last executing test programs: 3.152121064s ago: executing program 1 (id=4130): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000200), 0x2, 0x0) write$cgroup_subtree(r1, 0x0, 0xfdef) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@typedef={0x1, 0x0, 0x0, 0x8, 0x3}]}, {0x0, [0x2e]}}, 0x0, 0x27}, 0x20) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000100)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0x4, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7}, [@exit]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket(0x15, 0x5, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x10, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x0, 0x1, 0x1}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x94) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r4, &(0x7f0000000200), 0x806000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r3, 0x0) getsockopt(r2, 0x200000000114, 0x2710, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) 2.22786197s ago: executing program 0 (id=4144): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0xce) ioctl$SIOCAX25ADDUID(r1, 0x89e1, &(0x7f0000000240)={0x3, @bcast, 0xee00}) (async) ioctl$SIOCAX25ADDUID(r1, 0x89e1, &(0x7f0000000000)={0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b705000008000000850000005d00000095"], &(0x7f0000000300)='GPL\x00', 0x2, 0xff6, &(0x7f0000001e00)=""/4086}, 0x90) 2.113499014s ago: executing program 0 (id=4147): r0 = socket$kcm(0x2, 0x4a7824e637775451, 0x2) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$inet(r0, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x80, @loopback}, 0x10, 0x0}, 0x4043f7f) (async) sendmsg$inet(r0, &(0x7f0000000500)={&(0x7f0000000080)={0x2, 0x80, @loopback}, 0x10, 0x0}, 0x4043f7f) 1.970429166s ago: executing program 1 (id=4149): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xa, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000000000000000000000006301bb000000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r2, 0x10001) setsockopt$inet_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f0000001280), 0x4) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'erspan0\x00', &(0x7f0000000100)=@ethtool_cmd={0x49, 0x6, 0x3, 0xe, 0x31, 0xff, 0x80, 0xd7, 0x6, 0x10, 0x3, 0x7ff, 0x5, 0x8, 0xf, 0x0, [0x4006, 0x6]}}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@getstats={0x1c, 0x5e, 0x1, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r5, 0x2}}, 0x1c}}, 0x20008004) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c0002001c0000001f000000060001000000000008000500", @ANYRES32, @ANYBLOB='\b\x00\n\x00', @ANYRES32, @ANYBLOB="0a0001"], 0x64}}, 0x0) 1.897071859s ago: executing program 0 (id=4150): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000080)="5c00000013006bec9e3be35c6e17aa31076b876c1d0000007ea60864160af36507001ac00400020208000b000300012422000c00eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0000300000000000200ffffc6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, r2, 0x1, 0x70bd2d, 0x25dfdbff, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e21}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x5, 0x2, 0xa}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0xc010) 1.702275271s ago: executing program 0 (id=4153): r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r1, &(0x7f0000000100)=ANY=[], 0x32600) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8}, 0x48) r3 = syz_init_net_socket$ax25(0x3, 0x5, 0x6) ioctl$SIOCAX25CTLCON(r3, 0x89e8, &(0x7f0000001900)={@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, 0x1, 0xfffffffffffffffc, 0x3, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r4, 0x0, 0x32, &(0x7f00000000c0), 0x4) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{r2}, &(0x7f0000000000), &(0x7f00000005c0)=r5}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000040)='module_request\x00', r6}, 0x10) socketpair(0x0, 0x0, 0x0, &(0x7f00000006c0)) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r1, 0x0) pread64(r1, &(0x7f0000000b40)=""/4096, 0x1000, 0x3) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000300)=@raw={'raw\x00', 0x3c1, 0x3, 0x280, 0xe8, 0x18c, 0x203, 0x0, 0x19030000, 0x1b0, 0x2e0, 0x2e0, 0x1b0, 0x2e0, 0x7fffffe, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @mcast1, [0x0, 0x0, 0x0, 0xff], [0x7fffffff, 0xff000000, 0xff000000, 0xff000000], 'bond_slave_1\x00', 'bond0\x00', {}, {}, 0x84, 0x7, 0x2, 0x7d}, 0x300, 0xa8, 0xe8, 0x0, {0x1000000}}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x80000080, 0x1, 0x6, 0x8, 0x7d, 0x9, 0x2, 0x9]}}}, {{@uncond, 0x0, 0xa8, 0xc8}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2e0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x2d8, 0x0, 0x18c, 0x203, 0x0, 0x19030000, 0x208, 0x2e0, 0x2e0, 0x208, 0x2e0, 0x7fffffe, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, [0x0, 0x0, 0xff, 0xff], [0x7fffffff, 0xff000000, 0xff000000, 0xff000000], 'bond_slave_1\x00', 'bond0\x00', {}, {}, 0x84, 0x7, 0x2, 0x55}, 0x300, 0xf0, 0x118, 0x0, {0x1000000}, [@common=@dst={{0x48}, {0x7fff, 0x3, 0x7de91c6f22c9938, [0x9, 0x1ff, 0x87e, 0x2a, 0xafd4, 0x9, 0xa, 0x7, 0x6, 0x1000, 0x6, 0x200, 0x9, 0x0, 0x7, 0x3], 0xa}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x5, 0x1, 0x1, 'syz0\x00', {0x7}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x338) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x60, r10, 0x1, 0x0, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x2, 0x17}}}}, [@NL80211_ATTR_FRAME={0x2e, 0x33, @action={{{}, {}, @device_b}, @sp_mp_close={0xf, 0x3, {{0x72, 0x6}, {0x75, 0x6, {0xfffd, 0x9, @void, @val=0x6, @void}}}}}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x300]}]}, 0x60}}, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r12, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000600)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r13, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r14, @ANYBLOB="0c00990000000000000000000800a000ea15000008009f0003000000080026000816"], 0x40}}, 0x0) sendmsg$NL80211_CMD_LEAVE_OCB(r7, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, r10, 0x400, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r14}, @void}}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x4000840) 1.629627458s ago: executing program 1 (id=4154): shutdown(0xffffffffffffffff, 0x1) (async, rerun: 32) r0 = socket$inet_udp(0x2, 0x2, 0x0) (rerun: 32) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000340)={0x7, {{0x2, 0x0, @multicast2}}}, 0x88) (async) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000c80)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000002000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1414aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1e0001000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007f000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x590) setsockopt$inet_group_source_req(r0, 0x0, 0x2b, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @empty}}}, 0x108) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8983, &(0x7f0000000000)) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={'\x00', 0x800}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) (async, rerun: 32) r4 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) (async, rerun: 32) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000800)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000dffff000000010000000000000001410000001c001700000000000000006574683a73797a6b0e29fcdc05be6fe815b438c705a4ac616c6c65723003cfe36abfbdce66ec1f6713e32e22a9460cde94597b55ab69cd64cdad029e3caa43629bc348c84c7f56a5b0b841f36bf6f834410dc39b1a49c828fc44cd46f53bd9c348e47ff50fd1aa7e574cdd6397f8c5084df8abdf88f441da8fc7c3042ef426633c315a209e83b26b1abec56787c93c5524ed9f989f1cdc2f126d5f5f1a8c112bf7860597ed8016fc85e839e6c166a9fbac460fbff44568552e40c38030578cf92a1194dd571049bde89f"], 0x38}}, 0x80) (async, rerun: 32) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) r6 = socket$unix(0x1, 0x1, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'team_slave_0\x00'}) (async) r7 = socket(0x10, 0x3, 0x0) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000003840)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(serpent)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r8, 0x117, 0x1, &(0x7f0000001280)="b7f2288a911993f08d3aaea2bc0000de", 0x10) (async) r9 = accept$alg(r8, 0x0, 0x0) sendmmsg$alg(r9, &(0x7f0000000280)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000600)="b2dfd32936ad234ced2e74e4ad6ea7dc496faeafc97b7e6c44a2ae9df7c3dc2ee589a220431da3889f2a8617e3ee2e6252399cbfaab83bfe7c05ec25b9816da44387027b7ab4d6bde8ec960f7bc1363de2cd59ca6081bdfd1440b92b196ddc631e1405c2b1751059bac64e882735ee5d1f01f1766c9212853b51fe09df9c4dafcd4756a7c9553fa2ac7038dcd44574a62a564f9a2f3674fcf8768a7d9618395b1c5e9698951427297c35dbcefc9f6821bd8d78c6ed2911", 0xb7}, {&(0x7f00000006c0)="68b48f6e8fcedde03262d09e8336fe0925b41aec1e5c1dd66e7df0", 0x1b}], 0x2, 0x0, 0x0, 0x4000000}], 0x1, 0x8081) recvmmsg(r9, &(0x7f00000070c0)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000100)=""/106, 0x6a}, {&(0x7f0000000180)=""/63, 0x3f}, {&(0x7f00000001c0)=""/41, 0x29}], 0x3}}], 0x1, 0x2001, 0x0) (async, rerun: 32) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) 1.62813561s ago: executing program 4 (id=4156): socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x66, &(0x7f0000000c00)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00\x00\b', 0x30, 0x3a, 0xff, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast2, {[], @ndisc_redir={0x87, 0x0, 0x0, '\x00', @local, @private2={0xfc, 0x2, '\x00', 0x1}, [{0xe, 0x1, "2025b07f3c58"}]}}}}}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100), 0x6) getsockname(r0, 0x0, &(0x7f0000002100)) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_type(r1, 0x0, 0x2, 0x0) r2 = openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r2, &(0x7f0000000c40), 0x12) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x200002, 0x0) r4 = openat$cgroup_procs(r3, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r4, &(0x7f00000005c0), 0x12) 1.419659122s ago: executing program 4 (id=4159): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_ifreq(r0, 0x8919, &(0x7f0000000000)={'wlan1\x00', @ifru_mtu=0xffffff0f}) 1.241744214s ago: executing program 4 (id=4160): r0 = socket$igmp(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000001ec0)={&(0x7f00000003c0)={0x2, 0x4e22, @multicast1}, 0x10, &(0x7f0000001d40)=[{&(0x7f0000000c40)="174f0309acc581c27c0835a541d5ace14751a6fb5991e1eabe613766930c5209d76188595688370a8db8878df98ad326d683f46b7b423a4583c043d396d52fafd67bbd19f7e86b03f0890da3e3e1ac30139e27351572c4c42e96f4dec4c0c9d710f16af63cc306aa379bad5c6e7ef0f71776f0abdddb9ba606e921bcb3ac6bbea2ab3a0823b23088bc5e39310f040dacfd595b4675421c0046d89f2840d233d1034173a0fe91900d926e8d3a481c32b4f6079741d13e2ebb782090c8f38a9daebb1dea84e78c216cd7f9f10bf4b35158e3b36df0c4e9e74b585fc66f7b1fe5305f073f6de409973543e731424ab0605f2f4dfd7efe495ea426a69b13b27b7497895984a1502bac0855ad2bb86e88efdd6c976bbd1cc04dc6b4e8d579f1aecdf38461db91d3661703dec17b9a22d66299cacd23fb463dbb3fd7d59674fa4c5ec8b36422965f55ae455ef5051d029fe657b3f6c79a2bbfe60b0d64870d4ca793ebf5054a40157f0c78c3337cb131700670bc7dfa1cfddb8eb2d85b97c56339f45c4ee490d259121cdccf7be5bbc0ab7a375d931c0365c9809756d4491c866161833663e49a310df546ed981572ca40e40faea56bb05216b3390d807f756db218749a1c9a1ee817b9e5e6a00ca98e185cd6f690cc9e9d1567788e572378f11f688d8133c58b727ae51f95787f7f9952b32ed1494ea7e55f21baea3c9edb8b4523bbef158c8c239d4a54faa5996eb1f3f1c06acf8cd273e298e44b5642b8a50369b152a67932f48bed55c1c01d9a0ad6b2a3540e753c16e3054d483baad028fe42b4e5ebe562b6350c3a093f7456dde046258b8bfe19494d19a66809b612ba8deefea6b7007460ad826313420ac8e3f889da3c9b01a3d1f76acbdafb990fbe8479ded245d750a534e61b6b5fe9914f3760cbe0434f0b1593579f9d124e7c90ef5a50b21aad14ecd0cd712164782cfd329175225d99f90df6d123dde263d9329317f501199ba87458c0ead4baddeef35da92fea8ac878fa84bebfce075cbf56fad7fe823198ef50ce9e24d6c888337cfecb65e6dc7a3bce8f7b2cf734a1bf52cc24b77045e94c39756cb4287777e6f7bdfa19c387565dcb5258c3758a6d8cf94fa2adde5454735f944f6fde3c61376bf65c4c65bf973e1bdcd646b5883098b9f00712ab947b5a45ae1949357a7ef580895e7201e36ae4ab14da32e0a55327d25278d07e102c4e45f6566f5394c2259baa6b5b9511751c35ad74364be8bcfb77b0eb0d3c182dd50ae9fa498d5595bce5201d43acf6411e8e6074bdf001d4e4ddae00133002d9af61c3d9b594a230511c77460e477ab5d9d3d2dbdad6a971c4d4911d877a6d9eae79196e95565994954a3904d473fb369983020b99466c804127e8baf8147b5d228a17608d3ab4c31c6ad03135929e35feb8d166f5f820e40f94dd8102c9ca76ac48c3d668b00ca76cff37dcd35ddbf63b62ecaf7934a8ede4980f3294365ea63f7584373f638134fba55526983dabf2f189c70ddec701b55256d383dd802b4b09b801fb6cbe3408c9eb6d1fd85bf93b60b966680485d4550a3aa3454d888d6f8e81f669d4d87914041ac313e39f0ae29f31dedba1c5964c6729045cbd010e4469a7220335f76983c7d22a53401cb25444b9103643843726bdbb28d4032f9258f8539b9a7dfd6558b2c524d38c9e2e1c23fd7a6a42bf4bb5ebdf0b75ecc547ef15865536ee1de07155bc5e6b5a227c1170a6e4e44991f0685219c417d7194a4cdbce6a1e76f830fdd07887b49a3b648772b6e1b6fda08931540cc521e44f3fb221ce86438759704ce2422653a35f62c483a21ae6b34b14e6d900172dddecf8846a9423d784341296e141423f1c1efed6a0c334430647c0408af67c54a8cad69a43bf28ebe4a650343151223969bafa661999342df2a160f45b950f258f1e444575d6251a917bfcbb4dc834bd08d4deeb3be0dabade5f46060e54bc71f137f47e4233804eb9de", 0x589}], 0x1, &(0x7f0000001dc0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0xf}, @loopback}}}, @ip_retopts={{0x38, 0x0, 0x7, {[@noop, @generic={0x82, 0x12, "d0581ddc37253c05f7c0c7a54e649600"}, @timestamp_prespec={0x44, 0x14, 0x67, 0x3, 0x7, [{@dev={0xac, 0x14, 0x14, 0x30}, 0x10}, {@rand_addr=0x64010102, 0x5e}]}]}}}], 0x58}, 0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='pids.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f0000000000)={0x1f, 0x3, @fixed}, 0xe) syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r3, 0x6, 0x3, &(0x7f0000000080), &(0x7f00000000c0)=0x4) setsockopt$bt_BT_VOICE(r2, 0x112, 0xb, &(0x7f00000030c0), 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000000000000000000000000000711247000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) 1.166482505s ago: executing program 1 (id=4162): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)={0x2, 0x18, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, [@sadb_x_nat_t_port={0x1, 0x3}]}, 0x18}}, 0x0) socketpair(0xa, 0xcabf13a8c1283781, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x10) setsockopt(r4, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r4, 0x84, 0xc, &(0x7f0000000100), 0x4) recvmsg(r4, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_int(r5, &(0x7f0000000040)='cgroup.max.descendants\x00', 0x2, 0x0) write$cgroup_int(r6, &(0x7f0000000100), 0x12) sendfile(r6, r6, 0x0, 0x970b) getsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, &(0x7f0000000100), 0x2) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="200000001100010100"/20, @ANYRES32=r1], 0x20}, 0x1, 0x0, 0x0, 0xd5}, 0x8800) 1.077665145s ago: executing program 2 (id=4163): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x10, 0xe, &(0x7f0000001580)=ANY=[@ANYBLOB="b702000003460200bfa30000000000001702000000feffff7a0af0ff14ffffff79a4f0ff00000000b7060000ff0800007e640200000000005502faff037202000404000001007d60a6040000001000006a0a58fe39000f00850000003f0000009c600000000000009500000000000000a81bbfa32d51a7d0679fd43041097666ab982de7b0efc5733ed236e4add6de094e0832aaa6912a8b2ce571c4580034fb000000e3a94bd24d2eb3860d808922433e3e0f242a46b3009a54f4077db0d4968a384b0559c7919b893d3b72cd6c832e986440ff0a7e8620cb231ccd00000000000000000000007777e2704653f620b2272c3c7fea60491073847c4b04000000f33fb382d91ae8e18c9b6c9f0322ec5f1c7cc5869ff455896712198c4e2ddf8b86e714229527ca40b24cfd6a1f00e891728807982d90e116bba29bb70900000000000000c63ad2e7402f9cb424ac416e66af9ebbfea905d37cf226312cb81ec8439cea06e7fa5e5b3596301460142f83b464d9e57dfdb06dcb9101000100130033d649d2110cf2e1f4682c24a314447c5e0807f0b1766ebdecbd061772daa52a38539295d3fea7a7e669441e1ff04114dfa904fb43897f8d9c3c287acba716973eadf1bf9cd0a38edc345415c42d3d2dd3339d32a5796cbe8925efd0c81af69a3e97588878d7ce18b68bc37e061d33357d6a39d33c702576cc2a8891663e3776c7a37c5c962e12102f237bbf60c0a3bf07d55b3888418de2b2ad23d25395dd4ccddf247dd2c712e2e2eaf7d432e968122cc5dcaa7ba330963b7093a58a02dba114f75e1ffd5c2912b506bfb93122fc776aadec51a367658100000000000000b148a90000000000a2a283801ff218538cb12c72b56ffb6b7a062581ec749f5700000000009f1f5ab2e02739ccd50523d3360300005cbeaf95c7d797d6e094c4a3aee025bf43cebde7e7cdbae9b1698e19eb0e6d5244c1ffb0e97628a88a5e37032f1e8f6c893e514f6b3e1028cd404a1d8fe6569da0385e65e4d523166c4213abb8dae5b1409317f29572e788af92aedb0287f2816e301fc8a24dba6fca8b270d44fe65e7bd90a5fc16387bcb5e3df18d7d2a33c72cfda827b8926a6dc6bc19ce398cb8fe48b11b7f93e6fdfb040283c9627bd40909ee4307c4197b15797af17845fbc02846d2f8543f65594cb535a9598eb067b21111dbaa58b19a52f3f12880128d08eb477ad349ca214bc7f80000000000ffb52da89cff41552996e20a585c7d265bd749eeba040fa7111c84142757709d7c475fac2839beb833327db41c6b647c7ee9ad419a6c68dd5c2ce4fa23c280518fc6e54d1b055cae5492e8c4cdd314a49631a15de2bffc920dd74e670594acec7a9da17d809bf956f1af51cf3c0711792d3071dfdaec3c66053cdb00028f6fba8da8f53de39a5999e56fc26ae866674627c8a53d3fd245050060ed40782d1d98bf1e1f5dfd4d1fb399624c12732e300818b222ce029ce01055f941721226e3e5f05d2837240f8f6831b6ef2a02ec64aae1eea9cfac06d8b7042e8ebdc6cb0d4a14281e631d06afc99d397c5b67b290344e347c953806b298f288884335f624378b3748a4a86bbd0a62127b2c28ce3737661b98bd45965b537ece7bd4e365ffd5567df4d02034c8d488a49c6fb1a0a02eaab2f271d3a14e44211e4ff602d146f72355972860bdd14719d65301964d022819b75696ce47534c9d989d69a445095ff8fbebd2c84635acc333f2aca4623cfe9f9e6c3f9fbb4374c08e1be5eec12c329a87d335fd7a52a4e4e7c2e57fa2f0df9500347b300f84230783cb665f3fa44f5d6fa987aa93c2619ef4977f9e4d38adec323778f3bc987533ffd85fe5417398a3001b394fccbd2faee83b5e2b8a2dd18cf067b6198366283c531b3ef336a84e825c63b9bc7b98b4ad6a471692224adef86f4c9930169dfa133e22929d5a27e10bfbcfe7c02ca451afd74d26f489e0e09cf1b596ae0c959cf26cb0c8114a9311b7f2fe2ad977074ff5f62f674eadd43a62ad1173491a5c099290393e1f85aeb3886fbb7f6646212054a850d58a71c6d6027cd3a5ff22e98672349f9bddb23622e2f19b39e51ced84524567ec1fcb233a2fb85371e9b08b6fd4adcd4db148ed26757123a0e604bcf6ffdcc303956e1805f1746361bd3eeb55d3fefe6ac274c2e6c78963430118942d62a465698e600dadd81a53ffd29358746e8db2499e3fca62b0ff660b0aaeedadeb194a9217e9fed2ce04cc24451871d5bcd76173ab7123cc27eef33dbb4d3c3bf1fc2df68a98345c15667388c5000000000000000000000015000000c0459f900702908d4979288d06c7159ef2663dc7ea9302b10bf2da21e3990ddf20a38adc1fd15124310daf2461224cfbfd5e6265d012d60fc9e39209ce3209720f8d7bf39bf71d0d46ed6d51eede797da70cf0b7463cffc8557f9a2e15483dbafb146a3221c20d51f172cf2eefe1e6b28cffc1e40a789d5513626f5c4fbf65a2b5a093634b806b7ee570f70f624ce8c02d4c1ec7a9370f42a807f1d46fe77be0637a8007343b7771788f64b36cab94a99243bc780702f98f34a80f81aeb853f97c3e9586805d1a240d7e870b15defbc6b21fdc98a79759c9b8375313deea0000000009e38e9539d6b9507b6f3f8d29992d080a13aed8879a1f2cf352fb5a376427f89d432f7fe7c0cad2ce38427fc773cef47e00000000000000000000000000000000000d09b8ee6321377ffcb6cc386f8704ae9ce6c11b4bb91d0097ef2b77e0cd28af1222e68c2745eca64fa40db07f6e5925224069d14395f7170ab9c2d396f7510f65ce5b0405d895a37117d13c5b2f684c52bff2dc895f5e06e497adee9de0012dd140c592137c90319f8a578007b57aaba3fb93d29a6584313e5b58f8a71cebf77a0891f3633dba69588ec728e785e6e4431fce5a143451c7a51c22b1b605347db811eb9a461f4ef2612181aa8cafc33a2047b7ba57a5d1fe58a00c6855ada17dcbb20a2f03164292a1e4e53e4140224ba82b599de2604398b860906dccd87c1bf0e8d0cce2e34589ef2bd3672907b7604034d4697fa3f957622eaa59df5c02b307bceaf138b419ce49f4850328069ed4d5559babf388329d6605f74dc1c21c9f0f1aa9826ba2936f14affb0b06d0aeb1054b2d044cafe64979590000000000000000000000784de836bec51a9db6533248165f79bf47b13d6d2c83a7442632f60f9eb0cc4fa54e08e5e349cc3afdff6f3175a80c4015d380ee0880a8a822d0a630a864c823392420ec93fab6d4d98a53c8b75221a9576e8204169fa1046355a0342539527e882e7fcaf062f0733fc0fb97"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x3}, 0x8, 0x10, &(0x7f0000000080), 0x10}, 0x94) 1.033520787s ago: executing program 0 (id=4164): r0 = socket(0x2, 0x5, 0x0) setsockopt$CAIFSO_REQ_PARAM(r0, 0x84, 0x80, 0x0, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) setsockopt$ax25_int(r1, 0x101, 0x1, &(0x7f0000000240)=0xa, 0x4) connect$ax25(r1, &(0x7f0000000000)={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x4}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @null, @null, @null]}, 0x48) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x500, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'gre0\x00', 0x2}) ioctl$TUNSETCARRIER(r2, 0x400454e2, 0x0) 1.026047932s ago: executing program 4 (id=4165): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000000c0)=@newlink={0x38, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @vti={{0x10}, {0xc, 0x2, 0x0, 0x1, [@vti_common_policy=[@IFLA_VTI_IKEY={0x8}]]}}}]}, 0x38}, 0x1, 0x7500}, 0x0) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="500000001008210404000000070000000000000036099dc6b82074ccff7cd8ef6df6", @ANYRES32=0x0, @ANYBLOB="adffa888d2260000240012"], 0x50}}, 0xc080) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f00000002c0)={'ip6tnl0\x00', &(0x7f0000000000)=@ethtool_cmd={0x0, 0x0, 0x0, 0x200, 0x2, 0x0, 0x0, 0x0, 0xdb, 0x4, 0x4000, 0xfffff7fc, 0x7, 0x0, 0x0, 0x47, [0xfffffffc, 0x80]}}) r2 = socket(0x29, 0x100800, 0x2fef) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000040)={0x0, 0xc388}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f00000000c0)={r3, 0xe, 0x34, "a2b0d9d736d4ac2679297df981d5c8c1f58948dd7bef3f3045837dbe7bfe7ce95d00bd0ab3f1f64705991f228d310046eb04bc67"}, 0x3c) 913.465532ms ago: executing program 2 (id=4166): r0 = socket$kcm(0xa, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x64010101, 0x4e1d, 0x1003, 'lblc\x00', 0x15, 0x1080005, 0x6f}, 0x2c) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x25, &(0x7f0000000000)={0x0, @in={{0x2, 0x0, @private=0xa010101}}, 0x1, 0x4000}, 0x90) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e02, 0x0, @mcast1}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 890.636019ms ago: executing program 2 (id=4167): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="380000001e000100fdffffff0000000002000000010000070000000014000900766c616e300000000000000000000000080001"], 