last executing test programs: 3.139499689s ago: executing program 4 (id=4499): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0xfffffffffffffe01, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_TARGET_NAME={0x10, 0x1, 'CONNSECMARK\x00'}, @NFTA_TARGET_INFO={0x5, 0x3, "ef"}, @NFTA_TARGET_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x6006}]}]}], {0x14}}, 0xa0}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaa95000a11000086dd604df34200280600fc010000000000000000000000000002fe8000000000000000000000000000aa00004001", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="a0060400907801000013126d84a220129fd6262928f6b6d90a9a2bc9be"], 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a6c000000060a0104000000000000000002000000400004803c0001800c0001007061796c6f6164003a000280080004400000000008000540000000000800034000000061080002400000100208000640000000020900010073797a30000000000900020073797a3200000000140000001100010000000000000000000300000a4752ac7a9bbe3de80a4aad0cab59cd8887a819e164e04ad4aada987a3323d538e67b6aaa63e2dfcd88eb34cdbf3e68fbfb67ce527a3740d6f61f9079ca93c0d62040c1dd0caff4038b90616dcc0997c78a186949b5e62c676303ae484f65dae689b64d36800914ccf759f35d41c76a8794857ae807c065bd"], 0x94}}, 0x4) 2.880927876s ago: executing program 3 (id=4503): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x34, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x8}, {0x4}}]}, 0x34}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080), r0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000140)={'sit0\x00', &(0x7f00000000c0)={'gretap0\x00', r1, 0x7800, 0x7, 0xe0a, 0x1, {{0x10, 0x4, 0x3, 0x14, 0x40, 0x65, 0x0, 0x6, 0x2f, 0x0, @multicast1, @dev={0xac, 0x14, 0x14, 0x29}, {[@rr={0x7, 0x7, 0xe5, [@dev={0xac, 0x14, 0x14, 0x2b}]}, @timestamp_addr={0x44, 0x24, 0x4, 0x1, 0x0, [{@remote, 0x4}, {@loopback, 0xa}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6}, {@rand_addr=0x64010102, 0x6}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000200)={'syztnl0\x00', &(0x7f0000000180)={'ip6gre0\x00', r1, 0x0, 0xe, 0x80, 0x5, 0x2, @mcast2, @private0={0xfc, 0x0, '\x00', 0x1}, 0x7, 0x8, 0xe, 0x80000001}}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000005c0)={0xffffffffffffffff, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000240)=[0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, &(0x7f0000000300)=[0x0], &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x20, &(0x7f0000000380)=[{}, {}, {}], 0x18, 0x10, &(0x7f00000003c0), &(0x7f0000000400), 0x8, 0x80, 0x8, 0x8, &(0x7f0000000480)}}, 0x10) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r7, &(0x7f00000000c0)={&(0x7f0000000140)=@xdp={0x2c, 0xdd86, r8, 0x15}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000200)="f3a7b9b72c617e5eb41027a91e9d", 0xe}], 0x1}, 0x44) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=@newtfilter={0x5c, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0xb, 0xfff3}, {}, {0x8, 0x300}}, [@filter_kind_options=@f_flower={{0xb}, {0x2c, 0x2, [@TCA_FLOWER_INDEV={0x14, 0x2, 'vxcan1\x00'}, @TCA_FLOWER_KEY_CT_MARK_MASK={0x8, 0x60, 0x8001}, @TCA_FLOWER_KEY_ETH_DST={0xa, 0x4, @random="27b0eb124d28"}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000001140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001100)={&(0x7f0000000600)={0xae8, r2, 0x4, 0x70bd28, 0x25dfdbff, {}, [{{0x8, 0x1, r1}, {0x16c, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r3}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0x100}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r4}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xc}}}]}}, {{0x8, 0x1, r1}, {0x1a0, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0xc, 0x4, [{0x2d8, 0x7, 0x0, 0x9}]}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r1}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x3c5}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}]}}, {{0x8, 0x1, r1}, {0x4}}, {{0x8}, {0x16c, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r1}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r1}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xfffffffb}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r1}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r1}}}]}}, {{0x8, 0x1, r1}, {0xe8, 0x2, 0x0, 0x1, [{0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xe84e}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x40}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xb}}}]}}, {{0x8}, {0x15c, 0x2, 0x0, 0x1, [{0x5c, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x2c, 0x4, [{0xc, 0x60, 0x3, 0x5}, {0x9, 0x2, 0xb, 0x7ff}, {0x206b, 0x3, 0xff, 0x6}, {0xe40, 0x3, 0x6f, 0x6}, {0x4, 0xfc, 0x0, 0x7}]}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x81}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r5}}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @name={{0x24}, {0x5}, {0xf, 0x4, 'roundrobin\x00'}}}]}}, {{0x8, 0x1, r1}, {0x214, 0x2, 0x0, 0x1, [{0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}]}}, {{0x8, 0x1, r1}, {0x7c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x101000}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x40}}, {0x8, 0x6, r1}}}]}}, {{0x8, 0x1, r1}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8}}}]}}, {{0x8, 0x1, r8}, {0xf8, 0x2, 0x0, 0x1, [{0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8}}, {0x8, 0x6, r1}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8000}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r1}}}, {0x40, 0x1, @queue_id={{{0x24}, {0x5}, {0x8, 0x4, 0xe773}}, {0x8, 0x6, r10}}}]}}]}, 0xae8}, 0x1, 0x0, 0x0, 0x8000}, 0x40) r11 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r11, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.691803525s ago: executing program 2 (id=4504): syz_emit_ethernet(0x76, &(0x7f00000010c0)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb0800450014aa05009078e0000002430000000000000000110000ac141400ac1414aa440c0001000000004e210000442c0001e0000001000000000000000000000000ac141400000000000000000000000000ffffffff00"/118], 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000003f00000000c6253e03000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) pipe(&(0x7f0000000280)={0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r1, 0x0, r2, 0x0, 0x25a5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000780)=ANY=[@ANYBLOB="040100001a5703000000000000000089fc0000000000b5000000000000000000200100000000000000000000000000000000008366758313a12fb4fe0100"/74, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000aa000000002b000000ff020000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000200000000000000000014000e00"/188], 0x104}}, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="780000000001050500000000000000000a0000003c0002802c00018014000300ff01000000000000000000000000000114000400ff0200000000000000000000000000010c00028005000169437b25bc8ae6dc800c0002800500010000000000060003400300000006000340000200000800074000000001"], 0x78}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="8c0000000001050500000000000000000a000005400002802c00018014000300ff01000000000000000000000000000114000400ff02000000000000000000000000000106000340000100000600034000000000240001800c00028005000100000000001400018008000100ac1414aa080001f3e000000108000740000000000400068008000840000001ff"], 0x8c}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f00000000c0)) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket$unix(0x1, 0x1, 0x0) socket$kcm(0x11, 0x3, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) r10 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r11 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x80) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3800000054000147880000000000000007008209", @ANYRES32, @ANYBLOB="20000100", @ANYRES32], 0x38}}, 0x0) sendmmsg(r11, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.690880148s ago: executing program 4 (id=4505): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$alg(0x26, 0x5, 0x0) (async) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$devlink(&(0x7f0000000680), r2) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000680), r2) sendmmsg$alg(r2, &(0x7f0000007dc0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001fc0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x40000}], 0x1, 0x24000000) (async) sendmmsg$alg(r2, &(0x7f0000007dc0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000001fc0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x40000}], 0x1, 0x24000000) sendmsg$AUDIT_TRIM(r2, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000005c0)={0x10, 0x3f6, 0x800, 0x70bd26, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x800}, 0x90) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x40, 0x10, 0x40d, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_OFLAGS={0x6}]}}}]}, 0x40}}, 0x0) 2.490425467s ago: executing program 0 (id=4508): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x24048450) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="14000000100001000000000000000000050000fc7f000000060a0104d600010073797a31001c00005400c642699caa6137dfbe18abc59547ce6e0001800c0001007061799e1246cdc68053bd09c5a2596c6f616400240002800800014000000009080003400000003708000240000000001c0001800a0001007265646972000000250c000280080001400000000a090002007379000000000000000000000000000000f34a2893fce77a19dad445e90b21e1d3768baa22c14f1209977d4abc15310cb71db2bf3e1dbf58021fa86ca72a8cf0dae094abea74c8c630d2e46a1f73aeec07b631291eff65b2dbeb9c04503e260d473700"/255], 0xa8}, 0x1, 0x0, 0x0, 0x1014}, 0x24000840) (async) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000300)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16, @ANYBLOB="01002cbd700000100000010000000c00020002", @ANYRES8=r0, @ANYRESOCT=r0, @ANYRESOCT=r0, @ANYRES64=r0], 0x54}}, 0x4) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r1) sendmsg$IEEE802154_LIST_IFACE(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="07012cbd7000fedbdf251f00000008"], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x20004800) (async) socket$inet(0x2, 0x2, 0x1) (async) r3 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADDDEF(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={&(0x7f0000000180)={0x50, r3, 0x10, 0x70bd2d, 0x25dfdbfd, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast2}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_FAMILY={0x6, 0xb, 0x11}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @empty}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0x10}, 0x0) pipe(&(0x7f00000002c0)={0xffffffffffffffff}) bind$inet(r4, &(0x7f0000000000)={0x2, 0x6e24, @loopback}, 0x10) (async) r5 = socket$inet(0x2, 0x2, 0x1) setsockopt$sock_int(r5, 0x1, 0x2, &(0x7f0000000080), 0x4) (async) bind$inet(r5, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) (async) socket$nl_netfilter(0x10, 0x3, 0xc) 2.392329131s ago: executing program 4 (id=4509): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000100), r0) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r5 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000200)={'vxcan0\x00', 0x0}) bind$can_j1939(r5, &(0x7f00000001c0)={0x1d, r6, 0x2, {0x0, 0x1, 0x1}, 0xff}, 0x18) setsockopt$ALG_SET_AEAD_AUTHSIZE(r5, 0x6a, 0x5, 0x20000000, 0x8) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r7, 0x8933, &(0x7f0000000240)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_SEC_PARAMS(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)={0x34, r4, 0x1, 0x70bd2c, 0x25dfdbfb, {}, [@NL802154_ATTR_SEC_OUT_KEY_ID={0x18, 0x2b, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8}, @NL802154_KEY_ID_ATTR_IMPLICIT={0xc, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0x1}]}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}]}, 0x34}, 0x1, 0x0, 0x0, 0x8001}, 0x20048010) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000140)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_GET_INTERFACE(r0, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x48, r3, 0x100, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r9}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x3}]}, 0x48}, 0x1, 0x0, 0x0, 0x841}, 0x8c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='|\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100ffffffff0000000001000000100007800c00018008000100", @ANYRES32=r10, @ANYBLOB="0c0005006c010000000000000c000200ff7f000000000000400007800c00018008000100", @ANYRES32=r10, @ANYBLOB="0c00018008000100", @ANYRES32=r1], 0x7c}}, 0x20000000) 2.187111056s ago: executing program 0 (id=4512): sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfe2a}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[], 0x5c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xa, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 2.07681068s ago: executing program 3 (id=4513): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0xffff}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x30, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x8}, @NFTA_NG_DREG={0x8}, @NFTA_NG_MODULUS={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xcc}}, 0x0) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="0000000e8019e70d3e8200", @ANYRES16=r2, @ANYBLOB="01002dbd7000fcdbdf25450000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008008e0000000000"], 0x3c}}, 0x800) 1.953355399s ago: executing program 0 (id=4515): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x44004000) (async) bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) (async) syz_80211_join_ibss(&(0x7f0000000000)='wlan0\x00', &(0x7f0000000040)=@default_ibss_ssid, 0x6, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="2c0000001300010000b2691fb504d51d67000000", @ANYRES32=r2, @ANYBLOB="0000000004e000000c001a800800048004000a80"], 0x2c}, 0x1, 0x0, 0x0, 0x20040090}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000011000000000000000000000018120000", @ANYBLOB="7ef843bcb9d3d28f11cb324703e9a3075e994082a30ffd61de5fae1604c6419466fcecdb9d25ae12a1bccfa6331dd07bead7093328fc61649480a3f00a481f9607c5bc5be965af3182451d567e11aee726905dfec9a85431acb9da568dd20b266106cc62577fb2142a2b433e982eeb4db968ce21d83579b4e6fdab1a5618396f219bfe80b9082b7d0077195d181732c847c5f21a20c66ea02ae3d3edf3786ca5b8cc7946ea9163408a67356976e4a5865776609396a7dc180e84c82d1f66ea91869db703b617250fc1c7999fb70bf001df6862f50a7c631c95700121a23771951e501b40aea698adf17500", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa20000000000000702"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r2, @fallback=0x14, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1802000007000000000000060000000000000000750000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000180)=r4, 0x4) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a2800000013"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) 1.612663057s ago: executing program 1 (id=4516): sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfe2a}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[], 0x5c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xa, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) (fail_nth: 2) 1.589794507s ago: executing program 2 (id=4517): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000740)=0x801, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003940)={0x14, 0x2d, 0x107, 0xfffffffe, 0x25dfdbff, {0x3, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x4c855}, 0xc000) 1.542422424s ago: executing program 1 (id=4518): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0x2, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x7}, 0x1c) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="440000001000010400000000e1ffffffffffffff", @ANYRES32=0x0, @ANYBLOB="00000000000000002400128009000100626f6e64000000001400028005000e000000000005000d0010"], 0x44}}, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r2, &(0x7f0000000000)={0x1f, @fixed}, 0x8) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f00000012c0), 0x4) (async) setsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f00000012c0), 0x4) ioctl$BTRFS_IOC_FS_INFO(r2, 0x8400941f, &(0x7f0000001100)) (async) ioctl$BTRFS_IOC_FS_INFO(r2, 0x8400941f, &(0x7f0000001100)) getsockname$netlink(r1, &(0x7f0000000040), &(0x7f00000010c0)=0xc) socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000080)=@newtaction={0x1038, 0x30, 0x1, 0x0, 0x0, {}, [{0x1024, 0x1, [@m_bpf={0x1020, 0x1, 0x0, 0x0, {{0x8}, {0xff8, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_NAME={0xff4, 0x6, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x1038}}, 0x0) 1.21721986s ago: executing program 4 (id=4519): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x50, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x10}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x81}]}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}, @NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x4}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xcc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="740000001000210400000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="adffa8886004000024001280090001007866726d000000001400028008000100010000000800020011000000050021000000000008000a00", @ANYRES32, @ANYBLOB='\n\x00:'], 0x74}}, 0x0) 1.1987617s ago: executing program 3 (id=4520): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x12, 0x8, 0x4, 0xff, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000000)={r0, &(0x7f00000004c0)}, 0x20) (async, rerun: 32) r1 = socket$netlink(0x10, 0x3, 0x0) (rerun: 32) getsockopt(r1, 0xfffffffd, 0xd, &(0x7f0000000040)=""/182, &(0x7f0000000100)=0xb6) (async, rerun: 64) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x49f59122d9e6603d, &(0x7f0000000140)={@local, @broadcast, 0x0}, &(0x7f0000000180)=0xc) (async, rerun: 64) r3 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000240)={&(0x7f00000001c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x3, [@int={0x0, 0x0, 0x0, 0x1, 0x0, 0x7d, 0x0, 0x51, 0x1}]}, {0x0, [0x5f]}}, &(0x7f0000000200)=""/28, 0x2b, 0x1c, 0x1, 0x9, 0x10000}, 0x28) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000300)={0x1b, 0x0, 0x0, 0x101, 0x0, 0x1, 0x6, '\x00', r2, r3, 0x4, 0x1, 0x5}, 0x50) (async) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001140)=ANY=[@ANYBLOB="140000", @ANYRES16, @ANYBLOB="a90d0100000000000000ef11f3c90ed7000005000000bdb26ec500001247c807662b5203fd5b7eae7a0b9e47a35e1b0cb39d6dcf134f21139356778f"], 0x14}}, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r4, &(0x7f0000000140)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r5, 0x84, 0x20, 0x0, &(0x7f0000001040)) (async) sendmsg$NFT_BATCH(r1, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000700)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x4) 1.169944648s ago: executing program 3 (id=4521): r0 = accept4$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000040)=0x14, 0x800) ioctl$sock_ifreq(r0, 0x8992, &(0x7f0000000080)={'veth0_to_bond\x00', @ifru_addrs=@qipcrtr={0x2a, 0xffffffffffffffff, 0x2}}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c0000000206010200000000000000000000000005000100070000000900020073797a30000000000c0007800500150001000000050004000000ecff14000300686173683a69702c706f72742c6e657400000000050005000a000000"], 0x5c}, 0x1, 0x0, 0x0, 0xc040}, 0x0) 1.001269671s ago: executing program 0 (id=4522): r0 = socket(0x2, 0x2, 0x1) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x22}}}, 0x1, 0x1000}, &(0x7f0000000140)=0x90) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r2, 0x400448e4, &(0x7f0000000000)) setsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000180)={r1, 0x4d90, 0x4, 0x1}, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x3, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9}}, &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', r3}, 0x94) 945.649228ms ago: executing program 3 (id=4523): syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @dev, @void, {@ipv4={0x800, @tcp={{0xa, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa210106, @local, {[@ssrr={0x89, 0xf, 0xe9, [@multicast2, @remote, @multicast2]}, @generic={0x7, 0x2}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x20, 0x8000}}}}}}, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0xfffffffc}, 0x9) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001240)={0x24, 0x12, 0xa01, 0x0, 0x0, {0x80, 0x2}, [@generic="299a50bdc19377268b5707eafb"]}, 0x24}, 0x1, 0x0, 0x0, 0x81}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x3, 0x4, &(0x7f0000000680)=ANY=[@ANYBLOB="b7050000000000006110480000000000dc0500002000000095000000000000009abb1723bf24203831c9545b21c751ee4024f479cbe4b89f9805837203000000000000c2d182c7a3221481f5009edaf5f5ac058299e10e790a198f42a715b99fb3d2a73dd025848710155ad1efd7d991408000000000000085a0db0401fa29e075b7ab0408a0d8cfceeb23465bb027ee1151c02af21d8f9aa57e673a6724441d08087aff070eda8afef22b3a806c8226f5a2886c93bd29b37252ba4a6e9cc5f69e75680c431aa855e487ae513abd6c4ee973fce29a26018ed5e0780f8778a602a3533a3dac7da4fe491edf3abfa7bf871c58848ac46ada6776bd9b85df01e626026a59ddfa7a9c879acbfb0bf426785dec7d8611dc850df49ed8633bdb83dd505fb20649f53841a0e200c91f5bf1bb246ed87efc7b6f8859d029c8376ca19265e281fea0a6fd2222f8850c8445758503ede0ce1b3f73ecd8989e8c53c5e679b13802bddf80f3b1d07d6d68bfa12ab34697d40ac1150a842f8bb381344b994c19642a10eb30845a993daaa8bd4aebc595475feb3475d8e802498382e73edb98fcf2df96ab3c870490c4030b34c27a2f7fcd66ddde687c1255d0779ffec72ada8598e222d66bc90dacf240fe12755f780048804400f49d77b81534a8f1b0de80c49c7d9c87888801d819daaddb0c57513fdf7d0e942a799143dccc213cac7e8092d691a7894678472ba1970b4d6e393158dafeebae0a9d89e6e639115ddc7b54139b5b47f3d583c16b4d2da0a5c7b5ea751d03cc71fdd61140d66ff1ccfcbe83e40156854900"], &(0x7f00000002c0)='syzkaller\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x48) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r1, 