136.583764][ C0] ffff8880b8e37de8 ( [ 2136.590513][ T5817] syzkaller0: tun_net_xmit 76 [ 2136.595880][ C0] stock_lock){-.-.}-{2:2}, at: refill_obj_stock+0xef/0x6a0 [ 2136.595927][ C0] [ 2136.595927][ C0] which lock already depends on the new lock. [ 2136.595927][ C0] [ 2136.595933][ C0] [ 2136.595933][ C0] the existing dependency chain (in reverse order) is: [ 2136.595940][ C0] [ 2136.595940][ C0] -> #1 (stock_lock){-.-.}-{2:2}: [ 2136.595967][ C0] try_charge_memcg+0x237/0x17c0 [ 2136.615823][T18010] netlink: 132 bytes leftover after parsing attributes in process `syz.2.15740'. [ 2136.616418][ C0] __memcg_kmem_charge_page+0x224/0x380 [ 2136.679519][ C0] __alloc_pages+0x222/0x460 [ 2136.684655][ C0] __kmalloc_large_node+0x8c/0x1f0 [ 2136.690333][ C0] __kmalloc_node+0x112/0x240 [ 2136.695566][ C0] bpf_map_kmalloc_node+0xbc/0x1b0 [ 2136.701244][ C0] trie_update_elem+0x172/0xd60 [ 2136.706658][ C0] bpf_map_update_value+0x64b/0x710 [ 2136.712406][ C0] map_update_elem+0x586/0x710 [ 2136.717715][ C0] __sys_bpf+0x6b5/0x890 [ 2136.722520][ C0] __x64_sys_bpf+0x7c/0x90 [ 2136.727493][ C0] do_syscall_64+0x55/0xb0 [ 2136.732455][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2136.738898][ C0] [ 2136.738898][ C0] -> #0 (&trie->lock){-.-.}-{2:2}: [ 2136.746236][ C0] __lock_acquire+0x37ef/0x7d80 [ 2136.751728][ C0] lock_acquire+0x19e/0x420 [ 2136.756790][ C0] _raw_spin_lock_irqsave+0xb4/0x100 [ 2136.762637][ C0] trie_delete_elem+0x94/0x630 [ 2136.768006][ C0] bpf_prog_2c29ac5cdc6b1842+0x42/0x46 [ 2136.774016][ C0] trace_call_bpf+0x333/0x6c0 [ 2136.779237][ C0] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 2136.785341][ C0] perf_trace_lock_acquire+0x342/0x400 [ 2136.791365][ C0] lock_acquire+0x3ef/0x420 [ 2136.796419][ C0] mod_objcg_mlstate+0xad/0x320 [ 2136.801807][ C0] drain_obj_stock+0x154/0x3a0 [ 2136.807109][ C0] refill_obj_stock+0x1fc/0x6a0 [ 2136.812492][ C0] memcg_slab_free_hook+0x123/0x200 [ 2136.818216][ C0] __kmem_cache_free+0xa3/0x1f0 [ 2136.823597][ C0] security_cred_free+0xc0/0xf0 [ 2136.828971][ C0] put_cred_rcu+0x68/0x2a0 [ 2136.833907][ C0] rcu_core+0x9c1/0x17f0 [ 2136.838670][ C0] handle_softirqs+0x27d/0x820 [ 2136.843955][ C0] __irq_exit_rcu+0xd3/0x190 [ 2136.849065][ C0] irq_exit_rcu+0x9/0x20 [ 2136.853821][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 2136.859975][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2136.866480][ C0] _raw_spin_unlock_irqrestore+0xc0/0x120 [ 2136.872753][ C0] find_get_context+0x53e/0x660 [ 2136.878131][ C0] __se_sys_perf_event_open+0xaa7/0x1c60 [ 2136.884284][ C0] do_syscall_64+0x55/0xb0 [ 2136.889223][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2136.895639][ C0] [ 2136.895639][ C0] other info that might help us debug this: [ 2136.895639][ C0] [ 2136.905878][ C0] Possible unsafe locking scenario: [ 2136.905878][ C0] [ 2136.913323][ C0] CPU0 CPU1 [ 2136.918687][ C0] ---- ---- [ 2136.924045][ C0] lock(stock_lock); [ 2136.928026][ C0] lock(&trie->lock); [ 2136.934634][ C0] lock(stock_lock); [ 2136.941137][ C0] lock(&trie->lock); [ 2136.945201][ C0] [ 2136.945201][ C0] *** DEADLOCK *** [ 2136.945201][ C0] [ 2136.953335][ C0] 4 locks held by syz.3.15741/18012: [ 2136.958610][ C0] #0: ffff88802833d6e0 (&sig->exec_update_lock){++++}-{3:3}, at: __se_sys_perf_event_open+0x96c/0x1c60 [ 2136.969765][ C0] #1: ffffffff8d131ec0 (rcu_callback){....