0x38}, 0x1, 0x0, 0x0, 0x42812}, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) (async, rerun: 32) socket$kcm(0x2, 0xa, 0x2) (async, rerun: 32) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_DEV_UP(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="010028bd7000070000000200000008000100", @ANYRES32=r2], 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x8004) (async) write$nci(r1, &(0x7f0000000800)=ANY=[@ANYBLOB="f50401", @ANYRES16], 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) (async) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000040)=0x14) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000080)=@ipv4_deladdr={0x0, 0x15, 0x400, 0x70bd26, 0x25dfdbfd, {0x2, 0x38, 0x0, 0xff, r7}, [@IFA_TARGET_NETNSID={0x0, 0xa, 0x3}, @IFA_LABEL={0x0, 0x3, 'pimreg0\x00'}, @IFA_ADDRESS={0x0, 0x1, @initdev={0xac, 0x1e, 0x1, 0x0}}, @IFA_ADDRESS={0x0, 0x1, @local}, @IFA_FLAGS={0x0, 0x8, 0x80}, @IFA_LABEL={0x0, 0x3, 'veth1_macvtap\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x10}, 0x0) 809.169502ms ago: executing program 2 (id=4168): r0 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r0, 0x84, 0x6d, 0x0, &(0x7f0000001040)) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000041c0), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000800)={0x28, r3, 0x1, 0x70bd28, 0x1, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x28}}, 0x24000880) sendmsg$NL80211_CMD_LEAVE_MESH(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r1, 0x20, 0x70bd26, 0x25dfdbfe, {{}, {@void, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x4000040) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0xfffffffffffffe15) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_type(r4, &(0x7f0000000280), 0x2, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) read(r5, &(0x7f00000014c0)=""/4125, 0x1) 652.262962ms ago: executing program 3 (id=4170): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x70}}, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000640)=@security={'security\x00', 0x64, 0x4, 0x2a0, 0x100000c, 0xc0, 0xc0, 0x0, 0xffffffff, 0xffffffff, 0x208, 0x208, 0x208, 0xffffffff, 0x4, 0x0, {[{{@ip={@rand_addr, @rand_addr=0x64010100, 0xff000000, 0x0, 'veth0_vlan\x00', 'syzkaller1\x00', {}, {}, 0xff}, 0x0, 0x98, 0xc0, 0x0, {0x0, 0x1000000000000}, [@common=@inet=@socket1={{0x28}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}, {{@ip={@remote, @multicast2, 0x0, 0x0, 'syz_tun\x00', 'lo\x00'}, 0x0, 0x70, 0x98}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@inet=@TCPOPTSTRIP={0x40, 'TCPOPTSTRIP\x00', 0x0, {[0x7f, 0x9, 0x4, 0x6, 0x1, 0x7f, 0x1, 0x40]}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x300) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r7 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_pressure(r7, &(0x7f0000000040)='io.pressure\x00', 0x2, 0x0) ppoll(&(0x7f0000000240)=[{r8}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x5}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@newtfilter={0x5c, 0x2c, 0xd27, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r6, {0xa, 0xc}, {}, {0xc, 0x8}}, [@filter_kind_options=@f_route={{0xa}, {0x2c, 0x2, [@TCA_ROUTE4_TO={0x8, 0x2, 0xf6}, @TCA_ROUTE4_FROM={0x8, 0x3, 0x23}, @TCA_ROUTE4_FROM={0x8, 0x3, 0xb}, @TCA_ROUTE4_POLICE={0x10, 0x5, [@TCA_POLICE_PEAKRATE64={0xc, 0x9, 0x6}]}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x60000080}, 0x20000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="f000"], 0xf0}, 0x1, 0x0, 0x0, 0x4000801}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x4) sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0x3000000, 0x0, 0x4000001}, 0x40000) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x88, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x5c, 0x4, 0x0, 0x1, [{0x58, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x48, 0x2, 0x0, 0x1, [@NFTA_TARGET_INFO={0x2c, 0x3, "7339f2f10461afb9fdd672bad09dfb78c7699c74e891a0c700"/40}, @NFTA_TARGET_REV={0x8}, @NFTA_TARGET_NAME={0xe, 0x1, 'IDLETIMER\x00'}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xb0}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000001400791048000000000069003e000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0xa3}, 0x21) 532.512265ms ago: executing program 4 (id=4171): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1, 0x3, 0x261, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', r1}, 0x48) (async) r3 = socket(0x11, 0x2, 0x0) setsockopt(r3, 0x107, 0x1, &(0x7f00000001c0)="010000009700060000071a80010061cc", 0x10) (async) close(r3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x3, 0xf, &(0x7f0000002400)=ANY=[@ANYBLOB="08000000181100000000000000e0ff0000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', r1}, 0x94) 453.430921ms ago: executing program 2 (id=4172): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x20000845, &(0x7f0000b63fe4)={0xa, 0x2, 0xf12b, @ipv4={'\x00', '\xff\xff', @remote}, 0x8000000}, 0x1c) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xc4, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb}, {0x0, 0x4000000000000, 0x200000000000000}}, [@mark={0xc, 0x15, {0x350759, 0x81}}]}, 0xc4}}, 0x2c000010) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0xa, 0x0, 0xfffffffffffffff8}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x8, 0xc3, &(0x7f0000000400)=""/198, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff52}, 0x37) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x10, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x79, 0x10, 0x48}, [@ldst={0x3, 0x0, 0x3, 0xa, 0x0, 0xfffffffffffffff8}], {0x95, 0x0, 0x74}}, &(0x7f0000003ff6)='GPL\x00', 0x8, 0xc3, &(0x7f0000000400)=""/198, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffff52}, 0x37) sendmsg$nl_xfrm(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@updpolicy={0xb8, 0x15, 0x1, 0x0, 0x300, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000040)=0x2, 0x4) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e22, 0x1, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x80200008}, 0x1c) listen(r1, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) syz_emit_ethernet(0x13e, &(0x7f00000003c0)={@random="e33110495bfd", @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb653e", 0x108, 0x3a, 0xff, @dev, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @rand_addr=' \x01\x00', @private1, [{0x4, 0x1c, "9595f429ae08a565c9a41d413270a44d2e6f790a3872d50bb14d25344dc5b3a281f175f5ee04aab21301b94d966c72c15a143c69205625466855101cf44d89d9f6ee47d77c0d4e53e34b67c542fc6f6f6c60139c43b78286f5bb8f4f11d164af24e2633a45bf4ed944b0ef6a7b7167f73cf54e78686ac09402659c29eb0ce380654c1bb0f61d255b1556b7a311096b7aab867396997ffab76abca01185b08d1e29ee14d8fe61245487104b1c5205c6adc794ba413b92d2d208b86f40983c4819c33b59c1abe2a4b0aa661fcb54e0855d6bb5dd267878ff59bcfc6079e7a5"}]}}}}}}, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) (async) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) recvfrom(r6, 0x0, 0x1b, 0x40010021, 0x0, 0x0) (async) recvfrom(r6, 0x0, 0x1b, 0x40010021, 0x0, 0x0) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000300)={0x6, 'pim6reg\x00', {0x9}, 0x7}) sendmsg$802154_dgram(r6, &(0x7f0000000140)={&(0x7f0000000080)={0x24, @none={0x0, 0xffff}}, 0x14, &(0x7f0000000100)={0x0}, 0x7, 0x0, 0x0, 0x24044055}, 0x40408c0) r7 = openat$cgroup_devices(r5, &(0x7f00000001c0)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r7, &(0x7f00000000c0)=ANY=[@ANYBLOB='c ', @ANYRESHEX=r7], 0x10) socket$nl_route(0x10, 0x3, 0x0) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) (async) r9 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r10, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_ECN={0x8, 0xa, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24004002}, 0x2000400c) setsockopt$inet_sctp_SCTP_RTOINFO(r9, 0x84, 0x0, &(0x7f00000005c0)={0x0, 0x8, 0x8, 0x8}, 0x10) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000240)={'geneve0\x00', &(0x7f0000000200)=@ethtool_rxfh={0x46, 0x4, 0x400, 0x1, 0x6, "f7b6fe"}}) (async) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000240)={'geneve0\x00', &(0x7f0000000200)=@ethtool_rxfh={0x46, 0x4, 0x400, 0x1, 0x6, "f7b6fe"}}) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000c40)=ANY=[@ANYBLOB="3400000000080108000000000000000003000002050003002f010000060002400a000000040004800940010073797a3100000000"], 0x34}, 0x1, 0x0, 0x0, 0x4004}, 0x40) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000100)) 452.156958ms ago: executing program 0 (id=4173): r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r0, 0x5, 0x14, 0x0, &(0x7f00000000c0)="259a53f271a76d2608004c6588a80a38667d2f15", 0x0, 0xd0e, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) (async, rerun: 32) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 32) ioctl$sock_SIOCADDRT(r1, 0x890b, &(0x7f0000000700)={0x0, @rc={0x1f, @none, 0xc0}, @rc={0x1f, @none, 0x4}, @nl=@kern={0x10, 0x0, 0x0, 0x2}, 0x63af, 0x0, 0x0, 0x0, 0x9, &(0x7f00000006c0)='netdevsim0\x00', 0x1, 0x8, 0x7}) (async, rerun: 32) sendmsg$NFT_BATCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100001000000000000dfff000000000a20000000000a01020000000000000000010000000900010073797a30000000006c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a30000000004000038008000140000000002c0003801400010067656e65766530000000000000000000140001006c6f0000000000000000000000000000080002"], 0xb4}}, 0x0) (rerun: 32) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$kcm(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000380)="3336941113212e0f5155929150adfb0343e8d426500908d8c5edd1a826c5cc0e3d09e018ab78c395d0b89194bd1fe6a6884b9adbcb66844a5ef46e4b1fbe71ab5bfa66786941aba5d0b7fb9c0695fb38556b6cb7c788180cd5cc8bc2c1df456000d97f17bd24e0fb35afdd5dd644191b042da19d002773065961f192a50aae7a721af090dd6dd66ed65f8939df64444435b20336c0b0d06af86b05bc55ed65b758b93aab2affe3501087ba262897a38ce870e624f9003a70163ec161c0c1deb43a9e2091a7064b6c72d238bf613d7b95796945d121c4edb8dad8b2113f32b6b70c229d20333c3864a54603185518f9ca5bca12c27d8910053e30e2bc22", 0xfd}, {&(0x7f0000000240)="6567931eaf88add3b30639f2aa278a82ae466454f6d36fff2221effdf4b9a5df359066439df2c0f3f2c390fbc7351682f28b3c06e816cac37214d7675a159c4a3f651adaf10cc7", 0x47}, {&(0x7f0000000540)="9f0c2a84f8f1efa18fab22421ab5e12e960aa3bee40f276df611c2264f045f51e3d88ee77a2783f7d03c2b21239f5415b95d7a28fb0375fe4ae8bf90337c4ea3327d325111122a3e7e664305ebd0bdecf2a7bb0427e42e759605b51f7325edc46c66e9bc449c5db5e5bf392ce05b46e420e2d30f459c85c1db014b0109d84bcb58a209d615b4622477bb7e81bf3592e3d2", 0x91}], 0x3, &(0x7f0000000600)=ANY=[@ANYBLOB="700000000000000013010000e9000000bd284a361bf3406a427fd2aca30e59333e014546bfc28cb945d8aab0492278bfb7d066de0f1433357b0bd8acbc3d74d73966002d4ce86a0dcf031d46738da529cb3f0d7932431f1ccd474d46239a56d3b200"/112], 0x70}, 0x10) 399.768ms ago: executing program 3 (id=4174): r0 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000240)=""/76, &(0x7f00000002c0)=0x4c) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000800000000062015f00ad82b73f0000000095000000"], &(0x7f0000000040)='GPL\x00', 0xfffffffc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) r2 = accept$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @empty}, &(0x7f0000000180)=0x10) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f00000001c0)=ANY=[@ANYBLOB="ee0300000000000006000000000000000200000000000000", @ANYRES32=r1, @ANYBLOB="00000000ffffffff00000040000000000000000000", @ANYRES32=r1, @ANYBLOB='\x00\x00\x00\x00N\a\x00'/28]) 393.071233ms ago: executing program 4 (id=4175): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) (async) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000940)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "c5"}]}], {0x14}}, 0x84}}, 0x0) (async) sendmsg$NFT_BATCH(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)={{0x14}, [@NFT_MSG_NEWRULE={0x5c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x5, 0x7, 0x1, 0x0, "c5"}]}], {0x14}}, 0x84}}, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) socket(0x11, 0x3, 0x0) (async) r5 = socket(0x11, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(r5, 0x1, 0x25, &(0x7f0000000100)=0x1d1f, 0x4) r6 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, &(0x7f0000000000)=0x2512, 0x4) (async) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, &(0x7f0000000000)=0x2512, 0x4) sendmmsg$inet6(r6, &(0x7f00000000c0)=[{{&(0x7f00000001c0)={0xa, 0x0, 0x0, @mcast2}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r6, &(0x7f0000008d80)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x10140, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x2c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x4, 0xfff1}, {0xfff1}, {0xfff2, 0x2}}, [@TCA_CHAIN={0x8, 0xb, 0x1ff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804) (async) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x2c, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x4, 0xfff1}, {0xfff1}, {0xfff2, 0x2}}, [@TCA_CHAIN={0x8, 0xb, 0x1ff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804) r7 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'macsec0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="480000001000010010000000ffdbdf2500000000", @ANYRES32=r9, @ANYBLOB="20000000280e0400280012800b0001006d6163736563000018000280050003000800000d0c00040001000001000280"], 0x48}, 0x1, 0x0, 0x0, 0x24008001}, 0x0) 297.127642ms ago: executing program 2 (id=4176): r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TRIM(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x3f6, 0xb35a6e1699e5dc54, 0x70bd26, 0x25dfdbfb, "", ["", "", "", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x10}, 0x4000) ioctl$RFKILL_IOC_MAX_SIZE(0xffffffffffffffff, 0x2, &(0x7f0000000100)=0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000140), 0x4) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, 0x2, 0x2, 0x801, 0x0, 0x0, {0xd, 0x0, 0x8}, [@CTA_EXPECT_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x52}, @CTA_EXPECT_CLASS={0x8, 0x9, 0x1, 0x0, 0x100}]}, 0x24}, 0x1, 0x0, 0x0, 0x400c051}, 0x40844) r2 = accept4$inet6(r1, &(0x7f0000000280)={0xa, 0x0, 0x0, @private2}, &(0x7f00000002c0)=0x1c, 0x800) setsockopt$MRT6_DEL_MFC_PROXY(r2, 0x29, 0xd3, &(0x7f0000000300)={{0xa, 0x4e23, 0xad9, @mcast2, 0x4}, {0xa, 0x4e24, 0x9, @private0, 0xd}, 0xffffffffffffffff, {[0x0, 0x6, 0x59, 0x7, 0x9, 0x8, 0x0, 0x1]}}, 0x5c) ioctl$BTRFS_IOC_LOGICAL_INO(r0, 0xc0389424, &(0x7f00000003c0)={0x8, 0x10, '\x00', 0x1, &(0x7f0000000380)=[0x0, 0x0]}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000400)={0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000440)=0x28) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f0000000480)={r3, 0x6}, 0x8) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f00000004c0), &(0x7f0000000500)=0x4) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000680)={'syztnl1\x00', &(0x7f0000000600)={'syztnl2\x00', 0x0, 0x2f, 0xb, 0x58, 0x4, 0x4, @mcast2, @mcast2, 0x0, 0x8000, 0x8, 0xb}}) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000780)={&(0x7f00000006c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x60, 0x60, 0x5, [@typedef={0x8, 0x0, 0x0, 0x8, 0x1}, @struct={0xe, 0x6, 0x0, 0x4, 0x0, 0x6, [{0x6, 0x5, 0x6}, {0xd, 0x0, 0x7}, {0x4, 0x0, 0xffffffef}, {0xd, 0x1, 0x4}, {0x7, 0x1, 0x56c}, {0xd, 0x3}]}]}, {0x0, [0x5f, 0x51, 0x61]}}, &(0x7f0000000740)=""/45, 0x7d, 0x2d, 0x1, 0x3, 0x10000}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000007c0)={0x11, 0xe, &(0x7f0000000540)=@raw=[@generic={0x9, 0x9, 0x0, 0x1, 0x8}, @map_idx_val={0x18, 0xa, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x357b}, @printk={@llu, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @cb_func={0x18, 0x0, 0x4, 0x0, 0xfffffffffffffffd}], &(0x7f00000005c0)='GPL\x00', 0xf1b, 0x0, 0x0, 0x41100, 0x8, '\x00', r7, 0x0, r8, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r2, 0x84, 0x5, &(0x7f0000000880)={r5, @in={{0x2, 0x4e24, @loopback}}}, 0x84) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000009c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r9, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000a40)={&(0x7f0000000a00)={0x40, r10, 0x200, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x8, 0x65}}}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000801}, 0x20040000) socket$nl_netfilter(0x10, 0x3, 0xc) setsockopt$inet6_tcp_int(r1, 0x6, 0x18, &(0x7f0000000ac0)=0x88, 0x4) r12 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r12, 0x84, 0x6, &(0x7f0000000b00)={r4, @in6={{0xa, 0x4e21, 0x200, @loopback, 0x5}}}, &(0x7f0000000bc0)=0x84) sendmmsg(r1, &(0x7f0000000e00)=[{{&(0x7f0000000c00)=@hci={0x1f, 0x3, 0x3}, 0x80, &(0x7f0000000dc0)=[{&(0x7f0000000c80)="003a74e242915e225fe9db14ea94d071b6be8989350ca9582dc27247f29160c22975e7cb0cd01c2437974aba1e67f2f0614e990b84", 0x35}, {&(0x7f0000000cc0)="38ed56331841c764923aa8edc583cda96b62ced79bc99f16299220bcafe680077937aa6ae9019bcc8bae7c91191d769c0aed8f5550c6adc175edd247ca24a18d5ce25748254ec46326681f19eb3a33fa33fdc4a5f5606a78944274c572c7b88e424fa0631baa2517568dde6915bfaa208d1c9caab08458879de182ab925895704d944ce2d4b54c5a195db6323efab5e23cc3f86f87e4e99be4a5dd74b113fc776912934859b4bdc3ccdee276e0aabe0898ae969e5adfa2c65fe3553b110b2c7538e9b36ecb62282949188355", 0xcc}], 0x2}}], 0x1, 0x400c0) r13 = socket$inet(0x2, 0x1, 0x1) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r13, 0x84, 0x6, &(0x7f0000000e40)={r6, @in={{0x2, 0x4e22, @broadcast}}}, &(0x7f0000000f00)=0x84) getsockopt$IP_VS_SO_GET_TIMEOUT(r12, 0x0, 0x486, &(0x7f0000000f40), &(0x7f0000000f80)=0xc) sendto$inet6(r1, &(0x7f0000000fc0)="8daed4c383bfd4419f31031448d976fe0244731e3f89085461055e2a40babbc8686ce85df02004e945bd400e899d58441da7e0d5cf3124b0112b4a48698f0f81f08e0aecef29bb74b11216226c5e020893043977b240aa339cf5124e1d7c803b846b2c6b8add846b0ca275a66c7663da1244a3d3198741abe08d4ea8cedd3e60874eed25dcd8320c024be4e279f4cefb", 0x90, 0x0, &(0x7f0000001080)={0xa, 0x4e23, 0x10001, @remote, 0x7}, 0x1c) write$6lowpan_enable(0xffffffffffffffff, &(0x7f0000001100)='1', 0x1) 281.72247ms ago: executing program 3 (id=4177): r0 = socket$can_raw(0x1d, 0x3, 0x1) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000000)="ce50d1c314f8e2029e63c1e7aed0801a9cb98e6c5577ce0a2129f5f2f5c29aae", 0x20}], 0x1) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) (async) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r0, 0x8008f513, &(0x7f00000000c0)) (async, rerun: 32) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000100), 0x8) (rerun: 32) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{0x1, 0xffffffffffffffff}, &(0x7f0000000140), &(0x7f0000000180)}, 0x20) (async, rerun: 32) ioctl$sock_ipv6_tunnel_SIOCGET6RD(0xffffffffffffffff, 0x89f8, &(0x7f00000013c0)={'syztnl2\x00', &(0x7f0000001340)={'gre0\x00', 0x0, 0x80, 0x8000, 0x2, 0x9e, {{0x17, 0x4, 0x1, 0x3, 0x5c, 0x65, 0x0, 0x3, 0x29, 0x0, @multicast2, @local, {[@timestamp={0x44, 0x10, 0x9d, 0x0, 0xb, [0x7, 0xfffffff8, 0xe]}, @noop, @timestamp_prespec={0x44, 0x2c, 0xc9, 0x3, 0x9, [{@multicast1, 0xb}, {@broadcast, 0x5}, {@multicast1, 0xf9}, {@local, 0x322c}, {@private=0xa010101, 0x4}]}, @lsrr={0x83, 0x7, 0x5, [@broadcast]}, @ra={0x94, 0x4}]}}}}}) (rerun: 32) r6 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001500)={&(0x7f0000001400)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x4c, 0x4c, 0x8, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x4, 0x4}}, @ptr={0xf, 0x0, 0x0, 0x2, 0x3}, @const={0xb, 0x0, 0x0, 0xa, 0x1}, @var={0xf, 0x0, 0x0, 0xe, 0x5}, @fwd={0x8}]}, {0x0, [0x0, 0x2e, 0x5f, 0x0, 0x30, 0x61]}}, &(0x7f0000001480)=""/117, 0x6c, 0x75, 0x1, 0x300, 0x10000}, 0x28) (async, rerun: 32) r7 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000015c0)=@generic={&(0x7f0000001580)='./file0\x00', 0x0, 0x10}, 0x18) (async, rerun: 32) pipe(&(0x7f0000001600)={0xffffffffffffffff, 0xffffffffffffffff}) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001640)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0xe9e, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x1}, 0x50) r11 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000016c0)={0x0, 0x1, 0x10}, 0xc) (async) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001700)={0xffffffffffffffff, 0x2, 0x18}, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001800)={0x6, 0x19, &(0x7f0000000200)=@raw=[@cb_func={0x18, 0xb, 0x4, 0x0, 0x6}, @map_val={0x18, 0xa, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x46e7}, @alu={0x4, 0x0, 0xc, 0x4, 0x9, 0x6, 0xfffffffffffffff0}, @btf_id={0x18, 0x4, 0x3, 0x0, 0x3}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r3}}, @jmp={0x5, 0x1, 0x9, 0x4, 0x1, 0x20, 0xffffffffffffffff}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}, @printk={@li, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3}}], &(0x7f0000000300)='syzkaller\x00', 0x7808d6e3, 0x1000, &(0x7f0000000340)=""/4096, 0x41100, 0x24, '\x00', r5, 0x25, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000001540)={0x3, 0x1, 0x6, 0x926}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000001740)=[r7, r8, r10, r11, r12], &(0x7f0000001780)=[{0x4, 0x5, 0xa, 0x4}, {0x4, 0x2, 0x4, 0x3}, {0x2, 0x4, 0x6, 0x5}, {0x3, 0x4, 0xc, 0x4}, {0x4, 0x1, 0x6, 0x9}, {0x5, 0x5, 0x3, 0x8}, {0x5, 0x4, 0x9, 0xc}, {0x4, 0x5, 0x9, 0xa}], 0x10, 0x3}, 0x94) r13 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$sock_cred(r13, 0x1, 0x11, &(0x7f00000018c0), &(0x7f0000001900)=0xc) setsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000001940)=0x9, 0x4) (async) ioctl$F2FS_IOC_MOVE_RANGE(r8, 0xc020f509, &(0x7f0000001980)={r4, 0x1ff, 0x80, 0x3}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001a40)={{r14}, &(0x7f00000019c0), &(0x7f0000001a00)='%pI4 \x00'}, 0x20) (async, rerun: 32) setsockopt$bt_BT_SECURITY(r14, 0x112, 0x4, &(0x7f0000001a80)={0xff, 0xf0}, 0x2) (async, rerun: 32) setsockopt$MRT_ADD_MFC(r11, 0x0, 0xcc, &(0x7f0000001ac0)={@remote, @loopback, 0xffffffffffffffff, "93c4f1aa46b58b828772e14aa32f2edb81d0359a08e4986b2e62aa5f2df62dae", 0x185, 0x1, 0x4, 0x80ef}, 0x3c) ioctl$sock_SIOCSIFVLAN_GET_VLAN_VID_CMD(r8, 0x8983, &(0x7f0000001b00)) r15 = socket$nl_generic(0x10, 0x3, 0x10) (async) getsockopt$WPAN_SECURITY(r8, 