0x0) r2 = accept4(r1, 0x0, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000600)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(camellia-generic)\x00'}, 0x58) close(0x3) setsockopt$sock_timeval(r2, 0x1, 0x14, &(0x7f0000000600)={0x0, 0xea60}, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000000)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xc}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd708", 0x18, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x1, {[@window={0x3, 0x3, 0x96}]}}}}}}}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_CONNECT(r7, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000880)={0x2c, r4, 0x1, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}]]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000014}, 0x20000000) recvmsg$kcm(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/150, 0x96}], 0x5}, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000001c0)={'erspan0\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x7, 0x8000, 0x1, 0x216c, {{0x2c, 0x4, 0x2, 0x3c, 0xb0, 0x68, 0x0, 0x80, 0x29, 0x0, @broadcast, @multicast1, {[@cipso={0x86, 0x34, 0x2, [{0x7, 0xf, "eb6fa9ab5838bc764fdd56ad7a"}, {0x7, 0xf, "a231e85e21603ed7448ab6a40b"}, {0x2, 0x10, "ebc3830b5f36b5d500d0241907fe"}]}, @lsrr={0x83, 0x13, 0x51, [@local, @local, @private=0xa010101, @remote]}, @rr={0x7, 0x1f, 0x6f, [@rand_addr=0x64010100, @remote, @rand_addr=0x64010100, @initdev={0xac, 0x1e, 0x1, 0x0}, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1]}, @rr={0x7, 0x17, 0x11, [@loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast, @local, @rand_addr=0x64010100]}, @timestamp_addr={0x44, 0x1c, 0xec, 0x1, 0xe, [{@private=0xa010101, 0x5}, {@rand_addr=0x64010102, 0xb}, {@dev={0xac, 0x14, 0x14, 0xa}, 0x4d}]}]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000480)={'ip6gre0\x00', &(0x7f0000000400)={'syztnl2\x00', r8, 0x2f, 0xd, 0x6, 0x0, 0x2, @loopback, @private1, 0x7958, 0x1, 0x1}}) 945.085439ms ago: executing program 2 (id=4524): ioctl$F2FS_IOC_WRITE_CHECKPOINT(0xffffffffffffffff, 0xf507, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r0, 0x5201) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)="1abc282cc948fb58109b3013bdf7c357dc483fe4175569d5d8c7fa44ed01007e81fb43df0c0a19820d1fdd51", 0x2c}], 0x1) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000040)={{r0}, 0xc8b, 0x4c, 0x80000001}) ioctl$F2FS_IOC_WRITE_CHECKPOINT(0xffffffffffffffff, 0xf507, 0x0) (async) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) (async) ioctl$RFKILL_IOCTL_NOINPUT(r0, 0x5201) (async) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000000)="1abc282cc948fb58109b3013bdf7c357dc483fe4175569d5d8c7fa44ed01007e81fb43df0c0a19820d1fdd51", 0x2c}], 0x1) (async) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000040)={{r0}, 0xc8b, 0x4c, 0x80000001}) (async) 916.62973ms ago: executing program 1 (id=4525): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01080000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d65746100000000140002800800014000000012080002400000002214000000110001"], 0xd8}, 0x1, 0x0, 0x0, 0x2004c011}, 0x90) socket$can_raw(0x1d, 0x3, 0x1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NBD_CMD_RECONFIGURE(r1, &(0x7f0000000100)={&(0x7f0000000000), 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x20, 0x0, 0x2, 0x70bd28, 0x25dfdbff, {}, [@NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}]}, 0x20}, 0x1, 0x0, 0x0, 0x4001041}, 0x80) 829.966778ms ago: executing program 2 (id=4526): sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfe2a}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[], 0x5c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000080)={0x6, 0xa, 0x4, 0x1, 0x6, 0x0, 0x0, 0x8, 0x80, 0x8, 0x0, 0x0, 0x0, 0x4}, 0xe) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000340)=[@in={0x2, 0xfffe, @local}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000002c0)={r1, 0xa3, 0x4991, 0x7}, &(0x7f0000000300)=0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xa, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) 744.579771ms ago: executing program 4 (id=4527): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@ipv6_newaddr={0x2c, 0x14, 0x121, 0x0, 0x0, {0x23, 0x3f, 0x0, 0xfd}, [@IFA_LOCAL={0x14, 0x2, @rand_addr=' \x01\x00'}]}, 0x2c}}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x3a) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x40004}, 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)={0xc4, 0x27, 0x9, 0x70bd25, 0x25dfdbfd, {0x12}, [@typed={0xb0, 0x1, 0x0, 0x0, @binary="e470c475ff61c878688eb63b9cb55c294ae58f01cf1314e07c94dadda792f18ce708d650dc01809bde85fd452f7fd20f027e59ba9c27ddb576a3af3b0697981206f16fa4ce66cdd281f2da705a97ec421ad628562df6ce4a5c22e9b657f61b604dd5362c79615f48edb6498155418c68f7059e2b5d6905901a283427b4adbebcb49da29abdfa17c260e9172b4e158bb9f23a5c88cba14fee80c78fc6e4475cf186e8aea51b47d558094f0100"}]}, 0xc4}}, 0x4000080) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000006c0)={0x14, 0x47, 0x107, 0xfffffffe, 0xffffffff, {0x1, 0x7c}}, 0x14}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r4, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001500)={0x11, 0x1a, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x4}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x6}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x4}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000400)='syzkaller\x00', 0x2}, 0x94) 742.885349ms ago: executing program 0 (id=4528): sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000100)=ANY=[@ANYBLOB="60b80000", @ANYRES16, @ANYBLOB="050427bd7000fedbdf250100000008000100", @ANYRES32, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005"], 0x60}, 0x1, 0x0, 0x0, 0x4000401}, 0x4040084) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x1, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xffe0}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_LIMIT={0x8, 0x1, 0xf4b6}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xfe2a}]}}]}, 0x44}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[], 0x5c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0xa, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) (fail_nth: 3) 704.442977ms ago: executing program 1 (id=4529): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000080)=@framed={{}, [@ldst={0x2, 0x0, 0x3, 0x1, 0x0, 0xf}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x90) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000000)={0x3, 0xc0, "eca564", 0x4, 0x2}) (async) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x8, 0x7fe2, 0x2}, 0x48) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r2, &(0x7f0000000040), 0x0}, 0x20) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r3, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="61103400000000006113380000000000bfa00000000000000700000008ffffffd50301001874004095000600000000006916000000000000bf67000000000000360607000fff07201706000020190000160300000ee60060bf050000000000007b650000000000006507f9ff01000000070700004ddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d2aca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c437dc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc28206c812439ab129ae818837ee15620789c524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418df19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c747664e9f7478f8200"/1582], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) (async) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000000)={0x0, 0x0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x0, 0xf, &(0x7f00000002c0)=@ringbuf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, r5, r4}, 0x90) (async, rerun: 64) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x9, 0x7, &(0x7f0000000380)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x1000}, [@map_idx={0x18, 0x0, 0x5, 0x0, 0xf}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0x9, 0x0, 0x0, 0x0, 0x6}]}, &(0x7f00000003c0)='syzkaller\x00', 0x0, 0x29, &(0x7f0000000400)=""/41, 0x40f00, 0x5d, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x8, &(0x7f0000000440)={0x1, 0x3}, 0x8, 0x10, &(0x7f0000000480)={0x4, 0x8, 0x3, 0x7}, 0x10, 0xffffffffffffffff, r0, 0x1, &(0x7f00000004c0)=[0xffffffffffffffff, 0x1, 0x1, 0x1], &(0x7f0000000500)=[{0x4, 0x3, 0xe, 0xb}], 0x10, 0xfe}, 0x94) (rerun: 64) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x16, 0x12, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0xe69}, {}, {}, [@map_fd={0x18, 0x1, 0x1, 0x0, r2}, @ldst={0x0, 0x1, 0x3, 0x7, 0x8, 0xffffffffffffffe0, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000240)='GPL\x00', 0xe206, 0x50, &(0x7f0000000280)=""/80, 0x41000, 0x40, '\x00', 0x0, @flow_dissector, r3, 0x8, &(0x7f0000000300)={0x0, 0x4}, 0x8, 0x10, &(0x7f0000000340)={0x1, 0x0, 0x7, 0x4}, 0x10, r5, r6, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) (async) unshare(0x6a040000) 634.776281ms ago: executing program 2 (id=4530): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000180)={'caif0\x00', &(0x7f0000000140)=@ethtool_link_settings={0x4c, 0xe9, 0x0, 0x4d, 0x0, 0xa, 0x7, 0xe, 0x8, 0x3d, [0x81, 0x7, 0x80000, 0xfff, 0x6, 0x200000d, 0x8001]}}) r1 = accept4$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000080)=0x1c, 0x80000) getsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f00000000c0), &(0x7f0000000100)=0xe) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000000c0)=ANY=[@ANYBLOB="84000000", @ANYRES16=r3, @ANYBLOB="010027bd7000ffdbdf25030000000c0005002001000000000000340007800c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32, @ANYBLOB="0c00018008000100", @ANYRES32=r4, @ANYBLOB="1c0007800c00018008000100", @ANYRES32=r4, @ANYBLOB="0c00018006000100", @ANYRES32=r4, @ANYBLOB="080001"], 0x84}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=@newlink={0x30, 0x10, 0x801, 0xfffffffd, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8296}, [@IFLA_GROUP={0x8}, @IFLA_AF_SPEC={0x8, 0x1a, 0x0, 0x1, [@AF_INET6={0x4, 0x2d}]}]}, 0x30}}, 0x0) 548.591723ms ago: executing program 4 (id=4531): r0 = socket$netlink(0x10, 0x3, 0x4) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) sendto$packet(r1, &(0x7f0000000000)="05000806", 0x5e0, 0x0, &(0x7f0000000080)={0x11, 0x8100, r2}, 0x14) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r3, 0x107, 0x7, &(0x7f0000000100)=0x4000200, 0x4) setsockopt$packet_tx_ring(r3, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x6, 0x300, 0xfc}, 0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@delchain={0x3c, 0x64, 0x20, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff3}, {0xfff3, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ARP_SIP={0x8, 0x39, @rand_addr=0x64010102}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040054}, 0x4804) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) ioctl$sock_bt_hci(0xffffffffffffffff, 0x800448d7, &(0x7f00000037c0)) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000003c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'essiv(cbc(aes),sha256)\x00'}, 0x58) close(0x3) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r6, &(0x7f00000001c0)='O', 0x1, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r6, 0x84, 0x85, &(0x7f0000000380)={0x0, @in6={{0xa, 0x0, 0x0, @private2}}}, &(0x7f00000002c0)=0x100) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="640000001000010429bd700000000000e0000000", @ANYRES32=0x0, @ANYBLOB="00010000316f0600300012800b00010067656e657665000020000280080011"], 0x64}}, 0x20000000) r7 = socket(0x15, 0x5, 0x0) getsockopt(r7, 0x200000000114, 0x5, &(0x7f0000000580)=""/102393, &(0x7f0000000000)=0x18ff9) r8 = socket(0x15, 0x5, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_pid(r9, &(0x7f0000000200), 0x12) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r9, 0x0) getsockopt(r8, 0x200000000114, 0x2710, &(0x7f0000c35fff), &(0x7f0000000000)) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x6000008, 0x6e071, 0xffffffffffffffff, 0x80000000) r10 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffd8f}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYRES8=0x0, @ANYRES64=r10, @ANYRES16=r10, @ANYRESHEX=r3, @ANYRESDEC=r10, @ANYRES16=r3], &(0x7f00000002c0)='GPL\x00'}, 0x94) 548.177415ms ago: executing program 0 (id=4532): r0 = socket$inet6(0xa, 0x80002, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f00000004000000080000000c"], 0x50) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'caif0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@getqdisc={0x24, 0x26, 0x1, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {}, {0x0, 0xb}, {0x8, 0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x2000c021}, 0x4048000) sendto$packet(r3, &(0x7f00000001c0)="347b080d4576c33b7bd96f48e0548ae0da1a57d8109383782bb4f398bdd72847ead1f7e07ff8ef71b3edbf396badc5bb356e65da4b9752d64eea9e829bb1a7a27362ab171af51af1fbd1c38f3100c94bf63beda62c45888ce0062a880a96491d8924cad020dd0671d3", 0x69, 0x1, &(0x7f0000000280)={0x11, 0x17, r5, 0x1, 0x7, 0x6, @multicast}, 0x14) socket$inet6_sctp(0xa, 0x5, 0x84) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r6 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001000f320c9f97000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="81b8000000000000140012800b000100697036677265000004"], 0x34}, 0x1, 0x0, 0x0, 0x24048007}, 0x4040844) socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) close(0x3) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)) socket(0x400000000010, 0x3, 0xf) socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x20000801) write$bt_hci(r6, &(0x7f00000002c0)=ANY=[@ANYBLOB="01622045f79fe18ca6dd22fa09000900d7e7080001001004ab0000be700800050e0805000300d50ab106007f0702080204000f00000203ef800200020081360303"], 0x49) ioctl$sock_SIOCETHTOOL(r1, 0x89f6, &(0x7f0000000080)={'bridge0\x00', &(0x7f00000000c0)=@ethtool_regs={0x4, 0x0, 0x11, "2a161d2d71db37f20a8f1597f02515fcea"}}) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000001440)=ANY=[], 0xc0) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="31e02b103414e85d0eaf4eaaaaaaaaaabb86dd6000000000083a0000000000000000000000000000000000ff02000000000000000000018000907800000006"], 0x0) close(0xffffffffffffffff) 489.892566ms ago: executing program 1 (id=4533): r0 = socket(0x10, 0x803, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000340)={'team0\x00', 0x0}) (async) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) write$cgroup_pid(r4, &(0x7f0000000000), 0xffffff98) splice(r3, 0x0, r2, 0x0, 0xfffffffc, 0xf) (async) sendmsg$nl_route_sched(r0, &(0x7f0000000480)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=@getchain={0x24, 0x66, 0x200, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, {0x2ef936aa7ade7b22, 0x3}, {0xa, 0xffff}, {0x10, 0xc}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x20) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="1400f300", @ANYRES16=0x0, @ANYBLOB="20002dbd7000ffdbdf2514000000"], 0x14}, 0x1, 0x0, 0x0, 0x20000801}, 0x80) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048010}, 0x44000) (async) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) (async, rerun: 64) r10 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000100)={'veth0_to_bond\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="5cecffff0f0003040000000000000000000000008c48c0ed3fed65a9593530ede548911966f09e213c214499f33654dde3daee292c1dc092751b7d9ace764f836ad618e3eddad3e0cb6fc2e0e4f8a9dac11b15c1be1320c79bcc6b08bed407898e586b9ef631a8a7b5febbc9725758e6612f47e835087fddbb03bbbb795066fb79d4376361be9600ee10f86deff531f5aef1f0d9c3b980c602b1160289047084d185b3fc038342024d4573c0b795fdfbb87686dd4d663cb19d199b0dc6b543c2569628892cb64b8fe01e4e52007bb5bc9870440f397a037a7a1871f2dd59d1cc02a657", @ANYRES32=0x0, @ANYBLOB="5e2e0900000000002c00128009000100766c616e000000001c0002800600010004000000100003800c0001000700000f0100000008000500", @ANYRES32=r11, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r9], 0x5c}, 0x1, 0x0, 0x0, 0x600}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 283.013611ms ago: executing program 1 (id=4534): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r1, 0x1, 0x1d, &(0x7f0000000080)=0x3, 0x4) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) recvmmsg(r1, &(0x7f0000004300)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x49, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x4}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x8000ffff}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x90}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) (async) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="5800000010000100"/20, @ANYRES32=0x0, @ANYBLOB="5d5b00000000000024001a8020000a8014000700fe8000000000000000000000000000aa05000800000000001400350067726530"], 0x58}}, 0x0) 425.517µs ago: executing program 2 (id=4535): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=@newlink={0x38, 0x10, 0x503, 0x0, 0x0, {0x0, 0xcf}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @sit={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_FWMARK={0x8}]}}}]}, 0x38}}, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r2 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f7", 0x81}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000001580)=[{&(0x7f0000001280)=""/204, 0xcc}], 0x1}, 0x40000000) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)={0x2c, 0x10, 0x107, 0x0, 0x0, {0x3, 0x7c}, [@nested={0x18, 0x1, 0x0, 0x1, [@typed={0x14, 0x0, 0x0, 0x0, @ipv6=@local}]}]}, 0x2c}}, 0x0) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000080)={0x1b, 0x0, 0x0, 0xffffffff, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x4, 0x5}, 0x50) (async) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0xf000, 0xffff}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_IIF={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async, rerun: 64) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000009c0)={0xffffffffffffffff, 0x20, &(0x7f0000000980)={&(0x7f0000000780)=""/242, 0xf2, 0x0, &(0x7f0000000880)=""/235, 0xeb}}, 0x10) (rerun: 64) r9 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000a00)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2, 0x2}, 0x50) (async) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xa, 0x5, 0x2, 0x4}, 0x48) r11 = bpf$MAP_CREATE(0x0, &(0x7f0000000dc0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x14, 0x10, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r11, @ANYBLOB="0000000000000000b702000001000000850000008600000018110000", @ANYRES32=r10, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x18, 0x12, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x9221}, {{0x18, 0x1, 0x1, 0x0, r4}}, {}, [@initr0={0x18, 0x0, 0x0, 0x0, 0xd5e1, 0x0, 0x0, 0x0, 0x10000}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x1}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000300)='GPL\x00', 0x7, 0xe6, &(0x7f0000000600)=""/230, 0x40f00, 0x0, '\x00', r7, @fallback=0x18, 0xffffffffffffffff, 0x8, &(0x7f0000000700)={0x8, 0x2}, 0x8, 0x10, &(0x7f0000000740)={0x3, 0xc, 0x9, 0x8001}, 0x10, r8, 0xffffffffffffffff, 0x3, &(0x7f0000000a80)=[r9, r11], &(0x7f0000000ac0)=[{0x0, 0x4, 0xc, 0xc}, {0x2, 0x5, 0xd}, {0x4, 0x2, 0xa, 0xb}], 0x10, 0x7fffffff}, 0x94) 0s ago: executing program 3 (id=4536): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000004e40)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/96, 0x60}], 0x1, &(0x7f0000000140)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x80}}, {{&(0x7f00000001c0), 0x6e, &(0x7f0000001440)=[{&(0x7f0000000440)=""/4096, 0x1000}], 0x1}}, {{&(0x7f0000001480), 0x6e, &(0x7f0000001540)=[{&(0x7f0000001500)=""/25, 0x19}], 0x1, &(0x7f0000001580)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f00000015c0)=@abs, 0x6e, &(0x7f0000002780)=[{&(0x7f0000001640)=""/197, 0xc5}, {&(0x7f0000001740)=""/4096, 0x1000}, {&(0x7f0000002740)=""/1, 0x1}], 0x3, &(0x7f00000027c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x60}}, {{&(0x7f0000002840)=@abs, 0x6e, &(0x7f0000002cc0)=[{&(0x7f00000028c0)=""/160, 0xa0}, {&(0x7f0000002980)=""/76, 0x4c}, {&(0x7f0000002a00)=""/69, 0x45}, {&(0x7f0000002a80)=""/190, 0xbe}, {&(0x7f0000002b40)=""/81, 0x51}, {&(0x7f0000002bc0)=""/247, 0xf7}], 0x6}}, {{&(0x7f0000002d40)=@abs, 0x6e, &(0x7f0000002fc0)=[{&(0x7f0000002dc0)=""/114, 0x72}, {&(0x7f0000002e40)=""/7, 0x7}, {&(0x7f0000002e80)=""/17, 0x11}, {&(0x7f0000002ec0)=""/113, 0x71}, {&(0x7f0000002f40)=""/82, 0x52}], 0x5, &(0x7f0000003040)=[@cred={{0x1c}}], 0x20}}, {{&(0x7f0000003080)=@abs, 0x6e, &(0x7f00000032c0)=[{&(0x7f0000003100)=""/155, 0x9b}, {&(0x7f00000031c0)=""/174, 0xae}, {&(0x7f0000003280)}], 0x3}}, {{&(0x7f0000003300)=@abs, 0x6e, &(0x7f0000003840)=[{&(0x7f0000003380)=""/209, 0xd1}, {&(0x7f0000003480)=""/41, 0x29}, {&(0x7f00000034c0)=""/86, 0x56}, {&(0x7f0000003540)=""/71, 0x47}, {&(0x7f00000035c0)=""/44, 0x2c}, {&(0x7f0000003600)=""/175, 0xaf}, {&(0x7f00000036c0)=""/3, 0x3}, {&(0x7f0000003700)=""/190, 0xbe}, {&(0x7f00000037c0)=""/3, 0x3}, {&(0x7f0000003800)=""/22, 0x16}], 0xa, &(0x7f0000003900)=[@cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x98}}, {{&(0x7f00000039c0), 0x6e, &(0x7f0000004d80)=[{&(0x7f0000003a40)=""/48, 0x30}, {&(0x7f0000003a80)=""/4096, 0x1000}, {&(0x7f0000004a80)=""/55, 0x37}, {&(0x7f0000004ac0)=""/45, 0x2d}, {&(0x7f0000004b00)=""/45, 0x2d}, {&(0x7f0000004b40)=""/238, 0xee}, {&(0x7f0000004c40)=""/151, 0x97}, {&(0x7f0000004d00)=""/5, 0x5}, {&(0x7f0000004d40)=""/5, 0x5}], 0x9}}], 0x9, 0x20000000, &(0x7f0000005080)={0x0, 0x3938700}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r3, 