}-{0:0}, at: rcu_core+0x951/0x17f0 [ 2136.978648][ C0] #2: ffff8880b8e37de8 (stock_lock){-.-.}-{2:2}, at: refill_obj_stock+0xef/0x6a0 [ 2136.987879][ C0] #3: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: trace_call_bpf+0xc3/0x6c0 [ 2136.997193][ C0] [ 2136.997193][ C0] stack backtrace: [ 2137.003078][ C0] CPU: 0 PID: 18012 Comm: syz.3.15741 Not tainted syzkaller #0 [ 2137.010622][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2137.020686][ C0] Call Trace: [ 2137.023960][ C0] [ 2137.026803][ C0] dump_stack_lvl+0x18c/0x250 [ 2137.031484][ C0] ? load_image+0x420/0x420 [ 2137.035995][ C0] ? show_regs_print_info+0x20/0x20 [ 2137.041195][ C0] ? print_circular_bug+0x12b/0x1a0 [ 2137.046396][ C0] check_noncircular+0x2fc/0x400 [ 2137.051338][ C0] ? print_deadlock_bug+0x5d0/0x5d0 [ 2137.056535][ C0] ? lockdep_lock+0xf5/0x230 [ 2137.061133][ C0] ? _find_first_zero_bit+0xd6/0x100 [ 2137.066430][ C0] __lock_acquire+0x37ef/0x7d80 [ 2137.071297][ C0] ? perf_trace_buf_alloc+0x131/0x290 [ 2137.076672][ C0] ? verify_lock_unused+0x140/0x140 [ 2137.081873][ C0] ? perf_trace_lock_acquire+0x1a7/0x400 [ 2137.087504][ C0] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2137.094097][ C0] lock_acquire+0x19e/0x420 [ 2137.098601][ C0] ? trie_delete_elem+0x94/0x630 [ 2137.103575][ C0] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2137.110162][ C0] ? read_lock_is_recursive+0x20/0x20 [ 2137.115538][ C0] ? __pv_queued_spin_lock_slowpath+0x7f3/0x9c0 [ 2137.121877][ C0] _raw_spin_lock_irqsave+0xb4/0x100 [ 2137.127167][ C0] ? trie_delete_elem+0x94/0x630 [ 2137.132131][ C0] ? _raw_spin_lock+0x40/0x40 [ 2137.136840][ C0] trie_delete_elem+0x94/0x630 [ 2137.141623][ C0] bpf_prog_2c29ac5cdc6b1842+0x42/0x46 [ 2137.147083][ C0] trace_call_bpf+0x333/0x6c0 [ 2137.151756][ C0] ? trace_call_bpf+0xc3/0x6c0 [ 2137.156516][ C0] ? __bpf_trace_bpf_trace_printk+0x100/0x100 [ 2137.162581][ C0] perf_trace_run_bpf_submit+0x7a/0x1c0 [ 2137.168129][ C0] perf_trace_lock_acquire+0x342/0x400 [ 2137.173703][ C0] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2137.180290][ C0] ? perf_trace_run_bpf_submit+0x125/0x1c0 [ 2137.186095][ C0] lock_acquire+0x3ef/0x420 [ 2137.190596][ C0] ? mod_objcg_mlstate+0x8c/0x320 [ 2137.195628][ C0] ? trace_event_raw_event_lock_acquire+0x290/0x290 [ 2137.202223][ C0] ? read_lock_is_recursive+0x20/0x20 [ 2137.207590][ C0] ? mark_lock+0x94/0x320 [ 2137.211916][ C0] ? __lock_acquire+0x1262/0x7d80 [ 2137.216938][ C0] mod_objcg_mlstate+0xad/0x320 [ 2137.221786][ C0] ? mod_objcg_mlstate+0x8c/0x320 [ 2137.226851][ C0] ? mod_objcg_mlstate+0x8c/0x320 [ 2137.231868][ C0] ? drain_obj_stock+0x3a0/0x3a0 [ 2137.236805][ C0] ? read_lock_is_recursive+0x20/0x20 [ 2137.242177][ C0] drain_obj_stock+0x154/0x3a0 [ 2137.246940][ C0] refill_obj_stock+0x1fc/0x6a0 [ 2137.251792][ C0] ? refill_obj_stock+0xef/0x6a0 [ 2137.256723][ C0] ? obj_cgroup_charge+0x630/0x630 [ 2137.261828][ C0] ? mark_lock+0x94/0x320 [ 2137.266163][ C0] memcg_slab_free_hook+0x123/0x200 [ 2137.271360][ C0] ? security_cred_free+0xc0/0xf0 [ 2137.276387][ C0] __kmem_cache_free+0xa3/0x1f0 [ 2137.281242][ C0] security_cred_free+0xc0/0xf0 [ 2137.286126][ C0] put_cred_rcu+0x68/0x2a0 [ 2137.290545][ C0] ? __put_cred+0x130/0x130 [ 2137.295045][ C0] ? rcu_core+0x951/0x17f0 [ 2137.299459][ C0] rcu_core+0x9c1/0x17f0 [ 2137.303703][ C0] ? rcu_cpu_kthread_park+0x90/0x90 [ 2137.309014][ C0] ? __lock_acquire+0x7d80/0x7d80 [ 2137.314039][ C0] ? rebalance_domains+0x880/0x9d0 [ 2137.319165][ C0] handle_softirqs+0x27d/0x820 [ 2137.323947][ C0] ? read_tsc+0x9/0x20 [ 2137.328060][ C0] ? ktime_get+0x24b/0x280 [ 2137.332485][ C0] ? __irq_exit_rcu+0xd3/0x190 [ 2137.337250][ C0] ? do_softirq+0x1a0/0x1a0 [ 2137.341755][ C0] ? irqtime_account_irq+0xb6/0x1c0 [ 2137.346998][ C0] __irq_exit_rcu+0xd3/0x190 [ 2137.351591][ C0] ? irq_exit_rcu+0x20/0x20 [ 2137.356095][ C0] irq_exit_rcu+0x9/0x20 [ 2137.360328][ C0] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 2137.365962][ C0] [ 2137.368886][ C0] [ 2137.371812][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 2137.377802][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 [ 2137.384311][ C0] Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 fb 4e c6 f6 65 8b 05 5c 1d 6d 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 2137.403915][ C0] RSP: 0018:ffffc90004407c40 EFLAGS: 00000206 [ 2137.409981][ C0] RAX: dffffc0000000004 RBX: 0000000000000a02 RCX: 1a2afb2967f32200 [ 2137.417968][ C0] RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 [ 2137.425948][ C0] RBP: ffffc90004407cd8 R08: ffffffff911eb5a7 R09: 1ffffffff223d6b4 [ 2137.433921][ C0] R10: dffffc0000000000 R11: fffffbfff223d6b5 R12: dffffc0000000000 [ 2137.441896][ C0] R13: 1ffff110051c1785 R14: ffff8880780e0000 R15: 1ffff92000880f88 [ 2137.449877][ C0] ? _raw_spin_unlock+0x40/0x40 [ 2137.454740][ C0] find_get_context+0x53e/0x660 [ 2137.459598][ C0] __se_sys_perf_event_open+0xaa7/0x1c60 [ 2137.465255][ C0] ? __ia32_sys_get_robust_list+0x110/0x110 [ 2137.471152][ C0] ? __x64_sys_perf_event_open+0xc0/0xc0 [ 2137.476792][ C0] ? lock_chain_count+0x20/0x20 [ 2137.481640][ C0] ? lockdep_hardirqs_on+0x98/0x150 [ 2137.486837][ C0] ? __x64_sys_perf_event_open+0x20/0xc0 [ 2137.492466][ C0] do_syscall_64+0x55/0xb0 [ 2137.496884][ C0] ? clear_bhb_loop+0x40/0x90 [ 2137.501561][ C0] ? clear_bhb_loop+0x40/0x90 [ 2137.506236][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 2137.512123][ C0] RIP: 0033:0x7fe9bab9e0d9 [ 2137.516537][ C0] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 2137.536152][ C0] RSP: 002b:00007fe9bbae7028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a [ 2137.544560][ C0] RAX: ffffffffffffffda RBX: 00007fe9bae25fa0 RCX: 00007fe9bab9e0d9 [ 2137.552527][ C0] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000200000000040 [ 2137.560490][ C0] RBP: 00007fe9bac35024 R08: 0000000000000000 R09: 0000000000000000 [ 2137.568458][ C0] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 2137.576428][ C0] R13: 00007fe9bae26038 R14: 00007fe9bae25fa0 R15: 00007ffcbed89248 [ 2137.584402][ C0] [ 2137.653582][T18004] syzkaller0: delete flow: hash 1524729690 index 1