0x0, 0x1, &(0x7f0000001b40), &(0x7f0000001b80)=0x4) (async) r16 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001c00), r3) sendmsg$NL80211_CMD_SET_PMKSA(r3, &(0x7f0000001d00)={&(0x7f0000001bc0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001cc0)={&(0x7f0000001c40)={0x78, r16, 0xf0057b97c2e30bf5, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x4, 0x7b}}}}, [@NL80211_ATTR_PMK={0x14, 0xfe, "8c16a764e2ecf4a47cd2cd4a3a480898"}, @NL80211_ATTR_PMKID={0x14, 0x55, "80afcb548549276e21775987f1d2e9bd"}, @NL80211_ATTR_PMKID={0x14, 0x55, "c8a20e53ea253c33a42efe89a2de7307"}, @NL80211_ATTR_PMK_LIFETIME={0x8, 0x11f, 0x1ff}, @NL80211_ATTR_MAC={0xa, 0x6, @random="fc0f0045bf8f"}]}, 0x78}, 0x1, 0x0, 0x0, 0x2000c004}, 0x4080000) (async) r17 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001d80), r9) sendmsg$L2TP_CMD_SESSION_GET(r8, &(0x7f0000001e40)={&(0x7f0000001d40)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001e00)={&(0x7f0000001dc0)={0x34, r17, 0x2, 0x70bd2a, 0x25dfdbfc, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_DEBUG={0x8}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x3f}, @L2TP_ATTR_DATA_SEQ={0x5, 0x4, 0x8}]}, 0x34}, 0x1, 0x0, 0x0, 0x4044}, 0x20044080) (async) sendmsg$NL80211_CMD_STOP_AP(r15, &(0x7f0000001f80)={&(0x7f0000001e80)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000001f40)={&(0x7f0000001f00)={0x14, 0x0, 0x400, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @void}}, ["", "", "", "", "", "", "", "", ""]}, 0x14}}, 0x20000080) 148.004007ms ago: executing program 3 (id=4178): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000009500000000000000"], &(0x7f0000000000)='syzkaller\x00', 0x6}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000001c0)='sched_process_wait\x00', r1}, 0x10) r3 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r2}, 0x8) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000006c0)={@ifindex, 0xffffffffffffffff, 0x11, 0x0, 0x0, @void, @value=r3}, 0x20) getsockopt$inet6_int(r0, 0x29, 0x1, 0x0, &(0x7f0000000b40)) 147.217516ms ago: executing program 1 (id=4179): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a0400eb2636037f00000000", @ANYRES32=r1, @ANYBLOB="020000000000800080001200080001007674693674000200600004"], 0xa0}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) socket(0x10, 0x803, 0x0) (async) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) (async) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a0400eb2636037f00000000", @ANYRES32=r1, @ANYBLOB="020000000000800080001200080001007674693674000200600004"], 0xa0}}, 0x0) (async) 122.834277ms ago: executing program 3 (id=4180): socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x66, &(0x7f0000000c00)={@broadcast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00\x00\b', 0x30, 0x3a, 0xff, @private0={0xfc, 0x0, '\x00', 0x1}, @mcast2, {[], @ndisc_redir={0x87, 0x0, 0x0, '\x00', @local, @private2={0xfc, 0x2, '\x00', 0x1}, [{0xe, 0x1, "2025b07f3c58"}]}}}}}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100), 0x6) getsockname(r0, 0x0, &(0x7f0000002100)) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_type(r1, 0x0, 0x2, 0x0) openat$cgroup_procs(r1, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup/syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_procs(r2, &(0x7f00000003c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r3, &(0x7f00000005c0), 0x12) 708.841碌s ago: executing program 3 (id=4181): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000038c0), r0) sendmsg$IEEE802154_ASSOCIATE_RESP(r0, &(0x7f0000003980)={0x0, 0x0, &(0x7f0000003940)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r1, @ANYBLOB="01002cbd7000ffdbbf2513000000667dd30df8fc44f392d94cd4866e6c01e6add4fbe298eb8351ef378ec1ecf402d02cc10e9ea75eb5952b7342645254b3acd18e5b536b363b794151b50dd4306a8dba17a5"], 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x200008d0) r2 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000080)={r2}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000004c0)=@newqdisc={0xbc, 0x24, 0xf0b, 0x0, 0x3, {0x0, 0x0, 0x12, r3, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x68, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0xffff], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x4}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x16, 0x5, 0x1, 0x5, 0x0, 0xffffffff, 0x7fffffff}}, {0x4}}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$int_in(r5, 0x5452, &(0x7f0000000c80)=0xf4e) writev(r5, &(0x7f0000019880)=[{&(0x7f0000000400)="fb", 0x1}], 0x1) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xe, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="25efbc000000000000000017ad986d39153cdf48d3"], &(0x7f0000000000)='GPL\x00'}, 0x90) 0s ago: executing program 1 (id=4182): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, 0x0, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000700)={'wlan0\x00', 0x0}) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$l2tp6(r4, 0x0, 0x0, 0xc096, &(0x7f0000000000)={0xa, 0x0, 0x5, @private2, 0x1, 0x8}, 0x20) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000000000002100000008000300", @ANYRES32=r3, @ANYBLOB="10007d8005", @ANYRES8=0x0, @ANYRES32=r1], 0x2c}, 0x1, 0x0, 0x0, 0x20004080}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={0x0, 0x64}}, 0x4800) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)={0x1b, 0x0, 0x0, 0x4, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0x0, 0x2}, 0x95) r5 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r1, 0x80286722, &(0x7f0000000000)={&(0x7f0000000a40)=""/4096, 0x1000, 0x2, 0x10001}) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000040)={'bond0\x00', &(0x7f0000000480)=@ethtool_gstrings={0x1b, 0x8}}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000008c0)=@can_newroute={0x154, 0x18, 0x300, 0x0, 0x0, {0x1d, 0x1, 0x7}, [@CGW_MOD_XOR={0x15, 0x3, {{{}, 0x0, 0x0, 0x0, 0x0, "8ca5be073cff296e"}, 0x2}}, @CGW_CS_CRC8={0x11e, 0x6, {0x5, 0xff, 0x0, 0x0, 0x1, "71ec6d721744cd5200080000f8cfcad4c4ec6511ec028c5028564abce83afe14c93e15e556c2baed7f897fe841c155a2b2a4b9f3052b95cdf66a9c79a49555c5005b6c67281f1519cd7c32c2bf7563b9456575505da99ea128d37616896be8764a397686e807c95092e405bdc893770338925f824bd24689c0d11a5568fc3aaa9ad0d7766d8ea8d3bf1006e3df494e2f373148ecb4adafdd3908b118301f1e76054a64c6d243523f5de7b347f3b740e105d0ed18fae7289635301ebd8949268090b3bcd4cbed5f1cfe93cff41a9630802f96defe9e8ea850529827c5e301953a8abaafa1f121e590f74e28233f4129d4587eee87ec5d42c3ef0619022c00", 0x1, "5c8d586b2a88d81866930fca15c8a95d29e5b2ea"}}, @CGW_CS_XOR={0x8}]}, 0x154}}, 0x49080) kernel console output (not intermixed with test programs): er0: entered promiscuous mode [ 222.563507][T13608] syzkaller0: entered allmulticast mode [ 222.579009][T13609] xt_time: unknown flags 0xf4 [ 222.608464][T13607] set match dimension is over the limit! [ 222.674970][T13612] tipc: Resetting bearer [ 222.872699][T13600] tipc: Resetting bearer [ 222.944159][T13600] tipc: Disabling bearer [ 223.610492][T13671] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2232'. [ 223.922911][ T5890] IPVS: starting estimator thread 0... [ 224.017222][T13686] IPVS: using max 32 ests per chain, 76800 per kthread [ 224.136341][T13698] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 224.256594][T13703] xt_bpf: check failed: parse error [ 224.286715][T13703] xt_bpf: check failed: parse error [ 224.293390][T13703] xt_bpf: check failed: parse error [ 224.299674][T13703] xt_bpf: check failed: parse error [ 224.311526][T13703] xt_bpf: check failed: parse error [ 224.343866][T13703] xt_bpf: check failed: parse error [ 224.351103][T13703] xt_bpf: check failed: parse error [ 224.357860][T13703] xt_bpf: check failed: parse error [ 224.367778][T13703] xt_bpf: check failed: parse error [ 224.374747][T13703] xt_bpf: check failed: parse error [ 224.542269][T13717] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2250'. [ 224.554605][T13717] netlink: 104 bytes leftover after parsing attributes in process `syz.4.2250'. [ 224.575130][T13715] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2251'. [ 224.682197][T13724] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2253'. [ 224.949690][T13739] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 225.007000][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5750 ms [ 225.016685][ C0] lec:lec_tx_timeout: lec0 [ 225.047370][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 225.265010][T13752] netlink: 'syz.0.2262': attribute type 2 has an invalid length. [ 225.419796][T13751] vlan0 (unregistering): left allmulticast mode [ 225.428724][T13751] veth0_vlan (unregistering): left allmulticast mode [ 225.436036][T13751] vlan0 (unregistering): left promiscuous mode [ 225.623480][T13770] netlink: 'syz.1.2267': attribute type 1 has an invalid length. [ 225.675117][T13770] 8021q: adding VLAN 0 to HW filter on device bond0 [ 225.737981][T13770] veth5: entered promiscuous mode [ 225.798939][T13770] bond0: (slave veth5): Enslaving as an active interface with a down link [ 225.840418][T13783] x_tables: duplicate underflow at hook 1 [ 225.866005][T13781] vlan2: entered allmulticast mode [ 225.872233][T13781] bond0: entered allmulticast mode [ 225.882640][T13781] bond0: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 226.635556][T13821] netlink: 'syz.4.2281': attribute type 10 has an invalid length. [ 226.662147][T13821] __nla_validate_parse: 5 callbacks suppressed [ 226.662164][T13821] netlink: 808 bytes leftover after parsing attributes in process `syz.4.2281'. [ 226.913776][T13841] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2287'. [ 226.937991][T13841] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2287'. [ 227.099321][T13841] vlan3: entered promiscuous mode [ 227.157875][T13841] bridge0: entered promiscuous mode [ 227.268025][T13863] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2290'. [ 227.618305][T13882] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2295'. [ 227.900486][T13893] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2298'. [ 227.927514][T13893] bridge_slave_0: default FDB implementation only supports local addresses [ 228.397341][T13908] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2303'. [ 228.814716][T13927] IPVS: Error connecting to the multicast addr [ 228.930819][T13934] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2313'. [ 228.953071][T13934] netlink: 'syz.3.2313': attribute type 5 has an invalid length. [ 228.977787][T13934] netlink: 20 bytes leftover after parsing attributes in process `syz.3.2313'. [ 229.011645][T13941] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2313'. [ 229.053217][T13934] geneve3: entered promiscuous mode [ 229.068591][T13934] geneve3: entered allmulticast mode [ 229.091906][ T6554] netdevsim netdevsim3 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 229.102296][ T6554] netdevsim netdevsim3 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 229.122376][ T6554] netdevsim netdevsim3 eth2: set [1, 1] type 2 family 0 port 256 - 0 [ 229.141566][T13944] xt_TCPMSS: Only works on TCP SYN packets [ 229.142286][ T6554] netdevsim netdevsim3 eth3: set [1, 1] type 2 family 0 port 256 - 0 [ 229.810726][T13966] tipc: Enabled bearer , priority 10 [ 229.894238][ T6554] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 229.929291][ T6554] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 230.056342][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 230.064841][ C0] lec:lec_tx_timeout: lec0 [ 230.070156][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 230.319820][T13991] netlink: 'syz.3.2332': attribute type 1 has an invalid length. [ 230.427770][T14002] 8021q: adding VLAN 0 to HW filter on device bond6 [ 230.529690][T14014] mac80211_hwsim hwsim7 syzkaller0: entered promiscuous mode [ 230.540810][T14014] mac80211_hwsim hwsim7 syzkaller0: entered allmulticast mode [ 230.664239][T14017] veth7: entered promiscuous mode [ 230.894412][T14033] xt_time: unknown flags 0xf4 [ 230.928468][ T7338] tipc: Node number set to 1198374971 [ 231.132792][T14050] netlink: 'syz.3.2346': attribute type 1 has an invalid length. [ 231.145635][T14050] netlink: 'syz.3.2346': attribute type 2 has an invalid length. [ 231.157795][T14050] netlink: 'syz.3.2346': attribute type 1 has an invalid length. [ 231.750016][T14065] team0 (unregistering): Port device team_slave_0 removed [ 231.761190][T14065] team0 (unregistering): Port device team_slave_1 removed [ 231.775572][T14065] team0 (unregistering): Port device veth0_virt_wifi removed [ 232.158082][T14112] __nla_validate_parse: 11 callbacks suppressed [ 232.158102][T14112] netlink: 84 bytes leftover after parsing attributes in process `syz.2.2363'. [ 232.440384][T14123] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2367'. [ 232.479787][T14127] netlink: 100 bytes leftover after parsing attributes in process `syz.4.2369'. [ 232.482543][T14123] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2367'. [ 232.883328][T14150] netlink: 'syz.4.2376': attribute type 1 has an invalid length. [ 233.057845][T14156] blkio.reset_stats is deprecated [ 233.182462][T14159] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2379'. [ 233.658313][T14177] IPVS: fo: FWM 3 0x00000003 - no destination available [ 233.667260][ C0] IPVS: fo: FWM 3 0x00000003 - no destination available [ 233.954077][T14187] pimreg3: entered allmulticast mode [ 233.963140][T14169] lo: entered allmulticast mode [ 233.970407][T14188] netlink: 'syz.1.2389': attribute type 29 has an invalid length. [ 234.026403][T14188] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2389'. [ 234.073801][ T6554] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 234.085886][ T6554] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 234.189042][T14193] netlink: zone id is out of range [ 234.218854][T14193] netlink: zone id is out of range [ 234.243852][T14193] netlink: del zone limit has 8 unknown bytes [ 234.370806][T14205] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2394'. [ 234.545160][T14218] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2397'. [ 235.001496][T14238] tipc: Enabled bearer , priority 0 [ 235.020931][T14237] tipc: Resetting bearer [ 235.079339][T14237] tipc: Resetting bearer [ 235.086352][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 235.095823][ C0] lec:lec_tx_timeout: lec0 [ 235.101984][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 235.177657][T14256] netlink: 'syz.0.2408': attribute type 1 has an invalid length. [ 235.230711][T14256] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2408'. [ 235.293611][T14256] block nbd1: not configured, cannot reconfigure [ 235.369623][T14277] openvswitch: netlink: Key 22 has unexpected len 2 expected 4 [ 235.729443][T14297] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2419'. [ 235.999080][T14314] __bpf_mt_check_bytecode: 23 callbacks suppressed [ 235.999100][T14314] xt_bpf: check failed: parse error [ 236.133482][T14322] netlink: 'syz.2.2425': attribute type 1 has an invalid length. [ 238.010302][T14294] __nla_validate_parse: 2 callbacks suppressed [ 238.010323][T14294] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2418'. [ 238.036738][T14322] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 238.186214][T14329] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2426'. [ 238.243039][T14330] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2427'. [ 238.261184][T14338] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2429'. [ 238.278647][T14331] xt_l2tp: wrong L2TP version: 0 [ 238.284872][T14330] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 238.544833][T14353] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2432'. [ 238.604807][T14352] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2434'. [ 238.654847][T14352] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 238.740857][T14363] netlink: 'syz.4.2435': attribute type 1 has an invalid length. [ 238.790719][T14360] macvtap1: entered promiscuous mode [ 238.800786][T14360] vlan0: entered promiscuous mode [ 238.807453][T14360] macvtap1: entered allmulticast mode [ 238.809845][T14368] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2439'. [ 238.814619][T14360] vlan0: entered allmulticast mode [ 238.832145][T14360] veth0_vlan: entered allmulticast mode [ 238.855318][T14366] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2438'. [ 239.070598][T14382] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2443'. [ 239.175885][T14386] sctp: [Deprecated]: syz.3.2444 (pid 14386) Use of int in maxseg socket option. [ 239.175885][T14386] Use struct sctp_assoc_value instead [ 239.203349][T14386] netlink: 'syz.3.2444': attribute type 1 has an invalid length. [ 239.220430][T14386] netlink: 172 bytes leftover after parsing attributes in process `syz.3.2444'. [ 239.954904][T14434] delete_channel: no stack [ 239.979703][T14434] 0{X功: entered promiscuous mode [ 239.985229][T14434] 0{X功: left allmulticast mode [ 240.021590][T14435] 1{X功: renamed from 30{X功 [ 240.042046][T14435] 1{X功: left promiscuous mode [ 240.049277][T14435] 1{X功: entered allmulticast mode [ 240.063573][T14435] A link change request failed with some changes committed already. Interface 31{X功 may have been left with an inconsistent configuration, please check. [ 240.082899][T14434] 0{X功: renamed from 31{X功 (while UP) [ 240.095918][T14434] A link change request failed with some changes committed already. Interface 30{X功 may have been left with an inconsistent configuration, please check. [ 240.319446][T14457] netlink: 'syz.1.2464': attribute type 2 has an invalid length. [ 240.577619][T14478] tipc: Enabled bearer , priority 0 [ 240.586245][T14478] syzkaller0: entered promiscuous mode [ 240.592914][T14478] syzkaller0: entered allmulticast mode [ 240.641270][T14478] tipc: Resetting bearer [ 240.671538][T14477] tipc: Resetting bearer [ 240.737152][T14477] tipc: Disabling bearer [ 240.996376][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5890 ms [ 241.005566][ C0] lec:lec_tx_timeout: lec0 [ 241.011677][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 241.570321][T14539] netlink: 'syz.2.2483': attribute type 4 has an invalid length. [ 242.508440][T14602] netlink: 'syz.4.2501': attribute type 25 has an invalid length. [ 242.581205][T14605] tipc: Enabling of bearer rejected, already enabled [ 242.673272][T14613] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 242.674196][T14614] netlink: 'syz.2.2505': attribute type 1 has an invalid length. [ 243.155018][T14645] __nla_validate_parse: 20 callbacks suppressed [ 243.155037][T14645] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2513'. [ 243.169803][T14647] bond0: option all_slaves_active: invalid value (3) [ 243.346856][T14653] netlink: 'syz.3.2520': attribute type 9 has an invalid length. [ 243.453205][T14664] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 243.528655][T14667] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2521'. [ 243.541331][T14667] netlink: 18 bytes leftover after parsing attributes in process `syz.4.2521'. [ 243.903950][T14691] netlink: 'syz.4.2530': attribute type 1 has an invalid length. [ 243.957780][T14691] 8021q: adding VLAN 0 to HW filter on device bond2 [ 243.988207][T14695] netlink: 244 bytes leftover after parsing attributes in process `syz.1.2531'. [ 244.099036][T14702] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2533'. [ 244.136133][T14700] veth11: entered promiscuous mode [ 244.186851][T14707] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2534'. [ 244.199337][T14707] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2534'. [ 244.222910][T14710] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2534'. [ 244.241921][T14710] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2534'. [ 244.459918][T14725] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2538'. [ 244.563767][T14725] netlink: 'syz.1.2538': attribute type 6 has an invalid length. [ 245.130522][T14757] netlink: 'syz.0.2549': attribute type 29 has an invalid length. [ 245.172758][T14757] netlink: 'syz.0.2549': attribute type 29 has an invalid length. [ 245.417971][T14769] netlink: 'syz.1.2553': attribute type 3 has an invalid length. [ 245.448034][T14769] netlink: 'syz.1.2553': attribute type 3 has an invalid length. [ 245.729738][T14789] veth0_macvtap: left promiscuous mode [ 246.026899][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 246.036398][ C0] lec:lec_tx_timeout: lec0 [ 246.042902][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 246.238123][T14824] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 246.923475][T14864] vlan0: entered promiscuous mode [ 246.942664][T14864] vlan0: entered allmulticast mode [ 246.950858][T14864] hsr_slave_1: entered allmulticast mode [ 247.075799][T14875] validate_nla: 4 callbacks suppressed [ 247.075820][T14875] netlink: 'syz.4.2584': attribute type 1 has an invalid length. [ 247.523400][T14907] netlink: 'syz.4.2593': attribute type 1 has an invalid length. [ 247.779555][T14920] netlink: 'syz.4.2597': attribute type 32 has an invalid length. [ 247.850347][T14920] bond4: Setting coupled_control to off (0) [ 248.144605][T14944] Bluetooth: hci0: Opcode 0x0c1a failed: -22 [ 248.249747][T14949] xt_l2tp: missing protocol rule (udp|l2tpip) [ 248.262414][T14951] netlink: 'syz.3.2605': attribute type 1 has an invalid length. [ 248.339233][T14959] netlink: 'syz.2.2607': attribute type 1 has an invalid length. [ 248.381371][T14959] 8021q: adding VLAN 0 to HW filter on device bond5 [ 248.390721][T14962] __nla_validate_parse: 22 callbacks suppressed [ 248.390742][T14962] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2608'. [ 248.457974][T14959] veth7: entered promiscuous mode [ 248.557023][T14967] netlink: 'syz.2.2610': attribute type 29 has an invalid length. [ 248.568594][T14967] netlink: 'syz.2.2610': attribute type 29 has an invalid length. [ 248.997841][T14982] ieee802154 phy0 wpan0: encryption failed: -22 [ 249.026176][T14990] netlink: 152 bytes leftover after parsing attributes in process `syz.3.2617'. [ 249.112465][T14995] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2616'. [ 249.544252][T15015] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2622'. [ 249.568238][T15017] veth0: entered promiscuous mode [ 249.600307][T15017] veth0: left promiscuous mode [ 249.758037][T15025] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2625'. [ 249.831112][T15025] tc_dump_action: action bad kind [ 250.050249][T15045] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2632'. [ 250.107229][T15045] bond0: (slave bridge_slave_1): Releasing backup interface [ 250.187500][T15054] netlink: 144 bytes leftover after parsing attributes in process `syz.4.2635'. [ 250.200478][ T5825] Bluetooth: hci0: command tx timeout [ 250.272230][T15055] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2633'. [ 250.303369][T15057] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 250.318091][T15057] syz.3.2636 uses old SIOCAX25GETINFO [ 250.382678][T15057] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2636'. [ 250.750161][T15073] 8021q: adding VLAN 0 to HW filter on device bond7 [ 250.753829][T15077] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2642'. [ 251.056328][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 251.064965][ C0] lec:lec_tx_timeout: lec0 [ 251.070949][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 251.178646][T15101] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 251.780009][T15140] hsr_slave_0 (unregistering): left promiscuous mode [ 252.825401][T15195] netlink: 'syz.0.2681': attribute type 1 has an invalid length. [ 252.872807][T15195] netlink: 'syz.0.2681': attribute type 1 has an invalid length. [ 252.899145][T15195] netlink: 'syz.0.2681': attribute type 1 has an invalid length. [ 253.413018][T15216] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 253.878525][T15243] __nla_validate_parse: 12 callbacks suppressed [ 253.878545][T15243] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2694'. [ 253.933255][T15243] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2694'. [ 254.530920][T15227] Cannot find add_set index 2 as target [ 254.539467][T15228] Cannot find add_set index 2 as target [ 254.722797][T15270] netlink: 'syz.0.2701': attribute type 1 has an invalid length. [ 254.732023][T15270] netlink: 228 bytes leftover after parsing attributes in process `syz.0.2701'. [ 254.755342][T15270] syzkaller1: entered promiscuous mode [ 254.784989][T15270] syzkaller1: entered allmulticast mode [ 255.303770][T15291] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2706'. [ 255.454779][T15298] IPVS: set_ctl: invalid protocol: 29 172.30.0.5:20004 [ 255.619370][T15301] block nbd2: NBD_DISCONNECT [ 255.628026][T15296] nbd: device at index 2 is going down [ 255.721433][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.734861][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.905285][ T6746] udevd[6746]: inotify_add_watch(7, /dev/nbd2, 10) failed: No such file or directory [ 256.086385][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 256.095118][ C0] lec:lec_tx_timeout: lec0 [ 256.101190][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 256.234156][T15318] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2714'. [ 256.302924][T15320] netlink: 184 bytes leftover after parsing attributes in process `syz.2.2715'. [ 256.435969][T15320] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2715'. [ 257.115662][T15352] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2723'. [ 257.445405][T15367] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2729'. [ 257.633865][T15370] netlink: 1 bytes leftover after parsing attributes in process `syz.4.2730'. [ 258.130771][T15392] veth1_to_bond: entered allmulticast mode [ 258.145562][T15392] tipc: Enabling of bearer rejected, already enabled [ 258.172052][T15391] veth1_to_bond: left allmulticast mode [ 258.393957][T15401] tipc: Enabled bearer , priority 0 [ 258.402476][T15401] syzkaller0: entered promiscuous mode [ 258.409412][T15401] syzkaller0: entered allmulticast mode [ 258.423471][T15401] tipc: Resetting bearer [ 258.448923][T15400] tipc: Resetting bearer [ 258.469320][T15400] tipc: Disabling bearer [ 258.723343][T15184] Set syz1 is full, maxelem 65536 reached [ 259.000188][T15428] __nla_validate_parse: 4 callbacks suppressed [ 259.000207][T15428] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2751'. [ 259.052355][T15428] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2751'. [ 259.127723][T15428] netlink: 'syz.4.2751': attribute type 14 has an invalid length. [ 259.146614][T15438] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2755'. [ 259.153089][T15428] netlink: 'syz.4.2751': attribute type 13 has an invalid length. [ 259.325432][T15445] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2758'. [ 259.347228][T15445] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2758'. [ 259.377273][T15445] netlink: 'syz.0.2758': attribute type 12 has an invalid length. [ 259.389314][T15448] team_slave_0: entered promiscuous mode [ 259.401847][T15448] team_slave_1: entered promiscuous mode [ 259.420442][T15445] netlink: 'syz.0.2758': attribute type 11 has an invalid length. [ 259.433362][T15455] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2758'. [ 259.452561][T15455] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2758'. [ 259.468339][T15445] netlink: 332 bytes leftover after parsing attributes in process `syz.0.2758'. [ 259.591146][T15460] batman_adv: batadv0: Adding interface: vlan4 [ 259.598326][T15460] batman_adv: batadv0: The MTU of interface vlan4 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 259.632710][T15460] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 259.659561][T15460] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 259.701769][T15460] batman_adv: batadv0: Not using interface vlan4 (retrying later): interface not active [ 259.783434][T15469] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2764'. [ 259.794592][T15469] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 260.008740][T15469] batman_adv: batadv0: Removing interface: vlan4 [ 260.069557][T15469] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 260.191517][T15491] netlink: 56 bytes leftover after parsing attributes in process `syz.4.2773'. [ 260.680096][T15514] bond7 (unregistering): Released all slaves [ 260.840919][T15524] openvswitch: netlink: Port -1 exceeds max allowable 65535 [ 261.199150][T15547] netlink: 'syz.4.2792': attribute type 8 has an invalid length. [ 261.839249][ T5838] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 261.855742][ T5826] syz_tun (unregistering): left allmulticast mode [ 261.868362][ T5838] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 261.879436][ T5838] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 261.889384][ T5838] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 261.895217][ T5826] syz_tun (unregistering): left promiscuous mode [ 261.910758][ T5826] bridge0: port 3(syz_tun) entered disabled state [ 261.918767][ T5838] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 262.116396][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 6010 ms [ 262.126114][T15561] hsr0 speed is unknown, defaulting to 1000 [ 262.127251][ C0] lec:lec_tx_timeout: lec0 [ 262.141589][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 262.162119][T15561] wg1 speed is unknown, defaulting to 1000 [ 263.033672][T15561] chnl_net:caif_netlink_parms(): no params data found [ 263.051562][T15616] netlink: 'syz.0.2807': attribute type 1 has an invalid length. [ 263.144928][T15616] 8021q: adding VLAN 0 to HW filter on device bond9 [ 263.217026][T15623] 8021q: adding VLAN 0 to HW filter on device bond9 [ 263.227639][T15623] bond9: (slave vxcan3): The slave device specified does not support setting the MAC address [ 263.254365][T15623] bond9: (slave vxcan3): Error -95 calling set_mac_address [ 263.295037][T15616] veth5: entered promiscuous mode [ 263.319916][T15616] bond9: (slave veth5): Enslaving as an active interface with a down link [ 263.369685][T15630] vlan0: entered allmulticast mode [ 263.375286][T15630] bond9: entered allmulticast mode [ 263.639230][T15654] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 263.690898][T15561] bridge0: port 1(bridge_slave_0) entered blocking state [ 263.699718][T15561] bridge0: port 1(bridge_slave_0) entered disabled state [ 263.709088][T15561] bridge_slave_0: entered allmulticast mode [ 263.718873][T15561] bridge_slave_0: entered promiscuous mode [ 263.739405][T15561] bridge0: port 2(bridge_slave_1) entered blocking state [ 263.755789][T15561] bridge0: port 2(bridge_slave_1) entered disabled state [ 263.766047][T15561] bridge_slave_1: entered allmulticast mode [ 263.780047][T15561] bridge_slave_1: entered promiscuous mode [ 263.900605][T15561] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 263.932560][T15662] tipc: Enabling of bearer rejected, already enabled [ 263.945865][T15666] netlink: 'syz.0.2819': attribute type 29 has an invalid length. [ 263.958873][ T5838] Bluetooth: hci1: command tx timeout [ 263.970583][T15561] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 264.019469][T15666] netlink: 'syz.0.2819': attribute type 29 has an invalid length. [ 264.048882][T15666] __nla_validate_parse: 8 callbacks suppressed [ 264.048900][T15666] netlink: 596 bytes leftover after parsing attributes in process `syz.0.2819'. [ 264.072388][T15561] team0: Port device team_slave_0 added [ 264.095894][T15561] team0: Port device team_slave_1 added [ 264.207732][T15561] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 264.215659][T15561] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 264.259664][T15682] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2825'. [ 264.270952][T15561] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 264.308802][T15682] vlan1: entered allmulticast mode [ 264.315835][T15682] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 264.329093][T15561] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 264.339754][T15561] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 264.370188][T15561] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 264.443203][T15683] netlink: 808 bytes leftover after parsing attributes in process `syz.0.2824'. [ 264.632189][T15561] hsr_slave_0: entered promiscuous mode [ 264.669635][T15561] hsr_slave_1: entered promiscuous mode [ 264.698953][T15561] debugfs: 'hsr0' already exists in 'hsr' [ 264.708986][T15561] Cannot create hsr debugfs directory [ 264.796618][T15714] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2832'. [ 264.992913][T15715] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2832'. [ 265.253510][T15744] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2839'. [ 265.422674][T15561] netdevsim netdevsim1 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 265.474597][T15561] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.602412][T15767] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2843'. [ 265.673576][T15561] netdevsim netdevsim1 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 265.692253][T15561] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.864118][T15561] netdevsim netdevsim1 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 265.877424][T15561] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.898363][T15776] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2846'. [ 265.920871][T15776] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2846'. [ 266.036824][ T5838] Bluetooth: hci1: command tx timeout [ 266.049999][T15561] netdevsim netdevsim1 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 266.063190][T15561] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 266.091656][T15779] netlink: 'syz.2.2846': attribute type 11 has an invalid length. [ 266.098857][T15787] netlink: 'syz.4.2849': attribute type 1 has an invalid length. [ 266.236671][T15790] netlink: 'syz.2.2846': attribute type 11 has an invalid length. [ 266.470775][T15561] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 266.559931][T15561] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 266.620237][T15561] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 266.641892][T15561] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 266.848324][T15819] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2857'. [ 266.914448][T15561] 8021q: adding VLAN 0 to HW filter on device bond0 [ 266.928858][T15826] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 267.021829][T15561] 8021q: adding VLAN 0 to HW filter on device team0 [ 267.052589][ T44] bridge0: port 1(bridge_slave_0) entered blocking state [ 267.059895][ T44] bridge0: port 1(bridge_slave_0) entered forwarding state [ 267.101582][ T6569] bridge0: port 2(bridge_slave_1) entered blocking state [ 267.109564][ T6569] bridge0: port 2(bridge_slave_1) entered forwarding state [ 267.154613][T15834] netlink: 'syz.4.2860': attribute type 1 has an invalid length. [ 267.224130][T15834] bond5: entered promiscuous mode [ 267.230932][T15834] 8021q: adding VLAN 0 to HW filter on device bond5 [ 267.269383][T15841] 8021q: adding VLAN 0 to HW filter on device bond5 [ 267.278853][T15841] bond5: (slave wireguard0): The slave device specified does not support setting the MAC address [ 267.290675][T15841] bond5: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 267.306892][T15841] bond5: (slave wireguard0): making interface the new active one [ 267.317286][T15841] wireguard0: entered promiscuous mode [ 267.325124][T15841] bond5: (slave wireguard0): Enslaving as an active interface with an up link [ 267.699452][T15561] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 267.847592][T15875] netlink: 'syz.3.2868': attribute type 58 has an invalid length. [ 267.859621][T15561] veth0_vlan: entered promiscuous mode [ 267.876360][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5730 ms [ 267.879217][T15561] veth1_vlan: entered promiscuous mode [ 267.884512][ C0] lec:lec_tx_timeout: lec0 [ 267.884865][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 267.923019][T15561] veth0_macvtap: entered promiscuous mode [ 268.006075][T15561] veth1_macvtap: entered promiscuous mode [ 268.063912][T15561] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 268.097787][T15561] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 268.119010][ T5838] Bluetooth: hci1: command tx timeout [ 268.135058][T15889] IPv6: NLM_F_CREATE should be specified when creating new route [ 268.151236][ T8477] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.180796][ T8477] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.199310][ T8477] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.215189][ T8477] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 268.349208][ T8469] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 268.384894][ T8469] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 268.505092][ T8469] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 268.514472][ T8469] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 268.823009][T15919] rdma_op ffff888079abb9f0 conn xmit_rdma 0000000000000000 [ 268.876213][T15923] 1{X功: entered promiscuous mode [ 268.887806][T15923] 1{X功: left allmulticast mode [ 268.914839][T15924] netlink: 'syz.3.2880': attribute type 1 has an invalid length. [ 268.916964][T15927] netlink: 'syz.3.2880': attribute type 1 has an invalid length. [ 268.949978][T15922] 8021q: adding VLAN 0 to HW filter on device bond7 [ 269.291595][T15943] netlink: 'syz.1.2885': attribute type 26 has an invalid length. [ 269.333958][T15945] __nla_validate_parse: 13 callbacks suppressed [ 269.334097][T15945] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2886'. [ 269.352296][T15945] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2886'. [ 269.394754][T15943] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2885'. [ 269.445713][T15948] netlink: 48 bytes leftover after parsing attributes in process `syz.0.2887'. [ 269.764196][T15965] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2891'. [ 269.963292][T15980] netlink: 'syz.4.2895': attribute type 11 has an invalid length. [ 269.989309][T15981] openvswitch: netlink: Flow actions attr not present in new flow. [ 269.992044][T15975] netlink: 'syz.4.2895': attribute type 33 has an invalid length. [ 270.093471][T15986] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 270.131152][T15986] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2897'. [ 270.152023][T15993] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 270.196813][ T5838] Bluetooth: hci1: command tx timeout [ 270.683817][T16022] bond0: (slave macvlan3): Error -22 calling dev_set_mtu [ 270.928288][T16037] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2912'. [ 270.993777][T16040] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2913'. [ 271.232787][T16057] xt_CT: You must specify a L4 protocol and not use inversions on it [ 271.420140][T16066] ipt_REJECT: TCP_RESET invalid for non-tcp [ 271.448860][T16066] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2923'. [ 271.504912][T16072] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2925'. [ 271.516997][T16073] netlink: 'syz.0.2925': attribute type 1 has an invalid length. [ 271.529891][T16076] netlink: 'syz.1.2927': attribute type 1 has an invalid length. [ 271.632719][T16085] pim6reg1: entered promiscuous mode [ 271.640988][T16085] pim6reg1: entered allmulticast mode [ 271.860338][T16098] IPVS: set_ctl: invalid protocol: 136 224.0.0.2:20001 [ 271.866088][T16099] tipc: Enabling of bearer rejected, failed to enable media [ 272.764247][T16136] netlink: 'syz.0.2941': attribute type 1 has an invalid length. [ 272.916748][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 272.925303][ C0] lec:lec_tx_timeout: lec0 [ 272.930091][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 272.998558][T16143] xt_TPROXY: Can be used only with -p tcp or -p udp [ 273.019764][T16143] syzkaller0: entered promiscuous mode [ 273.047706][T16143] syzkaller0: entered allmulticast mode [ 273.127835][T16147] tipc: Started in network mode [ 273.133109][T16147] tipc: Node identity be5816b781b4, cluster identity 4711 [ 273.158126][T16147] tipc: Enabled bearer , priority 0 [ 273.217774][T16143] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 273.287672][T16147] tipc: Disabling bearer [ 273.419282][ T5825] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 273.431496][ T5825] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 273.443126][ T5825] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 273.452155][ T5825] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 273.484851][ T5825] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 273.545424][T16169] bridge0: entered promiscuous mode [ 273.566022][T16169] macsec1: entered promiscuous mode [ 273.573888][T16169] macsec1: entered allmulticast mode [ 273.582614][T16169] bridge0: entered allmulticast mode [ 273.591657][T16169] bridge0: port 3(macsec1) entered blocking state [ 273.600243][T16169] bridge0: port 3(macsec1) entered disabled state [ 273.629592][T16169] bridge0: left allmulticast mode [ 273.642868][T16169] bridge0: left promiscuous mode [ 273.843897][T16165] hsr0 speed is unknown, defaulting to 1000 [ 273.860257][T16165] wg1 speed is unknown, defaulting to 1000 [ 274.361820][T16217] __nla_validate_parse: 12 callbacks suppressed [ 274.361857][T16217] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2963'. [ 274.400457][T16224] ieee802154 phy0 wpan0: encryption failed: -22 [ 274.494592][T16217] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 274.564856][T16165] chnl_net:caif_netlink_parms(): no params data found [ 274.726254][T16247] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2972'. [ 274.739366][T16247] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2972'. [ 274.750196][T16247] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2972'. [ 274.800127][T16243] tipc: Enabled bearer , priority 0 [ 274.848063][T16249] tipc: Enabled bearer , priority 0 [ 274.855454][T16243] syzkaller0: entered promiscuous mode [ 274.862047][T16243] syzkaller0: entered allmulticast mode [ 274.872308][T16165] bridge0: port 1(bridge_slave_0) entered blocking state [ 274.880726][T16165] bridge0: port 1(bridge_slave_0) entered disabled state [ 274.889039][T16165] bridge_slave_0: entered allmulticast mode [ 274.897782][T16165] bridge_slave_0: entered promiscuous mode [ 274.905280][T16249] syzkaller0: entered promiscuous mode [ 274.912751][T16249] syzkaller0: entered allmulticast mode [ 274.921623][T16165] bridge0: port 2(bridge_slave_1) entered blocking state [ 274.929731][T16165] bridge0: port 2(bridge_slave_1) entered disabled state [ 274.938421][T16165] bridge_slave_1: entered allmulticast mode [ 274.946624][T16165] bridge_slave_1: entered promiscuous mode [ 274.967048][T16243] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2971'. [ 274.979240][T16249] tipc: Resetting bearer [ 274.990441][T16248] tipc: Resetting bearer [ 275.012509][T16248] tipc: Disabling bearer [ 275.043508][T16256] tipc: Resetting bearer [ 275.055376][T16165] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 275.073349][T16165] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 275.099870][T16242] tipc: Resetting bearer [ 275.139373][T16242] tipc: Disabling bearer [ 275.162560][T16262] sctp: [Deprecated]: syz.3.2976 (pid 16262) Use of int in maxseg socket option. [ 275.162560][T16262] Use struct sctp_assoc_value instead [ 275.215732][T16165] team0: Port device team_slave_0 added [ 275.233677][T16165] team0: Port device team_slave_1 added [ 275.304831][T16267] netlink: 'syz.3.2977': attribute type 1 has an invalid length. [ 275.386141][T16165] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 275.400883][T16165] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 275.443679][T16165] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 275.490238][T16270] 8021q: adding VLAN 0 to HW filter on device bond9 [ 275.501704][T16270] bond8: (slave bond9): making interface the new active one [ 275.511205][T16270] bond8: (slave bond9): Enslaving as an active interface with an up link [ 275.556950][ T5838] Bluetooth: hci5: command tx timeout [ 275.559918][T16165] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 275.587825][T16165] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 275.633241][T16165] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 275.703678][T16270] bond8: (slave ipvlan0): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 275.720493][T16270] bond8: (slave ipvlan0): The slave device specified does not support setting the MAC address [ 275.947918][T16165] hsr_slave_0: entered promiscuous mode [ 276.003613][T16165] hsr_slave_1: entered promiscuous mode [ 276.026467][T16165] debugfs: 'hsr0' already exists in 'hsr' [ 276.033666][T16165] Cannot create hsr debugfs directory [ 276.087037][T16300] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2985'. [ 276.368463][T16312] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2991'. [ 276.685384][T16165] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 276.717224][T16165] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 276.743965][ T5198] udevd[5198]: worker [5842] /devices/virtual/block/nbd0 timeout; kill it [ 276.755271][T16329] netlink: 'syz.1.2995': attribute type 4 has an invalid length. [ 276.780721][ T5198] udevd[5198]: seq 11524 '/devices/virtual/block/nbd0' killed [ 276.890917][T16165] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 276.908005][T16344] netlink: 'syz.4.2998': attribute type 1 has an invalid length. [ 276.917807][T16346] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2999'. [ 276.927660][T16346] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2999'. [ 276.939134][T16165] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 276.951731][T16344] netlink: 'syz.4.2998': attribute type 3 has an invalid length. [ 276.969011][T16344] netlink: 'syz.4.2998': attribute type 235 has an invalid length. [ 276.981446][T16349] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3001'. [ 277.099158][T16165] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 277.125760][T16165] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 277.230774][T16165] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 277.246174][T16363] netlink: 'syz.4.3006': attribute type 24 has an invalid length. [ 277.260422][T16165] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 277.321707][T16368] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 277.636864][ T5838] Bluetooth: hci5: command tx timeout [ 277.946336][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 277.955722][ C0] lec:lec_tx_timeout: lec0 [ 277.960663][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 278.137526][T16165] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 278.174406][T16165] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 278.221919][T16165] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 278.289087][T16165] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 278.478359][T16427] syzkaller0: entered promiscuous mode [ 278.483982][T16427] syzkaller0: entered allmulticast mode [ 279.726531][ T5838] Bluetooth: hci5: command tx timeout [ 280.923285][T16165] 8021q: adding VLAN 0 to HW filter on device bond0 [ 280.942013][T16466] __nla_validate_parse: 10 callbacks suppressed [ 280.942033][T16466] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3028'. [ 280.979897][T16464] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3027'. [ 281.003693][T16165] 8021q: adding VLAN 0 to HW filter on device team0 [ 281.031781][T16468] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 281.057299][T16468] bridge0: port 2(bridge_slave_1) entered disabled state [ 281.066851][T16468] bridge0: port 1(bridge_slave_0) entered disabled state [ 281.133450][ T8477] bridge0: port 1(bridge_slave_0) entered blocking state [ 281.141324][ T8477] bridge0: port 1(bridge_slave_0) entered forwarding state [ 281.214710][ T8477] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.223904][ T8477] bridge0: port 2(bridge_slave_1) entered forwarding state [ 281.421330][T16486] tipc: Enabled bearer , priority 0 [ 281.541630][T16486] syzkaller0: entered promiscuous mode [ 281.559933][T16486] syzkaller0: entered allmulticast mode [ 281.614795][T16486] tipc: Resetting bearer [ 281.677711][T16500] bond1: option miimon: invalid value (18446744073709551585) [ 281.687029][T16500] bond1: option miimon: allowed values 0 - 2147483647 [ 281.697720][T16500] bond1 (unregistering): Released all slaves [ 281.797338][ T5838] Bluetooth: hci5: command tx timeout [ 281.808777][T16165] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 281.825353][T16483] tipc: Resetting bearer [ 281.856176][T16483] tipc: Disabling bearer [ 281.864828][T16510] netlink: 220 bytes leftover after parsing attributes in process `syz.3.3040'. [ 281.876985][T16510] openvswitch: netlink: Flow key attr not present in new flow. [ 281.947751][T16165] veth0_vlan: entered promiscuous mode [ 281.997033][T16165] veth1_vlan: entered promiscuous mode [ 282.089534][T16165] veth0_macvtap: entered promiscuous mode [ 282.120111][T16165] veth1_macvtap: entered promiscuous mode [ 282.179712][T16165] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 282.222570][T16165] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 282.264109][ T44] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.286049][ T44] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.331469][ T8474] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.362153][ T8474] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 282.384414][T16529] bridge8: entered promiscuous mode [ 282.392026][T16529] bridge8: entered allmulticast mode [ 282.439886][T16531] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3046'. [ 282.452641][T16531] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3046'. [ 282.464990][T16531] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3046'. [ 282.493516][T16531] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3046'. [ 282.509459][T16531] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3046'. [ 282.566184][ T8474] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 282.613740][ T8474] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 282.627936][T16533] sctp: [Deprecated]: syz.1.3047 (pid 16533) Use of struct sctp_assoc_value in delayed_ack socket option. [ 282.627936][T16533] Use struct sctp_sack_info instead [ 282.688820][T16535] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3048'. [ 282.730946][ T44] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 282.742666][ T44] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 282.788767][T16538] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 282.976316][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 282.986084][ C0] lec:lec_tx_timeout: lec0 [ 282.991300][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 283.157657][T16557] tipc: Enabling of bearer rejected, already enabled [ 283.199065][T16558] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 283.213643][T16561] tipc: New replicast peer: fc02:0000:0000:0000:0000:0000:0000:0001 [ 283.261642][T16560] tunl0: left promiscuous mode [ 283.279985][T16562] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3056'. [ 283.626155][T16568] xt_NFQUEUE: number of total queues is 0 [ 283.665320][T16560] team_slave_0: left promiscuous mode [ 283.680903][T16560] team_slave_1: left promiscuous mode [ 283.782710][ T5825] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 283.801868][T16560] wg1: left promiscuous mode [ 283.803245][ T5825] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 283.816980][ T5825] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 283.817468][T16560] wg1: left allmulticast mode [ 283.847364][ T5825] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 283.867091][ T5825] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 283.960552][T16560] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 284.076205][T16560] ip6erspan0: left promiscuous mode [ 284.083512][T16560] ip6erspan0: left allmulticast mode [ 284.104169][T16560] veth7: left promiscuous mode [ 284.121917][T16560] bond5: left promiscuous mode [ 284.128259][T16560] wireguard0: left promiscuous mode [ 284.146624][T16562] geneve2: entered promiscuous mode [ 284.152643][T16562] geneve2: entered allmulticast mode [ 284.169443][ T5890] hsr0 speed is unknown, defaulting to 1000 [ 284.178341][ T5890] syz1: Port: 1 Link DOWN [ 284.256002][ T6534] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 284.314417][ T6534] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 284.332453][ T6534] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 284.425004][T16569] hsr0 speed is unknown, defaulting to 1000 [ 284.448948][T16569] wg1 speed is unknown, defaulting to 1000 [ 284.464341][T16593] veth1_macvtap: left promiscuous mode [ 284.472259][T16593] macsec0: entered promiscuous mode [ 284.540373][T16600] netlink: 'syz.1.3064': attribute type 10 has an invalid length. [ 284.583598][T16600] team0: Device ipvlan1 failed to register rx_handler [ 284.635778][T16601] tipc: Enabled bearer , priority 0 [ 284.693459][T16597] syzkaller0: entered promiscuous mode [ 284.726735][T16597] syzkaller0: entered allmulticast mode [ 284.796988][T16603] netlink: 'syz.2.3066': attribute type 9 has an invalid length. [ 284.808040][T16603] netlink: 'syz.2.3066': attribute type 6 has an invalid length. [ 284.843241][T16597] tipc: Resetting bearer [ 285.040558][T16596] tipc: Resetting bearer [ 285.064885][T16596] tipc: Disabling bearer [ 285.100949][T16621] kthread_run failed with err -4 [ 285.279822][T16569] chnl_net:caif_netlink_parms(): no params data found [ 285.467773][T16644] netlink: 'syz.2.3071': attribute type 7 has an invalid length. [ 285.488484][T16643] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 285.514642][T16644] netlink: 'syz.2.3071': attribute type 8 has an invalid length. [ 285.598187][T16569] bridge0: port 1(bridge_slave_0) entered blocking state [ 285.626529][T16569] bridge0: port 1(bridge_slave_0) entered disabled state [ 285.637852][T16569] bridge_slave_0: entered allmulticast mode [ 285.646216][T16569] bridge_slave_0: entered promiscuous mode [ 285.678110][T16569] bridge0: port 2(bridge_slave_1) entered blocking state [ 285.686127][T16569] bridge0: port 2(bridge_slave_1) entered disabled state [ 285.717687][T16569] bridge_slave_1: entered allmulticast mode [ 285.738972][T16569] bridge_slave_1: entered promiscuous mode [ 285.957578][ T5838] Bluetooth: hci2: command tx timeout [ 285.971963][T16569] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 286.015442][T16569] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 286.307756][T16659] syzkaller0: entered promiscuous mode [ 286.330155][T16659] syzkaller0: entered allmulticast mode [ 286.349779][T16569] team0: Port device team_slave_0 added [ 286.605069][T16685] __nla_validate_parse: 9 callbacks suppressed [ 286.605092][T16685] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3083'. [ 286.692431][T16690] netlink: 'syz.4.3082': attribute type 10 has an invalid length. [ 288.011690][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 288.021523][ C0] lec:lec_tx_timeout: lec0 [ 288.027660][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 288.049166][ T5838] Bluetooth: hci2: command tx timeout [ 288.617099][T16569] team0: Port device team_slave_1 added [ 288.650859][T16569] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 288.659593][T16569] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 288.693956][T16569] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 288.708108][T16688] workqueue: Failed to create a rescuer kthread for wq "bond10": -EINTR [ 288.738080][T16569] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 288.759198][T16569] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 288.795546][T16569] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 288.971361][T16703] netlink: 'syz.4.3087': attribute type 1 has an invalid length. [ 288.973338][T16569] hsr_slave_0: entered promiscuous mode [ 288.990999][T16569] hsr_slave_1: entered promiscuous mode [ 289.010450][T16569] debugfs: 'hsr0' already exists in 'hsr' [ 289.017827][T16703] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3087'. [ 289.027079][T16569] Cannot create hsr debugfs directory [ 289.037705][T16708] openvswitch: netlink: Key type 2064 is out of range max 32 [ 289.048585][T16703] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3087'. [ 289.438538][T16569] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 289.453374][T16569] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 289.477665][T16569] netdevsim netdevsim3 eth3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 289.642008][T16569] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 289.668723][T16569] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 289.681700][T16569] netdevsim netdevsim3 eth2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 289.719389][T16746] netlink: 'syz.4.3096': attribute type 83 has an invalid length. [ 289.766230][T16569] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 289.782643][T16569] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 289.816434][T16569] netdevsim netdevsim3 eth1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 289.914333][T16753] netlink: 'syz.4.3098': attribute type 1 has an invalid length. [ 289.970150][T16569] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 289.985570][T16569] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 19999 - 0 [ 290.015548][T16569] netdevsim netdevsim3 eth0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 290.016707][T16761] netlink: 260 bytes leftover after parsing attributes in process `syz.0.3101'. [ 290.046944][T16759] macvtap1: entered allmulticast mode [ 290.052819][T16759] veth0_macvtap: entered allmulticast mode [ 290.088086][T16764] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3102'. [ 290.126162][ T5838] Bluetooth: hci2: command tx timeout [ 290.351544][T16779] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3107'. [ 290.429132][T16569] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 290.522372][T16569] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 290.522599][T16785] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3109'. [ 290.550032][T16569] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 290.575634][T16569] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 290.826927][T16801] tipc: Enabling of bearer rejected, media not registered [ 290.838729][T16801] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3111'. [ 290.901807][T16805] openvswitch: netlink: IP tunnel dst address not specified [ 291.133641][T16569] 8021q: adding VLAN 0 to HW filter on device bond0 [ 291.223953][T16807] bond6: entered promiscuous mode [ 291.256959][T16807] bond6: entered allmulticast mode [ 291.266942][T16807] 8021q: adding VLAN 0 to HW filter on device bond6 [ 291.331118][T16809] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 291.356673][T16569] 8021q: adding VLAN 0 to HW filter on device team0 [ 291.389227][ T6534] bridge0: port 1(bridge_slave_0) entered blocking state [ 291.397087][ T6534] bridge0: port 1(bridge_slave_0) entered forwarding state [ 291.451171][T16816] x_tables: duplicate underflow at hook 1 [ 291.465021][ T6534] bridge0: port 2(bridge_slave_1) entered blocking state [ 291.473059][ T6534] bridge0: port 2(bridge_slave_1) entered forwarding state [ 291.672112][T16827] netlink: 'syz.4.3117': attribute type 10 has an invalid length. [ 291.687170][T16827] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3117'. [ 291.742922][T16827] team0: Port device geneve0 added [ 291.905153][T16838] netlink: 165 bytes leftover after parsing attributes in process `syz.4.3120'. [ 291.929404][T16842] syz_tun: entered allmulticast mode [ 292.206404][ T5838] Bluetooth: hci2: command tx timeout [ 292.251477][T16569] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 292.290706][T16857] netlink: 'syz.4.3126': attribute type 39 has an invalid length. [ 292.319524][T16569] veth0_vlan: entered promiscuous mode [ 292.349782][T16858] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3125'. [ 292.397441][T16858] 8021q: adding VLAN 0 to HW filter on device bond10 [ 292.449915][T16569] veth1_vlan: entered promiscuous mode [ 292.495483][T16569] veth0_macvtap: entered promiscuous mode [ 292.574787][T16569] veth1_macvtap: entered promiscuous mode [ 292.684245][T16877] syzkaller1: entered promiscuous mode [ 292.691282][T16877] syzkaller1: entered allmulticast mode [ 292.705098][T16569] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 292.751413][T16569] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 292.784014][ T8479] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 292.823114][ T8479] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 292.848281][ T8479] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 292.873255][ T8479] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 292.970961][T16887] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3133'. [ 293.014581][ T44] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 293.030177][ T44] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 293.036847][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 293.048493][ C0] lec:lec_tx_timeout: lec0 [ 293.054520][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 293.136458][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 293.155711][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 293.357987][T16899] syzkaller1: entered promiscuous mode [ 293.370087][T16899] syzkaller1: entered allmulticast mode [ 293.922099][T16928] Bluetooth: hci0: unsupported parameter 512 [ 293.938067][T16928] Bluetooth: hci0: unsupported parameter 6278 [ 293.952606][T16928] Bluetooth: hci0: unsupported parameter 512 [ 293.971455][T16928] Bluetooth: hci0: unsupported parameter 6278 [ 293.997217][T16933] netlink: 'syz.1.3145': attribute type 1 has an invalid length. [ 294.136707][T16937] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3148'. [ 294.183832][T16939] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3149'. [ 294.334373][ T5825] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 294.351513][ T5825] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 294.363199][ T5825] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 294.372540][ T5825] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 294.382374][ T5825] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 294.446030][T16945] wg1 speed is unknown, defaulting to 1000 [ 294.561342][T16953] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3153'. [ 294.713045][T16963] netlink: 'syz.0.3157': attribute type 2 has an invalid length. [ 294.713683][T16960] netlink: 1752 bytes leftover after parsing attributes in process `syz.1.3156'. [ 294.723546][T16963] netlink: 244 bytes leftover after parsing attributes in process `syz.0.3157'. [ 294.950901][T16945] chnl_net:caif_netlink_parms(): no params data found [ 295.165368][T16982] netlink: 'syz.0.3161': attribute type 1 has an invalid length. [ 295.185665][ T30] audit: type=1800 audit(1760796694.590:4): pid=16983 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.3162" name="cpuacct.usage_percpu_user" dev="tmpfs" ino=109 res=0 errno=0 [ 295.391116][T16982] workqueue: Failed to create a rescuer kthread for wq "bond11": -EINTR [ 295.596495][T17005] netlink: 'syz.2.3165': attribute type 1 has an invalid length. [ 295.600063][T17004] bridge1: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 295.618785][T17005] netlink: 224 bytes leftover after parsing attributes in process `syz.2.3165'. [ 295.636976][T16945] bridge0: port 1(bridge_slave_0) entered blocking state [ 295.653612][T16945] bridge0: port 1(bridge_slave_0) entered disabled state [ 295.667201][T16945] bridge_slave_0: entered allmulticast mode [ 295.677716][T17005] block nbd1: not configured, cannot reconfigure [ 295.691504][T16945] bridge_slave_0: entered promiscuous mode [ 295.716025][T16945] bridge0: port 2(bridge_slave_1) entered blocking state [ 295.729857][T16945] bridge0: port 2(bridge_slave_1) entered disabled state [ 295.739046][T16945] bridge_slave_1: entered allmulticast mode [ 295.749619][T16945] bridge_slave_1: entered promiscuous mode [ 295.813302][T17004] tun0: tun_chr_ioctl cmd 1074025675 [ 295.821582][T17004] tun0: persist disabled [ 295.869947][T16945] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 295.912162][T17020] netlink: 'syz.1.3170': attribute type 1 has an invalid length. [ 295.964895][T16945] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 296.148719][T16945] team0: Port device team_slave_0 added [ 296.183076][T16945] team0: Port device team_slave_1 added [ 296.318107][T16945] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 296.342928][T16945] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 296.410149][T16945] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 296.430294][T16945] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 296.447468][ T5825] Bluetooth: hci3: command tx timeout [ 296.454656][T16945] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 296.486021][T16945] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 296.581815][T16945] hsr_slave_0: entered promiscuous mode [ 296.610018][T16945] hsr_slave_1: entered promiscuous mode [ 296.617957][T16945] debugfs: 'hsr0' already exists in 'hsr' [ 296.625223][T16945] Cannot create hsr debugfs directory [ 296.762152][T17053] __nla_validate_parse: 5 callbacks suppressed [ 296.762172][T17053] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3179'. [ 296.911761][T17069] netlink: 'syz.0.3184': attribute type 1 has an invalid length. [ 296.940466][T17069] netlink: 224 bytes leftover after parsing attributes in process `syz.0.3184'. [ 296.952183][T17069] netlink: 68 bytes leftover after parsing attributes in process `syz.0.3184'. [ 297.176899][T16945] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.237405][T17077] tipc: Enabling of bearer rejected, already enabled [ 297.272109][T17080] tipc: New replicast peer: 255.255.255.255 [ 297.345586][T16945] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.496045][T16945] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 297.528726][T17097] lo: entered allmulticast mode [ 297.537238][T17097] lo: left allmulticast mode [ 297.795404][T16945] bond0: (slave netdevsim0): Releasing backup interface [ 297.881386][T17113] vcan0: tx address claim with different name [ 297.931813][T17119] netlink: 596 bytes leftover after parsing attributes in process `syz.1.3203'. [ 298.068028][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 298.077208][ C0] lec:lec_tx_timeout: lec0 [ 298.085004][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 298.280023][T17139] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3207'. [ 298.338544][T16945] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 298.378176][T16945] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 298.412663][T16945] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 298.420795][T17146] xt_ecn: cannot match TCP bits for non-tcp packets [ 298.453986][T16945] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 298.496253][T17148] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3210'. [ 298.513024][T17150] ip6t_srh: unknown srh invflags 4000 [ 298.520386][ T5825] Bluetooth: hci3: command tx timeout [ 298.541354][T17141] tipc: Enabled bearer , priority 0 [ 298.612010][T17141] syzkaller0: entered promiscuous mode [ 298.625388][T17141] syzkaller0: entered allmulticast mode [ 298.648088][T17161] netlink: 18 bytes leftover after parsing attributes in process `syz.2.3213'. [ 298.730086][T17141] tipc: Resetting bearer [ 298.751112][T17140] tipc: Resetting bearer [ 298.789240][T17167] netlink: 'syz.2.3214': attribute type 11 has an invalid length. [ 298.800460][T17140] tipc: Disabling bearer [ 298.901110][T17170] vlan2: entered promiscuous mode [ 298.907671][T17170] bridge0: entered promiscuous mode [ 298.943643][T16945] 8021q: adding VLAN 0 to HW filter on device bond0 [ 299.029289][T16945] 8021q: adding VLAN 0 to HW filter on device team0 [ 299.066264][ T8474] bridge0: port 1(bridge_slave_0) entered blocking state [ 299.074496][ T8474] bridge0: port 1(bridge_slave_0) entered forwarding state [ 299.103780][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 299.111123][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 299.112496][T17179] netlink: 'syz.2.3219': attribute type 1 has an invalid length. [ 299.181187][T17181] vlan0: entered allmulticast mode [ 299.207011][T17181] hsr0: entered allmulticast mode [ 299.213809][T17181] hsr_slave_0: entered allmulticast mode [ 299.225644][T17181] hsr_slave_1: entered allmulticast mode [ 299.284649][T17188] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 299.550829][T17207] siw: device registration error -23 [ 299.812195][T16945] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 299.813871][T17230] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3229'. [ 299.909925][T17230] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3229'. [ 300.209804][T17230] bridge2: port 1(gretap1) entered blocking state [ 300.291435][T17230] bridge2: port 1(gretap1) entered disabled state [ 300.329066][T17230] gretap1: entered allmulticast mode [ 300.356059][T17230] gretap1: entered promiscuous mode [ 300.596838][ T5825] Bluetooth: hci3: command tx timeout [ 300.870408][T16945] veth0_vlan: entered promiscuous mode [ 300.911205][T16945] veth1_vlan: entered promiscuous mode [ 300.927677][T17281] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3240'. [ 300.978965][T16945] veth0_macvtap: entered promiscuous mode [ 301.003448][T16945] veth1_macvtap: entered promiscuous mode [ 301.058493][T16945] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 301.088112][T17287] 8021q: VLANs not supported on wg2 [ 301.103119][T16945] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 301.106238][T17291] netlink: 'syz.1.3244': attribute type 25 has an invalid length. [ 301.132079][ T8474] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 301.143537][ T8474] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 301.583379][ T8474] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 301.598931][ T8474] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 301.794162][T17309] unsupported nla_type 52263 [ 301.942927][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 301.977972][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 302.072506][ T8474] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 302.098322][ T8474] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 302.260938][T17329] __nla_validate_parse: 2 callbacks suppressed [ 302.260966][T17329] netlink: 232 bytes leftover after parsing attributes in process `syz.1.3254'. [ 302.429756][T17338] openvswitch: netlink: Message has 4 unknown bytes. [ 302.465773][T17329] netlink: 'syz.1.3254': attribute type 1 has an invalid length. [ 302.467501][T17335] netlink: 'syz.4.3139': attribute type 10 has an invalid length. [ 302.596136][T17335] team0: Port device dummy0 added [ 302.676724][ T5825] Bluetooth: hci3: command tx timeout [ 302.810619][T17349] netlink: 'syz.4.3262': attribute type 1 has an invalid length. [ 302.900031][T17354] netlink: 'syz.2.3263': attribute type 1 has an invalid length. [ 302.985846][ T5838] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 303.013956][ T5838] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 303.023526][ T5838] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 303.039102][ T5838] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 303.061493][ T5838] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 303.068094][T17363] netlink: 'syz.3.3264': attribute type 1 has an invalid length. [ 303.135884][T17362] bond1: (slave gretap1): making interface the new active one [ 303.179722][T17363] netlink: 'syz.3.3264': attribute type 3 has an invalid length. [ 303.218571][T17363] netlink: 224 bytes leftover after parsing attributes in process `syz.3.3264'. [ 303.245667][T17362] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 303.273374][T17367] geneve3: entered promiscuous mode [ 303.295458][T17367] geneve3: entered allmulticast mode [ 303.339531][ T44] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 303.380916][T17377] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3268'. [ 303.411255][T17367] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 303.431954][ T44] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 303.442316][ T44] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 303.485758][T17372] tipc: Started in network mode [ 303.491706][T17372] tipc: Node identity 42c8e3256a2e, cluster identity 4711 [ 303.499981][T17372] tipc: Enabled bearer , priority 0 [ 303.507706][T17379] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3268'. [ 303.536061][T17369] tipc: Resetting bearer [ 303.582947][T17384] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3269'. [ 303.593505][T17384] block nbd1: Unsupported socket: should be TCP or UNIX. [ 303.877063][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5790 ms [ 303.885216][ C0] lec:lec_tx_timeout: lec0 [ 303.891102][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 304.090968][T17399] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 304.528208][ T24] tipc: Node number set to 686220069 [ 305.159285][ T5838] Bluetooth: hci4: command tx timeout [ 305.784268][T17369] tipc: Disabling bearer [ 305.794326][T17385] vcan0: entered allmulticast mode [ 305.838502][T17357] wg1 speed is unknown, defaulting to 1000 [ 305.920459][T17404] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3276'. [ 305.962297][T17404] ip6tnl1: entered promiscuous mode [ 306.030890][T17414] IPv6: NLM_F_CREATE should be specified when creating new route [ 306.224609][T17421] tipc: Enabled bearer , priority 0 [ 306.262296][T17421] syzkaller0: entered promiscuous mode [ 306.269802][T17421] syzkaller0: entered allmulticast mode [ 306.392100][T17367] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.414685][T17367] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 306.476510][T17422] sch_tbf: burst 206 is lower than device syzkaller0 mtu (1514) ! [ 306.572270][T17367] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.585485][T17367] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 306.623361][T17421] tipc: Resetting bearer [ 306.631737][T17357] chnl_net:caif_netlink_parms(): no params data found [ 306.649564][T17417] tipc: Resetting bearer [ 306.672884][T17417] tipc: Disabling bearer [ 306.751064][T17367] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 306.768611][T17367] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 307.041956][T17450] netlink: 'syz.4.3286': attribute type 1 has an invalid length. [ 307.122836][T17357] bridge0: port 1(bridge_slave_0) entered blocking state [ 307.143422][T17357] bridge0: port 1(bridge_slave_0) entered disabled state [ 307.153547][T17357] bridge_slave_0: entered allmulticast mode [ 307.166242][T17357] bridge_slave_0: entered promiscuous mode [ 307.210541][T17357] bridge0: port 2(bridge_slave_1) entered blocking state [ 307.221899][T17357] bridge0: port 2(bridge_slave_1) entered disabled state [ 307.234204][T17357] bridge_slave_1: entered allmulticast mode [ 307.247057][ T5838] Bluetooth: hci4: command tx timeout [ 307.250300][T17357] bridge_slave_1: entered promiscuous mode [ 307.290006][ T8474] netdevsim netdevsim1 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 307.300477][ T8474] netdevsim netdevsim1 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 307.354617][T17357] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 307.367034][ T36] netdevsim netdevsim1 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 307.376251][ T36] netdevsim netdevsim1 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 307.403501][T17466] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3291'. [ 307.431772][T17357] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 307.443053][ T36] netdevsim netdevsim1 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 307.458543][T17464] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3291'. [ 307.461338][ T36] netdevsim netdevsim1 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 307.479630][ T36] netdevsim netdevsim1 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 307.492613][ T36] netdevsim netdevsim1 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 307.508612][T17471] netlink: 80 bytes leftover after parsing attributes in process `syz.2.3293'. [ 307.523529][T17466] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 307.545248][T17466] netlink: 184 bytes leftover after parsing attributes in process `syz.4.3291'. [ 307.650832][T17357] team0: Port device team_slave_0 added [ 307.678687][T17357] team0: Port device team_slave_1 added [ 307.771331][T17357] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 307.797651][T17357] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 307.842935][T17357] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 307.860290][T17357] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 307.868360][T17357] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 307.898422][T17357] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 307.951951][T17485] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3298'. [ 308.042210][T17485] hsr_slave_1 (unregistering): left promiscuous mode [ 308.065046][T17490] raw_sendmsg: syz.2.3298 forgot to set AF_INET. Fix it! [ 308.087893][T17357] hsr_slave_0: entered promiscuous mode [ 308.095324][T17357] hsr_slave_1: entered promiscuous mode [ 308.104077][T17357] debugfs: 'hsr0' already exists in 'hsr' [ 308.111344][T17357] Cannot create hsr debugfs directory [ 308.278631][T17497] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3301'. [ 308.436219][T17504] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3304'. [ 308.542900][T17357] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 308.619615][T17357] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 308.655436][T17357] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 308.700390][T17357] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 308.777660][T17517] IPVS: set_ctl: invalid protocol: 136 224.0.0.2:20001 [ 308.789333][T17517] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3307'. [ 308.845730][T17517] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3307'. [ 308.916515][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 308.925023][ C0] lec:lec_tx_timeout: lec0 [ 308.930243][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 309.098532][T17549] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 309.201810][T17357] 8021q: adding VLAN 0 to HW filter on device bond0 [ 309.304698][T17357] 8021q: adding VLAN 0 to HW filter on device team0 [ 309.322336][ T5838] Bluetooth: hci4: command tx timeout [ 309.331743][T17556] tipc: Enabled bearer , priority 13 [ 309.354285][ T8477] bridge0: port 1(bridge_slave_0) entered blocking state [ 309.361667][ T8477] bridge0: port 1(bridge_slave_0) entered forwarding state [ 309.432176][ T8477] bridge0: port 2(bridge_slave_1) entered blocking state [ 309.440467][ T8477] bridge0: port 2(bridge_slave_1) entered forwarding state [ 309.543142][T17357] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 309.792231][T17584] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3325'. [ 309.844214][T17586] 8021q: VLANs not supported on sit0 [ 309.918983][T17589] openvswitch: netlink: Key type 30 is not supported [ 309.955145][T17590] x_tables: duplicate underflow at hook 3 [ 309.979384][T17590] netlink: 'syz.2.3326': attribute type 2 has an invalid length. [ 309.991884][T17357] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 310.002053][T17590] nbd: must specify at least one socket [ 310.030240][T17592] veth0_macvtap: left promiscuous mode [ 310.080098][T17595] tipc: Started in network mode [ 310.087402][T17595] tipc: Node identity 72b3e812bafc, cluster identity 4711 [ 310.095037][T17595] tipc: Enabled bearer , priority 0 [ 310.111718][T17590] syzkaller0: entered promiscuous mode [ 310.123526][T17590] syzkaller0: entered allmulticast mode [ 310.173123][T17590] tipc: Resetting bearer [ 310.195887][T17587] tipc: Resetting bearer [ 310.219145][T17587] tipc: Disabling bearer [ 310.241387][T17357] veth0_vlan: entered promiscuous mode [ 310.258599][T17357] veth1_vlan: entered promiscuous mode [ 310.326296][T17357] veth0_macvtap: entered promiscuous mode [ 310.333477][ T5890] tipc: Node number set to 1072436919 [ 310.351288][T17357] veth1_macvtap: entered promiscuous mode [ 310.402615][T17357] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 310.429797][T17357] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 310.481687][ T8474] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.513865][ T8474] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.551796][ T8474] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.575914][ T8474] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 310.664775][T17615] bridge2: entered promiscuous mode [ 310.671156][T17615] bridge2: entered allmulticast mode [ 310.765178][ T8479] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 310.788542][ T8479] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 310.864413][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 310.886492][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 311.242821][T17655] netlink: 'syz.4.3348': attribute type 29 has an invalid length. [ 311.401117][ T5838] Bluetooth: hci4: command tx timeout [ 311.561417][T17678] netlink: 'syz.4.3354': attribute type 1 has an invalid length. [ 312.078632][T17710] netlink: 'syz.3.3368': attribute type 1 has an invalid length. [ 312.154029][T17713] syz_tun: entered allmulticast mode [ 312.333061][T17726] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 312.344661][T17728] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 312.484881][T17730] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 312.699108][T17712] syz_tun: left allmulticast mode [ 312.755091][T17751] veth1_macvtap: left promiscuous mode [ 312.793079][T17753] __nla_validate_parse: 15 callbacks suppressed [ 312.793102][T17753] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3381'. [ 313.061090][T17759] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 313.103233][ T36] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 313.121183][T17771] syzkaller1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 313.142768][ T36] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 313.177540][ T36] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 313.211109][ T36] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 313.558583][T17800] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3391'. [ 313.663968][T17807] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3395'. [ 313.721470][T17807] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3395'. [ 313.874264][T17807] bond1 (unregistering): Released all slaves [ 313.946338][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 313.957000][ C0] lec:lec_tx_timeout: lec0 [ 314.028416][ T5984] IPVS: starting estimator thread 0... [ 314.128084][T17831] IPVS: using max 25 ests per chain, 60000 per kthread [ 314.181049][ T6534] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 314.200800][T17841] veth0: entered promiscuous mode [ 314.209410][T17836] bpq0: left promiscuous mode [ 314.222620][T17836] bpq0: left allmulticast mode [ 314.233130][ T6534] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 314.290641][ T6534] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 314.303204][ T6534] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 314.349979][T17849] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3404'. [ 314.377148][T17851] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3407'. [ 314.558554][ T24] IPVS: starting estimator thread 0... [ 314.647684][T17857] IPVS: using max 28 ests per chain, 67200 per kthread [ 314.817913][T17867] netlink: 'syz.0.3415': attribute type 1 has an invalid length. [ 315.069795][T17890] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3420'. [ 315.101535][T17890] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3420'. [ 315.126924][T17890] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3420'. [ 315.152330][T17890] netlink: 'syz.1.3420': attribute type 3 has an invalid length. [ 315.175641][T17890] netlink: 666 bytes leftover after parsing attributes in process `syz.1.3420'. [ 315.226950][T17898] tipc: Started in network mode [ 315.232042][T17898] tipc: Node identity 7a6dac04b4cc, cluster identity 4711 [ 315.269023][T17898] tipc: Enabled bearer , priority 0 [ 315.280557][T17908] syzkaller0: entered promiscuous mode [ 315.287675][T17908] syzkaller0: entered allmulticast mode [ 315.321192][T17907] netlink: 'syz.4.3425': attribute type 1 has an invalid length. [ 315.442356][T17910] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 315.485570][T17907] veth1: entered promiscuous mode [ 315.499685][T17907] bond1: (slave veth1): Enslaving as a backup interface with a down link [ 315.593488][T17898] tipc: Resetting bearer [ 315.611902][T17896] tipc: Resetting bearer [ 315.622192][T17913] netlink: 'syz.4.3426': attribute type 1 has an invalid length. [ 315.670938][T17896] tipc: Disabling bearer [ 315.737547][T17915] tipc: Started in network mode [ 315.753606][T17915] tipc: Node identity ac14140f, cluster identity 4711 [ 315.766886][T17913] sctp: [Deprecated]: syz.4.3426 (pid 17913) Use of struct sctp_assoc_value in delayed_ack socket option. [ 315.766886][T17913] Use struct sctp_sack_info instead [ 315.781410][T17915] tipc: New replicast peer: 255.255.255.255 [ 315.793793][T17915] tipc: Enabled bearer , priority 10 [ 315.852294][T17913] gretap1: entered promiscuous mode [ 316.091383][T17936] FAULT_INJECTION: forcing a failure. [ 316.091383][T17936] name failslab, interval 1, probability 0, space 0, times 1 [ 316.112899][T17936] CPU: 0 UID: 0 PID: 17936 Comm: syz.2.3434 Not tainted syzkaller #0 PREEMPT(full) [ 316.112927][T17936] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 316.112942][T17936] Call Trace: [ 316.112949][T17936] [ 316.112957][T17936] dump_stack_lvl+0x189/0x250 [ 316.112983][T17936] ? __pfx____ratelimit+0x10/0x10 [ 316.113007][T17936] ? __pfx_dump_stack_lvl+0x10/0x10 [ 316.113022][T17936] ? __pfx__printk+0x10/0x10 [ 316.113042][T17936] ? __lock_acquire+0xab9/0xd20 [ 316.113069][T17936] should_fail_ex+0x414/0x560 [ 316.113099][T17936] should_failslab+0xa8/0x100 [ 316.113123][T17936] kmem_cache_alloc_noprof+0x74/0x6e0 [ 316.113141][T17936] ? skb_clone+0x212/0x3a0 [ 316.113171][T17936] skb_clone+0x212/0x3a0 [ 316.113190][T17936] __netlink_deliver_tap+0x404/0x850 [ 316.113221][T17936] ? netlink_deliver_tap+0x2e/0x1b0 [ 316.113243][T17936] netlink_deliver_tap+0x19c/0x1b0 [ 316.113265][T17936] netlink_unicast+0x7fa/0x9e0 [ 316.113289][T17936] ? __pfx_netlink_unicast+0x10/0x10 [ 316.113309][T17936] ? netlink_sendmsg+0x642/0xb30 [ 316.113326][T17936] ? skb_put+0x11b/0x210 [ 316.113353][T17936] netlink_sendmsg+0x805/0xb30 [ 316.113380][T17936] ? __pfx_netlink_sendmsg+0x10/0x10 [ 316.113402][T17936] ? aa_sock_msg_perm+0xf1/0x1d0 [ 316.113422][T17936] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 316.113442][T17936] ? __pfx_netlink_sendmsg+0x10/0x10 [ 316.113462][T17936] __sock_sendmsg+0x21c/0x270 [ 316.113481][T17936] ____sys_sendmsg+0x505/0x830 [ 316.113508][T17936] ? __pfx_____sys_sendmsg+0x10/0x10 [ 316.113536][T17936] ? import_iovec+0x74/0xa0 [ 316.113557][T17936] ___sys_sendmsg+0x21f/0x2a0 [ 316.113573][T17936] ? __pfx____sys_sendmsg+0x10/0x10 [ 316.113614][T17936] ? __fget_files+0x2a/0x420 [ 316.113631][T17936] ? __fget_files+0x3a0/0x420 [ 316.113656][T17936] __x64_sys_sendmsg+0x19b/0x260 [ 316.113672][T17936] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 316.113693][T17936] ? __pfx_ksys_write+0x10/0x10 [ 316.113712][T17936] ? do_syscall_64+0xbe/0xfa0 [ 316.113736][T17936] do_syscall_64+0xfa/0xfa0 [ 316.113751][T17936] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 316.113764][T17936] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 316.113778][T17936] ? clear_bhb_loop+0x60/0xb0 [ 316.113795][T17936] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 316.113809][T17936] RIP: 0033:0x7fc91e98efc9 [ 316.113833][T17936] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 316.113846][T17936] RSP: 002b:00007fc91f8b9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 316.113869][T17936] RAX: ffffffffffffffda RBX: 00007fc91ebe5fa0 RCX: 00007fc91e98efc9 [ 316.113879][T17936] RDX: 000000002400c000 RSI: 00002000000003c0 RDI: 0000000000000003 [ 316.113888][T17936] RBP: 00007fc91f8b9090 R08: 0000000000000000 R09: 0000000000000000 [ 316.113898][T17936] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 316.113906][T17936] R13: 00007fc91ebe6038 R14: 00007fc91ebe5fa0 R15: 00007fffb3cd6db8 [ 316.113931][T17936] [ 316.716744][T17954] tipc: Enabling of bearer rejected, failed to enable media [ 316.827120][ T7342] tipc: Node number set to 2886997007 [ 316.912846][T17963] netlink: 'syz.0.3446': attribute type 1 has an invalid length. [ 316.928130][T17963] netlink: 'syz.0.3446': attribute type 11 has an invalid length. [ 317.171542][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.180477][ T1302] lec:lec_start_xmit: lec0:No lecd attached [ 317.493938][T17994] netlink: 'syz.1.3456': attribute type 27 has an invalid length. [ 317.531422][T17994] netlink: 'syz.1.3456': attribute type 4 has an invalid length. [ 317.847619][T18018] Cannot find add_set index 1 as target [ 317.861657][T18018] netlink: 'syz.4.3463': attribute type 26 has an invalid length. [ 317.882791][T18018] __nla_validate_parse: 10 callbacks suppressed [ 317.882813][T18018] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3463'. [ 317.903759][T18018] netlink: 'syz.4.3463': attribute type 26 has an invalid length. [ 317.912637][T18018] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3463'. [ 317.995297][T18027] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3463'. [ 318.009381][T18027] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3463'. [ 318.021540][T18027] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3463'. [ 318.032806][T18027] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3463'. [ 318.074733][T18029] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3466'. [ 318.087991][T18029] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3466'. [ 318.103681][T18029] netlink: 'syz.3.3466': attribute type 10 has an invalid length. [ 318.127994][T18032] bond3: option all_slaves_active: invalid value (222) [ 318.137187][T18032] bond3 (unregistering): Released all slaves [ 318.159327][T18029] bridge0: port 2(bridge_slave_1) entered disabled state [ 318.167218][T18029] bridge0: port 1(bridge_slave_0) entered disabled state [ 318.179586][T18029] bridge0: port 2(bridge_slave_1) entered blocking state [ 318.186988][T18029] bridge0: port 2(bridge_slave_1) entered forwarding state [ 318.195160][T18029] bridge0: port 1(bridge_slave_0) entered blocking state [ 318.203408][T18029] bridge0: port 1(bridge_slave_0) entered forwarding state [ 318.219646][T18029] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 318.387501][T18043] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3471'. [ 318.474680][T18046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3473'. [ 318.921187][T18070] dvmrp0: entered allmulticast mode [ 319.784222][T18103] Cannot find add_set index 1 as target [ 320.055273][T18120] tipc: Enabled bearer , priority 0 [ 320.063890][T18121] syzkaller0: entered promiscuous mode [ 320.069886][T18121] syzkaller0: entered allmulticast mode [ 320.095193][T18120] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 320.148200][T18128] tipc: Resetting bearer [ 320.193226][T18128] tipc: Resetting bearer [ 320.229769][T18127] xt_CT: You must specify a L4 protocol and not use inversions on it [ 320.239485][T18128] tipc: Disabling bearer [ 320.249761][T18127] netlink: 'syz.4.3496': attribute type 2 has an invalid length. [ 320.259215][T18127] nbd: must specify a device to reconfigure [ 320.675379][T18157] tipc: New replicast peer: fc02:0000:0000:0000:0000:0000:0000:0001 [ 321.403168][T18190] sch_tbf: burst 88 is lower than device veth5 mtu (1514) ! [ 321.906222][T18219] syzkaller1: entered promiscuous mode [ 321.913453][T18219] syzkaller1: entered allmulticast mode [ 322.346149][T18247] netlink: 'syz.3.3528': attribute type 2 has an invalid length. [ 322.390800][T18248] netlink: 'syz.3.3528': attribute type 2 has an invalid length. [ 322.402623][T18247] netlink: 'syz.3.3528': attribute type 1 has an invalid length. [ 322.529280][T18248] bridge0: Device is already in use. [ 322.917617][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5730 ms [ 322.925896][ C0] lec:lec_tx_timeout: lec0 [ 322.989784][T18295] __nla_validate_parse: 14 callbacks suppressed [ 322.989807][T18295] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3542'. [ 323.013007][T18295] netlink: 120 bytes leftover after parsing attributes in process `syz.2.3542'. [ 323.027340][T18295] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3542'. [ 323.038680][T18297] netlink: 256 bytes leftover after parsing attributes in process `syz.1.3544'. [ 323.053221][T18297] IPVS: set_ctl: invalid protocol: 136 224.0.0.2:20001 [ 323.075193][T18297] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3544'. [ 323.216756][T18312] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3546'. [ 323.297919][T18315] tipc: Enabled bearer , priority 0 [ 323.343381][T18315] mac80211_hwsim hwsim28 syzkaller0: entered promiscuous mode [ 323.364659][T18315] mac80211_hwsim hwsim28 syzkaller0: entered allmulticast mode [ 323.417504][T18319] netlink: 'syz.3.3549': attribute type 2 has an invalid length. [ 323.585102][T18329] veth0: entered promiscuous mode [ 323.604179][T18331] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3551'. [ 323.617526][T18331] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 323.640583][T18329] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3552'. [ 323.657378][T18328] veth0: left promiscuous mode [ 323.917576][T18339] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3553'. [ 324.064178][T18357] ieee802154 phy1 wpan1: encryption failed: -22 [ 324.148881][T18367] xt_CT: You must specify a L4 protocol and not use inversions on it [ 324.174098][T18365] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3559'. [ 324.416500][ T24] tipc: Node number set to 3360679954 [ 324.524686][T18387] bond0: entered promiscuous mode [ 324.532019][T18387] bond_slave_0: entered promiscuous mode [ 324.546599][T18387] bond_slave_1: entered promiscuous mode [ 324.553938][T18387] bridge0: entered promiscuous mode [ 324.586236][T18387] bond0: left promiscuous mode [ 324.608228][T18387] bond_slave_0: left promiscuous mode [ 324.619977][T18387] bond_slave_1: left promiscuous mode [ 324.625988][T18387] bridge0: left promiscuous mode [ 325.435835][T18419] xt_CT: No such helper "snmp_trap" [ 325.446124][T18424] syzkaller0: entered promiscuous mode [ 325.459966][T18424] syzkaller0: entered allmulticast mode [ 325.496525][T18423] tipc: Enabled bearer , priority 10 [ 325.631039][T18440] sctp: [Deprecated]: syz.1.3582 (pid 18440) Use of int in maxseg socket option. [ 325.631039][T18440] Use struct sctp_assoc_value instead [ 325.798599][T18450] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 325.899417][T18457] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input6 [ 328.059657][T18476] bond3: option arp_interval: mode dependency failed, not supported in mode 802.3ad(4) [ 328.105047][T18476] bond3 (unregistering): Released all slaves [ 328.161964][T18483] Cannot find del_set index 4 as target [ 328.471194][T18496] tipc: Enabling of bearer rejected, failed to enable media [ 328.570308][T18512] netdevsim netdevsim0: loading /lib/firmware/. failed with error -22 [ 328.614032][T18512] netdevsim netdevsim0: Direct firmware load for . failed with error -22 [ 328.683282][T18512] netdevsim netdevsim0: Falling back to sysfs fallback for: . [ 328.890670][T18527] __nla_validate_parse: 6 callbacks suppressed [ 328.890689][T18527] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3605'. [ 328.935220][T18525] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3604'. [ 329.040914][T18533] can: request_module (can-proto-0) failed. [ 329.400394][T18554] netlink: 11562 bytes leftover after parsing attributes in process `syz.1.3614'. [ 329.537434][T18565] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3617'. [ 329.554480][T18567] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3620'. [ 329.565126][T18569] bond3: peer notification delay (1164) is not a multiple of miimon (100), value rounded to 1100 ms [ 329.579075][T18569] bond3: entered promiscuous mode [ 329.584223][T18569] bond3: entered allmulticast mode [ 329.591186][T18569] 8021q: adding VLAN 0 to HW filter on device bond3 [ 329.600112][T18572] netlink: 'syz.1.3619': attribute type 1 has an invalid length. [ 329.608281][T18572] netlink: 224 bytes leftover after parsing attributes in process `syz.1.3619'. [ 329.629067][T18567] Bluetooth: MGMT ver 1.23 [ 329.637173][T18572] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3619'. [ 329.664259][T18573] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 329.704351][T18574] netlink: 'syz.0.3617': attribute type 2 has an invalid length. [ 329.715510][T18574] netlink: 244 bytes leftover after parsing attributes in process `syz.0.3617'. [ 329.930540][T18588] geneve3: left promiscuous mode [ 329.939933][T18589] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3622'. [ 329.962019][T18586] syzkaller0: entered promiscuous mode [ 329.992952][T18586] syzkaller0: entered allmulticast mode [ 330.022916][T18589] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3622'. [ 330.087088][T18584] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 330.127007][T18595] dvmrp0: entered allmulticast mode [ 331.596198][T18668] bridge_slave_1: left allmulticast mode [ 331.621679][T18669] xt_socket: unknown flags 0x50 [ 331.638358][T18668] bridge_slave_1: left promiscuous mode [ 331.644519][T18668] bridge0: port 2(bridge_slave_1) entered disabled state [ 331.662360][T18668] bridge_slave_0: left allmulticast mode [ 331.668899][T18668] bridge_slave_0: left promiscuous mode [ 331.675953][T18668] bridge0: port 1(bridge_slave_0) entered disabled state [ 331.716732][ T5838] Bluetooth: hci2: Opcode 0x0401 failed: -110 [ 331.718020][ T5825] Bluetooth: hci2: command 0x0401 tx timeout [ 334.889746][T18685] IPVS: set_ctl: invalid protocol: 1 127.0.0.1:20004 [ 334.895387][T18687] tap0: tun_chr_ioctl cmd 1074025678 [ 334.928877][T18687] tap0: group set to 0 [ 335.007349][T18694] __nla_validate_parse: 142 callbacks suppressed [ 335.007370][T18694] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3656'. [ 335.072595][T18689] wg1 speed is unknown, defaulting to 1000 [ 335.446218][T18720] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3665'. [ 335.600961][T18722] tipc: Resetting bearer [ 335.689976][T18722] tipc: Resetting bearer [ 335.761642][T18732] 8021q: VLANs not supported on ip6_vti0 [ 335.775083][T18729] lec:lec_start_xmit: lec0:No lecd attached [ 335.862162][T18738] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3671'. [ 335.966755][T18746] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3674'. [ 335.977583][T18746] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3674'. [ 335.997379][T18742] netlink: 'syz.1.3672': attribute type 32 has an invalid length. [ 336.005977][T18742] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3672'. [ 336.040867][T18742] bond3: Setting coupled_control to off (0) [ 336.048701][T18748] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3675'. [ 336.107202][T18754] netlink: 9 bytes leftover after parsing attributes in process `syz.0.3675'. [ 336.200732][T18756] netlink: 5 bytes leftover after parsing attributes in process `syz.0.3675'. [ 336.280363][T18722] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 336.287196][T18722] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 336.311378][T18746] team0 (unregistering): Port device team_slave_0 removed [ 336.328159][T18746] team0 (unregistering): Port device team_slave_1 removed [ 336.354710][T18748] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 336.359630][T18754] gretap0: entered promiscuous mode [ 336.401996][T18755] C: renamed from lo (while UP) [ 336.445493][T18756] 0{X功: renamed from gretap0 [ 336.469868][T18756] 0{X功: left promiscuous mode [ 336.484421][T18756] 0{X功: entered allmulticast mode [ 336.504970][T18756] A link change request failed with some changes committed already. Interface 30{X功 may have been left with an inconsistent configuration, please check. [ 336.661967][T18722] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 336.680107][T18722] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 336.850644][T18722] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 336.869802][T18722] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 336.969807][T18722] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 336.975851][T18722] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 337.046155][T18796] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3687'. [ 337.079758][T18801] nbd: must specify at least one socket [ 337.107991][T18722] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 337.114948][T18722] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 337.159469][T18805] netlink: 'syz.0.3687': attribute type 6 has an invalid length. [ 337.333340][T18809] 0{X功: left allmulticast mode [ 337.514032][T18818] netlink: 'syz.0.3693': attribute type 21 has an invalid length. [ 337.644794][T18823] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 337.667284][T18825] bridge_slave_1: left allmulticast mode [ 337.678612][T18825] bridge_slave_1: left promiscuous mode [ 337.691953][T18825] bridge0: port 2(bridge_slave_1) entered disabled state [ 337.719699][T18825] bridge_slave_0: left allmulticast mode [ 337.740046][T18825] bridge_slave_0: left promiscuous mode [ 337.745959][T18825] bridge0: port 1(bridge_slave_0) entered disabled state [ 338.480131][T18870] Unsupported ieee802154 address type: 0 [ 338.696237][T18881] syzkaller0: entered promiscuous mode [ 338.705705][T18881] syzkaller0: entered allmulticast mode [ 338.737703][T18879] netlink: 'syz.3.3711': attribute type 2 has an invalid length. [ 339.086534][T18888] bridge: RTM_NEWNEIGH with invalid ether address [ 339.749505][T18917] nbd: must specify a size in bytes for the device [ 340.926378][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5150 ms [ 340.934670][ C0] lec:lec_tx_timeout: lec0 [ 340.940652][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 341.472109][T18909] sch_fq: defrate 0 ignored. [ 341.537286][T18935] __nla_validate_parse: 5 callbacks suppressed [ 341.537306][T18935] netlink: 76 bytes leftover after parsing attributes in process `syz.3.3727'. [ 341.542425][T18918] bond3: option packets_per_slave: invalid value (18446744073709551615) [ 341.572995][T18918] bond3: option packets_per_slave: allowed values 0 - 65535 [ 341.585011][T18918] bond3 (unregistering): Released all slaves [ 342.071996][T18971] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3740'. [ 342.107118][T18973] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3739'. [ 342.107176][T18976] netlink: get zone limit has 8 unknown bytes [ 342.224729][T18980] netlink: 71 bytes leftover after parsing attributes in process `syz.2.3741'. [ 342.388943][T18992] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3740'. [ 342.416543][T19001] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3747'. [ 342.532422][T19006] netlink: 'syz.1.3749': attribute type 5 has an invalid length. [ 342.547107][T19007] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3750'. [ 342.557623][T19006] sctp: [Deprecated]: syz.1.3749 (pid 19006) Use of int in maxseg socket option. [ 342.557623][T19006] Use struct sctp_assoc_value instead [ 342.588991][T19006] netlink: 'syz.1.3749': attribute type 8 has an invalid length. [ 342.628759][T19014] netlink: 'syz.1.3749': attribute type 5 has an invalid length. [ 342.705248][T19020] netlink: 'syz.1.3753': attribute type 11 has an invalid length. [ 342.940121][T19027] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3755'. [ 342.979089][T19030] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 343.179539][T19030] bridge0: port 2(bridge_slave_1) entered disabled state [ 343.187310][T19030] bridge0: port 1(bridge_slave_0) entered disabled state [ 343.202081][T19052] netlink: 12 bytes leftover after parsing attributes in process `syz.3.3759'. [ 343.358711][T19030] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 343.745085][T19087] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3772'. [ 344.143734][T19116] bond4: entered allmulticast mode [ 344.182269][T19116] 8021q: adding VLAN 0 to HW filter on device bond4 [ 344.192053][T19116] bridge0: port 3(bond4) entered blocking state [ 344.199593][T19116] bridge0: port 3(bond4) entered disabled state [ 344.210446][T19116] bond4: entered promiscuous mode [ 344.238965][T19121] bridge3: the hash_elasticity option has been deprecated and is always 16 [ 344.395974][T19130] IPv6: sit1: Disabled Multicast RS [ 344.421865][T19133] openvswitch: netlink: Flow actions attr not present in new flow. [ 345.946395][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 345.954536][ C0] lec:lec_tx_timeout: lec0 [ 345.959522][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 347.048662][T19157] __nla_validate_parse: 3 callbacks suppressed [ 347.048681][T19157] netlink: 44 bytes leftover after parsing attributes in process `syz.3.3792'. [ 347.412035][T19183] openvswitch: netlink: Flow key attr not present in new flow. [ 347.523219][T19188] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3802'. [ 347.544005][T19186] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3801'. [ 347.559050][T19186] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3801'. [ 347.645318][T19183] netlink: 9 bytes leftover after parsing attributes in process `syz.3.3797'. [ 347.736162][T19197] netlink: 'syz.2.3804': attribute type 5 has an invalid length. [ 347.894128][T19207] netlink: 'syz.4.3807': attribute type 29 has an invalid length. [ 347.941218][T19207] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 347.999315][T19206] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3805'. [ 348.049849][T19212] siw: device registration error -23 [ 348.113782][T19219] netlink: 14436 bytes leftover after parsing attributes in process `syz.4.3810'. [ 348.128825][T19219] openvswitch: netlink: Key type 30 is not supported [ 348.229322][T19222] pim6reg1: entered promiscuous mode [ 348.256176][T19222] pim6reg1: entered allmulticast mode [ 348.364179][T19240] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3815'. [ 348.378797][T19226] wg1 speed is unknown, defaulting to 1000 [ 348.821982][T19255] vcan0: left allmulticast mode [ 348.992828][T19267] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3820'. [ 349.118146][T19269] vlan2: entered allmulticast mode [ 349.135276][T19269] bond0: entered allmulticast mode [ 349.142639][T19269] bond_slave_0: entered allmulticast mode [ 349.172061][T19278] IPVS: length: 8 != 1152 [ 349.176446][T19269] bond_slave_1: entered allmulticast mode [ 349.176470][T19269] bridge0: entered allmulticast mode [ 349.261333][T19262] netlink: 168 bytes leftover after parsing attributes in process `syz.4.3819'. [ 349.417105][T19285] syzkaller0: create flow: hash 1251301869 index 2 [ 349.417663][ T8476] syzkaller0: tun_net_xmit 76 [ 349.431563][ T8476] syzkaller0: tun_net_xmit 48 [ 349.450469][ T5933] syzkaller0: tun_net_xmit 76 [ 349.584313][T19283] syzkaller0: delete flow: hash 1251301869 index 2 [ 349.597626][ T5891] syzkaller0: tun_net_xmit 76 [ 350.966349][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 350.974709][ C0] lec:lec_tx_timeout: lec0 [ 350.979396][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 351.915921][T19322] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 352.131143][T19343] netlink: 'syz.2.3842': attribute type 2 has an invalid length. [ 352.143192][T19341] __nla_validate_parse: 1 callbacks suppressed [ 352.143218][T19341] netlink: 72 bytes leftover after parsing attributes in process `syz.4.3844'. [ 352.314141][T19356] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3847'. [ 352.325231][T19352] tipc: Enabled bearer , priority 0 [ 352.378111][T19352] syzkaller0: entered promiscuous mode [ 352.406528][T19352] syzkaller0: entered allmulticast mode [ 352.461269][T19351] tipc: Resetting bearer [ 352.529412][T19351] tipc: Disabling bearer [ 352.604691][T19368] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3850'. [ 352.658177][T19372] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3850'. [ 352.697930][T19375] IPVS: set_ctl: invalid protocol: 22 100.1.1.2:20002 [ 352.708001][T19371] IPVS: set_ctl: invalid protocol: 22 100.1.1.2:20002 [ 352.736968][T19377] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3853'. [ 352.746832][T19377] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3853'. [ 352.756212][T19377] netlink: 'syz.0.3853': attribute type 12 has an invalid length. [ 352.767110][T19377] netlink: 'syz.0.3853': attribute type 11 has an invalid length. [ 352.785077][T19380] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3852'. [ 352.925273][T19383] sch_tbf: burst 88 is lower than device veth3 mtu (1514) ! [ 353.328625][T19410] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3862'. [ 353.342277][T19410] netlink: 43 bytes leftover after parsing attributes in process `syz.1.3862'. [ 353.358399][T19410] netlink: 'syz.1.3862': attribute type 5 has an invalid length. [ 353.370049][T19410] netlink: 43 bytes leftover after parsing attributes in process `syz.1.3862'. [ 355.624191][T19431] mac80211_hwsim hwsim28 syzkaller0: left promiscuous mode [ 355.633376][T19431] mac80211_hwsim hwsim28 syzkaller0: left allmulticast mode [ 355.644524][T19439] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 355.996878][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 356.006134][ C0] lec:lec_tx_timeout: lec0 [ 356.012310][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 356.071413][T19463] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 356.325855][T19471] syzkaller0: entered promiscuous mode [ 356.332374][T19471] syzkaller0: entered allmulticast mode [ 356.337738][T19479] openvswitch: netlink: Port -1 exceeds max allowable 65535 [ 356.347027][T19476] tipc: Enabled bearer , priority 0 [ 356.471334][T19471] tipc: Resetting bearer [ 358.938937][T19471] tipc: Disabling bearer [ 359.106410][T19496] hsr_slave_0 (unregistering): left promiscuous mode [ 359.124949][T19537] __nla_validate_parse: 6 callbacks suppressed [ 359.124974][T19537] netlink: 80 bytes leftover after parsing attributes in process `syz.1.3897'. [ 359.222189][T19533] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3894'. [ 359.365142][T19550] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3901'. [ 359.391340][T19550] netlink: 'syz.2.3901': attribute type 1 has an invalid length. [ 359.510120][T19559] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3903'. [ 359.524357][T19561] netlink: 'syz.0.3904': attribute type 1 has an invalid length. [ 359.539100][T19564] netlink: 'syz.4.3905': attribute type 8 has an invalid length. [ 359.549582][T19566] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3905'. [ 359.620127][T19564] tipc: Enabling of bearer rejected, failed to enable media [ 359.672852][T19561] bond1: (slave bridge0): making interface the new active one [ 359.705558][T19561] bond1: (slave bridge0): Enslaving as an active interface with an up link [ 359.731641][T19550] gretap2: entered promiscuous mode [ 359.741896][T19550] gretap2: entered allmulticast mode [ 359.949664][T19582] team_slave_0: mtu less than device minimum [ 360.383367][T19607] netlink: 'syz.4.3918': attribute type 1 has an invalid length. [ 360.400239][T19607] netlink: 'syz.4.3918': attribute type 3 has an invalid length. [ 360.417274][T19607] netlink: 224 bytes leftover after parsing attributes in process `syz.4.3918'. [ 360.802504][T19626] ip6gre0: Master is either lo or non-ether device [ 360.811020][T19628] ip6gre0: Master is either lo or non-ether device [ 361.026389][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 361.034468][ C0] lec:lec_tx_timeout: lec0 [ 361.039208][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 361.139214][T19655] 0{X功: entered promiscuous mode [ 361.145156][T19655] vlan0: entered promiscuous mode [ 361.339082][T19660] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3933'. [ 361.389138][ T7342] IPVS: starting estimator thread 0... [ 361.456563][T19665] IPVS: nq: FWM 3 0x00000003 - no destination available [ 361.478241][T19666] IPVS: using max 31 ests per chain, 74400 per kthread [ 361.842368][T19684] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3941'. [ 362.134035][ T7338] IPVS: starting estimator thread 0... [ 362.257382][T19703] IPVS: using max 25 ests per chain, 60000 per kthread [ 362.264999][T19712] netlink: 'syz.2.3949': attribute type 4 has an invalid length. [ 362.268499][T19712] netlink: 'syz.2.3949': attribute type 4 has an invalid length. [ 362.299447][T19709] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 362.361366][T19716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3952'. [ 362.387504][T19716] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3952'. [ 362.457487][T19721] netlink: 'syz.0.3955': attribute type 11 has an invalid length. [ 362.562832][T19725] netlink: 'syz.4.3957': attribute type 11 has an invalid length. [ 362.620874][T19731] RDS: rds_bind could not find a transport for ::ffff:10.1.1.0, load rds_tcp or rds_rdma? [ 362.800861][T19742] netlink: 'syz.0.3963': attribute type 1 has an invalid length. [ 363.173369][T19762] 8021q: adding VLAN 0 to HW filter on device bond5 [ 363.184596][T19762] bond0: (slave bond5): Enslaving as an active interface with an up link [ 363.683828][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.698171][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.711613][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.741697][T19803] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 363.787251][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.807878][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.822055][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.831024][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.843055][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.852633][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.861766][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.872248][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.888625][T19803] hsr0 speed is unknown, defaulting to 1000 [ 363.898673][T19803] hsr0 speed is unknown, defaulting to 1000 [ 364.141830][T19833] sctp: [Deprecated]: syz.0.3994 (pid 19833) Use of struct sctp_assoc_value in delayed_ack socket option. [ 364.141830][T19833] Use struct sctp_sack_info instead [ 364.160683][T19829] __nla_validate_parse: 7 callbacks suppressed [ 364.160701][T19829] netlink: 44 bytes leftover after parsing attributes in process `syz.4.3993'. [ 364.234144][T19836] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 364.302085][T19838] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3996'. [ 364.342713][T19840] wireguard0: entered allmulticast mode [ 364.387124][T19843] ieee802154 phy1 wpan1: encryption failed: -126 [ 364.409440][T19843] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3998'. [ 364.423328][T19843] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3998'. [ 364.680654][T19862] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4003'. [ 364.722780][T19861] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4003'. [ 364.762046][T19869] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4005'. [ 365.321061][T19898] netlink: 104 bytes leftover after parsing attributes in process `syz.1.4010'. [ 365.429390][T19905] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4012'. [ 365.506581][T19905] bridge_slave_1: left allmulticast mode [ 365.515239][T19905] bridge_slave_1: left promiscuous mode [ 365.521788][T19905] bridge0: port 2(bridge_slave_1) entered disabled state [ 365.533853][T19905] bridge_slave_0: left allmulticast mode [ 365.541331][T19905] bridge_slave_0: left promiscuous mode [ 365.552695][T19905] bridge0: port 1(bridge_slave_0) entered disabled state [ 365.575891][T19916] IPVS: set_ctl: invalid protocol: 20 0.0.0.0:256 [ 365.615003][T19905] bond0: (slave bridge0): Releasing backup interface [ 365.625000][T19905] bridge0 (unregistering): left allmulticast mode [ 365.659215][T19920] validate_nla: 3 callbacks suppressed [ 365.659233][T19920] netlink: 'syz.0.4016': attribute type 1 has an invalid length. [ 365.707888][T19920] netlink: 'syz.0.4016': attribute type 1 has an invalid length. [ 365.793291][T19928] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4018'. [ 365.933528][T19938] bond_slave_0: vlans aren't supported yet for dev_uc|mc_add() [ 365.971497][T19938] netlink: 'syz.1.4023': attribute type 1 has an invalid length. [ 366.006418][T19938] netlink: 'syz.1.4023': attribute type 58 has an invalid length. [ 366.045236][T19944] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 366.046405][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 366.061963][ C0] lec:lec_tx_timeout: lec0 [ 366.067062][T19946] block nbd1: Unsupported socket: should be TCP or UNIX. [ 366.067983][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 366.075618][T19948] netlink: 'syz.1.4023': attribute type 7 has an invalid length. [ 366.435340][T19972] netlink: 'syz.2.4034': attribute type 1 has an invalid length. [ 367.083529][T20014] netlink: 'syz.4.4042': attribute type 4 has an invalid length. [ 367.136178][T20019] netlink: 'syz.4.4042': attribute type 4 has an invalid length. [ 367.161986][T20018] nbd: must specify a size in bytes for the device [ 367.234245][T20023] mac80211_hwsim hwsim30 syzkaller0: entered promiscuous mode [ 367.267185][T20023] mac80211_hwsim hwsim30 syzkaller0: entered allmulticast mode [ 367.903993][T20071] tipc: Enabled bearer , priority 0 [ 367.914174][T20071] tipc: Resetting bearer [ 368.023885][T20078] SET target dimension over the limit! [ 368.183417][T20085] xt_CT: You must specify a L4 protocol and not use inversions on it [ 368.262227][T20089] xt_CT: You must specify a L4 protocol and not use inversions on it [ 368.330170][T20096] netlink: 'syz.2.4070': attribute type 1 has an invalid length. [ 368.397776][T20096] 8021q: adding VLAN 0 to HW filter on device bond3 [ 368.544885][T20111] tipc: Enabling of bearer rejected, already enabled [ 368.568699][T20111] mac80211_hwsim hwsim28 syzkaller0: entered promiscuous mode [ 368.587560][T20111] mac80211_hwsim hwsim28 syzkaller0: entered allmulticast mode [ 368.678905][T20111] tipc: Resetting bearer [ 369.030212][T20140] netlink: 'syz.2.4084': attribute type 1 has an invalid length. [ 369.234418][T20155] __nla_validate_parse: 19 callbacks suppressed [ 369.234437][T20155] netlink: 228 bytes leftover after parsing attributes in process `syz.4.4091'. [ 369.355663][T20168] sctp: [Deprecated]: syz.4.4093 (pid 20168) Use of int in max_burst socket option. [ 369.355663][T20168] Use struct sctp_assoc_value instead [ 369.419229][T20163] sctp: [Deprecated]: syz.3.4094 (pid 20163) Use of struct sctp_assoc_value in delayed_ack socket option. [ 369.419229][T20163] Use struct sctp_sack_info instead [ 369.666766][T20187] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4100'. [ 369.783889][T20191] netlink: 766 bytes leftover after parsing attributes in process `syz.3.4101'. [ 369.800814][T20198] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 369.854036][T20200] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4104'. [ 370.027368][T20210] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4107'. [ 370.049921][T20210] openvswitch: netlink: Flow key attr not present in new flow. [ 370.156957][T20221] syzkaller0: entered promiscuous mode [ 370.162618][T20221] syzkaller0: entered allmulticast mode [ 370.547075][T20238] bond4: entered promiscuous mode [ 370.809503][T20262] validate_nla: 7 callbacks suppressed [ 370.809523][T20262] netlink: 'syz.4.4123': attribute type 1 has an invalid length. [ 371.086339][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 371.094452][ C0] lec:lec_tx_timeout: lec0 [ 371.099148][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 371.525191][T20308] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4135'. [ 371.900377][T20327] bond0: entered promiscuous mode [ 371.909272][T20326] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4140'. [ 371.926530][T20327] bond_slave_0: entered promiscuous mode [ 371.932752][T20327] bond_slave_1: entered promiscuous mode [ 371.947087][T20326] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 372.260444][T20345] wg1 speed is unknown, defaulting to 1000 [ 372.318040][T20345] hsr0 speed is unknown, defaulting to 1000 [ 372.325371][T20354] wg1 speed is unknown, defaulting to 1000 [ 372.346626][T20354] hsr0 speed is unknown, defaulting to 1000 [ 372.432515][T20361] netlink: 104 bytes leftover after parsing attributes in process `syz.2.4151'. [ 372.817690][T20393] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4157'. [ 372.942429][T20396] netlink: 60 bytes leftover after parsing attributes in process `syz.2.4158'. [ 373.255150][ T5891] IPVS: starting estimator thread 0... [ 373.335792][T20422] netlink: 'syz.2.4167': attribute type 9 has an invalid length. [ 373.366790][T20416] IPVS: using max 28 ests per chain, 67200 per kthread [ 373.589939][T20409] team0 (unregistering): Port device team_slave_0 removed [ 373.603174][T20409] team0 (unregistering): Port device team_slave_1 removed [ 373.642194][T20432] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 374.127933][ T31] INFO: task kworker/1:1H:2848 blocked for more than 143 seconds. [ 374.145316][ T31] Not tainted syzkaller #0 [ 374.160018][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 374.185513][ T31] task:kworker/1:1H state:D stack:24696 pid:2848 tgid:2848 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 374.203827][ T31] Workqueue: kblockd blk_mq_requeue_work [ 374.210385][ T31] Call Trace: [ 374.214871][ T31] [ 374.255414][ T31] __schedule+0x1798/0x4cc0 [ 374.267436][ T31] ? do_raw_spin_lock+0x121/0x290 [ 374.273186][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 374.279840][ T31] ? __pfx___schedule+0x10/0x10 [ 374.285010][ T31] ? schedule+0x91/0x360 [ 374.290721][ T31] schedule+0x165/0x360 [ 374.295257][ T31] schedule_timeout+0x12b/0x270 [ 374.301172][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 374.307099][ T31] ? __pfx_process_timeout+0x10/0x10 [ 374.312645][ T31] ? prepare_to_wait_event+0x437/0x480 [ 374.318665][ T31] nbd_queue_rq+0x662/0xf10 [ 374.323527][ T31] ? __pfx_nbd_queue_rq+0x10/0x10 [ 374.329254][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 374.335605][ T31] blk_mq_dispatch_rq_list+0x4c0/0x1900 [ 374.341389][ T31] ? sbitmap_find_bit+0x47f/0x520 [ 374.348166][ T31] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 374.354283][ T31] ? __blk_mq_alloc_driver_tag+0x2e7/0x6e0 [ 374.361717][ T31] __blk_mq_sched_dispatch_requests+0xda4/0x1570 [ 374.369357][ T31] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 374.377637][ T31] ? blk_mq_run_hw_queue+0x31f/0x4f0 [ 374.383731][ T31] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 374.390671][ T31] ? blk_mq_run_hw_queue+0x31f/0x4f0 [ 374.396787][ T31] blk_mq_run_hw_queue+0x348/0x4f0 [ 374.402382][ T31] blk_mq_run_hw_queues+0x33e/0x430 [ 374.410400][ T31] ? __pfx_blk_mq_run_hw_queues+0x10/0x10 [ 374.416904][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 374.422454][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 374.428471][ T31] blk_mq_requeue_work+0x717/0x760 [ 374.435580][ T31] ? __pfx_blk_mq_requeue_work+0x10/0x10 [ 374.442531][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 374.449069][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 374.456136][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 374.462745][ T31] process_scheduled_works+0xae1/0x17b0 [ 374.469912][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 374.476005][ T31] worker_thread+0x8a0/0xda0 [ 374.480984][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 374.488524][ T31] ? __kthread_parkme+0x7b/0x200 [ 374.493876][ T31] kthread+0x711/0x8a0 [ 374.498865][ T31] ? __pfx_worker_thread+0x10/0x10 [ 374.504846][ T31] ? __pfx_kthread+0x10/0x10 [ 374.509836][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 374.515414][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 374.521093][ T31] ? __pfx_kthread+0x10/0x10 [ 374.525931][ T31] ret_from_fork+0x4bc/0x870 [ 374.531224][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 374.536425][ T31] ? __switch_to_asm+0x39/0x70 [ 374.541228][ T31] ? __switch_to_asm+0x33/0x70 [ 374.546164][ T31] ? __pfx_kthread+0x10/0x10 [ 374.551070][ T31] ret_from_fork_asm+0x1a/0x30 [ 374.555874][ T31] [ 374.559647][ T31] [ 374.559647][ T31] Showing all locks held in the system: [ 374.567611][ T31] 1 lock held by khungtaskd/31: [ 374.575352][ T31] #0: ffffffff8e13d2e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 374.587607][ T31] 4 locks held by kworker/1:1H/2848: [ 374.593026][ T31] #0: ffff88801f699548 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 374.604672][ T31] #1: ffffc9000bd6fba0 ((work_completion)(&(&q->requeue_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 374.618127][ T31] #2: ffff8880246d1810 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_hw_queue+0x31f/0x4f0 [ 374.628301][ T31] #3: ffff888024e55738 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xc8/0xf10 [ 374.637432][ T31] 2 locks held by getty/5583: [ 374.642126][ T31] #0: ffff8880338c70a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 374.652408][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 374.663011][ T31] 1 lock held by udevd/5842: [ 374.667770][ T31] #0: ffff888143364358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 [ 374.678942][ T31] 4 locks held by kworker/u8:12/6541: [ 374.684695][ T31] #0: ffff8880b873a058 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 [ 374.694906][ T31] #1: ffffc9000b937ba0 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 374.708663][ T31] #2: ffff8880b8725958 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x1ae/0xf30 [ 374.717826][ T31] #3: ffffffff99c03d40 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0xbb/0x420 [ 374.728206][ T31] 2 locks held by syz.0.4173/20440: [ 374.733485][ T31] #0: ffffffff8f4e30a8 (bpf_dispatcher_xdp.mutex){+.+.}-{4:4}, at: bpf_dispatcher_change_prog+0x9c/0xc90 [ 374.745830][ T31] #1: ffffffff8e142d78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 374.757888][ T31] 1 lock held by syz.0.4173/20444: [ 374.763114][ T31] #0: ffff88805774e8d8 (&nft_net->commit_mutex){+.+.}-{4:4}, at: nf_tables_valid_genid+0x3b/0x100 [ 374.774471][ T31] 1 lock held by syz.4.4175/20451: [ 374.779649][ T31] #0: ffffffff8f4dfd48 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 374.789234][ T31] 2 locks held by syz.3.4181/20473: [ 374.795207][ T31] #0: ffffffff8f4dfd48 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x71c/0xb70 [ 374.808108][ T31] #1: ffffffff8e142d78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 [ 374.822174][ T31] [ 374.847869][ T31] ============================================= [ 374.847869][ T31] [ 374.856733][ T31] NMI backtrace for cpu 0 [ 374.856760][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 374.856776][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 374.856785][ T31] Call Trace: [ 374.856792][ T31] [ 374.856798][ T31] dump_stack_lvl+0x189/0x250 [ 374.856823][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 374.856838][ T31] ? __pfx__printk+0x10/0x10 [ 374.856863][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 374.856887][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 374.856907][ T31] ? __pfx__printk+0x10/0x10 [ 374.856925][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 374.856946][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 374.856968][ T31] watchdog+0xf60/0xfa0 [ 374.856993][ T31] ? watchdog+0x1e2/0xfa0 [ 374.857017][ T31] kthread+0x711/0x8a0 [ 374.857034][ T31] ? __pfx_watchdog+0x10/0x10 [ 374.857052][ T31] ? __pfx_kthread+0x10/0x10 [ 374.857070][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 374.857092][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 374.857106][ T31] ? __pfx_kthread+0x10/0x10 [ 374.857124][ T31] ret_from_fork+0x4bc/0x870 [ 374.857148][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 374.857177][ T31] ? __switch_to_asm+0x39/0x70 [ 374.857196][ T31] ? __switch_to_asm+0x33/0x70 [ 374.857213][ T31] ? __pfx_kthread+0x10/0x10 [ 374.857231][ T31] ret_from_fork_asm+0x1a/0x30 [ 374.857281][ T31] [ 374.857293][ T31] Sending NMI from CPU 0 to CPUs 1: [ 375.018267][ C1] NMI backtrace for cpu 1 [ 375.018286][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 375.018304][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 375.018326][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 375.018347][ C1] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 11 1c 00 f3 0f 1e fa fb f4 c8 e6 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 375.018362][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c6 [ 375.018378][ C1] RAX: 3a657550fbf7b600 RBX: ffffffff8196bc07 RCX: 3a657550fbf7b600 [ 375.018390][ C1] RDX: 0000000000000001 RSI: ffffffff8d7e847d RDI: ffffffff8bc077e0 [ 375.018401][ C1] RBP: ffffc90000197f10 R08: ffff8880b8732fdb R09: 1ffff110170e65fb [ 375.018413][ C1] R10: dffffc0000000000 R11: ffffed10170e65fc R12: ffffffff8f9e1470 [ 375.018425][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff1100385ab58 [ 375.018435][ C1] FS: 0000000000000000(0000) GS:ffff888125e0c000(0000) knlGS:0000000000000000 [ 375.018449][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 375.018459][ C1] CR2: 0000200000019880 CR3: 000000000df38000 CR4: 00000000003526f0 [ 375.018474][ C1] Call Trace: [ 375.018483][ C1] [ 375.018490][ C1] default_idle+0x13/0x20 [ 375.018512][ C1] default_idle_call+0x73/0xb0 [ 375.018530][ C1] do_idle+0x1e7/0x510 [ 375.018555][ C1] ? __pfx_do_idle+0x10/0x10 [ 375.018583][ C1] cpu_startup_entry+0x44/0x60 [ 375.018603][ C1] start_secondary+0x101/0x110 [ 375.018621][ C1] common_startup_64+0x13e/0x147 [ 375.018647][ C1] [ 375.019449][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 375.197107][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 375.207097][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 375.218310][ T31] Call Trace: [ 375.221984][ T31] [ 375.225837][ T31] dump_stack_lvl+0x99/0x250 [ 375.230729][ T31] ? __asan_memcpy+0x40/0x70 [ 375.235669][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 375.240958][ T31] ? __pfx__printk+0x10/0x10 [ 375.245839][ T31] vpanic+0x237/0x6d0 [ 375.249954][ T31] ? __pfx_vpanic+0x10/0x10 [ 375.254717][ T31] ? preempt_schedule_common+0x83/0xd0 [ 375.260635][ T31] panic+0xb9/0xc0 [ 375.264608][ T31] ? __pfx_panic+0x10/0x10 [ 375.269659][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 375.275079][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 375.282049][ T31] watchdog+0xf9f/0xfa0 [ 375.286547][ T31] ? watchdog+0x1e2/0xfa0 [ 375.291069][ T31] kthread+0x711/0x8a0 [ 375.295433][ T31] ? __pfx_watchdog+0x10/0x10 [ 375.300308][ T31] ? __pfx_kthread+0x10/0x10 [ 375.305972][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 375.312593][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 375.318010][ T31] ? __pfx_kthread+0x10/0x10 [ 375.322967][ T31] ret_from_fork+0x4bc/0x870 [ 375.327668][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 375.333135][ T31] ? __switch_to_asm+0x39/0x70 [ 375.338354][ T31] ? __switch_to_asm+0x33/0x70 [ 375.343564][ T31] ? __pfx_kthread+0x10/0x10 [ 375.350161][ T31] ret_from_fork_asm+0x1a/0x30 [ 375.356109][ T31] [ 375.360151][ T31] Kernel Offset: disabled [ 375.365227][ T31] Rebooting in 86400 seconds..