0x107, 0x8, 0x0, 0x0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[], 0x6c}}, 0x0) kernel console output (not intermixed with test programs): netlink: 16 bytes leftover after parsing attributes in process `syz.1.3131'. [ 375.701712][T17265] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 375.707427][ T8051] wlan1: Trigger new scan to find an IBSS to join [ 375.728267][T17265] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 375.736283][T17265] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 375.753784][T17265] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 375.770849][T17265] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 375.788166][T17265] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 375.809534][T17265] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 375.825967][T17265] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 375.875077][T17529] 8021q: adding VLAN 0 to HW filter on device bond1 [ 375.886557][T17529] bond0: (slave bond1): Enslaving as an active interface with an up link [ 375.990763][T17541] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 376.061336][T17265] 8021q: adding VLAN 0 to HW filter on device bond0 [ 376.114052][T17265] 8021q: adding VLAN 0 to HW filter on device team0 [ 376.116969][T17552] netlink: 'syz.2.3138': attribute type 2 has an invalid length. [ 376.132675][ T8051] bridge0: port 1(bridge_slave_0) entered blocking state [ 376.139863][ T8051] bridge0: port 1(bridge_slave_0) entered forwarding state [ 376.164556][T11452] bridge0: port 2(bridge_slave_1) entered blocking state [ 376.171757][T11452] bridge0: port 2(bridge_slave_1) entered forwarding state [ 376.216296][ T8051] tipc: Resetting bearer [ 376.619117][ T8051] wlan1: Creating new IBSS network, BSSID 9e:97:f2:37:a2:fd [ 377.188028][T17265] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 377.312347][T17265] veth0_vlan: entered promiscuous mode [ 377.347626][T17265] veth1_vlan: entered promiscuous mode [ 377.433759][T17265] veth0_macvtap: entered promiscuous mode [ 377.465545][T17623] netlink: 'syz.3.3158': attribute type 12 has an invalid length. [ 377.478553][T17265] veth1_macvtap: entered promiscuous mode [ 377.547370][ T5633] Bluetooth: hci4: command tx timeout [ 377.582168][T17265] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 377.622787][T17265] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 377.671216][T17632] macvtap1: entered promiscuous mode [ 377.685081][T17632] macvtap1: entered allmulticast mode [ 377.708726][T17633] macvtap2: entered promiscuous mode [ 377.714324][T17633] macvtap2: entered allmulticast mode [ 377.733807][T11447] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.751778][T17632] macvtap2: entered promiscuous mode [ 377.757826][T17632] macvtap2: entered allmulticast mode [ 377.778357][T11447] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.788394][T11447] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 377.803948][T17633] vcan1: entered allmulticast mode [ 377.812539][T17638] vcan2: entered allmulticast mode [ 377.824246][T11447] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 378.033562][T11447] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 378.060068][T11447] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 378.139561][T17648] netlink: 'syz.2.3165': attribute type 1 has an invalid length. [ 378.165107][T17648] netlink: 'syz.2.3165': attribute type 1 has an invalid length. [ 378.193580][T17655] tipc: Resetting bearer [ 378.209922][T11447] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 378.230251][T11447] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 378.238259][T17653] pim6reg: entered allmulticast mode [ 378.248408][T17653] pim6reg: left allmulticast mode [ 378.254226][T17653] vcan0: left allmulticast mode [ 378.291826][T17656] tipc: Resetting bearer [ 378.393780][T17670] Cannot find set identified by id 65534 to match [ 378.490552][T17665] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 378.782867][T17691] netlink: 'syz.0.3175': attribute type 21 has an invalid length. [ 378.806407][ T50] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 378.822160][ T50] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 378.833666][ T50] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 378.842730][ T50] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 378.846872][T17694] IPv6: NLM_F_CREATE should be specified when creating new route [ 378.865307][ T50] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 378.934075][T17697] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 378.985296][T17700] __nla_validate_parse: 10 callbacks suppressed [ 378.985312][T17700] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3177'. [ 378.998494][T17702] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3177'. [ 379.161841][T17707] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3178'. [ 379.278949][T17687] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3174'. [ 379.400307][T11446] tipc: Resetting bearer [ 379.498868][T17714] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3179'. [ 379.593117][T17719] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3179'. [ 379.604191][T11447] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 379.665553][T17716] tipc: Resetting bearer [ 379.818308][T17715] tipc: Resetting bearer [ 379.879333][T11447] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 380.143081][T11447] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 380.154750][T17738] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3184'. [ 380.165255][T17738] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3184'. [ 380.200199][T17740] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3183'. [ 380.217145][T17740] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3183'. [ 380.288506][T11447] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 380.312620][T17740] xt_TPROXY: Can be used only with -p tcp or -p udp [ 380.403807][T11455] tipc: Resetting bearer [ 380.442673][T17688] C speed is unknown, defaulting to 1000 [ 380.805342][T11447] bridge_slave_1: left allmulticast mode [ 380.811706][T11447] bridge_slave_1: left promiscuous mode [ 380.819543][T11447] bridge0: port 2(bridge_slave_1) entered disabled state [ 380.878510][T11447] bridge_slave_0: left allmulticast mode [ 380.895156][T11447] bridge_slave_0: left promiscuous mode [ 380.904932][T11447] bridge0: port 1(bridge_slave_0) entered disabled state [ 380.912574][ T5633] Bluetooth: hci3: command tx timeout [ 381.001881][T11447] dvmrp4: left allmulticast mode [ 381.615670][T11447] bond3 (unregistering): (slave geneve3): Releasing active interface [ 381.777315][T11447] bond2 (unregistering): (slave bridge2): Releasing backup interface [ 381.807710][T11447] bridge2 (unregistering): left promiscuous mode [ 381.839127][T11447] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 381.849512][T11447] bond0 (unregistering): (slave bond7): Releasing backup interface [ 381.866087][T11447] bond0 (unregistering): Released all slaves [ 381.877292][T11447] bond1 (unregistering): Released all slaves [ 381.892763][T11447] bond2 (unregistering): Released all slaves [ 381.911311][T11447] bond3 (unregistering): Released all slaves [ 381.924503][T11447] bond4 (unregistering): Released all slaves [ 381.938999][T11447] bond5 (unregistering): (slave C): Releasing backup interface [ 381.953908][T11447] bond5 (unregistering): (slave C): last VLAN challenged slave left bond - VLAN blocking is removed [ 381.965102][T11447] bond5 (unregistering): Released all slaves [ 381.981395][T11447] bond6 (unregistering): Released all slaves [ 381.996254][T11447] bond7 (unregistering): Released all slaves [ 382.010023][T11447] bond8 (unregistering): Released all slaves [ 382.032585][T11447] bond9 (unregistering): Released all slaves [ 382.168628][ T5287] 8021q: adding VLAN 0 to HW filter on device eth1 [ 382.629903][T17812] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 382.638004][T17814] netdevsim netdevsim3 : renamed from netdevsim0 (while UP) [ 382.651919][T17815] syzkaller0: entered promiscuous mode [ 382.660682][T17815] syzkaller0: entered allmulticast mode [ 382.987650][ T5633] Bluetooth: hci3: command tx timeout [ 383.154287][T17825] tipc: Started in network mode [ 383.162481][T17825] tipc: Node identity a216829c37ce, cluster identity 4711 [ 383.170945][T17825] tipc: Enabled bearer , priority 0 [ 383.186491][T17849] FAULT_INJECTION: forcing a failure. [ 383.186491][T17849] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 383.213947][T17849] CPU: 1 UID: 0 PID: 17849 Comm: syz.2.3206 Not tainted syzkaller #0 PREEMPT(full) [ 383.213971][T17849] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 383.213990][T17849] Call Trace: [ 383.213997][T17849] [ 383.214004][T17849] dump_stack_lvl+0xe8/0x150 [ 383.214037][T17849] should_fail_ex+0x40c/0x560 [ 383.214063][T17849] _copy_from_user+0x2d/0xb0 [ 383.214090][T17849] ___sys_sendmsg+0x1c6/0x360 [ 383.214117][T17849] ? __lock_acquire+0x683/0x2cf0 [ 383.214145][T17849] ? __pfx____sys_sendmsg+0x10/0x10 [ 383.214176][T17849] ? kstrtouint+0x6e/0xe0 [ 383.214222][T17849] ? __fget_files+0x2a/0x420 [ 383.214245][T17849] ? __fget_files+0x3a2/0x420 [ 383.214278][T17849] __sys_sendmmsg+0x273/0x4d0 [ 383.214310][T17849] ? __pfx___sys_sendmmsg+0x10/0x10 [ 383.214346][T17849] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 383.214384][T17849] ? ksys_write+0x242/0x270 [ 383.214414][T17849] ? __pfx_ksys_write+0x10/0x10 [ 383.214448][T17849] __x64_sys_sendmmsg+0xa0/0xc0 [ 383.214474][T17849] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 383.214495][T17849] do_syscall_64+0x174/0x580 [ 383.214517][T17849] ? trace_irq_disable+0x3b/0x140 [ 383.214540][T17849] ? clear_bhb_loop+0x40/0x90 [ 383.214563][T17849] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 383.214582][T17849] RIP: 0033:0x7fa14279de59 [ 383.214599][T17849] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 383.214615][T17849] RSP: 002b:00007fa143708028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 383.214634][T17849] RAX: ffffffffffffffda RBX: 00007fa142a25fa0 RCX: 00007fa14279de59 [ 383.214647][T17849] RDX: 0000000000000004 RSI: 0000200000003240 RDI: 0000000000000004 [ 383.214658][T17849] RBP: 00007fa143708090 R08: 0000000000000000 R09: 0000000000000000 [ 383.214670][T17849] R10: 0000000004040040 R11: 0000000000000246 R12: 0000000000000001 [ 383.214681][T17849] R13: 00007fa142a26038 R14: 00007fa142a25fa0 R15: 00007ffe589836c8 [ 383.214711][T17849] [ 383.486978][T17813] tipc: Resetting bearer [ 383.516516][T17813] tipc: Disabling bearer [ 383.596547][T17859] tipc: Resetting bearer [ 383.756149][T17854] tipc: Resetting bearer [ 383.877745][T17688] bridge0: port 1(bridge_slave_0) entered blocking state [ 383.885016][T17688] bridge0: port 1(bridge_slave_0) entered disabled state [ 383.910041][T17688] bridge_slave_0: entered allmulticast mode [ 383.920550][T17688] bridge_slave_0: entered promiscuous mode [ 383.931025][ T5287] 8021q: adding VLAN 0 to HW filter on device eth2 [ 383.960637][T17688] bridge0: port 2(bridge_slave_1) entered blocking state [ 383.985655][T17688] bridge0: port 2(bridge_slave_1) entered disabled state [ 384.010157][T17688] bridge_slave_1: entered allmulticast mode [ 384.032553][T17688] bridge_slave_1: entered promiscuous mode [ 384.266098][T17688] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 384.339616][T11461] tipc: Resetting bearer [ 384.364472][T17688] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 384.475141][T17688] team0: Port device team_slave_0 added [ 384.520281][T17688] team0: Port device team_slave_1 added [ 384.761840][T17688] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 384.790073][T17688] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 384.857827][T17688] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 384.879714][T17688] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 384.899293][T17688] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 384.959831][T17688] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 384.976312][T17928] __nla_validate_parse: 6 callbacks suppressed [ 384.976329][T17928] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3222'. [ 385.077507][ T5633] Bluetooth: hci3: command tx timeout [ 385.719708][T17935] syzkaller0: entered promiscuous mode [ 385.725790][T17935] syzkaller0: entered allmulticast mode [ 385.783772][ T5287] 8021q: adding VLAN 0 to HW filter on device eth3 [ 385.877555][T17961] tipc: Resetting bearer [ 385.908742][T17961] tipc: Resetting bearer [ 386.002399][T17688] hsr_slave_0: entered promiscuous mode [ 386.017942][T17688] hsr_slave_1: entered promiscuous mode [ 386.044746][T17688] debugfs: 'hsr0' already exists in 'hsr' [ 386.061453][T17688] Cannot create hsr debugfs directory [ 386.117383][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 386.295736][T17987] netlink: 83 bytes leftover after parsing attributes in process `syz.3.3232'. [ 386.320604][T11447] IPVS: stop unused estimator thread 0... [ 386.543849][T17997] netlink: 'syz.3.3236': attribute type 2 has an invalid length. [ 386.564051][T17997] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3236'. [ 386.601289][T17993] syzkaller0: entered allmulticast mode [ 386.747771][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 386.846435][T11447] tipc: Resetting bearer [ 387.020989][T18016] bond1: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 387.031788][T18023] netlink: 199784 bytes leftover after parsing attributes in process `syz.2.3242'. [ 387.043221][T18023] netlink: 'syz.2.3242': attribute type 1 has an invalid length. [ 387.051911][T18016] bond1 (unregistering): Released all slaves [ 387.146795][ T5633] Bluetooth: hci3: command tx timeout [ 387.154348][T18016] netlink: 'syz.0.3239': attribute type 15 has an invalid length. [ 387.175782][T18016] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3239'. [ 387.241287][T18020] tipc: Resetting bearer [ 387.307415][T18025] tipc: Resetting bearer [ 387.433759][T18037] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3244'. [ 387.463570][T18048] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3247'. [ 387.532292][T18043] tipc: Enabling of bearer rejected, already enabled [ 387.583927][T18056] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3248'. [ 387.593903][T18056] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3248'. [ 387.608525][T18043] syzkaller0: MTU too low for tipc bearer [ 387.643402][T18043] tipc: Disabling bearer [ 388.017835][T18081] netlink: 'syz.0.3255': attribute type 1 has an invalid length. [ 388.043658][T18081] netlink: 228 bytes leftover after parsing attributes in process `syz.0.3255'. [ 388.197133][T18096] netlink: 'syz.1.3256': attribute type 9 has an invalid length. [ 388.733622][T17688] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 388.802636][T17688] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 388.840517][T17688] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 388.905168][T17688] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 388.977920][T17688] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 389.033768][T17688] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 389.222913][T17688] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 389.252270][T17688] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 389.556523][T17688] 8021q: adding VLAN 0 to HW filter on device bond0 [ 389.642717][T17688] 8021q: adding VLAN 0 to HW filter on device team0 [ 389.694284][T11457] bridge0: port 1(bridge_slave_0) entered blocking state [ 389.701537][T11457] bridge0: port 1(bridge_slave_0) entered forwarding state [ 389.764418][T11461] bridge0: port 2(bridge_slave_1) entered blocking state [ 389.771632][T11461] bridge0: port 2(bridge_slave_1) entered forwarding state [ 390.164861][T18207] netlink: 'syz.0.3276': attribute type 12 has an invalid length. [ 390.270981][T18205] syzkaller0: entered promiscuous mode [ 390.284730][T18205] syzkaller0: entered allmulticast mode [ 390.334895][T18217] __nla_validate_parse: 3 callbacks suppressed [ 390.334912][T18217] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3278'. [ 390.442405][T18214] bond13: option ad_actor_sys_prio: mode dependency failed, not supported in mode balance-rr(0) [ 390.460515][T18214] bond13 (unregistering): Released all slaves [ 390.496374][T18223] bond0: entered promiscuous mode [ 390.503118][T18223] bond_slave_0: entered promiscuous mode [ 390.509553][T18223] bond_slave_1: entered promiscuous mode [ 390.515459][T18223] bond1: entered promiscuous mode [ 390.529407][T18223] bond0: left promiscuous mode [ 390.534272][T18223] bond_slave_0: left promiscuous mode [ 390.553503][T18223] bond_slave_1: left promiscuous mode [ 390.568957][T18223] bond1: left promiscuous mode [ 392.468385][T18222] workqueue: Failed to create a rescuer kthread for wq "bond13": -EINTR [ 392.503014][T18236] batadv0: entered promiscuous mode [ 392.543198][T18236] macsec2: entered promiscuous mode [ 392.567189][T18236] 8021q: adding VLAN 0 to HW filter on device macsec2 [ 392.617670][T18236] batadv0: left promiscuous mode [ 393.298909][T17688] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 393.398688][T18294] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3297'. [ 393.886511][T18304] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3300'. [ 393.925857][T18304] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3300'. [ 393.980071][T18310] netlink: 'syz.0.3301': attribute type 21 has an invalid length. [ 394.076185][T18310] bond1: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 394.162847][T18310] bond1 (unregistering): Released all slaves [ 394.534926][T17688] veth0_vlan: entered promiscuous mode [ 394.599595][T17688] veth1_vlan: entered promiscuous mode [ 394.734954][T17688] veth0_macvtap: entered promiscuous mode [ 394.796253][T17688] veth1_macvtap: entered promiscuous mode [ 394.869218][T17688] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 394.915891][T17688] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 394.986472][T11457] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 395.022478][T11457] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 395.081405][T11457] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 395.120862][T11457] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 395.123866][T18350] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3309'. [ 395.161039][T18350] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3309'. [ 395.194008][T18350] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3309'. [ 395.373915][T11457] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 395.422199][T11457] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 395.454316][T18362] netlink: 48 bytes leftover after parsing attributes in process `syz.3.3311'. [ 395.510507][T11447] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 395.536346][T11447] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 395.654873][T18370] Unsupported xt match [ 395.654893][T18370] unable to load match [ 396.026385][T18404] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3320'. [ 396.444049][T18425] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3324'. [ 396.444923][T18428] netlink: 'syz.4.3325': attribute type 2 has an invalid length. [ 396.809014][T18453] tun0: tun_chr_ioctl cmd 1074025675 [ 396.826917][T18453] tun0: persist enabled [ 397.025506][T18460] netlink: 'syz.1.3333': attribute type 4 has an invalid length. [ 397.257524][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 397.269857][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 397.280114][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 397.288459][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 397.297811][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 397.615282][T18502] netlink: 'syz.0.3341': attribute type 83 has an invalid length. [ 397.765532][T18511] netlink: 'syz.1.3342': attribute type 2 has an invalid length. [ 397.796454][T18513] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3343'. [ 398.054338][T18524] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3342'. [ 398.230914][T18545] netlink: 'syz.2.3347': attribute type 1 has an invalid length. [ 398.355388][T18477] C speed is unknown, defaulting to 1000 [ 398.429533][T18557] bond1: (slave bridge2): making interface the new active one [ 398.444021][T18557] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 398.474674][T18561] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 398.722537][T18577] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 398.805226][T18577] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 399.010557][T18477] bridge0: port 1(bridge_slave_0) entered blocking state [ 399.018107][T18477] bridge0: port 1(bridge_slave_0) entered disabled state [ 399.025338][T18477] bridge_slave_0: entered allmulticast mode [ 399.033265][T18477] bridge_slave_0: entered promiscuous mode [ 399.042320][T18477] bridge0: port 2(bridge_slave_1) entered blocking state [ 399.049855][T18477] bridge0: port 2(bridge_slave_1) entered disabled state [ 399.058452][T18477] bridge_slave_1: entered allmulticast mode [ 399.066006][T18477] bridge_slave_1: entered promiscuous mode [ 399.112013][T18477] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 399.125014][T18477] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 399.166123][T18477] team0: Port device team_slave_0 added [ 399.174896][T18477] team0: Port device team_slave_1 added [ 399.212191][T18477] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 399.219642][T18477] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 399.245906][T18477] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 399.264232][T18477] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 399.271560][T18477] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 399.299928][T18477] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 399.362023][T18477] hsr_slave_0: entered promiscuous mode [ 399.369298][T18477] hsr_slave_1: entered promiscuous mode [ 399.375692][T18477] debugfs: 'hsr0' already exists in 'hsr' [ 399.382902][T18477] Cannot create hsr debugfs directory [ 399.398074][ T5633] Bluetooth: hci0: command tx timeout [ 399.555824][T18477] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 399.567393][T18477] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.635389][T18477] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 399.645851][T18477] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.695624][T18477] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 399.709043][T18477] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 399.784325][T18477] netdevsim netdevsim3  (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 399.794664][T18477] netdevsim netdevsim3  (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 400.709779][T18511] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 400.753762][T18477] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 400.832720][T18477] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 400.864396][T18602] veth0: entered promiscuous mode [ 400.879523][T18603] veth0: left promiscuous mode [ 400.902014][T18477] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 400.921110][T18477] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 400.934232][T18477] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 400.954733][T18477] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 400.982830][T18477] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 401.012520][T18477] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 401.137397][T18626] macvtap1: entered promiscuous mode [ 401.159713][T18626] macvtap1: entered allmulticast mode [ 401.185403][T18626] veth1_vlan: entered allmulticast mode [ 401.219706][T18631] macvtap2: entered promiscuous mode [ 401.234681][T18631] macvtap2: entered allmulticast mode [ 401.268165][T18636] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3361'. [ 401.406652][T18477] 8021q: adding VLAN 0 to HW filter on device bond0 [ 401.413920][T18642] netlink: 'syz.1.3362': attribute type 1 has an invalid length. [ 401.455716][T18641] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 401.471491][ T5633] Bluetooth: hci0: command tx timeout [ 401.471871][T18651] netlink: 'syz.1.3362': attribute type 1 has an invalid length. [ 401.536392][T18651] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3362'. [ 401.558836][T18642] bond2: entered promiscuous mode [ 401.566207][T18642] 8021q: adding VLAN 0 to HW filter on device bond2 [ 401.575778][T18477] 8021q: adding VLAN 0 to HW filter on device team0 [ 401.592468][T18651] bond2: entered allmulticast mode [ 401.611587][T11435] bridge0: port 1(bridge_slave_0) entered blocking state [ 401.618774][T11435] bridge0: port 1(bridge_slave_0) entered forwarding state [ 401.628554][T18660] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3366'. [ 401.644744][T18642] bond2: (slave bridge2): making interface the new active one [ 401.653664][T18642] bridge2: entered promiscuous mode [ 401.659914][T18642] bridge2: entered allmulticast mode [ 401.666255][T18642] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 401.678738][T18659] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3368'. [ 401.715562][T11439] bridge0: port 2(bridge_slave_1) entered blocking state [ 401.722766][T11439] bridge0: port 2(bridge_slave_1) entered forwarding state [ 401.733360][T18657] Bluetooth: hci2: Opcode 0x0401 failed: -4 [ 401.780661][T18667] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3370'. [ 401.797412][T18667] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3370'. [ 402.312062][T18704] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3378'. [ 402.624188][T18718] openvswitch: netlink: IP tunnel dst address not specified [ 402.658737][T18721] syzkaller0: entered promiscuous mode [ 402.664440][T18721] syzkaller0: entered allmulticast mode [ 402.677038][T18721] netlink: 'syz.4.3382': attribute type 1 has an invalid length. [ 402.680902][T18477] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 402.702281][T18721] netlink: 2 bytes leftover after parsing attributes in process `syz.4.3382'. [ 402.728979][T18725] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 402.784945][T18477] veth0_vlan: entered promiscuous mode [ 402.800472][T18477] veth1_vlan: entered promiscuous mode [ 402.831766][T18729] bridge_slave_0: left allmulticast mode [ 402.838458][T18729] bridge_slave_0: left promiscuous mode [ 402.846201][T18729] bridge0: port 1(bridge_slave_0) entered disabled state [ 402.881145][ T5762] hid-generic 0005:15C2:100F.0001: item fetching failed at offset 0/1 [ 402.881956][T18729] bridge_slave_1: left allmulticast mode [ 402.892473][ T5762] hid-generic 0005:15C2:100F.0001: probe with driver hid-generic failed with error -22 [ 402.931507][T18729] bridge_slave_1: left promiscuous mode [ 402.939748][T18729] bridge0: port 2(bridge_slave_1) entered disabled state [ 402.953637][T18729] bond0: (slave bond_slave_0): Releasing backup interface [ 402.970859][T18729] bond0: (slave bond_slave_1): Releasing backup interface [ 402.998202][T18729] team0: Port device team_slave_0 removed [ 403.017815][T18729] team0: Port device team_slave_1 removed [ 403.024151][T18729] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 403.031583][T18729] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 403.040962][T18729] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 403.049834][T18729] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 403.058700][T18729] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 403.183747][T18477] veth0_macvtap: entered promiscuous mode [ 403.223955][T18477] veth1_macvtap: entered promiscuous mode [ 403.255878][T18741] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 403.303509][T18741] Bluetooth: MGMT ver 1.23 [ 403.373195][T18477] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 403.417793][T18477] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 403.428756][T18751] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3390'. [ 403.523170][T18753] bridge0: port 2(bridge_slave_1) entered disabled state [ 403.530930][T18753] bridge0: port 1(bridge_slave_0) entered disabled state [ 403.547802][ T50] Bluetooth: hci0: command tx timeout [ 403.603631][T18764] netlink: 'syz.4.3391': attribute type 4 has an invalid length. [ 403.626786][ T50] Bluetooth: hci2: command 0x0401 tx timeout [ 403.638559][T18753] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 403.651528][T18753] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 403.806775][T11433] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.838058][T11433] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.849929][T11433] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.872596][T11433] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.890117][T11433] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.911268][T11433] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.930311][T18772] netlink: zone id is out of range [ 403.939381][T11433] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 403.953678][T11433] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 403.963381][T11433] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 403.963519][T18772] netlink: zone id is out of range [ 403.988388][T18772] netlink: zone id is out of range [ 404.001596][T18772] netlink: zone id is out of range [ 404.008259][T11433] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.018076][T18772] netlink: zone id is out of range [ 404.023348][T11433] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.035934][T18772] netlink: zone id is out of range [ 404.057514][T18772] netlink: zone id is out of range [ 404.058887][T11433] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 404.172139][T18777] syzkaller0: entered promiscuous mode [ 404.178367][T18777] syzkaller0: entered allmulticast mode [ 405.627256][ T50] Bluetooth: hci0: command tx timeout [ 406.340642][T18751] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 406.450393][T18798] netlink: 'syz.0.3405': attribute type 1 has an invalid length. [ 406.469684][ T171] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 406.502926][ T171] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 406.539055][T18799] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 406.568801][ T171] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 406.570079][T18804] No such timeout policy "syz0" [ 406.601459][T18804] netlink: 228 bytes leftover after parsing attributes in process `syz.4.3407'. [ 406.611932][ T171] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 406.673742][ T171] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 406.738545][ T5836] IPVS: starting estimator thread 0... [ 406.758963][T18813] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 406.839566][T18823] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3331'. [ 406.851864][T18818] IPVS: using max 30 ests per chain, 72000 per kthread [ 406.879993][T18823] netlink: 144 bytes leftover after parsing attributes in process `syz.3.3331'. [ 406.915355][T18823] netlink: 52 bytes leftover after parsing attributes in process `syz.3.3331'. [ 407.040063][T18841] netlink: 'syz.0.3416': attribute type 4 has an invalid length. [ 407.082920][T18841] Bluetooth: MGMT ver 1.23 [ 407.124658][T18852] netlink: 176 bytes leftover after parsing attributes in process `syz.3.3417'. [ 407.153700][T18852] nbd: must specify a device to reconfigure [ 407.175225][T18851] syzkaller0: entered promiscuous mode [ 407.200868][T18851] syzkaller0: entered allmulticast mode [ 407.225682][T18857] netlink: 'syz.1.3421': attribute type 1 has an invalid length. [ 407.381325][T18857] 8021q: adding VLAN 0 to HW filter on device bond3 [ 407.402955][T18857] gretap1: entered promiscuous mode [ 407.428849][T18851] tipc: Started in network mode [ 407.437984][T18851] tipc: Node identity 96804247522f, cluster identity 4711 [ 407.445487][T18851] tipc: Enabled bearer , priority 0 [ 407.466463][T18849] tipc: Resetting bearer [ 407.513539][T18849] tipc: Disabling bearer [ 407.527644][T18878] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3428'. [ 407.754088][T18892] netlink: 40 bytes leftover after parsing attributes in process `syz.0.3428'. [ 408.003249][T18913] netlink: 'syz.0.3433': attribute type 1 has an invalid length. [ 408.032995][T18914] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3435'. [ 408.074419][T18922] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3438'. [ 408.093335][T18913] 8021q: adding VLAN 0 to HW filter on device bond2 [ 408.170619][T18920] bond2: (slave gretap1): making interface the new active one [ 408.192375][T18920] bond2: (slave gretap1): Enslaving as an active interface with an up link [ 408.343161][T18934] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3441'. [ 408.398874][T18938] netlink: 'syz.1.3439': attribute type 21 has an invalid length. [ 408.552768][T18941] syzkaller0: entered promiscuous mode [ 408.560924][T18941] syzkaller0: entered allmulticast mode [ 408.664758][T18952] ipt_REJECT: TCP_RESET invalid for non-tcp [ 408.783812][T18958] net_ratelimit: 1 callbacks suppressed [ 408.783830][T18958] openvswitch: netlink: IPv4 tunnel dst address is zero [ 410.838991][T18986] bond3: (slave ip6gre0): The slave device specified does not support setting the MAC address [ 410.849844][T18986] bond3: (slave ip6gre0): Error -95 calling set_mac_address [ 411.663924][T18957] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 411.816228][T19005] __nla_validate_parse: 2 callbacks suppressed [ 411.816258][T19005] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3458'. [ 411.835070][T19005] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3458'. [ 411.842363][T19007] netlink: 'syz.1.3459': attribute type 8 has an invalid length. [ 411.849888][T19005] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3458'. [ 411.862942][T19005] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3458'. [ 412.023586][T19020] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3462'. [ 412.064169][T19027] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3464'. [ 412.076402][T19019] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3462'. [ 412.368601][ T29] audit: type=1804 audit(1783188446.221:9): pid=19036 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.3470" name="/newroot/66/cgroup.controllers" dev="tmpfs" ino=356 res=1 errno=0 [ 412.436764][ T29] audit: type=1800 audit(1783188446.241:10): pid=19036 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3470" name="cgroup.controllers" dev="tmpfs" ino=356 res=0 errno=0 [ 412.520238][T19036] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 413.213389][T19081] syzkaller0: entered promiscuous mode [ 413.219423][T19081] syzkaller0: entered allmulticast mode [ 413.230887][T19090] netlink: 'syz.4.3490': attribute type 1 has an invalid length. [ 413.335706][ T171] tipc: Subscription rejected, illegal request [ 413.537489][T19111] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3494'. [ 415.322018][T19109] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3494'. [ 415.365444][T19125] bridge2: entered allmulticast mode [ 415.492206][T19132] netlink: 104 bytes leftover after parsing attributes in process `syz.1.3500'. [ 415.515692][T19130] ip6gre1: entered allmulticast mode [ 415.673587][T19143] TCP: TCP_TX_DELAY enabled [ 415.984823][T19172] ipt_ECN: cannot use operation on non-tcp rule [ 416.115707][T19186] netlink: 'syz.0.3517': attribute type 3 has an invalid length. [ 416.134245][T19188] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input8 [ 416.251248][T19188] veth1_to_bond: entered allmulticast mode [ 416.306237][T19193] veth1_to_bond: entered promiscuous mode [ 416.356067][T19188] veth1_to_bond (unregistering): left allmulticast mode [ 416.391181][T19188] veth1_to_bond (unregistering): left promiscuous mode [ 416.977223][T19234] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 416.995848][T19232] __nla_validate_parse: 134 callbacks suppressed [ 416.995863][T19232] netlink: 64 bytes leftover after parsing attributes in process `syz.4.3532'. [ 417.158373][T19245] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3535'. [ 417.355621][T19252] netlink: 56 bytes leftover after parsing attributes in process `syz.1.3538'. [ 417.531045][T19258] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3539'. [ 417.546488][T19261] netlink: 'syz.0.3540': attribute type 39 has an invalid length. [ 417.615199][T19258] team0: entered promiscuous mode [ 417.637615][T19258] team_slave_0: entered promiscuous mode [ 417.647648][T19258] team_slave_1: entered promiscuous mode [ 417.685827][T19258] team0: left promiscuous mode [ 417.729452][T19258] team_slave_0: left promiscuous mode [ 417.749171][T19258] team_slave_1: left promiscuous mode [ 417.968813][T19274] netlink: 'syz.4.3546': attribute type 18 has an invalid length. [ 418.017211][T11446] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 418.026196][T19274] netlink: 'syz.4.3546': attribute type 18 has an invalid length. [ 418.041938][T11446] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 418.056962][T19279] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3544'. [ 418.074624][T19276] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3545'. [ 418.096226][T11446] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 418.117053][T19276] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3545'. [ 418.126070][T11446] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 418.201403][ T1121] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 418.211173][T19276] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3545'. [ 418.220191][ T1121] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 418.229794][ T1121] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 418.247989][T19276] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3545'. [ 418.272770][ T1121] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 418.412810][T19291] veth1_to_bond: entered allmulticast mode [ 418.434061][T19291] veth1_to_bond: entered promiscuous mode [ 418.454949][T19291] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3550'. [ 418.493373][T19291] veth1_to_bond (unregistering): left allmulticast mode [ 418.512806][T19291] veth1_to_bond (unregistering): left promiscuous mode [ 418.584909][T19291] bond0: (slave bond_slave_1): Releasing backup interface [ 419.128839][T19327] ipvlan2: entered promiscuous mode [ 419.391393][T19332] syzkaller0: entered promiscuous mode [ 419.397351][T19332] syzkaller0: entered allmulticast mode [ 419.433975][T19332] gretap0: entered promiscuous mode [ 419.660813][T19355] Cannot find add_set index 46338 as target [ 422.149934][T19397] x_tables: unsorted underflow at hook 2 [ 422.266228][T19402] Bluetooth: MGMT ver 1.23 [ 422.283188][T19406] openvswitch: netlink: IPv4 tunnel dst address is zero [ 422.292034][T19405] netlink: 'syz.1.3580': attribute type 21 has an invalid length. [ 422.300711][T19405] IPv6: NLM_F_CREATE should be specified when creating new route [ 422.300898][T19406] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 422.321895][T19405] __nla_validate_parse: 7 callbacks suppressed [ 422.321909][T19405] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3580'. [ 422.342969][T19402] netlink: 80 bytes leftover after parsing attributes in process `syz.4.3581'. [ 422.412283][T19413] netlink: 'syz.2.3584': attribute type 2 has an invalid length. [ 422.429637][T19413] netlink: 'syz.2.3584': attribute type 11 has an invalid length. [ 422.445529][T19413] netlink: 132 bytes leftover after parsing attributes in process `syz.2.3584'. [ 422.458742][T19406] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3579'. [ 422.478318][T19416] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3585'. [ 422.493748][T19416] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3585'. [ 422.549799][T19421] netlink: 'syz.1.3587': attribute type 21 has an invalid length. [ 422.574652][T19421] netlink: 128 bytes leftover after parsing attributes in process `syz.1.3587'. [ 422.601152][T19421] netlink: 'syz.1.3587': attribute type 5 has an invalid length. [ 422.616840][T19421] netlink: 3 bytes leftover after parsing attributes in process `syz.1.3587'. [ 422.648624][T19429] netlink: 'syz.3.3589': attribute type 1 has an invalid length. [ 422.675296][T19433] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -107 0 [ 422.684389][T19421] xt_hashlimit: size too large, truncated to 1048576 [ 422.735663][T19429] 8021q: adding VLAN 0 to HW filter on device bond1 [ 422.779101][T19435] vlan2: entered promiscuous mode [ 422.816379][T19435] bond1: entered promiscuous mode [ 422.845129][T19435] vlan2: entered allmulticast mode [ 422.874261][T19435] bond1: entered allmulticast mode [ 422.905540][T19429] bond1: (slave bridge3): making interface the new active one [ 422.915797][T19429] bridge3: entered promiscuous mode [ 422.924203][T19429] bridge3: entered allmulticast mode [ 422.931789][T19429] bond1: (slave bridge3): Enslaving as an active interface with an up link [ 423.083055][T19456] netlink: 'syz.2.3596': attribute type 4 has an invalid length. [ 423.117908][T19455] sctp: [Deprecated]: syz.3.3595 (pid 19455) Use of int in max_burst socket option. [ 423.117908][T19455] Use struct sctp_assoc_value instead [ 423.134412][T19457] sctp: [Deprecated]: syz.3.3595 (pid 19457) Use of int in max_burst socket option. [ 423.134412][T19457] Use struct sctp_assoc_value instead [ 423.156496][T19455] openvswitch: netlink: Flow actions attr not present in new flow. [ 423.448632][T19472] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3600'. [ 423.965401][T19494] xt_hashlimit: size too large, truncated to 1048576 [ 424.010481][T19510] netlink: 'syz.1.3610': attribute type 23 has an invalid length. [ 424.154992][T19516] netlink: zone id is out of range [ 424.176350][T19516] netlink: set zone limit has 4 unknown bytes [ 424.357305][ T5633] Bluetooth: hci2: command 0x0401 tx timeout [ 424.361955][ T50] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 424.399680][T19531] SET target dimension over the limit! [ 424.491942][T19539] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3619'. [ 424.661865][T19549] netlink: 'syz.3.3622': attribute type 12 has an invalid length. [ 424.669714][T19545] syzkaller0: entered promiscuous mode [ 424.669734][T19545] syzkaller0: entered allmulticast mode [ 424.682076][T19549] netlink: 'syz.3.3622': attribute type 11 has an invalid length. [ 425.352568][ T29] audit: type=1804 audit(1783188459.201:11): pid=19586 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.3633" name="/newroot/95/cgroup.controllers" dev="tmpfs" ino=508 res=1 errno=0 [ 425.413469][ T29] audit: type=1800 audit(1783188459.241:12): pid=19586 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3633" name="cgroup.controllers" dev="tmpfs" ino=508 res=0 errno=0 [ 425.442791][T19593] openvswitch: netlink: ufid size 41726 bytes exceeds the range (1, 16) [ 425.454522][T19593] openvswitch: netlink: Message has 512 unknown bytes. [ 426.012389][T19625] netlink: 'syz.3.3646': attribute type 1 has an invalid length. [ 426.139883][T19625] 8021q: adding VLAN 0 to HW filter on device bond2 [ 426.561083][T19662] syzkaller0: entered promiscuous mode [ 426.577683][T19662] syzkaller0: entered allmulticast mode [ 426.735508][T19676] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 426.751751][T19675] tunl0: entered promiscuous mode [ 426.785944][T19675] netlink: 'syz.4.3660': attribute type 4 has an invalid length. [ 426.920851][T19685] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 426.948677][T19689] tipc: Enabling of bearer rejected, failed to enable media [ 427.031318][T19692] xt_hashlimit: invalid rate [ 427.088437][T19695] bridge: RTM_NEWNEIGH with invalid ether address [ 427.526146][T19729] __nla_validate_parse: 17 callbacks suppressed [ 427.526231][T19729] netlink: 768 bytes leftover after parsing attributes in process `syz.2.3673'. [ 427.696950][T19738] syzkaller0: entered allmulticast mode [ 427.780014][T19743] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3677'. [ 427.804095][T19745] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3678'. [ 427.825617][T19743] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3677'. [ 428.022914][T19759] netlink: 156 bytes leftover after parsing attributes in process `syz.2.3682'. [ 428.035249][T19760] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3683'. [ 428.043393][T19763] x_tables: ip6_tables: NETMAP.0 target: invalid size 40 (kernel) != (user) 0 [ 428.085060][T19761] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 428.113907][T19760] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3683'. [ 428.623346][T19786] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3688'. [ 428.937825][T19814] veth0_to_bridge: entered promiscuous mode [ 429.082628][T19814] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3694'. [ 429.155230][T19827] netlink: 'syz.1.3697': attribute type 21 has an invalid length. [ 429.166413][T19830] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3696'. [ 429.191749][T19827] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 429.199035][T19827] IPv6: NLM_F_CREATE should be set when creating new route [ 429.206481][T19827] IPv6: NLM_F_CREATE should be set when creating new route [ 429.213741][T19827] IPv6: NLM_F_CREATE should be set when creating new route [ 429.265790][T19833] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 429.279486][T19812] veth0_to_bridge: left promiscuous mode [ 429.331042][T19822] nbd2: detected capacity change from 0 to 5283809934367890 [ 429.355388][T19837] syzkaller0: entered promiscuous mode [ 429.365820][ T50] block nbd2: Receive control failed (result -104) [ 429.370918][ T1622] block nbd2: Send control failed (result -32) [ 429.379325][T19837] syzkaller0: entered allmulticast mode [ 429.385311][ T1622] block nbd2: Request send failed, requeueing [ 429.405518][ T9898] block nbd2: Dead connection, failed to find a fallback [ 429.419535][ T9898] block nbd2: shutting down sockets [ 429.425444][ T9898] blk_print_req_error: 111 callbacks suppressed [ 429.425458][ T9898] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x0 phys_seg 3 prio class 2 [ 429.443092][ T9898] buffer_io_error: 138 callbacks suppressed [ 429.443107][ T9898] Buffer I/O error on dev nbd2, logical block 1, async page read [ 429.458056][ T9898] Buffer I/O error on dev nbd2, logical block 2, async page read [ 429.466058][ T9898] Buffer I/O error on dev nbd2, logical block 3, async page read [ 429.515220][T19843] netlink: 'syz.0.3701': attribute type 8 has an invalid length. [ 429.571827][T19841] Cannot find add_set index 46338 as target [ 429.754707][ T171] bridge_slave_1: left allmulticast mode [ 429.761663][ T171] bridge_slave_1: left promiscuous mode [ 429.771153][ T171] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.781883][ T171] bridge_slave_0: left allmulticast mode [ 429.792984][ T171] bridge_slave_0: left promiscuous mode [ 429.801031][ T171] bridge0: port 1(bridge_slave_0) entered disabled state [ 430.348383][ T171] pim6reg: left allmulticast mode [ 430.599661][ T171] bond2 (unregistering): (slave ip6gre1): Releasing backup interface [ 430.610467][ T171] ip6gre1 (unregistering): left promiscuous mode [ 430.796131][ T171] bond1 (unregistering): (slave gretap1): Releasing active interface [ 430.994537][ T171] bond4 (unregistering): (slave bridge2): Releasing backup interface [ 431.002710][ T171] bridge2 (unregistering): left promiscuous mode [ 431.020632][ T171] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 431.030871][ T171] bond0 (unregistering): Released all slaves [ 431.040999][ T171] bond1 (unregistering): Released all slaves [ 431.060948][ T171] bond2 (unregistering): Released all slaves [ 431.078216][ T171] bond3 (unregistering): Released all slaves [ 431.098801][ T171] bond4 (unregistering): Released all slaves [ 431.112318][ T171] bond5 (unregistering): Released all slaves [ 431.125899][ T171] bond6 (unregistering): Released all slaves [ 431.140867][ T171] bond7 (unregistering): Released all slaves [ 431.155055][ T171] bond8 (unregistering): Released all slaves [ 431.174955][ T171] bond9 (unregistering): Released all slaves [ 431.202360][ T171] bond10 (unregistering): Released all slaves [ 431.367010][ T171] : left promiscuous mode [ 431.588645][T19911] block nbd3: Unsupported socket: should be TCP or UNIX. [ 431.611716][T19915] set match dimension is over the limit! [ 431.893206][ T171] tipc: Disabling bearer [ 431.945157][ T171] tipc: Left network mode [ 431.945430][T19935] netlink: 'syz.1.3718': attribute type 1 has an invalid length. [ 432.032223][ T171] IPVS: stopping backup sync thread 7522 ... [ 432.037408][T19935] 8021q: adding VLAN 0 to HW filter on device bond4 [ 432.153139][T19947] netlink: 'syz.2.3721': attribute type 15 has an invalid length. [ 432.161789][T19942] bond4: (slave gretap2): making interface the new active one [ 432.198607][T19942] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 432.210403][T19938] tipc: Enabled bearer , priority 0 [ 432.387880][T19943] syzkaller0: entered promiscuous mode [ 432.412420][T19943] syzkaller0: entered allmulticast mode [ 432.425074][T19943] tipc: Resetting bearer [ 432.503584][T19967] netlink: 'syz.1.3728': attribute type 1 has an invalid length. [ 432.614910][T11439] tipc: Resetting bearer [ 432.621766][T19936] tipc: Resetting bearer [ 434.338536][T19936] tipc: Disabling bearer [ 434.377043][ T24] tipc: Node number set to 2513994396 [ 434.886602][T20004] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 434.898827][T19981] bridge0: port 2(bridge_slave_1) entered disabled state [ 434.906540][T19981] bridge0: port 1(bridge_slave_0) entered disabled state [ 434.981546][T20009] netlink: 'syz.1.3738': attribute type 1 has an invalid length. [ 435.010941][T20011] netlink: 'syz.2.3740': attribute type 10 has an invalid length. [ 435.062269][T20015] __nla_validate_parse: 2 callbacks suppressed [ 435.062285][T20015] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3741'. [ 435.069294][T19981] bridge_slave_0: left allmulticast mode [ 435.087814][T20018] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3741'. [ 435.107073][T19981] bridge_slave_0: left promiscuous mode [ 435.114395][T19981] bridge0: port 1(bridge_slave_0) entered disabled state [ 435.153964][T19981] bridge_slave_1: left allmulticast mode [ 435.163001][T19981] bridge_slave_1: left promiscuous mode [ 435.169300][T19981] bridge0: port 2(bridge_slave_1) entered disabled state [ 435.182582][T19981] bond0: (slave bond_slave_0): Releasing backup interface [ 435.195159][T19981] bond0: (slave bond_slave_1): Releasing backup interface [ 435.208353][T19981] team0: Port device team_slave_0 removed [ 435.220400][T19981] team0: Port device team_slave_1 removed [ 435.230844][T19981] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 435.240235][T19981] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 435.250372][T19981] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 435.259840][T19981] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 435.274608][T19981] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 435.360981][T20009] 8021q: adding VLAN 0 to HW filter on device bond5 [ 435.383290][T20011] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 435.450516][T20013] vlan2: entered allmulticast mode [ 435.469840][T20013] veth0_to_bond: entered allmulticast mode [ 435.499792][T20013] bond5: (slave vlan2): Opening slave failed [ 435.579935][ T171] hsr_slave_0: left promiscuous mode [ 435.598828][ T171] hsr_slave_1: left promiscuous mode [ 435.621574][ T171] veth1_macvtap: left promiscuous mode [ 435.629284][ T171] veth0_macvtap: left promiscuous mode [ 435.636420][ T171] veth1_vlan: left promiscuous mode [ 435.644257][ T171] veth0_vlan: left promiscuous mode [ 436.203648][T20055] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3748'. [ 436.409413][T20065] IPv6: NLM_F_CREATE should be specified when creating new route [ 436.439030][T20065] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 436.446351][T20065] IPv6: NLM_F_CREATE should be set when creating new route [ 436.743069][T20083] netlink: 'syz.1.3756': attribute type 21 has an invalid length. [ 437.512324][T20117] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3767'. [ 437.554893][T20117] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3767'. [ 437.605717][T20132] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3767'. [ 437.605983][T20117] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3767'. [ 438.366039][T20182] netlink: 'syz.4.3786': attribute type 11 has an invalid length. [ 438.491850][T20193] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3788'. [ 438.546616][T20195] vlan2: entered promiscuous mode [ 438.565394][T20195] bridge0: entered promiscuous mode [ 438.653569][T20203] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3793'. [ 438.690171][T20200] bond4: entered allmulticast mode [ 439.016423][T20223] netlink: 'syz.1.3800': attribute type 8 has an invalid length. [ 439.072017][T20223] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 439.092518][T20223] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3800'. [ 439.241106][T20243] netlink: 'syz.4.3807': attribute type 1 has an invalid length. [ 439.282880][T20243] netlink: 'syz.4.3807': attribute type 1 has an invalid length. [ 439.520004][T20268] syz_tun: refused to change device tx_queue_len [ 439.624250][T20274] nbd: must specify at least one socket [ 439.835120][T20280] syzkaller0: entered promiscuous mode [ 439.862841][T20280] syzkaller0: entered allmulticast mode [ 440.121978][T20312] __nla_validate_parse: 12 callbacks suppressed [ 440.121996][T20312] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3824'. [ 442.061666][T11448] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 442.088180][T11448] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 442.105895][T11448] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 442.127042][T11448] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 442.203530][T20339] netlink: 'syz.2.3831': attribute type 2 has an invalid length. [ 442.387310][T20356] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3837'. [ 442.393910][T20357] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3836'. [ 442.414577][T20358] xt_hashlimit: max too large, truncated to 1048576 [ 442.468523][T20354] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3837'. [ 442.519231][T20358] No such timeout policy "syz1" [ 442.593488][T20368] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 442.659031][T20371] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3842'. [ 442.713919][T20374] netlink: 'syz.0.3842': attribute type 3 has an invalid length. [ 442.722079][T20374] netlink: 3 bytes leftover after parsing attributes in process `syz.0.3842'. [ 442.775256][T20378] bridge3: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 443.127400][T20389] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3848'. [ 443.342999][T20405] netlink: 'syz.4.3851': attribute type 29 has an invalid length. [ 443.345156][T20408] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3853'. [ 443.370842][T20408] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3853'. [ 443.429911][T20410] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 443.499620][T20413] netlink: 'syz.2.3855': attribute type 1 has an invalid length. [ 443.692166][T20420] bond2: (slave geneve2): Opening slave failed [ 443.741399][T20425] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3855'. [ 446.013374][T20425] 8021q: adding VLAN 0 to HW filter on device bond2 [ 446.051666][T20434] netlink: 'syz.3.3860': attribute type 4 has an invalid length. [ 446.192810][T20434] openvswitch: netlink: Flow actions attr not present in new flow. [ 446.208727][T20444] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3863'. [ 446.624415][T20473] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3873'. [ 446.712832][T20479] team0: Device ipvlan2 failed to register rx_handler [ 446.769027][T20486] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3876'. [ 446.770267][T20481] bridge: RTM_NEWNEIGH with invalid ether address [ 446.804894][T20476] syzkaller0: entered promiscuous mode [ 446.822999][T20476] syzkaller0: entered allmulticast mode [ 447.169144][T20507] netlink: 'syz.3.3880': attribute type 1 has an invalid length. [ 447.187534][T20507] netlink: 'syz.3.3880': attribute type 1 has an invalid length. [ 447.195492][T20507] netlink: 'syz.3.3880': attribute type 1 has an invalid length. [ 447.216847][T20507] netlink: 'syz.3.3880': attribute type 1 has an invalid length. [ 447.311185][T20520] netlink: 240 bytes leftover after parsing attributes in process `syz.2.3884'. [ 447.671609][T20535] sctp: [Deprecated]: syz.3.3890 (pid 20535) Use of int in max_burst socket option. [ 447.671609][T20535] Use struct sctp_assoc_value instead [ 447.788433][T20541] netlink: 'syz.1.3889': attribute type 1 has an invalid length. [ 447.812938][T20545] netlink: 'syz.2.3892': attribute type 1 has an invalid length. [ 447.842415][T20545] netlink: 'syz.2.3892': attribute type 4 has an invalid length. [ 447.854039][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 447.879382][T20545] netlink: 9491 bytes leftover after parsing attributes in process `syz.2.3892'. [ 447.894302][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 447.955660][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 447.999457][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.035527][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.071007][T20555] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3895'. [ 448.081277][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.089371][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.112217][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.120245][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.155582][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.212805][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.240048][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.255199][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.269102][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.276074][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.294104][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.310162][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.317469][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.324476][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.332381][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.340570][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.349481][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.356427][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.363782][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.371943][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.373236][T20564] syzkaller0: entered promiscuous mode [ 448.380279][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380310][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380336][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380369][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380394][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380419][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380444][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380468][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380493][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380517][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380542][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380567][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380591][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380616][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380641][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380665][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380689][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380714][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380739][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380763][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380788][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380813][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380837][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380861][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380886][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380910][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380935][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380959][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.380984][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.381009][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.381033][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.381057][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.381081][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.381106][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.381131][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.381155][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.381180][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.381205][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.381343][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.381375][T20546] IPVS: set_ctl: invalid protocol: 44 100.1.1.1:20004 [ 448.689589][T20564] syzkaller0: entered allmulticast mode [ 448.818594][T20573] macsec1: entered promiscuous mode [ 449.070451][T20585] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3902'. [ 449.088910][T20588] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3905'. [ 449.107468][T20591] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3904'. [ 449.245382][T20591] team1: entered promiscuous mode [ 449.261370][T20591] team1: entered allmulticast mode [ 449.419132][T20607] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3909'. [ 449.540345][T20610] syzkaller1: entered promiscuous mode [ 449.546209][T20610] syzkaller1: entered allmulticast mode [ 449.696028][T20617] openvswitch: netlink: Missing key (keys=40, expected=80) [ 449.951945][T20629] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 450.040770][ T5836] hid-generic 0005:0005:0008.0002: item fetching failed at offset 4/5 [ 450.051394][T20636] SET target dimension over the limit! [ 450.091006][ T5836] hid-generic 0005:0005:0008.0002: probe with driver hid-generic failed with error -22 [ 450.106882][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 450.114943][ C1] ip6_tunnel: ip6tnl2 xmit: Local address not yet configured! [ 450.232519][T20638] veth9: entered promiscuous mode [ 450.774448][T20672] IPVS: set_ctl: invalid protocol: 43 172.20.20.170:20002 [ 450.793853][T20667] 8021q: adding VLAN 0 to HW filter on device bond5 [ 451.005473][T20682] C speed is unknown, defaulting to 1000 [ 451.948087][T20700] __nla_validate_parse: 4 callbacks suppressed [ 451.948134][T20700] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3939'. [ 451.966138][T20700] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3939'. [ 452.234910][T20706] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 452.250626][T20706] IPVS: set_ctl: invalid protocol: 58 0.0.0.0:20000 [ 452.415860][T20711] sit1: entered promiscuous mode [ 452.423031][T20711] sit1: entered allmulticast mode [ 452.508893][ T5633] Bluetooth: hci3: command 0x0405 tx timeout [ 452.945297][T20734] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3949'. [ 452.972845][T17688] syz-executor invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0 [ 453.032559][T17688] CPU: 1 UID: 0 PID: 17688 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) [ 453.032585][T17688] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 453.032595][T17688] Call Trace: [ 453.032602][T17688] [ 453.032608][T17688] dump_stack_lvl+0xe8/0x150 [ 453.032638][T17688] dump_header+0xd3/0x4b0 [ 453.032665][T17688] oom_kill_process+0x3ab/0x970 [ 453.032688][T17688] out_of_memory+0x1064/0x1480 [ 453.032703][T17688] ? try_charge_memcg+0xbca/0x1590 [ 453.032738][T17688] ? __pfx_out_of_memory+0x10/0x10 [ 453.032754][T17688] ? do_raw_spin_unlock+0xf5/0x210 [ 453.032782][T17688] try_charge_memcg+0xc74/0x1590 [ 453.032820][T17688] ? __pfx_try_charge_memcg+0x10/0x10 [ 453.032860][T17688] ? charge_memcg+0x20/0x2b0 [ 453.032886][T17688] charge_memcg+0x19c/0x2b0 [ 453.032909][T17688] ? mem_cgroup_swapin_charge_folio+0x2b/0x390 [ 453.032930][T17688] mem_cgroup_swapin_charge_folio+0x25a/0x390 [ 453.032959][T17688] swap_cache_alloc_folio+0x4de/0x990 [ 453.032990][T17688] swap_cluster_readahead+0x4d9/0x640 [ 453.033015][T17688] ? __pfx_swap_cluster_readahead+0x10/0x10 [ 453.033041][T17688] ? rcu_is_watching+0x15/0xb0 [ 453.033066][T17688] ? get_vma_policy+0x27b/0x3c0 [ 453.033092][T17688] swapin_readahead+0x19a/0xc10 [ 453.033115][T17688] ? swap_table_get+0x1e/0x260 [ 453.033130][T17688] ? swap_table_get+0x1e/0x260 [ 453.033150][T17688] ? __pfx_swapin_readahead+0x10/0x10 [ 453.033168][T17688] ? swap_table_get+0x1e/0x260 [ 453.033185][T17688] ? swap_table_get+0x1e/0x260 [ 453.033197][T17688] ? swap_table_get+0x1e/0x260 [ 453.033216][T17688] ? swap_table_get+0x216/0x260 [ 453.033233][T17688] ? swap_cache_get_folio+0x2e7/0x2f0 [ 453.033256][T17688] do_swap_page+0x455/0x5060 [ 453.033293][T17688] ? __pte_offset_map+0x29/0x240 [ 453.033317][T17688] ? __lock_acquire+0x683/0x2cf0 [ 453.033338][T17688] ? do_swap_page+0x124/0x5060 [ 453.033361][T17688] ? __pfx_do_swap_page+0x10/0x10 [ 453.033386][T17688] ? __pte_offset_map+0x1ae/0x240 [ 453.033412][T17688] ? pte_offset_map_rw_nolock+0xea/0x160 [ 453.033433][T17688] handle_mm_fault+0x124c/0x3080 [ 453.033462][T17688] ? handle_mm_fault+0xec/0x3080 [ 453.033487][T17688] ? __pfx_handle_mm_fault+0x10/0x10 [ 453.033504][T17688] ? lock_vma_under_rcu+0x45a/0x500 [ 453.033547][T17688] do_user_addr_fault+0xa4d/0x1340 [ 453.033580][T17688] ? trace_page_fault_user+0x84/0x1e0 [ 453.033607][T17688] exc_page_fault+0x6a/0xc0 [ 453.033628][T17688] asm_exc_page_fault+0x26/0x30 [ 453.033645][T17688] RIP: 0033:0x7f7d1b55e68e [ 453.033660][T17688] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 453.033676][T17688] RSP: 002b:00007fff1de5e858 EFLAGS: 00010246 [ 453.033690][T17688] RAX: 0000000000000000 RBX: 000055555b943500 RCX: 00007f7d1b55e68e [ 453.033703][T17688] RDX: 00007fff1de5e8b0 RSI: 0000000000000000 RDI: 0000000000000000 [ 453.033713][T17688] RBP: 00007fff1de5e91c R08: 0000000000000000 R09: 0000000000000000 [ 453.033722][T17688] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000001388 [ 453.033734][T17688] R13: 00000000000927c0 R14: 000000000006e436 R15: 00007fff1de5e970 [ 453.033761][T17688] [ 453.347779][T17688] memory: usage 307200kB, limit 307200kB, failcnt 633 [ 453.355679][T17688] memory+swap: usage 307320kB, limit 9007199254740988kB, failcnt 0 [ 453.365205][T17688] kmem: usage 307184kB, limit 9007199254740988kB, failcnt 0 [ 453.372768][T17688] Memory cgroup stats for /syz4: [ 453.372911][T17688] cache 0 [ 453.380822][T17688] rss 0 [ 453.383585][T17688] rss_huge 0 [ 453.390839][T17688] shmem 0 [ 453.393816][T17688] mapped_file 0 [ 453.397566][T17688] dirty 0 [ 453.400499][T17688] writeback 0 [ 453.403776][T17688] workingset_refault_anon 8 [ 453.408295][T17688] workingset_refault_file 57 [ 453.412884][T17688] swap 122880 [ 453.416160][T17688] swapcached 172032 [ 453.420033][T17688] pgpgin 62105 [ 453.423403][T17688] pgpgout 62101 [ 453.427151][T17688] pgfault 122870 [ 453.430692][T17688] pgmajfault 8 [ 453.434055][T17688] inactive_anon 4096 [ 453.437977][T17688] active_anon 12288 [ 453.441782][T17688] inactive_file 0 [ 453.445412][T17688] active_file 0 [ 453.448919][T17688] unevictable 0 [ 453.452371][T17688] hierarchical_memory_limit 314572800 [ 453.458037][T17688] hierarchical_memsw_limit 9223372036854771712 [ 453.464190][T17688] total_cache 0 [ 453.467771][T17688] total_rss 0 [ 453.471058][T17688] total_rss_huge 0 [ 453.474779][T17688] total_shmem 0 [ 453.478303][T17688] total_mapped_file 0 [ 453.482282][T17688] total_dirty 0 [ 453.485737][T17688] total_writeback 0 [ 453.489799][T17688] total_workingset_refault_anon 8 [ 453.494839][T17688] total_workingset_refault_file 57 [ 453.500034][T17688] total_swap 122880 [ 453.503847][T17688] total_swapcached 172032 [ 453.508211][T17688] total_pgpgin 62106 [ 453.512102][T17688] total_pgpgout 62102 [ 453.516077][T17688] total_pgfault 122872 [ 453.520430][T17688] total_pgmajfault 8 [ 453.524323][T17688] total_inactive_anon 4096 [ 453.528789][T17688] total_active_anon 12288 [ 453.533112][T17688] total_inactive_file 0 [ 453.537320][T17688] total_active_file 0 [ 453.541299][T17688] total_unevictable 0 [ 453.545278][T17688] anon_cost 0 [ 453.548904][T17688] file_cost 0 [ 453.552200][T17688] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0-1,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.3938,pid=20695,uid=0 [ 453.570304][T17688] Memory cgroup out of memory: Killed process 20695 (syz.4.3938) total-vm:98596kB, anon-rss:1248kB, file-rss:21644kB, shmem-rss:0kB, UID:0 pgtables:124kB oom_score_adj:1000 [ 454.421444][T20767] macvlan0: entered promiscuous mode [ 454.497295][T20769] mac80211_hwsim hwsim22 syzkaller0: entered promiscuous mode [ 454.543730][T20769] mac80211_hwsim hwsim22 syzkaller0: entered allmulticast mode [ 454.631642][T20771] x_tables: duplicate underflow at hook 1 [ 454.674404][T20776] netlink: 'syz.0.3960': attribute type 1 has an invalid length. [ 454.695192][T20777] netlink: 'syz.0.3960': attribute type 1 has an invalid length. [ 454.755249][T20776] 8021q: adding VLAN 0 to HW filter on device bond6 [ 456.796837][T20802] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3967'. [ 457.573486][T20830] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3974'. [ 457.798512][T20817] syzkaller0: entered promiscuous mode [ 457.817497][T20817] syzkaller0: entered allmulticast mode [ 457.823405][T20833] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3975'. [ 459.712594][ T9898] block nbd2: Possible stuck request ffff888027525080: control (read@0,1024B). Runtime 30 seconds [ 460.277978][T20837] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 460.302020][T20838] bridge6: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 460.789938][T20854] block nbd3: Unsupported socket: should be TCP or UNIX. [ 460.889522][T20869] netlink: 84 bytes leftover after parsing attributes in process `syz.1.3984'. [ 461.235518][ T50] Bluetooth: hci3: link tx timeout [ 461.246221][ T50] Bluetooth: hci3: killing stalled connection 11:aa:aa:aa:aa:aa [ 461.303132][T20884] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 461.420804][T20891] netlink: 'syz.3.3990': attribute type 10 has an invalid length. [ 461.464359][T20893] netlink: 'syz.4.3992': attribute type 1 has an invalid length. [ 461.478082][T20893] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3992'. [ 461.488768][T20893] workqueue: Failed to create a rescuer kthread for wq "phy3-mac-cmds": -EINTR [ 461.714906][T20905] netlink: 'syz.0.3993': attribute type 4 has an invalid length. [ 461.747485][T20905] netlink: 17 bytes leftover after parsing attributes in process `syz.0.3993'. [ 461.772321][T20907] sctp: [Deprecated]: syz.2.3995 (pid 20907) Use of int in max_burst socket option. [ 461.772321][T20907] Use struct sctp_assoc_value instead [ 461.829457][T20905] netlink: 14601 bytes leftover after parsing attributes in process `syz.0.3993'. [ 461.994094][T20917] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3999'. [ 462.012928][T20918] netlink: 'syz.4.4000': attribute type 1 has an invalid length. [ 462.049922][T20922] netlink: 32 bytes leftover after parsing attributes in process `syz.0.4001'. [ 462.096472][T20923] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3999'. [ 462.121871][T20917] 8021q: adding VLAN 0 to HW filter on device bond3 [ 462.134616][T20923] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3999'. [ 462.191312][T20918] 8021q: adding VLAN 0 to HW filter on device bond2 [ 462.203497][T20924] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 462.436477][T20938] team0: Port device xfrm0 added [ 462.528618][T20942] netlink: 'syz.2.4006': attribute type 1 has an invalid length. [ 462.552679][T20944] netlink: 'syz.0.4008': attribute type 2 has an invalid length. [ 462.605584][T20944] __nla_validate_parse: 2 callbacks suppressed [ 462.605601][T20944] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4008'. [ 462.629787][T20948] syzkaller1: entered promiscuous mode [ 462.645879][T20948] syzkaller1: entered allmulticast mode [ 462.660790][T20952] netlink: 'syz.0.4008': attribute type 30 has an invalid length. [ 462.714609][T20952] bond7: option arp_missed_max: invalid value (0) [ 462.721332][T20952] bond7: option arp_missed_max: allowed values 1 - 255 [ 462.739758][T20952] bond7 (unregistering): Released all slaves [ 462.789084][T20958] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4011'. [ 462.789131][T20962] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4011'. [ 462.844917][T20958] syz.4.4011: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 462.860952][T20958] CPU: 1 UID: 0 PID: 20958 Comm: syz.4.4011 Not tainted syzkaller #0 PREEMPT(full) [ 462.860974][T20958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 462.860985][T20958] Call Trace: [ 462.860992][T20958] [ 462.860999][T20958] dump_stack_lvl+0xe8/0x150 [ 462.861032][T20958] warn_alloc+0x24c/0x270 [ 462.861057][T20958] ? stack_depot_save_flags+0x33/0x800 [ 462.861082][T20958] ? __pfx_warn_alloc+0x10/0x10 [ 462.861107][T20958] ? kasan_save_track+0x3e/0x80 [ 462.861128][T20958] ? __kasan_kmalloc+0x93/0xb0 [ 462.861153][T20958] ? xsk_setsockopt+0x52a/0x960 [ 462.861172][T20958] ? do_sock_setsockopt+0x17c/0x1b0 [ 462.861196][T20958] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 462.861220][T20958] ? do_syscall_64+0x174/0x580 [ 462.861244][T20958] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.861272][T20958] __vmalloc_node_range_noprof+0x12c/0x1730 [ 462.861325][T20958] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 462.861352][T20958] ? __kasan_kmalloc+0x93/0xb0 [ 462.861377][T20958] ? __kmalloc_cache_noprof+0x32d/0x660 [ 462.861401][T20958] ? __kmalloc_cache_noprof+0x150/0x660 [ 462.861427][T20958] vmalloc_user_noprof+0xad/0xe0 [ 462.861448][T20958] ? xskq_create+0xbf/0x170 [ 462.861474][T20958] xskq_create+0xbf/0x170 [ 462.861499][T20958] xsk_init_queue+0x8a/0xe0 [ 462.861523][T20958] xsk_setsockopt+0x52a/0x960 [ 462.861543][T20958] ? __fget_files+0x2a/0x420 [ 462.861569][T20958] ? __pfx_xsk_setsockopt+0x10/0x10 [ 462.861590][T20958] ? __pfx_aa_sk_perm+0x10/0x10 [ 462.861621][T20958] ? aa_sock_opt_perm+0xff/0x1a0 [ 462.861644][T20958] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 462.861663][T20958] ? __pfx_xsk_setsockopt+0x10/0x10 [ 462.861685][T20958] do_sock_setsockopt+0x17c/0x1b0 [ 462.861716][T20958] __x64_sys_setsockopt+0x13d/0x1b0 [ 462.861744][T20958] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.861764][T20958] do_syscall_64+0x174/0x580 [ 462.861787][T20958] ? trace_irq_disable+0x3b/0x140 [ 462.861809][T20958] ? clear_bhb_loop+0x40/0x90 [ 462.861832][T20958] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.861850][T20958] RIP: 0033:0x7f7d1b59de59 [ 462.861867][T20958] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 462.861882][T20958] RSP: 002b:00007f7d1c4cf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 462.861900][T20958] RAX: ffffffffffffffda RBX: 00007f7d1b825fa0 RCX: 00007f7d1b59de59 [ 462.861914][T20958] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000007 [ 462.861924][T20958] RBP: 00007f7d1b633e6f R08: 0000000000000004 R09: 0000000000000000 [ 462.861943][T20958] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 462.861954][T20958] R13: 00007f7d1b826038 R14: 00007f7d1b825fa0 R15: 00007fff1de5e578 [ 462.861984][T20958] [ 462.862059][T20958] Mem-Info: [ 463.148349][T20958] active_anon:6715 inactive_anon:4 isolated_anon:0 [ 463.148349][T20958] active_file:342 inactive_file:42920 isolated_file:0 [ 463.148349][T20958] unevictable:768 dirty:30 writeback:0 [ 463.148349][T20958] slab_reclaimable:11754 slab_unreclaimable:115844 [ 463.148349][T20958] mapped:29463 shmem:1293 pagetables:1490 [ 463.148349][T20958] sec_pagetables:0 bounce:0 [ 463.148349][T20958] kernel_misc_reclaimable:0 [ 463.148349][T20958] free:1297037 free_pcp:14110 free_cma:0 [ 463.195173][T20958] Node 0 active_anon:26860kB inactive_anon:16kB active_file:1368kB inactive_file:171480kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:117852kB dirty:120kB writeback:0kB shmem:3636kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15600kB pagetables:5820kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 463.253332][T20958] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 463.288221][T20958] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 463.322865][ T50] Bluetooth: hci3: command 0x0405 tx timeout [ 463.329726][T20958] lowmem_reserve[]: 0 2489 2489 2489 2489 [ 463.335634][T20958] Node 0 DMA32 free:1232280kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:25860kB inactive_anon:16kB active_file:1368kB inactive_file:171480kB unevictable:1536kB writepending:120kB zspages:0kB present:3129332kB managed:2548796kB mlocked:0kB bounce:0kB free_pcp:58052kB local_pcp:34776kB free_cma:0kB [ 463.399855][T20958] lowmem_reserve[]: 0 0 0 0 0 [ 463.405651][T20958] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:264kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 463.439848][T20958] lowmem_reserve[]: 0 0 0 0 0 [ 463.444647][T20971] ÿÿÿÿÿÿ: renamed from vlan1 (while UP) [ 463.453895][T20958] Node 1 Normal free:3940304kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 463.489420][T20958] lowmem_reserve[]: 0 0 0 0 0 [ 463.496096][T20958] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 463.526904][T20958] Node 0 DMA32: 3212*4kB (UME) 1597*8kB (UME) 730*16kB (UME) 388*32kB (UME) 136*64kB (UME) 83*128kB (UME) 35*256kB (UME) 29*512kB (UM) 14*1024kB (UM) 10*2048kB (UM) 271*4096kB (UM) = 1237688kB [ 463.558396][T20958] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 463.572909][T20958] Node 1 Normal: 2*4kB (U) 5*8kB (UM) 10*16kB (UM) 8*32kB (UM) 6*64kB (UM) 3*128kB (UM) 5*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 960*4096kB (M) = 3940304kB [ 463.620217][T20958] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 463.624702][T20980] vlan1: entered allmulticast mode [ 463.631555][T20981] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4016'. [ 463.635812][T20980] bond0: entered allmulticast mode [ 463.663443][T20958] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 463.696277][T20980] dummy0: entered allmulticast mode [ 463.697465][T20958] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 463.716098][T20958] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 463.727292][T20958] 44551 total pagecache pages [ 463.733242][T20958] 0 pages in swap cache [ 463.741112][T20958] Free swap = 124996kB [ 463.746023][T20958] Total swap = 124996kB [ 463.750865][T20958] 2097051 pages RAM [ 463.755228][T20958] 0 pages HighMem/MovableOnly [ 463.760604][T20958] 428171 pages reserved [ 463.765333][T20958] 0 pages cma reserved [ 463.835880][T20988] netlink: 'syz.0.4020': attribute type 1 has an invalid length. [ 463.876451][T20989] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4021'. [ 463.909074][T20991] macsec0: entered allmulticast mode [ 464.207503][T21011] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4025'. [ 464.238554][T21015] netlink: 'syz.4.4026': attribute type 1 has an invalid length. [ 464.271579][T21011] xt_hashlimit: invalid rate [ 464.529888][T20984] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 464.593370][T21029] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4030'. [ 464.664273][T21029] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4030'. [ 464.689797][T21029] netlink: 2 bytes leftover after parsing attributes in process `syz.2.4030'. [ 464.720975][T21034] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4033'. [ 464.732308][T21029] veth1_to_bridge: entered allmulticast mode [ 465.023882][T21048] netlink: 'syz.2.4036': attribute type 2 has an invalid length. [ 465.444688][T21059] syzkaller0: entered promiscuous mode [ 465.456957][T21059] syzkaller0: entered allmulticast mode [ 465.528055][T21071] team0 (unregistering): Port device team_slave_0 removed [ 465.563017][T21071] team0 (unregistering): Port device team_slave_1 removed [ 466.555128][T21129] xt_ecn: cannot match TCP bits for non-tcp packets [ 467.135991][T21141] gretap0: entered promiscuous mode [ 467.197329][T21141] vlan3: entered promiscuous mode [ 467.769839][T21181] sctp: [Deprecated]: syz.0.4070 (pid 21181) Use of int in max_burst socket option. [ 467.769839][T21181] Use struct sctp_assoc_value instead [ 467.777531][T21183] validate_nla: 3 callbacks suppressed [ 467.777561][T21183] netlink: 'syz.1.4071': attribute type 1 has an invalid length. [ 467.805484][T21183] __nla_validate_parse: 6 callbacks suppressed [ 467.805515][T21183] netlink: 224 bytes leftover after parsing attributes in process `syz.1.4071'. [ 467.926088][T21187] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4072'. [ 468.159835][T21189] syzkaller0: entered promiscuous mode [ 468.173366][T21189] syzkaller0: entered allmulticast mode [ 468.194616][T21202] netlink: 'syz.0.4076': attribute type 29 has an invalid length. [ 468.221258][T21202] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4076'. [ 468.301974][T21193] netlink: 'syz.4.4073': attribute type 1 has an invalid length. [ 468.381764][T21193] 8021q: adding VLAN 0 to HW filter on device bond3 [ 468.427073][T21198] bond3: (slave veth0_to_bond): making interface the new active one [ 468.461692][T21198] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 468.518599][T21216] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 468.534664][T21222] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4082'. [ 468.547722][T21222] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4082'. [ 468.666479][T21228] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4081'. [ 468.723832][T21225] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4081'. [ 470.951168][T21189] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 471.167784][T21235] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4086'. [ 471.601175][T21252] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 472.250211][T21274] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4094'. [ 472.338527][T21274] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4094'. [ 472.390112][ T29] audit: type=1804 audit(1783188506.241:13): pid=21282 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.4097" name="/newroot/193/cgroup.controllers" dev="tmpfs" ino=1008 res=1 errno=0 [ 472.427555][ T29] audit: type=1800 audit(1783188506.261:14): pid=21282 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.4097" name="cgroup.controllers" dev="tmpfs" ino=1008 res=0 errno=0 [ 472.630793][T21293] netlink: 'syz.0.4102': attribute type 4 has an invalid length. [ 472.708376][T21295] netlink: 'syz.4.4101': attribute type 1 has an invalid length. [ 473.160760][T21318] __nla_validate_parse: 3 callbacks suppressed [ 473.160778][T21318] netlink: 400 bytes leftover after parsing attributes in process `syz.2.4109'. [ 473.271474][T21323] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4108'. [ 473.432540][T21327] netlink: 11 bytes leftover after parsing attributes in process `syz.2.4110'. [ 473.552656][T21330] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4111'. [ 473.593044][T21330] netlink: 'syz.1.4111': attribute type 30 has an invalid length. [ 473.649816][T21330] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4111'. [ 473.903363][T21344] netlink: 'syz.3.4116': attribute type 1 has an invalid length. [ 473.933033][T21347] can: request_module (can-proto-0) failed. [ 473.947224][T21354] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4118'. [ 474.012937][T21360] netlink: 'syz.4.4121': attribute type 3 has an invalid length. [ 474.012999][T21358] netlink: 84 bytes leftover after parsing attributes in process `syz.0.4119'. [ 474.025000][T21360] netlink: 'syz.4.4121': attribute type 1 has an invalid length. [ 474.040059][T21360] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4121'. [ 474.129281][T21344] bond7: entered promiscuous mode [ 474.164960][T21344] 8021q: adding VLAN 0 to HW filter on device bond7 [ 474.277451][T21361] bond7: (slave bridge4): making interface the new active one [ 474.301928][T21361] bridge4: entered promiscuous mode [ 474.324058][T21361] bond7: (slave bridge4): Enslaving as an active interface with an up link [ 474.359412][T21375] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4124'. [ 474.424164][T21373] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4125'. [ 474.544187][T21379] syzkaller0: entered promiscuous mode [ 474.558186][T21379] syzkaller0: entered allmulticast mode [ 474.597119][T21381] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 474.946123][T21396] netlink: 'syz.2.4132': attribute type 1 has an invalid length. [ 475.276977][T21396] 8021q: adding VLAN 0 to HW filter on device bond4 [ 475.317372][T21401] bond4: up delay (136) is not a multiple of miimon (100), value rounded to 100 ms [ 475.390721][T21401] bond4: entered allmulticast mode [ 475.483835][T21407] bond4: (slave ip6gretap1): Enslaving as an active interface with an up link [ 475.845594][T21431] netlink: 'syz.0.4141': attribute type 13 has an invalid length. [ 476.243323][T21463] netlink: 'syz.4.4145': attribute type 21 has an invalid length. [ 476.271831][T21463] netlink: 'syz.4.4145': attribute type 6 has an invalid length. [ 476.689013][T21476] openvswitch: netlink: IPv6 tunnel dst address is zero [ 476.704195][T21478] netlink: 'syz.1.4152': attribute type 19 has an invalid length. [ 476.729327][T21478] netlink: 'syz.1.4152': attribute type 19 has an invalid length. [ 477.053366][T21495] syzkaller1: entered promiscuous mode [ 477.081979][T21495] syzkaller1: entered allmulticast mode [ 477.105272][T21495] PF_CAN: dropped non conform CAN skbuff: dev type 280, len 324 [ 477.143427][T21504] IPVS: length: 8 != 1152 [ 477.283231][T21503] 8021q: adding VLAN 0 to HW filter on device bond8 [ 477.492791][T21523] sctp: [Deprecated]: syz.0.4172 (pid 21523) Use of int in max_burst socket option. [ 477.492791][T21523] Use struct sctp_assoc_value instead [ 477.585244][T21525] veth0_to_bridge: entered promiscuous mode [ 477.612886][T21529] veth0_to_bridge: left promiscuous mode [ 477.632743][T21532] openvswitch: netlink: Flow key attribute not present in set flow. [ 477.743123][ T5739] IPVS: starting estimator thread 0... [ 477.750980][T21538] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 477.798489][ T5633] Bluetooth: hci5: command 0x0406 tx timeout [ 477.855789][T11433] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 477.874679][T21539] IPVS: using max 32 ests per chain, 76800 per kthread [ 477.912512][T21543] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 478.176409][T21560] __nla_validate_parse: 15 callbacks suppressed [ 478.176426][T21560] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4180'. [ 478.199553][T21564] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4182'. [ 478.301420][T21564] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4182'. [ 478.687091][T21585] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 478.974030][T21600] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4193'. [ 479.370211][T21620] validate_nla: 4 callbacks suppressed [ 479.370243][T21620] netlink: 'syz.2.4197': attribute type 1 has an invalid length. [ 479.532759][T21636] netlink: 'syz.1.4202': attribute type 1 has an invalid length. [ 479.562660][T21619] bond5: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 479.637351][T21619] bond5 (unregistering): Released all slaves [ 479.762109][T21633] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4201'. [ 479.798302][T21633] netlink: 64 bytes leftover after parsing attributes in process `syz.0.4201'. [ 479.901929][T21620] 8021q: adding VLAN 0 to HW filter on device bond5 [ 479.962803][T21636] bond6: entered promiscuous mode [ 479.969712][T21636] 8021q: adding VLAN 0 to HW filter on device bond6 [ 480.017129][T21638] 8021q: adding VLAN 0 to HW filter on device bond6 [ 480.032144][T21638] bond6: (slave vti0): The slave device specified does not support setting the MAC address [ 480.044466][T21638] bond6: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 480.064236][T21638] bond6: (slave vti0): making interface the new active one [ 480.073402][T21638] vti0: entered promiscuous mode [ 480.085232][T21638] bond6: (slave vti0): Enslaving as an active interface with an up link [ 480.412239][T21669] syzkaller1: entered allmulticast mode [ 480.976093][T21714] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4221'. [ 481.279979][T21739] ICMPv6: Received fragmented ndisc packet. Carefully consider disabling suppress_frag_ndisc. [ 481.324899][T21739] netlink: 576 bytes leftover after parsing attributes in process `syz.2.4228'. [ 481.480997][ T9] IPVS: starting estimator thread 0... [ 481.489049][T21741] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4230'. [ 481.565267][T21745] syzkaller0: entered promiscuous mode [ 481.571791][T21745] syzkaller0: entered allmulticast mode [ 481.610152][T21748] IPVS: using max 31 ests per chain, 74400 per kthread [ 481.618847][T21746] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap2 [ 481.631699][T21746] gretap2: default qdisc (pfifo_fast) fail, fallback to noqueue [ 481.640194][T21746] gretap2: entered promiscuous mode [ 481.645609][T21746] gretap2: entered allmulticast mode [ 482.036420][T21771] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4239'. [ 482.151407][T21779] bond3: (slave veth0_to_bond): Releasing active interface [ 482.384529][T21791] netlink: 'syz.4.4243': attribute type 142 has an invalid length. [ 485.046988][T21818] bridge1: entered promiscuous mode [ 485.063366][T21818] bridge1: entered allmulticast mode [ 485.463349][T21841] netlink: 'syz.0.4255': attribute type 9 has an invalid length. [ 485.559654][T21847] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 485.585612][T21847] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 485.601964][T21842] __nla_validate_parse: 2 callbacks suppressed [ 485.601995][T21842] netlink: 76 bytes leftover after parsing attributes in process `syz.0.4255'. [ 485.616322][T21855] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4257'. [ 485.652357][T21842] nbd: illegal input index 65508 [ 486.069821][T21867] netlink: 'syz.2.4261': attribute type 1 has an invalid length. [ 486.083468][T21867] netlink: 240 bytes leftover after parsing attributes in process `syz.2.4261'. [ 486.096246][T21867] netlink: 'syz.2.4261': attribute type 1 has an invalid length. [ 486.339425][T21884] netlink: 36 bytes leftover after parsing attributes in process `syz.4.4265'. [ 486.339981][T21886] netlink: 100 bytes leftover after parsing attributes in process `syz.3.4266'. [ 486.405895][T21886] netlink: 72 bytes leftover after parsing attributes in process `syz.3.4266'. [ 486.845485][T21915] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4277'. [ 487.194567][T21932] netlink: 'syz.2.4282': attribute type 12 has an invalid length. [ 487.249348][T21905] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4272'. [ 487.264109][T21925] bond10: entered promiscuous mode [ 487.324253][T21939] bond8: Removing last ns target with arp_interval on [ 487.381876][T21945] netlink: 'syz.0.4284': attribute type 2 has an invalid length. [ 487.412312][T21944] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4284'. [ 488.052451][ T50] Bluetooth: hci2: command 0x0401 tx timeout [ 488.234788][T21984] netlink: 112 bytes leftover after parsing attributes in process `syz.3.4292'. [ 488.495901][T21994] xt_cluster: you have exceeded the maximum number of cluster nodes (2048 > 32) [ 488.884669][T22015] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 489.002681][T22021] netlink: 'syz.1.4299': attribute type 1 has an invalid length. [ 489.250342][T22021] bond9: entered promiscuous mode [ 489.256044][T22021] 8021q: adding VLAN 0 to HW filter on device bond9 [ 489.281464][T22028] ipvlan3: entered allmulticast mode [ 489.287526][T22028] bond9: entered allmulticast mode [ 489.442680][T22039] bond9: (slave bridge8): making interface the new active one [ 489.456858][T22039] bridge8: entered promiscuous mode [ 489.472160][T22039] bridge8: entered allmulticast mode [ 489.500093][T22039] bond9: (slave bridge8): Enslaving as an active interface with an up link [ 489.576594][T22050] netlink: 'syz.4.4307': attribute type 6 has an invalid length. [ 489.801530][ T9898] block nbd2: Possible stuck request ffff888027525080: control (read@0,1024B). Runtime 60 seconds [ 490.191366][T22077] netlink: 'syz.1.4312': attribute type 1 has an invalid length. [ 490.228935][T22077] netlink: 'syz.1.4312': attribute type 13 has an invalid length. [ 490.669314][T22103] netlink: 'syz.2.4318': attribute type 21 has an invalid length. [ 490.850197][T22098] x_tables: duplicate underflow at hook 3 [ 491.225243][T22118] lo: Caught tx_queue_len zero misconfig [ 492.038867][T22175] __nla_validate_parse: 6 callbacks suppressed [ 492.038901][T22175] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4330'. [ 492.214902][T22188] netlink: 'syz.4.4333': attribute type 9 has an invalid length. [ 492.272239][T22186] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 492.384426][T22200] netlink: 11 bytes leftover after parsing attributes in process `syz.3.4337'. [ 492.413365][T22202] syz.0.4336: vmalloc error: size 8589938688, exceeds total pages, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 492.503919][T22202] CPU: 1 UID: 0 PID: 22202 Comm: syz.0.4336 Not tainted syzkaller #0 PREEMPT(full) [ 492.503952][T22202] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 492.503964][T22202] Call Trace: [ 492.503971][T22202] [ 492.503979][T22202] dump_stack_lvl+0xe8/0x150 [ 492.504012][T22202] warn_alloc+0x24c/0x270 [ 492.504038][T22202] ? stack_depot_save_flags+0x33/0x800 [ 492.504182][T22202] ? __pfx_warn_alloc+0x10/0x10 [ 492.504207][T22202] ? kasan_save_track+0x3e/0x80 [ 492.504229][T22202] ? __kasan_kmalloc+0x93/0xb0 [ 492.504254][T22202] ? xsk_setsockopt+0x52a/0x960 [ 492.504316][T22202] ? do_sock_setsockopt+0x17c/0x1b0 [ 492.504372][T22202] ? __x64_sys_setsockopt+0x13d/0x1b0 [ 492.504396][T22202] ? do_syscall_64+0x174/0x580 [ 492.504470][T22202] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.504499][T22202] __vmalloc_node_range_noprof+0x12c/0x1730 [ 492.504560][T22202] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 492.504588][T22202] ? __kasan_kmalloc+0x93/0xb0 [ 492.504614][T22202] ? __kmalloc_cache_noprof+0x32d/0x660 [ 492.504637][T22202] ? __kmalloc_cache_noprof+0x150/0x660 [ 492.504663][T22202] vmalloc_user_noprof+0xad/0xe0 [ 492.504686][T22202] ? xskq_create+0xbf/0x170 [ 492.504709][T22202] xskq_create+0xbf/0x170 [ 492.504735][T22202] xsk_init_queue+0x8a/0xe0 [ 492.504759][T22202] xsk_setsockopt+0x52a/0x960 [ 492.504780][T22202] ? __fget_files+0x2a/0x420 [ 492.504805][T22202] ? __pfx_xsk_setsockopt+0x10/0x10 [ 492.504827][T22202] ? __pfx_aa_sk_perm+0x10/0x10 [ 492.504886][T22202] ? aa_sock_opt_perm+0xff/0x1a0 [ 492.504908][T22202] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 492.504927][T22202] ? __pfx_xsk_setsockopt+0x10/0x10 [ 492.504950][T22202] do_sock_setsockopt+0x17c/0x1b0 [ 492.504981][T22202] __x64_sys_setsockopt+0x13d/0x1b0 [ 492.505009][T22202] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.505030][T22202] do_syscall_64+0x174/0x580 [ 492.505056][T22202] ? clear_bhb_loop+0x40/0x90 [ 492.505080][T22202] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 492.505099][T22202] RIP: 0033:0x7fe56879de59 [ 492.505117][T22202] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 492.505134][T22202] RSP: 002b:00007fe569647028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 492.505154][T22202] RAX: ffffffffffffffda RBX: 00007fe568a26090 RCX: 00007fe56879de59 [ 492.505167][T22202] RDX: 0000000000000006 RSI: 000000000000011b RDI: 0000000000000005 [ 492.505179][T22202] RBP: 00007fe568833e6f R08: 0000000000000004 R09: 0000000000000000 [ 492.505191][T22202] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 492.505202][T22202] R13: 00007fe568a26128 R14: 00007fe568a26090 R15: 00007ffdc3ed7318 [ 492.505234][T22202] [ 492.777394][T22202] Mem-Info: [ 492.781435][T22202] active_anon:6229 inactive_anon:3 isolated_anon:0 [ 492.781435][T22202] active_file:342 inactive_file:42930 isolated_file:0 [ 492.781435][T22202] unevictable:768 dirty:63 writeback:0 [ 492.781435][T22202] slab_reclaimable:11757 slab_unreclaimable:117568 [ 492.781435][T22202] mapped:30635 shmem:1297 pagetables:1543 [ 492.781435][T22202] sec_pagetables:0 bounce:0 [ 492.781435][T22202] kernel_misc_reclaimable:0 [ 492.781435][T22202] free:1296857 free_pcp:12601 free_cma:0 [ 492.826922][T22202] Node 0 active_anon:24896kB inactive_anon:12kB active_file:1368kB inactive_file:171528kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:122484kB dirty:260kB writeback:0kB shmem:3652kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:16396kB pagetables:6084kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 492.862219][T22202] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:140kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 492.895279][T22202] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 492.925877][T22202] lowmem_reserve[]: 0 2489 2489 2489 2489 [ 492.931714][T22202] Node 0 DMA32 free:1231708kB boost:0kB min:34160kB low:42700kB high:51240kB reserved_highatomic:0KB free_highatomic:0KB active_anon:24896kB inactive_anon:12kB active_file:1368kB inactive_file:171528kB unevictable:1536kB writepending:260kB zspages:0kB present:3129332kB managed:2548796kB mlocked:0kB bounce:0kB free_pcp:50532kB local_pcp:29252kB free_cma:0kB [ 492.965845][T22202] lowmem_reserve[]: 0 0 0 0 0 [ 492.970663][T22202] Node 0 Normal free:0kB boost:0kB min:0kB low:0kB high:0kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:264kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 493.000649][T22202] lowmem_reserve[]: 0 0 0 0 0 [ 493.005389][T22202] Node 1 Normal free:3940272kB boost:0kB min:55736kB low:69668kB high:83600kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:200kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 493.037538][T22202] lowmem_reserve[]: 0 0 0 0 0 [ 493.042279][T22202] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 493.056496][T22202] Node 0 DMA32: 2249*4kB (UME) 1245*8kB (UME) 629*16kB (UME) 679*32kB (UME) 253*64kB (UME) 105*128kB (UME) 47*256kB (UME) 35*512kB (UM) 16*1024kB (UM) 9*2048kB (UM) 266*4096kB (UM) = 1234684kB [ 493.103531][T22202] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 493.130915][T22202] Node 1 Normal: 2*4kB (U) 5*8kB (UM) 10*16kB (UM) 7*32kB (UM) 6*64kB (UM) 3*128kB (UM) 5*256kB (UM) 3*512kB (UM) 2*1024kB (UM) 1*2048kB (U) 960*4096kB (M) = 3940272kB [ 493.156874][ T5636] Bluetooth: hci4: command 0x0406 tx timeout [ 493.194334][T22202] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 493.215825][T22202] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 493.244413][T22202] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 493.291040][T22202] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 493.324648][T22207] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 493.339061][T22207] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 493.354479][T22202] 44567 total pagecache pages [ 493.361643][T22202] 0 pages in swap cache [ 493.374143][T22202] Free swap = 124996kB [ 493.418248][T22202] Total swap = 124996kB [ 493.428943][T22202] 2097051 pages RAM [ 493.441642][T22202] 0 pages HighMem/MovableOnly [ 493.467533][T22202] 428171 pages reserved [ 493.476867][T22202] 0 pages cma reserved [ 494.087984][T22255] pimreg: entered allmulticast mode [ 494.372306][T22262] tipc: Started in network mode [ 494.387912][T22262] tipc: Node identity 26ae7cf5b49e, cluster identity 4711 [ 494.416127][T22262] tipc: Enabled bearer , priority 0 [ 494.463007][T22262] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 494.812962][T22300] netlink: 'syz.2.4362': attribute type 1 has an invalid length. [ 494.833545][T22300] netlink: 228 bytes leftover after parsing attributes in process `syz.2.4362'. [ 495.031770][T22260] tipc: Disabling bearer [ 495.085590][T22314] netlink: 'syz.0.4365': attribute type 11 has an invalid length. [ 495.109131][T22314] netlink: 4320 bytes leftover after parsing attributes in process `syz.0.4365'. [ 495.132257][T22313] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4364'. [ 495.200736][T22325] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4366'. [ 495.283744][T22313] team0: Port device team_slave_0 removed [ 495.327792][T22327] netlink: 52 bytes leftover after parsing attributes in process `syz.3.4368'. [ 495.351620][T22330] netlink: 72 bytes leftover after parsing attributes in process `syz.0.4369'. [ 495.360747][T22330] netlink: 72 bytes leftover after parsing attributes in process `syz.0.4369'. [ 495.876818][T22354] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4375'. [ 496.355431][T22370] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 496.393144][T22370] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 496.401234][T22370] IPv6: NLM_F_CREATE should be set when creating new route [ 496.455315][T22370] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 496.468649][T22374] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 496.752122][T22388] pim6reg: entered allmulticast mode [ 497.155102][T22410] __nla_validate_parse: 8 callbacks suppressed [ 497.155118][T22410] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4393'. [ 497.424869][T22415] ip6tnl0: Caught tx_queue_len zero misconfig [ 497.470628][T22417] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4395'. [ 497.639211][T22426] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4397'. [ 497.679697][T22426] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4397'. [ 497.900594][T22439] netlink: 108 bytes leftover after parsing attributes in process `syz.1.4401'. [ 497.970529][T22445] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4404'. [ 497.989598][T22444] netlink: 'syz.0.4403': attribute type 1 has an invalid length. [ 498.180952][T22457] netlink: 'syz.2.4407': attribute type 4 has an invalid length. [ 498.207707][T22458] mac80211_hwsim hwsim22 ÿ: renamed from wlan1 [ 498.228529][T22457] netlink: 152 bytes leftover after parsing attributes in process `syz.2.4407'. [ 498.301537][T22457] .`: renamed from bond0 (while UP) [ 498.344156][T22464] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4409'. [ 498.462015][T22467] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4410'. [ 498.522116][T22469] netlink: 48 bytes leftover after parsing attributes in process `syz.3.4411'. [ 498.715854][T22483] netlink: 'syz.3.4415': attribute type 3 has an invalid length. [ 498.854050][T22490] netlink: 'syz.3.4417': attribute type 4 has an invalid length. [ 498.874664][T22490] syzkaller1: entered promiscuous mode [ 498.881013][T22490] syzkaller1: entered allmulticast mode [ 501.053029][T22447] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 501.254659][T22512] netlink: 'syz.2.4427': attribute type 1 has an invalid length. [ 501.675544][T22544] .`: (slave dummy0): Releasing backup interface [ 501.739073][T22544] dummy0: left allmulticast mode [ 501.760752][T22544] batman_adv: batadv0: Adding interface: dummy0 [ 501.767294][T22544] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 501.824470][T22544] batman_adv: batadv0: Not using interface dummy0 (retrying later): interface not active [ 502.204025][T22578] netlink: 'syz.3.4445': attribute type 1 has an invalid length. [ 502.244023][T22573] __nla_validate_parse: 6 callbacks suppressed [ 502.244074][T22573] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4442'. [ 502.442958][T22578] 8021q: adding VLAN 0 to HW filter on device bond11 [ 502.475434][ T171] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 502.491054][ T171] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 502.523271][T22595] geneve3: entered promiscuous mode [ 502.529706][T22595] geneve3: entered allmulticast mode [ 502.539023][ T171] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 502.563388][ T171] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 502.595916][ T171] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 19999 - 0 [ 502.663826][ T171] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 19999 - 0 [ 502.692360][ T171] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 19999 - 0 [ 502.757340][T11435] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 19999 - 0 [ 502.757724][T22607] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4449'. [ 503.153307][T22632] netlink: 112 bytes leftover after parsing attributes in process `syz.3.4453'. [ 503.285834][T22637] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4451'. [ 503.560889][T22639] netlink: 'syz.4.4455': attribute type 13 has an invalid length. [ 503.612974][T22639] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4455'. [ 503.699161][T22656] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4459'. [ 503.751721][T22664] netlink: 'syz.0.4460': attribute type 5 has an invalid length. [ 503.771935][T22664] netlink: 20 bytes leftover after parsing attributes in process `syz.0.4460'. [ 503.985619][T22670] bond0: entered promiscuous mode [ 503.996179][T22670] batadv0: entered promiscuous mode [ 504.019346][T22670] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 504.030936][T22670] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 504.042952][T22670] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 504.060460][T22670] bond0: left promiscuous mode [ 504.071647][T22670] batadv0: left promiscuous mode [ 506.518534][T22646] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 506.764316][T22693] netlink: 'syz.0.4466': attribute type 4 has an invalid length. [ 506.808081][T22702] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4464'. [ 506.833355][T22697] netlink: 'syz.3.4465': attribute type 3 has an invalid length. [ 506.855788][T22704] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4464'. [ 506.883769][T22697] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4465'. [ 507.270595][T22725] h: entered promiscuous mode [ 507.446165][T22731] bridge5: entered promiscuous mode [ 507.452357][T22731] bridge5: entered allmulticast mode [ 507.725017][T22747] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4476'. [ 508.085034][T22766] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4481'. [ 508.114392][T22766] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4481'. [ 508.174644][T22766] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4481'. [ 508.184462][T22767] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4481'. [ 509.015454][T22812] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 509.644203][T22834] openvswitch: netlink: Duplicate or invalid key (type 0). [ 509.673539][T22834] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 509.697585][T22838] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 509.716277][T22839] bridge: RTM_NEWNEIGH bridge0 with NTF_USE is not supported [ 509.745591][T22838] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4499'. [ 509.793908][T22848] FAULT_INJECTION: forcing a failure. [ 509.793908][T22848] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 509.820711][T22848] CPU: 0 UID: 0 PID: 22848 Comm: syz.0.4501 Not tainted syzkaller #0 PREEMPT(full) [ 509.820735][T22848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 509.820746][T22848] Call Trace: [ 509.820753][T22848] [ 509.820761][T22848] dump_stack_lvl+0xe8/0x150 [ 509.820802][T22848] should_fail_ex+0x40c/0x560 [ 509.820828][T22848] _copy_from_user+0x2d/0xb0 [ 509.820956][T22848] ___sys_sendmsg+0x1c6/0x360 [ 509.820982][T22848] ? __lock_acquire+0x683/0x2cf0 [ 509.821010][T22848] ? __pfx____sys_sendmsg+0x10/0x10 [ 509.821042][T22848] ? kstrtouint+0x6e/0xe0 [ 509.821087][T22848] ? __fget_files+0x2a/0x420 [ 509.821109][T22848] ? __fget_files+0x3a2/0x420 [ 509.821142][T22848] __sys_sendmmsg+0x273/0x4d0 [ 509.821173][T22848] ? __pfx___sys_sendmmsg+0x10/0x10 [ 509.821208][T22848] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 509.821280][T22848] ? ksys_write+0x242/0x270 [ 509.821308][T22848] ? __pfx_ksys_write+0x10/0x10 [ 509.821341][T22848] __x64_sys_sendmmsg+0xa0/0xc0 [ 509.821368][T22848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.821388][T22848] do_syscall_64+0x174/0x580 [ 509.821410][T22848] ? trace_irq_disable+0x3b/0x140 [ 509.821433][T22848] ? clear_bhb_loop+0x40/0x90 [ 509.821455][T22848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 509.821474][T22848] RIP: 0033:0x7fe56879de59 [ 509.821491][T22848] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 509.821507][T22848] RSP: 002b:00007fe569668028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 509.821527][T22848] RAX: ffffffffffffffda RBX: 00007fe568a25fa0 RCX: 00007fe56879de59 [ 509.821541][T22848] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 509.821554][T22848] RBP: 00007fe569668090 R08: 0000000000000000 R09: 0000000000000000 [ 509.821566][T22848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 509.821576][T22848] R13: 00007fe568a26038 R14: 00007fe568a25fa0 R15: 00007ffdc3ed7318 [ 509.821607][T22848] [ 510.185447][T22864] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4504'. [ 510.219545][T22869] syz_tun: entered allmulticast mode [ 510.331027][T22879] netlink: 'syz.1.4507': attribute type 1 has an invalid length. [ 510.366581][T22879] netlink: 'syz.1.4507': attribute type 2 has an invalid length. [ 510.386474][T22880] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4508'. [ 510.576801][T22893] netlink: 'syz.1.4511': attribute type 1 has an invalid length. [ 510.645681][T22898] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4512'. [ 510.667066][T22902] netlink: 'syz.1.4511': attribute type 1 has an invalid length. [ 510.689210][T22898] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4512'. [ 510.779736][T22906] syzkaller1: entered promiscuous mode [ 510.785264][T22906] syzkaller1: entered allmulticast mode [ 510.962024][ T5636] block nbd3: Receive control failed (result -107) [ 511.071760][T22894] nbd3: detected capacity change from 0 to 63 [ 511.104276][T22925] FAULT_INJECTION: forcing a failure. [ 511.104276][T22925] name failslab, interval 1, probability 0, space 0, times 0 [ 511.116917][T22925] CPU: 0 UID: 0 PID: 22925 Comm: syz.1.4516 Not tainted syzkaller #0 PREEMPT(full) [ 511.116940][T22925] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 511.116950][T22925] Call Trace: [ 511.116957][T22925] [ 511.116964][T22925] dump_stack_lvl+0xe8/0x150 [ 511.116994][T22925] should_fail_ex+0x40c/0x560 [ 511.117019][T22925] should_failslab+0xa8/0x100 [ 511.117047][T22925] kmem_cache_alloc_node_noprof+0xb3/0x610 [ 511.117068][T22925] ? local_lock_release+0x9c/0x160 [ 511.117204][T22925] ? __alloc_skb+0x1d7/0x7a0 [ 511.117225][T22925] ? __alloc_skb+0x1d7/0x7a0 [ 511.117252][T22925] __alloc_skb+0x1d7/0x7a0 [ 511.117279][T22925] netlink_sendmsg+0x5d4/0xb40 [ 511.117370][T22925] ? __pfx_netlink_sendmsg+0x10/0x10 [ 511.117402][T22925] ? aa_sock_msg_perm+0xf1/0x1b0 [ 511.117426][T22925] ? __pfx_netlink_sendmsg+0x10/0x10 [ 511.117452][T22925] sock_sendmsg_nosec+0x13a/0x180 [ 511.117476][T22925] ____sys_sendmsg+0x54e/0x850 [ 511.117508][T22925] ? __pfx_____sys_sendmsg+0x10/0x10 [ 511.117542][T22925] ? import_iovec+0x73/0xa0 [ 511.117570][T22925] ___sys_sendmsg+0x2a5/0x360 [ 511.117594][T22925] ? __lock_acquire+0x683/0x2cf0 [ 511.117623][T22925] ? __pfx____sys_sendmsg+0x10/0x10 [ 511.117654][T22925] ? kstrtouint+0x6e/0xe0 [ 511.117709][T22925] ? __fget_files+0x2a/0x420 [ 511.117732][T22925] ? __fget_files+0x3a2/0x420 [ 511.117765][T22925] __sys_sendmmsg+0x273/0x4d0 [ 511.117797][T22925] ? __pfx___sys_sendmmsg+0x10/0x10 [ 511.117833][T22925] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 511.117872][T22925] ? ksys_write+0x242/0x270 [ 511.117902][T22925] ? __pfx_ksys_write+0x10/0x10 [ 511.117935][T22925] __x64_sys_sendmmsg+0xa0/0xc0 [ 511.117962][T22925] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.117982][T22925] do_syscall_64+0x174/0x580 [ 511.118005][T22925] ? trace_irq_disable+0x3b/0x140 [ 511.118027][T22925] ? clear_bhb_loop+0x40/0x90 [ 511.118050][T22925] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 511.118068][T22925] RIP: 0033:0x7f0b3e99de59 [ 511.118087][T22925] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 511.118103][T22925] RSP: 002b:00007f0b3f8ef028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 511.118123][T22925] RAX: ffffffffffffffda RBX: 00007f0b3ec25fa0 RCX: 00007f0b3e99de59 [ 511.118136][T22925] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000003 [ 511.118149][T22925] RBP: 00007f0b3f8ef090 R08: 0000000000000000 R09: 0000000000000000 [ 511.118161][T22925] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 511.118172][T22925] R13: 00007f0b3ec26038 R14: 00007f0b3ec25fa0 R15: 00007fff513813c8 [ 511.118199][T22925] [ 511.444318][ T50] block nbd3: Receive control failed (result -104) [ 511.544232][T22930] bond12: option fail_over_mac: invalid value (16) [ 511.600527][T22930] bond12 (unregistering): Released all slaves [ 511.676591][T22945] netlink: 'syz.4.4519': attribute type 58 has an invalid length. [ 512.047422][T22970] netlink: 'syz.4.4527': attribute type 2 has an invalid length. [ 512.320588][T22997] block nbd0: reconnected socket [ 512.325578][T22997] netlink: 'syz.2.4530': attribute type 1 has an invalid length. [ 512.338536][T22997] nbd: error processing sock list [ 512.375402][T22980] veth1_to_bridge: left allmulticast mode [ 512.427863][T22980] ip6gre1: left allmulticast mode [ 512.441111][T22980] mac80211_hwsim hwsim22 syzkaller0: left allmulticast mode [ 512.502691][T22980] vlan1: left allmulticast mode [ 512.518525][T22980] .`: left allmulticast mode [ 512.537938][T22980] bond4: left allmulticast mode [ 512.566916][T22995] bridge0: port 3(dummy0) entered blocking state [ 512.573372][T22995] bridge0: port 3(dummy0) entered disabled state [ 512.580100][T22995] dummy0: entered allmulticast mode [ 512.639917][T22995] dummy0: entered promiscuous mode [ 512.653478][ T50] block nbd0: Receive control failed (result -32) [ 512.666037][T22995] bridge0: port 3(dummy0) entered blocking state [ 512.672567][T22995] bridge0: port 3(dummy0) entered forwarding state [ 512.716680][T23014] gre0: entered promiscuous mode [ 512.727641][T23014] gre0: entered allmulticast mode [ 512.766288][T23017] __nla_validate_parse: 5 callbacks suppressed [ 512.766304][T23017] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4536'. [ 512.833073][T23017] [ 512.835447][T23017] ====================================================== [ 512.842455][T23017] WARNING: possible circular locking dependency detected [ 512.849473][T23017] syzkaller #0 Not tainted [ 512.853874][T23017] ------------------------------------------------------ [ 512.860882][T23017] syz.3.4536/23017 is trying to acquire lock: [ 512.866935][T23017] ffff8880787dac98 (set->srcu){.+.+}-{0:0}, at: __synchronize_srcu+0xb5/0x2f0 [ 512.875815][T23017] [ 512.875815][T23017] but task is already holding lock: [ 512.883164][T23017] ffff88802a300588 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 512.892633][T23017] [ 512.892633][T23017] which lock already depends on the new lock. [ 512.892633][T23017] [ 512.903025][T23017] [ 512.903025][T23017] the existing dependency chain (in reverse order) is: [ 512.912027][T23017] [ 512.912027][T23017] -> #6 (&q->elevator_lock){+.+.}-{4:4}: [ 512.919841][T23017] __mutex_lock+0x19d/0x1550 [ 512.924950][T23017] elevator_change+0x1af/0x480 [ 512.930228][T23017] elevator_set_none+0xb5/0x140 [ 512.935591][T23017] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 512.942010][T23017] nbd_start_device+0x189/0xb30 [ 512.947409][T23017] nbd_genl_connect+0x1597/0x1c10 [ 512.952954][T23017] genl_family_rcv_msg_doit+0x233/0x340 [ 512.959017][T23017] genl_rcv_msg+0x614/0x7a0 [ 512.964033][T23017] netlink_rcv_skb+0x226/0x4a0 [ 512.969308][T23017] genl_rcv+0x28/0x40 [ 512.973799][T23017] netlink_unicast+0x7bb/0x940 [ 512.979076][T23017] netlink_sendmsg+0x813/0xb40 [ 512.984353][T23017] sock_sendmsg_nosec+0x13a/0x180 [ 512.989887][T23017] ____sys_sendmsg+0x54e/0x850 [ 512.995164][T23017] ___sys_sendmsg+0x2a5/0x360 [ 513.000356][T23017] __x64_sys_sendmsg+0x1b1/0x290 [ 513.005807][T23017] do_syscall_64+0x174/0x580 [ 513.010911][T23017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.017319][T23017] [ 513.017319][T23017] -> #5 (&q->q_usage_counter(io)#49){++++}-{0:0}: [ 513.025915][T23017] blk_alloc_queue+0x544/0x690 [ 513.031287][T23017] __blk_mq_alloc_disk+0x194/0x390 [ 513.036913][T23017] nbd_dev_add+0x494/0xb60 [ 513.041847][T23017] nbd_init+0x15f/0x1e0 [ 513.046519][T23017] do_one_initcall+0x250/0x870 [ 513.051800][T23017] do_initcall_level+0x10a/0x1a0 [ 513.057252][T23017] do_initcalls+0x59/0xa0 [ 513.062094][T23017] kernel_init_freeable+0x29d/0x3e0 [ 513.067806][T23017] kernel_init+0x1d/0x1d0 [ 513.072644][T23017] ret_from_fork+0x514/0xb70 [ 513.077745][T23017] ret_from_fork_asm+0x1a/0x30 [ 513.083018][T23017] [ 513.083018][T23017] -> #4 (fs_reclaim){+.+.}-{0:0}: [ 513.090217][T23017] fs_reclaim_acquire+0x71/0x100 [ 513.095667][T23017] __kmalloc_cache_node_noprof+0x66/0x630 [ 513.101895][T23017] create_worker+0x112/0x7b0 [ 513.107018][T23017] workqueue_prepare_cpu+0xe4/0x170 [ 513.112743][T23017] cpuhp_invoke_callback+0x434/0x810 [ 513.118541][T23017] _cpu_up+0x2ce/0x5b0 [ 513.123121][T23017] cpu_up+0x1d2/0x220 [ 513.127612][T23017] cpuhp_bringup_mask+0xb2/0x1a0 [ 513.133064][T23017] cpuhp_bringup_cpus_parallel+0x109/0x120 [ 513.139382][T23017] bringup_nonboot_cpus+0x17/0x30 [ 513.144920][T23017] smp_init+0x32/0x110 [ 513.149500][T23017] kernel_init_freeable+0x27f/0x3e0 [ 513.155223][T23017] kernel_init+0x1d/0x1d0 [ 513.160080][T23017] ret_from_fork+0x514/0xb70 [ 513.165191][T23017] ret_from_fork_asm+0x1a/0x30 [ 513.170466][T23017] [ 513.170466][T23017] -> #3 (cpu_hotplug_lock){++++}-{0:0}: [ 513.178247][T23017] cpus_read_lock+0x42/0x160 [ 513.183354][T23017] static_key_slow_inc+0x12/0x30 [ 513.188825][T23017] nbd_genl_reconfigure+0x1301/0x1e80 [ 513.194718][T23017] genl_family_rcv_msg_doit+0x233/0x340 [ 513.200783][T23017] genl_rcv_msg+0x614/0x7a0 [ 513.205800][T23017] netlink_rcv_skb+0x226/0x4a0 [ 513.211085][T23017] genl_rcv+0x28/0x40 [ 513.215582][T23017] netlink_unicast+0x7bb/0x940 [ 513.220861][T23017] netlink_sendmsg+0x813/0xb40 [ 513.226488][T23017] sock_sendmsg_nosec+0x13a/0x180 [ 513.232025][T23017] ____sys_sendmsg+0x54e/0x850 [ 513.237308][T23017] ___sys_sendmsg+0x2a5/0x360 [ 513.242497][T23017] __x64_sys_sendmsg+0x1b1/0x290 [ 513.247953][T23017] do_syscall_64+0x174/0x580 [ 513.253061][T23017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.259469][T23017] [ 513.259469][T23017] -> #2 (&nsock->tx_lock){+.+.}-{4:4}: [ 513.267112][T23017] __mutex_lock+0x19d/0x1550 [ 513.272225][T23017] nbd_queue_rq+0x373/0x1150 [ 513.277329][T23017] blk_mq_dispatch_rq_list+0x499/0x1990 [ 513.283392][T23017] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 513.290328][T23017] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 513.296842][T23017] blk_mq_run_work_fn+0x16c/0x300 [ 513.302383][T23017] process_scheduled_works+0xa8e/0x14e0 [ 513.308448][T23017] worker_thread+0xa47/0xfb0 [ 513.313556][T23017] kthread+0x388/0x470 [ 513.318142][T23017] ret_from_fork+0x514/0xb70 [ 513.323248][T23017] ret_from_fork_asm+0x1a/0x30 [ 513.328523][T23017] [ 513.328523][T23017] -> #1 (&cmd->lock){+.+.}-{4:4}: [ 513.335730][T23017] __mutex_lock+0x19d/0x1550 [ 513.340838][T23017] nbd_queue_rq+0xc1/0x1150 [ 513.345862][T23017] blk_mq_dispatch_rq_list+0x499/0x1990 [ 513.351922][T23017] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 513.358772][T23017] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 513.365269][T23017] blk_mq_run_work_fn+0x16c/0x300 [ 513.370801][T23017] process_scheduled_works+0xa8e/0x14e0 [ 513.376856][T23017] worker_thread+0xa47/0xfb0 [ 513.381959][T23017] kthread+0x388/0x470 [ 513.386545][T23017] ret_from_fork+0x514/0xb70 [ 513.391648][T23017] ret_from_fork_asm+0x1a/0x30 [ 513.396925][T23017] [ 513.396925][T23017] -> #0 (set->srcu){.+.+}-{0:0}: [ 513.404047][T23017] __lock_acquire+0x1520/0x2cf0 [ 513.409414][T23017] lock_sync+0x9d/0x120 [ 513.414090][T23017] __synchronize_srcu+0xc9/0x2f0 [ 513.419538][T23017] elevator_switch+0x1e8/0x7b0 [ 513.424814][T23017] elevator_change+0x2fa/0x480 [ 513.430523][T23017] elevator_set_default+0x375/0x440 [ 513.436234][T23017] blk_register_queue+0x3f3/0x4e0 [ 513.441845][T23017] __add_disk+0x6cb/0xe30 [ 513.446682][T23017] add_disk_fwnode+0xfb/0x4b0 [ 513.451868][T23017] nbd_dev_add+0x733/0xb60 [ 513.456817][T23017] nbd_genl_connect+0x992/0x1c10 [ 513.462276][T23017] genl_family_rcv_msg_doit+0x233/0x340 [ 513.468367][T23017] genl_rcv_msg+0x614/0x7a0 [ 513.473379][T23017] netlink_rcv_skb+0x226/0x4a0 [ 513.478657][T23017] genl_rcv+0x28/0x40 [ 513.483147][T23017] netlink_unicast+0x7bb/0x940 [ 513.488422][T23017] netlink_sendmsg+0x813/0xb40 [ 513.493703][T23017] sock_sendmsg_nosec+0x13a/0x180 [ 513.499236][T23017] ____sys_sendmsg+0x54e/0x850 [ 513.504512][T23017] ___sys_sendmsg+0x2a5/0x360 [ 513.509703][T23017] __x64_sys_sendmsg+0x1b1/0x290 [ 513.515160][T23017] do_syscall_64+0x174/0x580 [ 513.520261][T23017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.527099][T23017] [ 513.527099][T23017] other info that might help us debug this: [ 513.527099][T23017] [ 513.537310][T23017] Chain exists of: [ 513.537310][T23017] set->srcu --> &q->q_usage_counter(io)#49 --> &q->elevator_lock [ 513.537310][T23017] [ 513.550954][T23017] Possible unsafe locking scenario: [ 513.550954][T23017] [ 513.558391][T23017] CPU0 CPU1 [ 513.563743][T23017] ---- ---- [ 513.569098][T23017] lock(&q->elevator_lock); [ 513.573688][T23017] lock(&q->q_usage_counter(io)#49); [ 513.581578][T23017] lock(&q->elevator_lock); [ 513.588676][T23017] sync(set->srcu); [ 513.592565][T23017] [ 513.592565][T23017] *** DEADLOCK *** [ 513.592565][T23017] [ 513.600695][T23017] 6 locks held by syz.3.4536/23017: [ 513.605882][T23017] #0: ffffffff9009c2a8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 513.614089][T23017] #1: ffffffff9009c0e0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 513.623052][T23017] #2: ffff8880298601c0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: add_disk_fwnode+0xe7/0x4b0 [ 513.633398][T23017] #3: ffff88802a300610 (&q->sysfs_lock){+.+.}-{4:4}, at: blk_register_queue+0x10d/0x4e0 [ 513.643229][T23017] #4: ffff88802a300098 (&q->q_usage_counter(queue)#53){+.+.}-{0:0}, at: elevator_change+0x194/0x480 [ 513.654117][T23017] #5: ffff88802a300588 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1af/0x480 [ 513.663943][T23017] [ 513.663943][T23017] stack backtrace: [ 513.669835][T23017] CPU: 0 UID: 0 PID: 23017 Comm: syz.3.4536 Not tainted syzkaller #0 PREEMPT(full) [ 513.669853][T23017] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 513.669863][T23017] Call Trace: [ 513.669869][T23017] [ 513.669878][T23017] dump_stack_lvl+0xe8/0x150 [ 513.669902][T23017] print_circular_bug+0x2e1/0x300 [ 513.669918][T23017] check_noncircular+0x12e/0x150 [ 513.669949][T23017] __lock_acquire+0x1520/0x2cf0 [ 513.669969][T23017] ? check_noncircular+0xda/0x150 [ 513.669992][T23017] ? lockdep_unlock+0x5d/0xd0 [ 513.670009][T23017] ? __lock_acquire+0x13e8/0x2cf0 [ 513.670028][T23017] ? __lock_acquire+0x13e8/0x2cf0 [ 513.670047][T23017] ? __synchronize_srcu+0xb5/0x2f0 [ 513.670065][T23017] lock_sync+0x9d/0x120 [ 513.670083][T23017] ? __synchronize_srcu+0xb5/0x2f0 [ 513.670103][T23017] __synchronize_srcu+0xc9/0x2f0 [ 513.670123][T23017] ? __pfx___synchronize_srcu+0x10/0x10 [ 513.670141][T23017] ? do_raw_spin_lock+0x12b/0x2f0 [ 513.670159][T23017] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 513.670257][T23017] ? ktime_get_mono_fast_ns+0x2d2/0x2f0 [ 513.670277][T23017] ? synchronize_srcu+0x20a/0x260 [ 513.670296][T23017] elevator_switch+0x1e8/0x7b0 [ 513.670314][T23017] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 513.670336][T23017] elevator_change+0x2fa/0x480 [ 513.670355][T23017] ? do_raw_spin_unlock+0xf5/0x210 [ 513.670371][T23017] elevator_set_default+0x375/0x440 [ 513.670391][T23017] ? __pfx_elevator_set_default+0x10/0x10 [ 513.670412][T23017] ? disk_register_independent_access_ranges+0x2d8/0x380 [ 513.670463][T23017] ? blk_crypto_sysfs_register+0x11c/0x170 [ 513.670530][T23017] blk_register_queue+0x3f3/0x4e0 [ 513.670553][T23017] __add_disk+0x6cb/0xe30 [ 513.670570][T23017] add_disk_fwnode+0xfb/0x4b0 [ 513.670586][T23017] nbd_dev_add+0x733/0xb60 [ 513.670609][T23017] ? __pfx_nbd_dev_add+0x10/0x10 [ 513.670637][T23017] ? bpf_lsm_capable+0x9/0x20 [ 513.670654][T23017] ? security_capable+0x7e/0x2c0 [ 513.670719][T23017] ? radix_tree_lookup+0x25c/0x290 [ 513.670760][T23017] nbd_genl_connect+0x992/0x1c10 [ 513.670784][T23017] ? __pfx_nbd_genl_connect+0x10/0x10 [ 513.670805][T23017] ? rcu_is_watching+0x15/0xb0 [ 513.670826][T23017] ? trace_kmalloc+0x2a/0xf0 [ 513.670844][T23017] ? __kmalloc_noprof+0x396/0x720 [ 513.670862][T23017] ? __nla_parse+0x40/0x60 [ 513.670882][T23017] ? genl_family_rcv_msg_attrs_parse+0x20b/0x2f0 [ 513.670900][T23017] ? genl_family_rcv_msg_attrs_parse+0x265/0x2f0 [ 513.670921][T23017] genl_family_rcv_msg_doit+0x233/0x340 [ 513.670946][T23017] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 513.670966][T23017] ? __lock_acquire+0x683/0x2cf0 [ 513.670989][T23017] genl_rcv_msg+0x614/0x7a0 [ 513.671006][T23017] ? __pfx_genl_rcv_msg+0x10/0x10 [ 513.671022][T23017] ? __pfx_nbd_genl_connect+0x10/0x10 [ 513.671047][T23017] netlink_rcv_skb+0x226/0x4a0 [ 513.671069][T23017] ? __pfx_genl_rcv_msg+0x10/0x10 [ 513.671085][T23017] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 513.671111][T23017] ? down_read+0x2be/0x330 [ 513.671132][T23017] genl_rcv+0x28/0x40 [ 513.671146][T23017] netlink_unicast+0x7bb/0x940 [ 513.671169][T23017] netlink_sendmsg+0x813/0xb40 [ 513.671194][T23017] ? __pfx_netlink_sendmsg+0x10/0x10 [ 513.671217][T23017] ? aa_sock_msg_perm+0xf1/0x1b0 [ 513.671232][T23017] ? __pfx_netlink_sendmsg+0x10/0x10 [ 513.671253][T23017] sock_sendmsg_nosec+0x13a/0x180 [ 513.671271][T23017] ____sys_sendmsg+0x54e/0x850 [ 513.671293][T23017] ? __pfx_____sys_sendmsg+0x10/0x10 [ 513.671317][T23017] ? import_iovec+0x73/0xa0 [ 513.671337][T23017] ___sys_sendmsg+0x2a5/0x360 [ 513.671357][T23017] ? __lock_acquire+0x683/0x2cf0 [ 513.671377][T23017] ? __pfx____sys_sendmsg+0x10/0x10 [ 513.671399][T23017] ? futex_wait+0x2a2/0x390 [ 513.671425][T23017] ? __fget_files+0x2a/0x420 [ 513.671444][T23017] ? __fget_files+0x3a2/0x420 [ 513.671465][T23017] __x64_sys_sendmsg+0x1b1/0x290 [ 513.671487][T23017] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 513.671513][T23017] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.671529][T23017] do_syscall_64+0x174/0x580 [ 513.671547][T23017] ? trace_irq_disable+0x3b/0x140 [ 513.671565][T23017] ? clear_bhb_loop+0x40/0x90 [ 513.671581][T23017] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 513.671596][T23017] RIP: 0033:0x7fcda6f9de59 [ 513.671611][T23017] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 513.671625][T23017] RSP: 002b:00007fcda7d9b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 513.671641][T23017] RAX: ffffffffffffffda RBX: 00007fcda7225fa0 RCX: 00007fcda6f9de59 [ 513.671652][T23017] RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 [ 513.671662][T23017] RBP: 00007fcda7033e6f R08: 0000000000000000 R09: 0000000000000000 [ 513.671671][T23017] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 513.671681][T23017] R13: 00007fcda7226038 R14: 00007fcda7225fa0 R15: 00007ffe705ebc08 [ 513.671698][T23017] [ 516.267104][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.275619][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.284270][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.292724][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.301245][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.310004][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.318674][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 516.327198][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 517.447275][ T4992] udevd[4992]: worker [11072] /devices/virtual/block/nbd2 is taking a long time [ 519.466865][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 519.869196][ T9898] block nbd2: Possible stuck request ffff888027525080: control (read@0,1024B). Runtime 90 seconds [ 522.586833][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.595106][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.603339][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 522.611556][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog