last executing test programs: 5.130492159s ago: executing program 1 (id=7373): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001080)={0xffffffffffffffff}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0xc4701000) getsockopt$sock_timeval(r0, 0x1, 0x48, 0x0, &(0x7f00000014c0)) 4.893869581s ago: executing program 2 (id=7377): r0 = socket$netlink(0x10, 0x3, 0x4) writev(r0, &(0x7f0000000000)=[{&(0x7f00000000c0)="58000000140019230a834b80040d8c560a117436c379000000ed000000005800074824ca945fff0200004250c28e0ebc20ffff000000008000f0fffeffe809005309fdf510a4baa7bb98318b00"/88, 0x58}], 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000004c0)=@raw={'raw\x00', 0x8, 0x3, 0x500, 0x340, 0x11, 0x148, 0x0, 0x0, 0x468, 0x2a8, 0x2a8, 0x468, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x6, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @pinned={0x1, 0x0, 0x0, './file0\x00'}}]}, @unspec=@CT0={0x48}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'vlan0\x00', 'netdevsim0\x00'}, 0x0, 0xf8, 0x128, 0x0, {}, [@common=@osf={{0x50}, {'syz1\x00', 0x0, 0x4, 0x0, 0x2}}, @common=@unspec=@quota={{0x38}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x560) r3 = accept4(r1, 0x0, 0x0, 0x80000) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f00000003c0), r3) sendmsg$L2TP_CMD_SESSION_GET(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="00032dbd7000ffdbdf250800000014001f00ff01000000000000000000000027a47df663981ab960879aaa8617000001050012008100000006000100000000000c001600140000000000000006001a004e1e0000050022000100000006000300ff0100000c00f400010000000000008005000d00000000005206712e73295a7686192d5f340dcfbf0d413b1ffb360a0f5281001251987e51d642b96287c59cd6bb00b7899928682c85e6cdcd426dcf5f4c868da7f2caf3a995204f139e3262d7685c9c79b097e8ce0aa2f054b89124ce8e7f6bce5d842f6ec35437d0ec9ba3951c601920c9356fbd2e94e163ee5fd269e44b0c48940617a2f6a69aae2842bb07b889e2d29baf0b12612a5f0eb9fc38753a6c812081d817feeab275b830d1a609ee9f813e16e3a74997df"], 0x70}, 0x1, 0x0, 0x0, 0x4004090}, 0x4004) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000000f80)={0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f00000042c0)="86", 0xff0f}], 0x1}, 0x0) recvmsg(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000004300)=""/203, 0xcb}], 0x1, 0x0, 0xfffffffffffffeb3}, 0x141) writev(r3, &(0x7f0000000040)=[{&(0x7f00000012c0)="a4eac90f8e3ae7580e2e693731ef6b447fc2057d9a84e61f40c79e10218d131f865d68b23cd7c3f2b681e2205f67f140252abcc3b8015e176881d81a9e61b6a2c92a9d8e1f51861b64e7b61bf9a131e197f5a6c6d4d887d86c79836e81c69e211d2bf4c595b01c94de464ff9aa72b6058fe774c81142bbce9bd0d83f6239362c3347e3daadb292cf3fee4766a2d43cf006a476ce0e4dd221acdcdefcf67733ed2978c2cd564772844077920cf54543db03688079168e36709dbbf84933a2415a32617f7de4336d89967c2cbcd76a973d88a3c440862bc11e51df6f1cd25f1aa711b721c33703645bcf93b775f1eb28c7640d1b7cbe44b9fc0e55d1a4d8f83b8fd537a231fe75ebb7255387d089ae7924c86b36f11d4c09d27626fd8cd62dbee1662558322e3dffdb4c4816e8ee2501b8e73eda5a8caf70487ea6edede6b8337d5ff348bd874de5b9a5058b85c0659031d237abfcdc40bd6b45d4845b08adc7bdaefa8099bef8d5f6cae07abc605dc651a21b04ae53f6d89d9fac3ec696ca9508a681ca65a4524242fae4d79e40840ce54330107125a916b03459f58e4e6c3215a97e391c069926a24d9486909ef1f0c210514e2cd81cbaa6352a2de4f5829eb670a6500c83eb8c8bd5edbe4005bfb524fce3d4796d028acf27fb9df67851db5d59b2f88d97aa591d607d602dbb9bb4211abbc8641610aae237e8d47f8381dced80019a4e9b3d0e6e2a978ffeec19fe0a6077eb48d3d4d478801eb1902bb3f8552d402dd8de49cb6bb7c78600c75e3bcf53bf58e391d6484423cbfe17cf95f3b30a41b849af63ffd6a7b5aaab0ce5ac6d78519430c27415fd46f150671ee860341b9c473937c498cc9aae0cb64a73f24780b4771b1ea51816bd68f19c49747c4caf0acd418517e88e1f82cd9d2d870abb33624483670269aac3d2fe75fff726d60fe1be2fc2abc47b98eb75ef2f7f4eca0b50450ef48d71921cd10307563d120eed0416e3dcf4b198ec8424d857ab872d9de56e614e3fba275bae2c21793bebe86cdfbe822bffd2c9be6e623fcbb441e202cf8107da69cb06f93f7956a4ee88de99dc881fac8894ea5acaf4cac4c65de055017ab0dcd1adab2a22e1c2a12e73316be0f4d07b405d6bf4adda88fac3f081f8f180b403a067184b26e35860e1064d87748390e6f63217d7db40f002f85c57c125be768d68600e2c795a83a3477481a41b8392a6ae2c3a51cec2da15980c299f528e658641960ef2983ae3e30955586dd9e6a6591d81645ed451dfc14b2c648a89655af1f66067350c6fb356610469ae7b20ccd14cbb0fb04f58bfda8f28f90ebade9b6f8017094f1d467d9df73dfcc48cea0307ca833b72978e64651c8eb429f2b36adab59251452b4abaa2ecb42eaf674b12b49081b40c324d6da586212f187c51e32c42b00622b3fcb1acfecaeb603cec87a0010c199a80cf184894b0992fe709613c672ec91587afe94c637cce86a50dfe9c695c8398e963e68156537014405962d20610846691a352dad6204a33f07f175e5dbdc89aab549ef4150320084fd999a090d86affac5ac371dfe5dd595b7459b39bd78ba5bb77469da251d4f9906356667a27ac58025eed8d0ded3a69cd2a6cae52ac4dd5799802421fd8a818c5bc787da162a42f5dec2175b4ff37a543d214bdf0cc071de0b77c9902ce7dbb42ace340e64a020100b677a73bc4449655f4165f074cb1b85cd491f18f3fbeb03ca708a91fe041a46433d8d8e1693dbff6333981c243b1d412c87741aca8e790f3ebb3151e3b44870ba74c64cc5c3011d7ac138ef0bd48f197a32c31fac8d53ba54ae114119328eb9e8825555ba29e9d45cbe656eeff1b4e39600695d3911ab4f5075c3d5691b731c50adc226d3ebf50d3c38561a5d0cef2c9d16e071bb8221ab4f85a802a63b7071402f88c7cf39cfc916f8622357b3234f3761f89cfbf3aded40c512a614702ae867e197510d3bdb4ee60df96c4e51b5a338b58b07e8ee62be9822e0d166ff874b8d1f9e4486c601d9b56a26eb0b83a80704dee19d10cc05c63b95f7d1efef88177645bc30d8473983ed552926d219bd0c3dbcb0fb464649624ba7a57f5163f49f33fb79a46e7ac9797e300262a843f15f644f5230546f3c62450242fe12a79bd44c61fd946165662b0bfbcffd12deb93e0cb82dc8cc66bebf0721b94a5fa0d66381540246ff78c6225a952ab984c06c07902ed42e40fcc9151b0a59be83f454698f302f349014082ff08bcecbf0b9dea7e32b063449d573ca1b6efc812acf382ef7b7e6cd206185e063c985b8c44fe38d62d4a8d3d15228406f3abed51fe90bae3ddc283069d46e0ebd3a8bb87e4e0eb116dff6fc881e8fd0e5032e6a6494cadfd85652ed1c9c2d7aa00e18ccbde0aa3c857c50ee86975aff735f633471ab8e6db33bfcefeae661bd1bd6dfb55a9a4b4f9be01fd15e27e03fc943ccdb91a799d2eb168d9fdeecd32c19169cc0443ebb8e2f681d773efff72530f61a288cfb49c0217b9a9223ceb3798390e15fbe9475975c05f22a7c4d1990f9400a249d32eec4a5773bea0d15cc0df06d223e057b3693ac906cf632da8c9092e52718bd9f16af452dacfab22cfc2c58a3168de9914570f1035ae9b3092346db21dda270393a992cb967dc074ae2fe8b545df855b9e8b251cac7935a842bda9e850a9efb5309cc0fb83a630dcb3684fec4999ed6c4cc91aea72961420523be74711ff4c3f16a5f6ee906dae87d2bbc194b2d8b7743c157f6c8d80e6f4e377cf05810bef82e51fa5c1e442018466071f7d572cae794fab5cfbbd8e8d398c3a2823e8ce4357572a32123312d0d3976d63dc2a00b2d474ad288762e768e31ab7b4f09e7f3cfcb7a48adbdbca43d30c9bc8f67d115bc34f24eaf0318bb5e2994ff0f8b62c13f46abebdd0846da71a5d106e62266ec3e5a3f2c7166628220568807b595dc73920a0a7a9f2644db70fc53fac0a547cf6cbefe7aee975e0159fe8f413eab912925757581d2fe97cc5f19343f329b2ef081397737414a822432b5f9fa2044aebda92c1d6a065401b70c20a6867fb93e8f6f575aa9fae3e67b6fc6e0418f58731d932b3e5bd1dddbb9854a25144a334d00bea2995d7a751d40a06c37372b05cc584aaf62b90fdd95f87ff53eab367600d50eebbbb4cf04f225824086cfaca6aa82b3e3433881f7ec32cd419780ed0de6fb2234368983282fb93b9d1a6bd96c3d14aff8272328db634b02bbbc5b8957c695e469f80fc50eac333b88303d0bf29c42c13a92a58a9bf30391cfe6a0c5df40cd5b7a8637cbece9a4f251e5aa4aa2fdf883d82d2a430f06416f0372911e426620b25d8839d2ac9d73cb782194f0daddd4caa68f1ff6892981c00d6812d21ffb5fcd9b1cd187d519040968aa2d7f4ccfcc236ffe2cae8d349f39feb3fa574272a428dfbfba0a735a349188b1396b96d1fc2e86069fc797de98985bf338e495d66cbed89c2f5f2cc78ec2b880f04627e5cd49e93bb606d241149b936ab29b790e22022361c483d760e07cabdfdd204114fc3808b7bb7cf977ffe0b8c58584364571578084f1dfbb592e47e0f01c020d02aafc8c83a56299f31836574923a706e7a46861502dfbf0e9d2893a38aca39a16cec44664541e092ec489abfa28128ebd73e7bbe062515384c69c656268ef42c37632ce2db76afd09e6de7928136cfaae1b4fdeaab590617584831a7eb19af64625ec2ca635f79f50caa48524b0fcd1e08a09bcf52e231f3487ab54fc77ae44e13a966976e9e9deaf8ab9da7f804fe6290e16629c6f83110f54e5c206798033c614be334a5ee04f4ecb30f58371eeb3664eab1d00f52725992897279d21d475cefbe2345a7f1df6e916a806e7c39b651866f6c1108d00990673ca858d8af73a26a74e1f8d7818859e7d0123224f866ed0745382b2a29f5374d7c6c0fa54ddf743d89c85dc56cfab74ee786d054a5f4f1db15d85e9fe1a7fdaa3746d9e7429735f2253cb2a600b81f969c7c7e56f22b47f15aa700b3369102ea105106b96cebd1161673ae4725a4d96421833f65f76c64de5aa7957b0df8ab64583e8d5018faa1f4e0376f1d38103ac78403f65f809619c3a9fe43c6b3493d29c52d4c230a39914b1b49c627fba1612c6479205c256ef023cb52ca142c6c37391ec9f74ba334ddebce6438cdf6e99527e68585324cbf6547872366d2d0b7db30a33528a745cbc8820e52a3cf77e50a76935ff4a7f41dfc58c86ff05e24436faf28f423467105b314bd6e4edbf1a352840728e8fe4dd79ee5f770dd987eb62ba3ff5c26c9de6685afefa5a227a4a6dfc1d23ba09eefab45402b138b53b83873a3797096d4b62450c579a894be0c05b947646ef2039ed37955155b58fae377c727605979505b037a0a72e622b883cd1001f69da95ffdd143e68e1fc2cc42db37bde33184ff85c89713a722e1eba4ad292ec9ccd1c8c18674e77bf6394edd47ad635b278ec09921020507104485a6453585c385d0cd4cf611d0c6da50ec3d34eecaf3bba0ae5051a55450ae2e40c4fd0ba420b04b2e1b4d1592e8b80f92d40d42de588e719fe2b022c30a5187c64cc5c48679f680387464d3681edea585006a2e852be2266e8c4230a6bf60dd8efb0e3c1b4dcfed2844d495957ae734470d0199a0e0278f80018a39e9c82c15cb9c73a3deb2579444b414ca7061bfb4f599fe3968334c0ebde54b9a046370bb7d3227c9dd23e8edcf8b07aabf328bb164c79c6df5f0bd46a276413dee370e32da823d5e9839937e72b6480ac0439d104cadba1a8d6d0542f73f720ecdafece52fc6fa291e44b3852af376a3aceb05c2c293a2576175a3b4135ff6799a232d9c3907fcdd49e0d97e80ece0135dac08c37a16a93046d7ca3f3db91d0c28447522759017980f4d3321981ab53000fbe5293b396f6163e3ae016329bc42f6c958d648a30ed5c6e14eeef235fb74cbc24e183a0f89ee89b3c51a8b7106afefb2e406a026619793fe4c3f4bdc7d66fbf98a740afb32485ae5451b905c22bf63f9b3b42b30a3287f266559db4067d1c00d2ffee58378a44614dafed9107d97d9c3048f2bdba374ccc827f302dae2a4637354cedfc0a2d7f2d2462f5ed43f1b682e8167a2081a20741ed8bb94791526355e14a6b191aee05ef45f5d5cd83cf8fa66e5c5b4f38d7bedc90da431a285b239e13a3f9e68399da38eda883b4e443c1d557fc4cec84ce9bccf67a652e7d94c8ff57c277fb0ce233ea35929d98467ea8643cfc0464827aa26e381293c0efc049b4707416551c7d57c40d232a660b2c8d722dcd1cde8629e2b30b476c2ea9da3beec02a6b38f507230ee700f871338007cdb06d3be80450fb20f8493668183d776c902d044d4152c8a4e9ffa909d82d1b6aa27ca390706d7690b307436de72b4a81c094688397281810e98053b8c622bdc1194f54aab47fe1d3d9512733ee3e6b5b7688a90960929a0afee9580440b8964c450e3caeefcbe24c1bf6e74336ad4954f62c874a4a1ba019cae59bd1eb2ffee6174e04324348d92b588a312", 0xf61}], 0x1) sendmsg$IPVS_CMD_ZERO(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, 0x0, 0x400, 0x70bd2c, 0x25dfdbfb}, 0x14}}, 0x20000800) socket(0x1d, 0x1, 0x6) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f3, &(0x7f00000002c0)={'sit0\x00', &(0x7f00000000c0)={'tunl0\x00', 0x0, 0x40, 0x700, 0x3, 0x80001000, {{0x5, 0x4, 0x0, 0x3c, 0x14, 0x65, 0xfffd, 0x0, 0x89, 0x0, @private=0xa010101, @dev={0xac, 0x14, 0x14, 0x1b}}}}}) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), r3) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, r8, 0x4, 0x70bd2d, 0x25dfdbff, {}, [@L2TP_ATTR_UDP_ZERO_CSUM6_TX={0x5}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0x1800}, @L2TP_ATTR_LNS_MODE={0x5, 0x14, 0x6}, @L2TP_ATTR_RECV_TIMEOUT={0xc, 0x16, 0xfffffffffffffd50}]}, 0x3c}, 0x1, 0x0, 0x0, 0x801}, 0x40) 4.693587805s ago: executing program 2 (id=7380): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r1, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0xd, 0x6, 0x0, 0x0, 0x0, {0x2, 0x0, 0x6}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x44005}, 0x4) ioctl$SIOCGSTAMP(r0, 0x8906, 0x0) recvmmsg(r0, &(0x7f00000099c0)=[{{0x0, 0x0, &(0x7f0000007040)=[{&(0x7f0000006040)=""/4086, 0xff6}], 0x1}, 0x8000}], 0x1, 0x10002, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}, 0x1, 0x0, 0x0, 0x4030}, 0x0) 4.52178414s ago: executing program 4 (id=7381): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'ip6gre0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001240)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x4000000, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x1, 0x0, 0x1fc, 0x100, 0xfdfffc80, 0x0, 0x6, 0x4, 0x600, 0x73a, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x20, 0x0, 0xfffffffc, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5, 0x0, 0x0, 0x2, 0xffffffff, 0x2, 0xc00, 0x0, 0xffffffff, 0x0, 0x1ff, 0xfffffffd, 0x0, 0x0, 0x0, 0x10, 0xfffffffc, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x272, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0xfffffff7, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffc, 0x3, 0x0, 0x0, 0x0, 0xb97, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5e, 0xfffffffc, 0x8, 0x0, 0x0, 0x400004, 0x7, 0x4, 0xc, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x400, 0x0, 0x10000, 0x1, 0xfff, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x20, 0x0, 0x0, 0x135, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfffffefe, 0x0, 0x0, 0x0, 0x7, 0xfffffffc, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0xb3c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x10000000, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x400, 0xffffffff, 0x0, 0xd79, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x100, 0x0, 0x8, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x71280dd2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x8, 0x0, 0xfffefffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0x0, 0x0, 0x0, 0x6}, {0xff}, 0x0, 0x7f}}]}}]}, 0x45c}}, 0x0) 4.496197472s ago: executing program 1 (id=7382): r0 = socket$key(0xf, 0x3, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0802034000000014480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d10300000700064043b2010014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={0x2c, 0xd, 0xa, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24000801}, 0x8000) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') unshare(0x6a040000) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) r3 = socket$kcm(0x10, 0x3, 0x10) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r1, 0x4058587a, &(0x7f0000000900)={{r0, &(0x7f00000006c0)='ns/pid_for_children\x00', 0x600000, &(0x7f0000000700)={@_ha_fsid={[0xffff, 0x9]}, {0x2, 0xffc0, 0x3, 0x6a}}, 0x6, &(0x7f0000000740)={@_ha_fsid}, &(0x7f00000007c0)=0x4}, {[0x7fffffff, 0x3b7b40, 0x4, 0x4]}, 0x6cec, 0x43, &(0x7f0000000800)=""/67}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc4, 0xc4, 0x4, [@func={0xa, 0x0, 0x0, 0xc, 0x4}, @ptr={0xc, 0x0, 0x0, 0x2, 0x4}, @float={0xb, 0x0, 0x0, 0x10, 0x2}, @type_tag={0x5, 0x0, 0x0, 0x12, 0x5}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x3, 0xf}}, @func_proto={0x0, 0x7, 0x0, 0xd, 0x0, [{0xe, 0x2}, {0xd, 0x1}, {0x0, 0x2}, {0x8, 0x1}, {0x9}, {0xa, 0x2}, {0x9, 0x1}]}, @restrict={0xd, 0x0, 0x0, 0xb, 0x5}, @var={0x3, 0x0, 0x0, 0xe, 0x3, 0x1}, @func_proto={0x0, 0x2, 0x0, 0xd, 0x0, [{0x5, 0x4}, {0x6, 0x5}]}]}, {0x0, [0x30, 0x0]}}, &(0x7f0000000580)=""/228, 0xe0, 0xe4, 0x0, 0x8, 0x10000, @value=r4}, 0x28) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000780)="1400000016000b63d2b947468b041c031193e473", 0x14}], 0x1}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@private1, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@private}}, &(0x7f00000002c0)=0xe8) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=@getpolicy={0x58, 0x15, 0x1, 0x70bd26, 0x25dfdbfd, {{@in=@loopback, @in=@local, 0x4e23, 0x8, 0x4e24, 0x4, 0xa, 0x0, 0xa0, 0x0, r6, r7}, 0x86e6bb1}, [@XFRMA_IF_ID={0x8, 0x1f, 0x1}]}, 0x58}}, 0x0) 4.47489344s ago: executing program 0 (id=7383): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x64, r1, 0x1, 0xffffffff, 0x400000, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x10000000}, @L2TP_ATTR_IP6_DADDR={0x14, 0x20, @dev={0xfe, 0x80, '\x00', 0x3a}}, @L2TP_ATTR_PEER_CONN_ID={0x8}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @empty}, @L2TP_ATTR_ENCAP_TYPE={0x6, 0x2, 0xffe4}, @L2TP_ATTR_UDP_DPORT={0x6, 0x1b, 0x4e20}]}, 0x64}, 0x1, 0x620b}, 0x40cd4) 4.413481186s ago: executing program 2 (id=7385): r0 = socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x80003, 0x0) write(r0, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000fe0000000000000008000f00fd000000", 0x24) socket(0x22, 0x800, 0x7) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, &(0x7f0000000100)=[{{0x0, 0x0, 0x0, 0x1}, {0x2}}, {{0x4}, {0x2, 0x0, 0x0, 0x1}}], 0x10) setsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, &(0x7f00000004c0)=[{{0x2, 0x1}, {0x1, 0x0, 0x1}}], 0x8) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="280000000706058000000000000000000500010007e5ffffff00"/40], 0x28}}, 0x4000000) recvmmsg(r1, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x20, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) listen(0xffffffffffffffff, 0x2) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@getchain={0x74, 0x66, 0x200, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0xfff3, 0xd}, {0xffe0, 0xffff}, {0xfff2, 0x10}}, [{0x8, 0xb, 0xe9}, {0x8, 0xb, 0xdb}, {0x8, 0xb, 0x4}, {0x8, 0xb, 0x5}, {0x8, 0xb, 0x7}, {0x8, 0xb, 0x6}, {0x8, 0xb, 0x2}, {0x8, 0xb, 0x7fff}, {0x8, 0xb, 0x6}, {0x8, 0xb, 0x8002}]}, 0x74}}, 0x20000000) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x90, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0xffff, 0x5}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x8, 0x8, 0x8, 0xa, 0x3}, 0x1}}, @TCA_IFE_SMAC={0xa, 0x4, @broadcast}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x90}}, 0x800) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r10 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r10, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r11, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\r', 0x1}], 0x1}, 0x4) sendmsg$NFT_BATCH(r3, &(0x7f0000009ac0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000009a80)={&(0x7f0000016cc0)=ANY=[@ANYBLOB="140000001000010100000000000000000200000a64000000060a01020000000000000000030000054400800a0001006c696d69740000000400028010000180090001007866726d000000001cef0080090001006d617371000000000c000280080003400000000f04000480080009400000000314000000030a0103000000000000000007000003140000000e0a0102000000000000000001000002140000001100010000000000000000000000000a"], 0xb4}, 0x1, 0x0, 0x0, 0x40000}, 0x5) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000180)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=ANY=[@ANYRES32=r1], &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) socket$nl_route(0x10, 0x3, 0x0) 4.411227518s ago: executing program 4 (id=7386): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Qzo9\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fffffffffffffffffeffffff00"/28], 0x1b) (async) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Qzo9\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fffffffffffffffffeffffff00"/28], 0x1b) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xd, 0x12, r1, 0x1f4d2000) (async) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xd, 0x12, r1, 0x1f4d2000) close(r1) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f00000001c0)=0x2) bpf$MAP_LOOKUP_ELEM(0x5, &(0x7f00000000c0)={r0, &(0x7f0000000000), &(0x7f0000000040)=""/73}, 0x70) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r4 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=@gettaction={0x20, 0x5a, 0x1, 0x0, 0x1, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}]}, 0x20}}, 0x20000450) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000140)=ANY=[@ANYBLOB="42141c7fe7d66d167f81b73bbff8b02ad7a0c6e253064596aba17ae56838b3ef1a9f15937d90a779464c41d4b9aa70a75ff40d76aca6", @ANYRES8=r4, @ANYBLOB="01e52bbd7008000300", @ANYRES32=r3, @ANYBLOB="08002600fd16000008002700030000000800a10000000000"], 0x34}, 0x1, 0x0, 0x0, 0x2404c091}, 0x40044) (async) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000140)=ANY=[@ANYBLOB="42141c7fe7d66d167f81b73bbff8b02ad7a0c6e253064596aba17ae56838b3ef1a9f15937d90a779464c41d4b9aa70a75ff40d76aca6", @ANYRES8=r4, @ANYBLOB="01e52bbd7008000300", @ANYRES32=r3, @ANYBLOB="08002600fd16000008002700030000000800a10000000000"], 0x34}, 0x1, 0x0, 0x0, 0x2404c091}, 0x40044) setsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000000c0)={0x0, 0xfffffffe}, 0x8) 4.34127641s ago: executing program 0 (id=7387): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=@newtaction={0x148, 0x30, 0x871a15abc695fb3d, 0x0, 0x0, {}, [{0x134, 0x1, [@m_tunnel_key={0x130, 0x1, 0x0, 0x0, {{0xf}, {0x38, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0xc, @broadcast}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @loopback}, @TCA_TUNNEL_KEY_ENC_IPV4_DST={0x8, 0x4, @broadcast}]}, {0xcb, 0x6, "213eb6f9b78a49ca9bc1fd5e80f83ca1288618cf0f292bf07e2aef72ec19084a5b5a9e2feaefe20094c5bca0f14562e1e266bd6799374664b67696cfb0e55d13e446183049cd5ffef029eaef4a4c51ceac6756453e66a660d052705b9295a0f2ec40e2ec2c8a0b03974389c307620ea32d9e4ef21507d98a5879cf3dd3e4fa93cc58c11f0bcabc85f014bfbf1496838eb72a5182ddfe3585c14f07a15ee7a45f58a4d34fe6442071a941cde1e945dd2392c84b96104957447a882cb06811777afa806373128cb9"}, {0xc}, {0xc}}}]}]}, 0x148}}, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x9, 0x3032, 0xffffffffffffffff, 0x1000) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'pimreg\x00', 0x5005}) r3 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r3, &(0x7f0000000400)={0x18, 0x0, {0x4, @link_local, 'lo\x00'}}, 0x1e) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$kcm(0x29, 0x7, 0x0) sendmsg$kcm(r5, &(0x7f0000000a80)={&(0x7f0000000740)=@un=@abs={0x1, 0x0, 0x4e22}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000800)="37b00b0753bac0c8e4c88918f84a5c21d4551087a8cdeb436f32bbabe03040401608c3cdebd4130542dcccff020c9316945170b92955c3499b3120b026ad26bc074a49f38e200a56c90bebeafeedf9d453cf66828c108da09d58d4e776cc2b41c7ed7987f0675434db03aa61bc68b69e5af0f246f839a69309419ecb7cab905bb64638a940a37d88450af9ed728d5eba32133078e7e81e062a528cf42b20eca50b075fb0af038af2d1675711156f2c675e142e761342b2448dcd955eb0bd947c0b2495d98fd89ce7fa8a30b7d934bd8c94cd45e9089feb388ff9d8e135", 0xdd}, {&(0x7f0000000900)="8099dece75c59a340cc78d3d12cb1d8b34f99ca526ddd2b7ca4caf4da85966e03f65ba45a25604b170f3411692a86191acaf338f5721af9e5e73ce337c40c887716aeb9b994edd9de91bfe9a92d94cbd038c98d44befb1a5b32ce577f73d1760ab67e35b142688087686f225b0db070fa44c4723a77d43e0906c2032a0721e002f4f7aedb12a6c0f03d61fb2672e87693e53f443ce1c4c5ffbd471364f9d915e288eb068102861392677db71b46c56c1d6678ae24194468529d463988a1b14b11bb17c8eddfdd11040c82792ac129ebfe3ed8fbef5e09307eb", 0xd9}], 0x2, &(0x7f0000000a40)=[{0x18, 0x117, 0x9, "313ba0f7"}, {0x18, 0x88, 0x101, '\a'}], 0x30}, 0x4800) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000ac0)={0xe, 0x4, &(0x7f0000000d80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be2566cd072f5b89c3043c47c896ce0bce66a245ad98a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb3c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34700de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0d18a93ee341ab59016f81860324b8003"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1200000004000000040000001200000000000000", @ANYRES32, @ANYBLOB="0000000000000613", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r7, r6, 0x26}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000000c0)={r7, &(0x7f0000000180), &(0x7f0000000040)=@udp=r4}, 0x20) close(0x3) socket$netlink(0x10, 0x3, 0x7) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="300000001000018000000000e2ffffffffffffff", @ANYRES32=0x0, @ANYBLOB="0000000000000000080004000006000008001b0000000000"], 0x30}}, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00"/13], 0x48) close(r1) ioctl$FIBMAP(r8, 0x1, &(0x7f0000000080)=0x79) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000400000002"], 0x50) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{}, &(0x7f00000007c0), &(0x7f0000000640)=r10}, 0x20) r11 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x10, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000002000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000060000007b8af8ff00000000bca2000000000000a6020000f8ffffffb7030000eaffffffb704000000000000850000003300000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r10, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r11, 0x2000012, 0x0, 0x0, &(0x7f0000000c40), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) 4.238939356s ago: executing program 3 (id=7388): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c000000020000000000000002000084ffffffff000000000300000000000000000000000200000000000000000000000000000a030000000000000000000002"], 0x0, 0x56, 0x12}, 0x20) 4.238830832s ago: executing program 4 (id=7389): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000005d00)=ANY=[@ANYBLOB="180100002f00010000000000fcdbdf250701f2800c0002000aac0f000000000014000100ff02000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bfafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb42f9621dc08c029d1608a46cf26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f00ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f170400e90000"], 0x118}], 0x1, 0x0, 0x0, 0x1}, 0x0) 4.113677565s ago: executing program 3 (id=7390): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x15}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0xa}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc8}}, 0x0) 4.0930644s ago: executing program 1 (id=7391): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0}, 0x1, 0x0, 0x0, 0x24000840}, 0x24044041) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$tipc(0x1e, 0x5, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) sendmsg$NFT_BATCH(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000b00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x403, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x14, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @dup_ipv4={{0x8}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_USERDATA={0x6, 0x7, 0x1, 0x0, "6214"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x20040040) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000140)={0x10000042, 0x0, 0x2}, 0x10) r4 = socket(0x10, 0x3, 0x8000000) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000e40)=@newqdisc={0x58, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x0, 0x1, 0xe, 0x1, 0x0, 0x7ff, 0x7fffffff}}, {0x4}}]}]}, 0x58}}, 0x0) r5 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r5, 0x0, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r6, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x1, 0x803, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) syz_open_procfs$namespace(0x0, &(0x7f0000000340)='ns/pid_for_children\x00') ioctl$BTRFS_IOC_BALANCE_PROGRESS(r7, 0x84009422, &(0x7f0000000a00)={0x0, 0x0, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}}) r10 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCDELRT(r10, 0x890c, &(0x7f0000000000)={0x5e38b282e414372c, @default, @netrom={'nr', 0x0}, 0x12, 'syz0\x00', @bcast, 0x2000045, 0x4, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=@delneigh={0x30, 0x1a, 0x1, 0x0, 0xfffffffd, {0x1c}, [@NDA_DST_IPV6={0x14, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}]}, 0x30}, 0x1, 0x0, 0x0, 0xc0}, 0x4004840) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="440000001000030428bd78000000000000000000", @ANYRES32=0x0, @ANYBLOB="46060900000000001c00128009000100766c616e000000000c000280060001000100000008000500", @ANYRES32=r9, @ANYBLOB="428c266457cf742057b11740ebd60b2e04026508463b33dbd88d183e9fce352ce557d3448b9f089b2eaa1a5846a64ece20a0040be8319666aeff32783e374919790b0c0b2334c23b81ce84d143c99fd201d1951582095810bfe386f05f7954fa"], 0x44}, 0x1, 0x0, 0x0, 0x600}, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB='8\x00', @ANYRES16, @ANYBLOB="010000000000000000003900000001000080", @ANYRES32, @ANYBLOB="1c005a801800018014000300000000000000080001"], 0x38}}, 0x0) sendmsg$NL80211_CMD_UPDATE_CONNECT_PARAMS(r8, &(0x7f0000002680)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000002640)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="40170000", @ANYRES16=0x0, @ANYBLOB="04002bbd7000fddbdf257a00000008000300", @ANYRES32=0x0, @ANYBLOB="58002a0076066a072d0001007107ff00ff01000248054104090429b240c0d05368b3792b772346cae5cb81dd6b974531af136674d6777b1253fe477852f057ca875f8a6673cda677e4dc316e741645d61a7038c5e97c59df6b00fc001ec85f594ff4b40b4bd550ccfa938e8f4616273d985f7c3bf9ad1ecfc9ec18a59820803a69f27973865b515418a0bb85f8b085721303011a391993116ad7386ec01bc83827f056de5738d29d16bba63225427bb9c0310a16404d8b45ada18363dbebf5ab7481e3001200f900fb40569835a1caae5e3a39c999df00000d00f900d3e200ecc42a22f1200000004b00fc00eeb925a5ed5dd237c8aee03afa093d1905b458274658b2164f5f2181bb218514ffd525eb506963bc13bcb40c81369da28f6f0087292c9da1cbec4941de24bbefaef89219ce3c33000e00f900ec4b4d59a1b68b45011f00008f00fa0002e4a3efb6d8bc9f081cf59798e8c37820652c585fefae1175d3b98bb3cc4352f6899f17ed7f226d4f3887779122a7f2fcbc4b66ba83d70cc2f986a6212ca0526d053139be38e25a568ad92bceff620aa9e69aaf77e50e69714517853982d19320eda90c47a92b98616a215f9f5f88f4f4cb91607cdb5f4596789ccf2ee919be261c4857d407edfe8d02d7000600f9007bee00007e012a00bd06080211000001030100bd06080211000001250300aeff8c18b00801bc88b4675408f1cf289de0b6ac6d4bbdd5de797250060206008456010600080211000000060000004000000802110000000ec60000020040ffffffffffff07000000080211000001320000080211000000cfd80000420000080211000000fe0900000500000802110000010600000002002d1a20001f030000000000000006000700080000000004a70800000cddce18b9b58982df78967c081af80ac06899a0395e5e2a60444c8f15fa247850824006484d623aa7bb1ee577cbc8cdfdd9348c10a6edb13328e938dc64f0890c16a924dd364ee10f166b3419b23be90ccd9504c355774b32935b8dbfed1d977aa6dd568faecd9690ae0cf7cafa4dcdef9baea0dff9d377f3ab6fbbc7965ed2c59d0372de86f9221a22e2efdb80a44cfa8f00a343c011211abe84a3a4a274af8bcf3c2aa7dc9bb468483009707dc808d8ed8056103fa253bcd2d7687c974bcd32c15f3804f90d55e7227dc303b7e22c1f00003e00fa000b73dae33a2090975b28e03fe079fb973478236904aff529c93d9b20ea8c5582c4ad9704d952795b68925d99fbb710e015e92ca8d1fe340925ef00003500fc00565ea4e679601090f9ea6a34594b0836a8ed7728766545d8efe1c9fa3c19f49a23977e2a0d44649d2cc24e4a36c2350908000000cb00fa007b6a4b66fdd9a4b3748a044c13906239ab75973347257d94a76bcbfe7866a0891cdabc05764d9bc8836a0f97720cb27961f8487aa19b8187de47e4a325ec9f4fa1ed3ae3288bf445dff0015b612bae0b49624e48661d1fc37bbbba489e4afcd0fda82f10b14fb3251b73b5571f75be837c7ec43c0f817ef69b3040bcb0fffdc74fe97e601d273e094b86949aab3cf6bc1f419d5a741ea09fa4b38378adc7d9a68ae3de498d45502f12d268c22ba2d5c4e839a091f2274dbd775ffb43c310e2c452f3e188854cf300f700fa00de59f6824a39c4709f4446a85e2824f1bd85086b2de7d55a90da920136a4a2ef95289d60cc1dcf980458221e5a1baed71dc28bc9597451ff29dd1ae75355aa4b9148bfb70d83041b875c832c0a060d670c9a22a14416d092a54fded8f3fbe1f89ddef00c5ce00453d9874283a24f87633adab053958458208e4db5b0c880c1081575ac664a11171a766c035c4b241b0e9d15bad8df66129ede695257d6487936bce17677dafebebe7ee543d4276b7f526c42ad1e2b1ea435e2f871a20bec07520fd1c365525b5ce71749592c2e756f1b5089f14b20e4e01a863fbb5e2956281b22776576c60e862528f9b97743dcd93ff3abae000410fa00904ec877db0ede1585b22be68292a1da4533ab7d51d50b7987b94fc5ba52477e521b380b5f124d1d63940e27b5d48c72c7795a0ea79e8b52669e673dba245adae6ccf220872a961df45bb60e4cb73abd2fd17ffd7b4ac551e5a602a767b6ac8eda8aafec87c71c2b1c8caf4a2adeae8686c56b23585ee3b7dfee26db416ccd22661b207994a79f77dd16e3cf8ee3c456bde09fb72b70dcf116b1b10ff1be2ae18d609838ab70d7c0307013ae371b7210be22d5c1dfd646fe5033e0740b5a4669aee3bede8c04e6a3a566a6c03fb76ad7b987ae12f3f25e72b19f3584e8dc5d29492d89d79bc95cd3539a684bfe3a49bb771871f57218f2740da5d7bfd5d84e142d2c9bfb4efd76282c77a59e314f8b163ad00b7976d9d62dfe0413490dc09ced60dace57ba47922aba2413c4e35bf2eb31d594e6d338b8d80141dd9b6c05039f45303b86b07d63748b0630596507e2d13ae10fb5306aefe910d6e43c5a40daefa6a96a72dcd440489c1e6a7346abfd55ec02afa1aa0ccf885804610adb0571afbd2a685ab980fb4483fdbebee09a8fec7d81c9f896563369d15167e3f96cfdaba9138aeb49732f93fe9ab5cc974d4157ec946eff44469378054641a55387f94a03ba03cd5fbec6525a3138334d939dca0bfd6a211966b53a392abfc64f8d6c1a9f3948b727699ec4bdc2b650fb55dfb9756e499875b08435b2baac072a678da192c092a7b1548e694f0b64953ebb1c223b98aced6890aa95544b1bdb812ac12d2126d85e88489d3b7f5961fa61571ac91bd649eaa84339de4b9f042e4a2317511588fdb0084a9d2f9f0fc702c465bf7ae221097b7a5c2b16dd1ab602eedf1072200259ebc40e7f759b3cbc67cefb1a20235127bb48e74dc801ece425c58d295070240e0eb3f72a321c662b17de68773829173810f944d261e3eb3b78e33a7476b86fa251232d7428c5875fb49a33292d7c291106350fc5143900411c8343dc1be29c81f5c66171b005b4916c84010d80106edd5b2c4276a640810d79a01bb603e52c77ffc9b8dd92501dfa4eaa13e32afa3ff07327045bb5766ed2a80e25366c1a0da6f4084c71b4a5c568e4239c774cc36781717df752df9d308070f08525ca05fa7738f24f3450fcfa0b5b92eb027ab4d039cc50e6bb4edbb5de49d6be8163f7a5ade5b304168c78b3eb036994de8e6a867d70c8fabfabd576ce9ddb127aeca67d1d5778f185588d83b8e8527af64b432b7bd0c59b3c7d79ae86c9276be97bfaf2a9e103db1208ec15b0c880b8795b25050ae1466cd02b73f902981ce107bc69649de98d5cb85d681344a080c60caf58c824d2bb121685feaac3b9f47523d0d6e69ceedb76576232a47488c88198c81e913d2b0295e9cab466be6d71f5b1caaa78c997dc2787faa3fe3fed1330073385af250e56fc22afe3b701f4baa8be8d3e852a39e65698594f2c3b69f6507c2301880cea3a9cc576fbe76bbb6b1de77a06c735e130444aad11d564ce048d4f30c8701c909fa7896e7bbbc15ae8ff06a2b3fd876036eeab78119206d99eb678f6d1403e22953839c94625bb156af635704efc2e2fc456640eb6390b0d58f834b585536b86e82386d9a3a85e3a1313a717721b89041862d6bcd7daa9e7214134055144dc51253cb95da7f143fbeb97098ee423b5122ce49c6f3a3bfcc6fedc5beade72df1846b87296771e15338091382db1b1b4e9e13b87b1c1ba1192b50e954621fda2e5d5293e584e17c93915f1d109ed2c9ff1232cc70530e07e9cd5e82ddae1e388c2dbaf896ae5de77232888a6c0a22700483bcb24e736436b9b27e4d53bb7508b6048ac6ad15a9149bfadd26c5fbf827dd34bab4cca2a8c53efbd799df7e9e3236124a6eb8b2e1e4e05e9ba91355d4070e5497d39d98c76096c6ecc2a00e1a470ae6591a322e7e33a14fed42393047834466f07eddf8eae09deb1e142f9d7d06eac271736023f37a9fc927ec23aaffc8c5dd51d7483d4af04f125158d5ce7abe8d9ead3b0b171b52380a6a2a52babfe2990563cc9321192f4ac90c926731562947d0deb8f71e509d8d8d978c80268fbca5809cb11ff19300767ad76dc7b582d8279841db8015f478439fe9f899038cbdfa6c0e8312b6dffdf4af18f4df70ef80ee65ef3573bff33799b7edda5973f7fcd161f940cf17e2a7ef8e93437ff88c7fabc5a52502391fafc60114ab4ab22543e66d69f0e9d76ce191141469b8af0fdad806835760131e9f9c4e46f43486fb37aff89aba08e8a6e0c6235f1ed16e4824ec7e26b2c1d918d6ac4142d5969850bdd5704fdebf34e234d30657bf8241b11626ee3347de8c6f96a75fb985c48c00cb19ef072c448d7a305ad89e1ae8babcb8d2b045e8cf03e960aecf02bb741596e0c1ec8964cc143778ec1361f99776be921bfc890050f58cca85ea3c639746f439158d472fa46aaf11631d00d2e4e55d381b27c8fa5b5a8776a1b7b548d4e97e2329adb5ad990db092fa67b32a4dbd5141d05e37a45d91cb1fbcae2fb1e311bc30a3acafa629277fbfa7777dac883091f9714cf912b8410935dfe892261e9b03cb0dcf7e20412dda28db26ea691d6a9c439139015f85db43f082e03124f88b78feed1ac303ba7e2af85cfad124a252cf87556ae1215856d019134eadcb1903de4ca8a9207526260fd2992a8e96810b9116b26036fcf468497e3fa03d1dbb7a699e4ae1a30ffa8751ae828ee998f462ce36ed644dbfdf36626a8ef681a160ccb1cb1d7a83e381867480278b81b2c98e5c91d71b06bb934a57e8c8d9659b29eefa03091c7b66f94be61ab5940e6bf1145ddefb9700a74397d54eda8af9348de4ae13157d0f0127a64ac68903009b175fa80bc1d6e8c0c4b46ff89d548205e50d9fea57441acad576c115d8b93086e3393af4018265a6b489b4fd3d3f03fdc307ed378a0e0e09144b518fb0a75669dba1732b534f9b0e3645a62dc8b51f837c9a1896bfafcc240655c9389fabe500a5e80c6754cc4046c3ada5b4a03ac52a989a5f90e94ebbb0393afecf97b6922db395738a125dde32ae45d5d5d3adc5c958a64f77842c5110d45149da924409e5ccbb4541a4de3913231916fdfcd9832e1fff9a7e3f781e46a87617388dde05631fb8e1ae39343d45cc9a5d10c16a51284b2a4c320216e9b5e0758f2aff2098e7eceaf520f13c6449e368e29d7a7f29d2f7f1ef77ce02b34524cdc8302778a5e1ef4aad80d36b55ce051106e9959bce84a0ae4069f84b3bb4d50c3d4c1bff4e298ca39fbbe6d0447bc0523146f0152cd7dde772507158b20a01639b281a4e11e8d32040086f43086953abc2033775f02b5359c49cd918fd340bf6d8a0857bef6d30cdebf8e4e74419b5d16585e6bf5dc8225218b0040462796e336d4d3c2dd75d5b3a93c0edd26164014270ceb839dcb0b8c7607149808e1f60887eb10cce16e323e4f9e0b0858be6ec1841dccac379026135ba326c67e1e3814e1163e8cdfe2570df76efe9209976ad789f3a773ba92e66fe059a5769b9637bdc7cf64b5ff0e233dc310e924913ee1e29f3bedb2c3e446256794002a43c5ec14517752c54082e35b638ccdc0bb2828b97285726a92a16aea105bb0b575ee74479a12e75174e88130d401774ff06cf0f2cf50625819a680876a698d852374db7b67cf6eb0e711dfc2bc67de781f00591e6a275b313729fcd814365757e44300f9e625b163801178afb658663c1d9c1f86bef65f51781c46ad0b8433cffb2198086e74e4f273641016d462a4269ab27032330aa7c301baa6548621ddeebdb85bf62c231760ea3a8522bf2c3b0e48eb45516b637761c41838d4c7ba9807ca9823cb550e178afc41eea7dad0efebcbeb5912702b1aebdf886cfc070603e94e0d2b19c3836e119595cc3ea7817f8259c67a951b24094011949987353c53af359f83f680485f2e511faffa7a81e2e4bb76f77e833044eaf72182dc0347844ea525b0892dfb6353c1c39cf904f3eff389d1b71a19a7298d64f99b26f4f523e6eb4f7448e57e426be6977530d9797d53cac2aa6aa43e76614d1791feba38480aad724c36a16d9ee68f561ea6b1216c0db3c5951168807e6d4ccb1b5cb555dd1af76bece25b80b6543410e67fa9c9f13717b726bc1dde7636c0f142873cdc772f473ac8a9e5b5ae89e28fedab550d150e7453f218175f9a77639f70226c8dbdcbe189abb2db74ba35579825179356090c4966f53a24b3790d667f671032db11361261cf8fe644edf860b53b153916e32a008f215326af060bdca0224245bb19876350ce02802bf0ebaf43d3e8264045ab6da26008144cf496be78330b9da0486102f38bd894c2bd23cc4f2f7a4b01d98ee60ffd397cd46f1de5a7327c52a96a8a89c08f7fea7d5c299b87375f36dd19b425cd321383d23105502dbcdcc5daa3c119b7d6fce1f604b6e43073f58a87f80332d52cbfbb13d83187fa402e0261d7e1fb280d302450d2f356cdfcef5d2da5cd87e85dbc33bdd8cffbb59751e9364f15abf3328e8c8c8e5e479fb4ffef1b549730a15833d041e6e5b2de6802e1ad64fa51754dd93dc8c31b88db4e267bd2c9da6700106aa93ac532529e45309bc626042ee26e63af08a5ed7176953b72d602abe8829402998e08efb3070ac2371704a1e25c854e773e0ff14662c3e16e81ca6273a9a13a65f78db504e7189ba3be4810449170b6162cd6f1d8ad1f0ddb8d8b144c5c05fb03afae9cac384c37804feb279c1129c1bcebe604b3b1e6dafdd12cc3510455aaa3f4be6dbd340f6c9b8a8d4f53a8c4b25be30083250028365ea8be5e3710355a2c25e0fcd8660d763c0fd69e29e35f59bb1f6699f424f34522f15560b3b34227d74dde36ecf1f4f0e58014901cfb30433a7529bf6770e571ca668a1ad8565dd7cc02eddc75d99d6e373725010a7cd7f9a16f27763cd1851a244eba18bfe786b559bb350fe6a438047c58edc14654e36bea5f8ffa42381deffa8dfe3dbc559f8c41253e65dfb4fed218ea0649e6b02c7ab74817ea7fa0b25fd04c2579f4d4749cad11b57390b685306f2c4dabec1e5c7cae202ce44d29feabf1accb92763acb946a90393c703fbd52e9ecc39e751bebec40f1a80f52e84e854d6379ecb6bd644f70c3f6c2a5d5f42c95175990141f06d6d593df6db1911d35ade036faf3b4b0d8fe507abffb590bc6d7a709c151c2e8ca1de949ad4c07e05878159dbcad271cdb2e2a3c4c4127a046ef8c7cde2142322ca5347679bd23512acefe35395d4f0fb4156c7b7aec234dab4c6e27a3d1af523eced1b8d20ce8ce28f6303b58d6363c930d79a0ae717cff877bfb30b640cd17ab062baf8cdde3949532212674a9a3101629c22f8aafda8a06254aa2aa30eee32b18d083860593b3eeed6c8136ea3ee4fdbb9e2ecac9e8a3930c354777ef41adb164702d3e4edfdd00023807b4acfc8806b773537f829259997217b1f974e59e7a9c107eabb3067b3029eb98ac210a1e857b48e15b165caa859c52055b493c0cdc8e80b43c2569b763ae5f7acc39b5596bcd6249e355ca2cc1f3f5f07a8b636bc704d441526c1b67e75362bb561d57beec79cb86f6e6983e61a7643d39ced6e8d9c7142feffe28019e181b50cde377edd62063a234aecc90ecb55b4d89e121016b9816efa17a145aac530acd5fb3060a7f64aece90381a5f0a38ccce653b3690f8b2741395d365c12279d05ce36a83f4eff9e4619c7ed1d3791646b1436fdae74b8c538196fb954c546daf647b018dc6b02d06acf85fa301eb1200f900856ce2156a9b4e02c7e1c74d075e00008400fa0014e287e35959effa4d0890687265466d96b8a081542671546d4f1371e0a0db765d5fb2d8931a2f347e5d4d84d6ce923261fcc8bc7bd2c1cbf92fbdd9b9ed43f345f3aa99268ffb0b66ea9631088cfa47960d53761e6dbf8767b457f7d6573e11b292296d50d4170031720944fede22dad9de341d8cc42050f4f73326599cbdd70900f900ab64ede94e000000ca00fa00cc013dcdeb55413d92fa00bb12d5eafa85da31535dcc1f219cd02769ae5c1a981972d71fd5897c8c5712be23efc055bc73abb0aff6af7e269db099236f5e1fc0cffca1774b800f927e8ffcb707cd6eba484098c39553352a54cc9482e6d8b9e12dccf81b616a45c2f05646ff0c9186e69bd67dc3117d8dd47621fd321d275df7761c157b8064a3f119a7913595d11d7042a7a79ec91b855c323e8ab023617cf013a0c6009c661ebd414a3f74fc5dfc499f5bc9b01939ba3bdd6f3e291b824224d1ab9c5f96af00000900f9007aca2866ed0000000b00f900d294e6d5e9c5b900"], 0x1740}}, 0x48011) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@newlink={0x54, 0x10, 0xffffff1f, 0x8, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4408}, [@IFLA_LINKINFO={0x2c, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GENEVE_TTL={0x5, 0x3, 0x6c}, @IFLA_GENEVE_TTL_INHERIT={0x5, 0xc, 0x1}, @IFLA_GENEVE_PORT={0x6, 0x5, 0x4e20}]}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x54}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 4.074638459s ago: executing program 4 (id=7392): r0 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_buf(r0, 0x107, 0x2, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x10) (async) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r6) r7 = socket$unix(0x1, 0x1, 0x0) (async, rerun: 64) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (rerun: 64) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r9 = socket$kcm(0x11, 0x3, 0x0) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x408a82, 0x0) close(r10) (async) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) (async, rerun: 64) sendmsg$nl_route_sched(r11, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000006c0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r12, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0xfffffff9}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) (async, rerun: 64) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) (rerun: 64) sendmsg$kcm(r9, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r13, 0x3a}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000840)='\'', 0x30}], 0x1}, 0x894) (async, rerun: 64) r14 = socket$unix(0x1, 0x2, 0x0) (rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (rerun: 64) 4.00994098s ago: executing program 3 (id=7393): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000000), 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4c094}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)={0x1c, r2, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_ADDR={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'geneve1\x00'}) writev(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}, {&(0x7f00000005c0)="1a9ef439feffff090000000003001000", 0x10}], 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=@newtfilter={0x58, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r7, {0x8, 0x7}, {}, {0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x28, 0x2, [@TCA_FLOWER_KEY_ARP_THA={0xa, 0x41, @remote}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x22044028}, 0x20000060) 3.998362848s ago: executing program 0 (id=7394): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000004c0)={&(0x7f00000003c0)={0xac, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @handle=@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}, @handle=@pci={{0x8}, {0x11}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x1}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @DEVLINK_ATTR_PORT_INDEX={0x8}, @DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}]}, 0xac}, 0x1, 0x0, 0x0, 0x91}, 0x20004801) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, 0x2, 0x7}, {0x0, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x40}, 0x8, 0x32}, 0x0, @in=@private=0xa0100fe, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x1c) 894.008078ms ago: executing program 0 (id=7395): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a84000000060a0b040000000000000073797a30000000000900020073797a320000000058000480540001800a000100696e6e65720000004400028008000240000000c208002d5be1eae3f660fe600240000000fd0800044000000034080004400000002b08e85a8912fd9cdfd95b098f6b21950240000000e81f080001400000000008005b140000001100010000000000000000000700000a000000000000000066b1000028bd9eff7d9775dd02ba1a0882572d9afdc593819d0d0db4f18539de199384a962d2025a526763be2e156b44bf8dc54c6994016dedea4740b271a43ad1b17f89dfc46071f81d82e9094e1d6841dc3950b21c69a1bc8de9e740fd06"], 0xac}, 0x1, 0x0, 0x0, 0x40884}, 0xc000) (async) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106-gcm-aesni\x00'}, 0x58) r2 = socket$netlink(0x10, 0x3, 0x0) (async) r3 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f0000000100)={0x20000014}) (async) socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) (async) close(0x4) (async) syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/ipc\x00') (async) unshare(0x6a040000) (async) socket(0xa, 0x5, 0x0) (async) socket$inet(0x2, 0x4000000000000001, 0x0) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) (async) r7 = socket$phonet(0x23, 0x2, 0x1) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000010c0)=ANY=[@ANYBLOB="3401000010000100"/20, @ANYRES32=r7, @ANYBLOB="000000000000000014011a80400002803c000180080021000000000008001800000000000800030000000000080009000000000008000c0000000000080012000000000008001f00000000006c000a80140007"], 0x134}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000000)={0x80000001}) (async) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r8, &(0x7f0000000040)={0x20000014}) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@ipv4_deladdr={0x18, 0x15, 0x1}, 0x18}}, 0x0) (async) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000080)={'vlan1\x00', {0x2, 0x4e24, @private=0xa010101}}) (async) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) (async) r9 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000680)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x34, r9, 0x800, 0x70bd2d, 0x25dfdbfb, {{}, {}, {0x18, 0x17, {0xa, 0xd41f, @udp='udp:syz1\x00'}}}, ["", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x20000040}, 0xc000) (async) accept4(r1, 0x0, 0x0, 0x800) sendmsg$IPCTNL_MSG_CT_DELETE(r0, &(0x7f00000005c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x410004}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)={0x194, 0x2, 0x1, 0x801, 0x0, 0x0, {0x1, 0x0, 0x3}, [@CTA_NAT_SRC={0xcc, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @local}, @CTA_NAT_V6_MINIP={0x14, 0x4, @empty}, @CTA_NAT_V4_MINIP={0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x19}}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @CTA_NAT_V6_MINIP={0x14, 0x4, @private0={0xfc, 0x0, '\x00', 0x1}}, @CTA_NAT_V6_MINIP={0x14, 0x4, @dev={0xfe, 0x80, '\x00', 0xe}}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @remote}, @CTA_NAT_PROTO={0x2c, 0x3, 0x0, 0x1, [@CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e23}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e21}, @CTA_PROTONAT_PORT_MAX={0x6, 0x2, 0x4e22}, @CTA_PROTONAT_PORT_MIN={0x6, 0x1, 0x4e23}]}]}, @CTA_NAT_SRC={0x40, 0x6, 0x0, 0x1, [@CTA_NAT_V4_MINIP={0x8, 0x1, @rand_addr=0x64010102}, @CTA_NAT_V4_MINIP={0x8, 0x1, @empty}, @CTA_NAT_V6_MAXIP={0x14, 0x5, @private1}, @CTA_NAT_V4_MINIP={0x8, 0x1, @loopback}, @CTA_NAT_V4_MINIP={0x8, 0x1, @local}, @CTA_NAT_V4_MAXIP={0x8, 0x2, @broadcast}]}, @CTA_LABELS={0x2c, 0x16, 0x1, 0x0, [0xef4, 0x3, 0xd, 0x3, 0x3, 0x6, 0x8, 0x4, 0x6, 0x8]}, @CTA_ID={0x8, 0xc, 0x1, 0x0, 0x2}, @CTA_LABELS={0x8, 0x16, 0x1, 0x0, [0xffff]}, @CTA_LABELS_MASK={0x24, 0x17, [0x810000, 0xb, 0xb, 0x0, 0xb, 0x6, 0xe7, 0x10000]}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x7}, @CTA_FILTER={0xc, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x40}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000005}, 0x20008010) 872.523817ms ago: executing program 3 (id=7396): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'ip6gre0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001240)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x4000000, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x1, 0x0, 0x1fc, 0x100, 0xfdfffc80, 0x0, 0x6, 0x4, 0x1700, 0x73a, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x20, 0x0, 0xfffffffc, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x5, 0x0, 0x0, 0x2, 0xffffffff, 0x2, 0xc00, 0x0, 0xffffffff, 0x0, 0x1ff, 0xfffffffd, 0x0, 0x0, 0x0, 0x10, 0xfffffffc, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x272, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1, 0xfffffff7, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffc, 0x3, 0x0, 0x0, 0x0, 0xb97, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5e, 0xfffffffc, 0x8, 0x0, 0x0, 0x400004, 0x7, 0x4, 0xc, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x400, 0x0, 0x10000, 0x1, 0xfff, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x20, 0x0, 0x0, 0x135, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xfffffefe, 0x0, 0x0, 0x0, 0x7, 0xfffffffc, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0xb3c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x10000000, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x400, 0xffffffff, 0x0, 0xd79, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x100, 0x0, 0x8, 0xfffffffd, 0xffffffff, 0x0, 0x0, 0x71280dd2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x8, 0x0, 0xfffefffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0x0, 0x0, 0x0, 0x6}, {0xff}, 0x0, 0x7f}}]}}]}, 0x45c}}, 0x0) 864.465026ms ago: executing program 1 (id=7397): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], 0x0, 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000500)={r1, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f00000004c0)='./cgroup/cgroup.procs\x00', &(0x7f00000002c0)=[0x1], &(0x7f0000000700), 0x200000000000, 0x1}}, 0x40) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'hash\x00', 0x0, 0x0, 'wp384-generic\x00'}, 0x58) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x4040004) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) write$tun(r3, &(0x7f0000000200)=ANY=[@ANYBLOB="00000000bbbbbbbbbbbbbbbbbbbbbbbb810048000800460b005c00660000fc2f9078ffffffffffffffff440435300420880b0000000001000800090086dd080088be0000000415fb860b0100000000000006080022eb000000042805bb930200000000000007002689010800655800000001bf19ba2470420bd3309b2f8e12d7771ebb2777f66268155f5cda8b83deb0f42bc436e9511bdc431147fea04cc004bfbe6595e603eac31a0323e7a22f6269dd6ca457d56208561b9317f785d117d65042dade598a01a866c84e4eb4811e1cd9cc875be525e88ab4d7868efb757f12313464bfe13de5687f625cd79ae9a51bbb4022210925297e8d4e79c4"], 0x72) r5 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000540)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) setsockopt$ALG_SET_AEAD_AUTHSIZE(r6, 0x117, 0x5, 0x0, 0x9) r7 = accept4(r6, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), r7) recvmmsg(r5, &(0x7f0000015b40)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000300)=""/122, 0x7a}], 0x1}, 0x3}, {{0x0, 0x0, 0x0}, 0x3}], 0x2, 0x160, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) syz_init_net_socket$ax25(0x3, 0x3, 0xcf) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x13, r8, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='devices.list\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r9, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r10, 0x1, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) 794.425249ms ago: executing program 2 (id=7398): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$kcm(0x29, 0x5, 0x0) accept(r1, 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'lo\x00', {0x2, 0x4e22, @empty}}) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x9, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0xb0260000) mmap(&(0x7f0000867000/0x2000)=nil, 0x2000, 0x0, 0x11, 0xffffffffffffffff, 0xffffe000) 731.076851ms ago: executing program 0 (id=7399): r0 = socket$kcm(0x10, 0x400000002, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$sock_buf(r1, 0x1, 0x19, 0x0, &(0x7f0000000280)) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000200)={'filter\x00', 0x4}, 0x68) write$cgroup_subtree(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000800)=""/4136, 0x1028}], 0x1}, 0x10100) unshare(0x28000600) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x288840, 0x0) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/uts\x00') ioctl$FICLONERANGE(r3, 0x4020940d, &(0x7f0000000180)={{r2}, 0x2, 0x4, 0x8}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x8000, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000002c0)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r5, 0x89f2, &(0x7f0000000380)={'syztnl2\x00', &(0x7f0000000300)={'syztnl2\x00', r7, 0x700, 0x8, 0xb7f, 0xffff, {{0x10, 0x4, 0x1, 0x0, 0x40, 0x67, 0x0, 0xdc, 0x29, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010101, {[@generic={0x7, 0x8, "e663acd84f0e"}, @ssrr={0x89, 0x23, 0x12, [@remote, @rand_addr=0x64010100, @empty, @broadcast, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1]}]}}}}}) ioctl$sock_inet6_SIOCADDRT(r5, 0x890b, &(0x7f0000000500)={@private1, @empty, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8, 0x200, 0x400, 0x100, 0x1, 0x200200, r8}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x4, 0x8}, {}, {0x2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xeb, 0xd2, 0x8}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8849}, 0x448c4) sendmsg$nl_route_sched(r5, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@gettfilter={0x24, 0x2e, 0x1, 0x70bd28, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xfff2, 0xffe0}, {0x0, 0xfff1}, {0x7, 0x2}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r10 = socket(0x400000000010, 0x3, 0x0) r11 = socket$l2tp(0x2, 0x2, 0x73) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x3, {0x0, 0x0, 0x0, r12, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x38}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r10, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000480)=@newtfilter={0x50, 0x2c, 0xd27, 0x70bd28, 0x25dfdbfc, {0x0, 0x0, 0x0, r12, {0xfff3, 0x8}, {}, {0x8, 0x1}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x20, 0x2, [@TCA_CGROUP_EMATCHES={0x1c, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xf417}}, @TCA_EMATCH_TREE_LIST={0x10, 0x2, 0x0, 0x1, [@TCF_EM_IPT={0xc, 0x1, 0x0, 0x0, {{0x6f7, 0x9, 0x1}}}]}]}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x40010) connect$nfc_llcp(r10, &(0x7f0000000180)={0x27, 0x0, 0x3e59bb9c, 0x6, 0x0, 0x3, "9748bd9fed99ec22ba7f6d935d31527ac0c8cfdf5856ab63daecd0e71707eb800e9663a28c93035b30d6990321f5ef4c23161c4242cddaf4adb32440da14f6", 0x1d}, 0x60) sendmsg$NFT_BATCH(r9, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000001300c000b400000000000000006b01600000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000070160380f4000080e4000180e000010007c4ddae87e98eafd124d88300ff1e75afd14ef9c278938db451062adeb3d033cacbf736b8197b4e6f23c34448e5406a811d009e6c9052c8a04e13c6ba016ef77db93c179e3408ec444a634e4a7ab3996ece22903a9474242abd9690a646984c920c0bba7668066fa1262a3f996449102849f0da1bcce3649e795b7207d338727ca1681f9d121feee964157d9efb47177db307d1cf30af07fc0e3f4bba5c328a139bfd4b1d014b39011d40c981773e40be0b364d850327ea1d186aa1c92e8f0526593b922ded79321ca5fa78eef0dde1f4cb4147fe1a8fc99bd6362c0c0005"], 0x1728}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 705.514307ms ago: executing program 4 (id=7400): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f0000000140)={0x1d, r1}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@getqdisc={0x40, 0x26, 0x200, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r1, {0xb, 0xfff3}, {0xd, 0xc}, {0xb, 0x2}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x83}, 0x1, 0x0, 0x0, 0x4c860}, 0x4018888) 654.487183ms ago: executing program 2 (id=7401): r0 = socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x100, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x94, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r8, {0x1, 0x5}, {}, {0x7, 0xd}}, [@filter_kind_options=@f_matchall={{0xd}, {0x60, 0x2, [@TCA_MATCHALL_ACT={0x5c, 0x2, [@m_ife={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_IFE_METALST={0x8, 0x6, [@IFE_META_SKBMARK={0x4, 0x1, @void}]}, @TCA_IFE_PARMS={0x1c, 0x1, {{0xfffffff9, 0xfbed, 0x1, 0x3, 0x4}, 0x1}}]}, {0xa, 0x6, "5b83d3d7144e"}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x94}, 0x1, 0x0, 0x0, 0x20008013}, 0x800) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r9) socket$nl_rdma(0x10, 0x3, 0x14) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) r10 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r10, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r11, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)='\r', 0x1}], 0x1}, 0x4) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000), 0x8) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000480)={0x4001, 0x8004}, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="700000001000030500000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="35c60100ef000000500012800e0001006970366772657461700000003c00028014000600fe880000000000000000000000000101140007000000000000bb"], 0x70}, 0x1, 0x0, 0x0, 0x240488c0}, 0x0) 635.659249ms ago: executing program 3 (id=7402): r0 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) getsockopt$inet_buf(r0, 0x118, 0x29, 0x0, &(0x7f00000003c0)) (async) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000000)={'filter\x00', 0x4}, 0x68) syz_80211_inject_frame(&(0x7f0000000080), &(0x7f00000000c0)=@ctrl_frame=@bar={{}, {0x4}, @device_a, @device_b, @compressed={{0x0, 0x0, 0x1, 0x0, 0x9}, {0x9, 0x1}}}, 0x14) 608.103326ms ago: executing program 4 (id=7403): ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x3, 0x5, 0x85cc}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x12, 0x9, 0x4, 0x3}, 0x50) r2 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r2, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r1, &(0x7f0000000080), &(0x7f0000000180)=@tcp=r2}, 0x20) r3 = socket(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xffff}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0xfff3, 0xffe0}, {}, {0x5, 0x8}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x0, 0xffff}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8848}, 0x4000010) sendmmsg(r3, &(0x7f0000000000), 0x400000000000235, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r1, &(0x7f00000000c0)}, 0x20) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c9, &(0x7f0000000100)) getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000080)=0x14) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)={0x1b, 0x0, 0x0, 0x1, 0x0, r9, 0x3, '\x00', r8, r10, 0x1, 0x2, 0x2}, 0x50) syz_80211_inject_frame(&(0x7f0000000300), 0x0, 0x0) 322.973107ms ago: executing program 2 (id=7404): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000040)="89e7ee0c7cdad9b4b47380c988cafb", 0x140}, {&(0x7f0000000340)="448b7cff000000000000108a15df", 0xe}, {&(0x7f0000000500)="301ed9f9a338ef93c403155b88695211f012aee324b0a5caadf1", 0x1a}], 0x3) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r4, 0xffffffffffffffff}, 0x4) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x11, &(0x7f0000000140)=ANY=[@ANYRESDEC=r5, @ANYRES32=r4, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000080)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r6, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547e9f17dbe9abc89b6e0704", 0x0, 0x3696, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 162.499856ms ago: executing program 1 (id=7405): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) shutdown(r0, 0x1) (async) setsockopt(r0, 0x84, 0x7f, &(0x7f0000000380)="1a00000002800000", 0x8) 143.737592ms ago: executing program 0 (id=7406): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_BIND_MAP(0x23, &(0x7f0000000000), 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000001f0900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4c094}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)={0x1c, r2, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x4}, @MPTCP_PM_ATTR_ADDR={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4010}, 0x0) socket$can_raw(0x1d, 0x3, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'geneve1\x00'}) writev(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}, {&(0x7f00000005c0)="1a9ef439feffff090000000003001000", 0x10}], 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=@newtfilter={0x58, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r7, {0x8, 0x7}, {}, {0xa}}, [@filter_kind_options=@f_flower={{0xb}, {0x28, 0x2, [@TCA_FLOWER_KEY_ARP_THA={0xa, 0x41, @remote}, @TCA_FLOWER_KEY_ENC_OPTS={0x18, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_ERSPAN={0x14, 0x3, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_ERSPAN_VER={0x5, 0x1, 0x1}, @TCA_FLOWER_KEY_ENC_OPT_ERSPAN_INDEX={0x8, 0x2, 0x100c}]}]}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x22044028}, 0x20000060) 14.023104ms ago: executing program 1 (id=7407): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x11, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000000000000000003000000850000006d00000018010000696c6c25000000000000000007010000f8ffffffb70200000800fbffb60300000000000085000000b00000009500000000000000"], &(0x7f0000000180)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) (async) r1 = accept$netrom(0xffffffffffffffff, 0x0, &(0x7f0000000140)) recvmmsg(r1, &(0x7f0000000940)=[{{&(0x7f0000000340)=@pptp={0x18, 0x2, {0x0, @loopback}}, 0x80, &(0x7f0000000780)=[{&(0x7f00000003c0)=""/90, 0x5a}, {&(0x7f0000000440)}, {&(0x7f0000000600)=""/221, 0xdd}, {&(0x7f0000000700)=""/30, 0x1e}, {&(0x7f0000000740)=""/60, 0x3c}], 0x5}, 0x8b}], 0x1, 0x20, &(0x7f0000000980)={0x77359400}) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) (async) r4 = socket(0x10, 0x3, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r4) (async) getsockname$packet(r4, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r5, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) (async) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r6, 0x84, 0x6e, &(0x7f0000000000)=[@in6={0xa, 0x0, 0x0, @private1}], 0x1c) shutdown(r6, 0x2) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x4, &(0x7f0000000080)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x800007d}, [@call={0x85, 0x0, 0x0, 0x4c}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0xffffffffffffff2b, 0x0, 0x41100, 0x1a, '\x00', r5, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10007ff}, 0x94) (async) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}}, 0x4000800) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@delchain={0x3c, 0x64, 0xf31, 0xfffffffb, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xfff3}, {0xfff3, 0xffff}, {0xa, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS={0x4}, @TCA_FLOWER_KEY_ENC_OPTS_MASK={0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40044}, 0x4804) (async) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f00000004c0)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000180000003d030100000000009500f000000000006926000000000000bf67000000000000560602000fff07007706000020000000170200000ee60000bf250000000000002d350000000000006507000002080000070700004c0000001f75000000000000bf54000000000000070400000400f9ffad35010000000000840400000000000014000000100000009500000000000000db13d5d8b741f2cdaabc8383c8f56b8c2b848b00ea6553f304000000815dcf00c3ee7b042d1937ba52037fdefeb0cff9fc56357d81b2cc1a9e37d7b75c020b070000003eb22062bafaca036d9cc7db6671573e202e0a92ee4ba12b064981cc32d1ac0b9ecc8f604dcac2563e1c1e762400"/300], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x48) 0s ago: executing program 3 (id=7408): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@ipv4_delroute={0x24, 0x18, 0xa11, 0x70bd2f, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8}, [@RTA_DST={0x8, 0x1, @dev}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$BTRFS_IOC_SNAP_CREATE(r0, 0x89e5, 0x0) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$sock_netrom_SIOCADDRT(r2, 0x890b, &(0x7f00000001c0)={0x1, @bcast, @bpq0, 0x7ffffffe, 'syz1\x00', @null, 0x40005, 0x1, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @default]}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000000)={0x0, 'netpci0\x00', {}, 0x2}) kernel console output (not intermixed with test programs): ype 10 has an invalid length. [ 747.541735][T28134] netlink: 2 bytes leftover after parsing attributes in process `syz.0.6085'. [ 747.657060][T28139] netlink: 'syz.0.6085': attribute type 27 has an invalid length. [ 747.721186][T28147] lo speed is unknown, defaulting to 1000 [ 747.734063][T28147] gre0 speed is unknown, defaulting to 1000 [ 747.771377][ T9977] IPVS: starting estimator thread 0... [ 747.877343][T28151] IPVS: using max 38 ests per chain, 91200 per kthread [ 747.899972][T28153] ip6gretap1: entered allmulticast mode [ 747.921180][T28153] netlink: 'syz.4.6092': attribute type 30 has an invalid length. [ 748.006378][T28153] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6092'. [ 748.402543][T28168] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6094'. [ 748.735885][T28172] bridge0: port 2(bridge_slave_1) entered disabled state [ 748.743746][T28172] bridge0: port 1(bridge_slave_0) entered disabled state [ 749.367584][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 749.375990][ C0] lec:lec_tx_timeout: lec0 [ 749.380785][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 749.411985][T28172] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 749.423342][T28172] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 749.476380][T28172] veth0_macvtap: left allmulticast mode [ 749.629391][T28166] bridge_slave_0 (unregistering): left allmulticast mode [ 749.636654][T28166] bridge_slave_0 (unregistering): left promiscuous mode [ 749.682387][T28200] netlink: 'syz.2.6107': attribute type 27 has an invalid length. [ 749.696776][T28166] bridge0: port 1(bridge_slave_0) entered disabled state [ 749.748294][ T1147] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 749.779621][ T1147] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 749.800920][ T1147] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 749.850230][T28209] netlink: 'syz.3.6109': attribute type 10 has an invalid length. [ 749.859799][T28209] netlink: 2 bytes leftover after parsing attributes in process `syz.3.6109'. [ 749.896092][ T1147] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 749.909716][T28209] hsr0: entered promiscuous mode [ 749.927882][T28209] bridge0: port 3(hsr0) entered blocking state [ 749.934248][T28209] bridge0: port 3(hsr0) entered disabled state [ 749.948817][T28209] hsr0: entered allmulticast mode [ 749.956250][T28209] hsr_slave_0: entered allmulticast mode [ 749.964946][T28209] hsr_slave_1: entered allmulticast mode [ 749.972929][T28209] bridge0: port 3(hsr0) entered blocking state [ 749.979469][T28209] bridge0: port 3(hsr0) entered forwarding state [ 750.045337][T28212] netlink: 'syz.3.6109': attribute type 27 has an invalid length. [ 750.219569][T28224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.244003][T28224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.258310][T28224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.269687][T28224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.278665][T28224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.287951][T28224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.297604][T28224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.308286][T28224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.318519][T28224] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.748236][T28254] lo speed is unknown, defaulting to 1000 [ 750.756321][T28254] gre0 speed is unknown, defaulting to 1000 [ 751.420748][T28237] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 751.619057][T28277] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 751.626411][T28277] IPv6: NLM_F_CREATE should be set when creating new route [ 751.634842][T28277] IPv6: NLM_F_CREATE should be set when creating new route [ 751.880087][T28292] __nla_validate_parse: 4 callbacks suppressed [ 751.880103][T28292] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6135'. [ 751.884985][T28293] netlink: 212348 bytes leftover after parsing attributes in process `syz.2.6133'. [ 751.947635][T28295] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6136'. [ 751.967551][T28295] openvswitch: netlink: Key 4 has unexpected len 4 expected 12 [ 751.978061][T28297] netlink: 'syz.1.6137': attribute type 6 has an invalid length. [ 751.986467][T28297] netlink: 128 bytes leftover after parsing attributes in process `syz.1.6137'. [ 752.008804][T28295] Cannot find set identified by id 0 to match [ 752.090648][T28299] IPVS: set_ctl: invalid protocol: 255 172.30.0.5:20001 [ 752.450927][T28306] netlink: 'syz.0.6139': attribute type 10 has an invalid length. [ 752.546349][T28312] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6141'. [ 752.658013][T28307] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6139'. [ 752.708967][T28316] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6142'. [ 752.786578][T28318] syzkaller1: entered promiscuous mode [ 752.806842][T28321] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6142'. [ 752.837034][T28318] syzkaller1: entered allmulticast mode [ 752.929971][T28331] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6147'. [ 753.027884][T28335] vlan0: entered allmulticast mode [ 753.051042][T28335] bond0: entered allmulticast mode [ 753.056605][T28335] bond_slave_0: entered allmulticast mode [ 753.057585][T28336] netlink: 14 bytes leftover after parsing attributes in process `syz.1.6149'. [ 753.063814][T28335] bond_slave_1: entered allmulticast mode [ 753.080650][T28340] lo: Caught tx_queue_len zero misconfig [ 753.189420][T28336] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 753.223381][T28336] bond_slave_0: left allmulticast mode [ 753.241036][T28336] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 753.261163][T28336] bond_slave_1: left allmulticast mode [ 753.268547][T28336] bond0 (unregistering): Released all slaves [ 753.610955][T28371] wg1 speed is unknown, defaulting to 1000 [ 753.630680][T28371] wg1 speed is unknown, defaulting to 1000 [ 753.640111][T28371] wg1 speed is unknown, defaulting to 1000 [ 754.014929][T28386] veth0_to_bridge: Caught tx_queue_len zero misconfig [ 754.115131][T28391] netlink: 'syz.4.6170': attribute type 3 has an invalid length. [ 754.157188][T28391] netlink: 'syz.4.6170': attribute type 3 has an invalid length. [ 754.175912][T28371] infiniband syz0: set down [ 754.181094][ T9976] wg1 speed is unknown, defaulting to 1000 [ 754.197263][T28371] infiniband syz0: added wg1 [ 754.347716][T28371] RDS/IB: syz0: added [ 754.352040][T28371] smc: adding ib device syz0 with port count 1 [ 754.388453][T28371] smc: ib device syz0 port 1 has no pnetid [ 754.395196][ T9976] wg1 speed is unknown, defaulting to 1000 [ 754.406978][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 754.415202][ C0] lec:lec_tx_timeout: lec0 [ 754.421459][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 754.429883][T28371] wg1 speed is unknown, defaulting to 1000 [ 754.761852][T28418] xt_CT: You must specify a L4 protocol and not use inversions on it [ 754.824205][ T5847] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 754.835057][ T5847] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 754.844498][ T5847] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 754.853341][ T5847] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 754.861551][ T5847] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 754.989099][T28426] lo speed is unknown, defaulting to 1000 [ 754.996902][T28426] gre0 speed is unknown, defaulting to 1000 [ 755.069739][T28421] lo speed is unknown, defaulting to 1000 [ 755.207519][T28371] wg1 speed is unknown, defaulting to 1000 [ 755.483297][T28421] gre0 speed is unknown, defaulting to 1000 [ 756.424153][T10777] bridge0 (unregistering): left promiscuous mode [ 756.621289][T10777] bond4 (unregistering): (slave bridge5): Releasing backup interface [ 756.629773][T10777] bridge5 (unregistering): left promiscuous mode [ 756.636295][T10777] bridge5 (unregistering): left allmulticast mode [ 756.711665][T10777] bond0 (unregistering): left promiscuous mode [ 756.718021][T10777] batadv0: left promiscuous mode [ 756.728909][T10777] bond0 (unregistering): (slave batadv0): Releasing backup interface [ 756.738553][T10777] bond0 (unregistering): Released all slaves [ 756.751004][T10777] bond1 (unregistering): Released all slaves [ 756.765161][T10777] bond2 (unregistering): Released all slaves [ 756.779381][T10777] bond3 (unregistering): Released all slaves [ 756.801175][T10777] bond4 (unregistering): Released all slaves [ 756.814295][T28426] wg1 speed is unknown, defaulting to 1000 [ 756.958183][T28474] netlink: 'syz.4.6189': attribute type 10 has an invalid length. [ 756.960304][T10777] tipc: Left network mode [ 756.966313][T28474] __nla_validate_parse: 6 callbacks suppressed [ 756.966329][T28474] netlink: 2 bytes leftover after parsing attributes in process `syz.4.6189'. [ 756.971702][ T5833] Bluetooth: hci0: command tx timeout [ 756.999744][T28474] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 757.044190][T28474] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 757.058060][T28476] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6190'. [ 757.070806][T28474] hsr0: entered promiscuous mode [ 757.091776][T28474] bridge0: port 1(hsr0) entered blocking state [ 757.102441][T28474] bridge0: port 1(hsr0) entered disabled state [ 757.127604][T28474] hsr0: entered allmulticast mode [ 757.148666][T28474] hsr_slave_0: entered allmulticast mode [ 757.186391][T28474] hsr_slave_1: entered allmulticast mode [ 757.259431][T28484] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6191'. [ 757.283727][T28484] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6191'. [ 757.293838][T28478] netlink: 'syz.4.6189': attribute type 27 has an invalid length. [ 757.919395][T28371] wg1 speed is unknown, defaulting to 1000 [ 758.290151][T28518] netlink: 616 bytes leftover after parsing attributes in process `syz.4.6197'. [ 758.595153][T28421] wg1 speed is unknown, defaulting to 1000 [ 758.827873][T28532] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6200'. [ 758.912577][T28537] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 758.920429][T28537] IPv6: NLM_F_CREATE should be set when creating new route [ 758.928028][T28537] IPv6: NLM_F_CREATE should be set when creating new route [ 758.965689][T28532] 8021q: adding VLAN 0 to HW filter on device bond1 [ 759.020029][T28537] bond1: entered promiscuous mode [ 759.025427][T28537] bond1: entered allmulticast mode [ 759.047255][ T5833] Bluetooth: hci0: command tx timeout [ 759.057769][T28537] 8021q: adding VLAN 0 to HW filter on device bond1 [ 759.092518][T28537] team0: Port device bond1 added [ 759.104591][T28371] wg1 speed is unknown, defaulting to 1000 [ 759.118960][T28543] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6201'. [ 759.132231][T28543] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6201'. [ 759.210149][T28532] vxcan3: entered promiscuous mode [ 759.215543][T28532] bond1: (slave vxcan3): refused to change device type [ 759.224673][T28544] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6200'. [ 759.252266][T28546] netlink: 'syz.4.6202': attribute type 13 has an invalid length. [ 759.262456][T28546] netlink: 'syz.4.6202': attribute type 17 has an invalid length. [ 759.383190][T28546] 8021q: adding VLAN 0 to HW filter on device bond0 [ 759.399490][T28546] 8021q: adding VLAN 0 to HW filter on device team0 [ 759.415112][T28546] net_ratelimit: 2 callbacks suppressed [ 759.415122][T28546] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 759.447679][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 759.456646][ C0] lec:lec_tx_timeout: lec0 [ 759.461569][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 759.485721][T28371] wg1 speed is unknown, defaulting to 1000 [ 759.553018][T28555] netlink: 'syz.3.6205': attribute type 10 has an invalid length. [ 759.562100][T28555] netlink: 2 bytes leftover after parsing attributes in process `syz.3.6205'. [ 759.650112][T28421] chnl_net:caif_netlink_parms(): no params data found [ 759.740370][T28559] netlink: 'syz.3.6205': attribute type 27 has an invalid length. [ 759.767914][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.996141][T28371] wg1 speed is unknown, defaulting to 1000 [ 760.050391][T28421] bridge0: port 1(bridge_slave_0) entered blocking state [ 760.080902][T28421] bridge0: port 1(bridge_slave_0) entered disabled state [ 760.110834][T28421] bridge_slave_0: entered allmulticast mode [ 760.153917][T28421] bridge_slave_0: entered promiscuous mode [ 760.193055][T28421] bridge0: port 2(bridge_slave_1) entered blocking state [ 760.219560][T28421] bridge0: port 2(bridge_slave_1) entered disabled state [ 760.241045][T28421] bridge_slave_1: entered allmulticast mode [ 760.266705][T28421] bridge_slave_1: entered promiscuous mode [ 760.365490][T28421] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 760.401943][T28421] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 760.552384][T28421] team0: Port device team_slave_0 added [ 760.603475][T28421] team0: Port device team_slave_1 added [ 760.614340][T28585] xt_CT: No such helper "netbios-ns" [ 760.701264][T28421] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 760.747336][T28421] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 760.879732][T28421] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 760.977574][T28421] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 761.006750][T28421] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 761.073777][T28421] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 761.122896][T28606] IPVS: set_ctl: invalid protocol: 136 172.20.20.170:20002 [ 761.141034][ T5833] Bluetooth: hci0: command tx timeout [ 761.398999][T28616] netlink: 'syz.1.6220': attribute type 10 has an invalid length. [ 761.431408][T28421] hsr_slave_0: entered promiscuous mode [ 761.439234][T28421] hsr_slave_1: entered promiscuous mode [ 761.453424][T28421] debugfs: 'hsr0' already exists in 'hsr' [ 761.473061][T28421] Cannot create hsr debugfs directory [ 761.610304][T28617] netlink: 'syz.1.6220': attribute type 27 has an invalid length. [ 762.554496][T28631] __nla_validate_parse: 4 callbacks suppressed [ 762.554514][T28631] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6225'. [ 762.573956][T28632] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6225'. [ 762.586145][T28632] netlink: 'syz.3.6225': attribute type 2 has an invalid length. [ 762.640119][T28634] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6224'. [ 762.648950][T28631] netlink: 'syz.3.6225': attribute type 2 has an invalid length. [ 762.649937][T28634] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6224'. [ 762.740122][T10777] pim6reg (unregistering): left allmulticast mode [ 763.217178][ T5833] Bluetooth: hci0: command tx timeout [ 763.270271][T28641] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6227'. [ 763.279836][T28644] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6228'. [ 763.287089][T28641] netlink: 'syz.3.6227': attribute type 30 has an invalid length. [ 763.349311][T28641] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6227'. [ 763.363903][T28641] netlink: 'syz.3.6227': attribute type 30 has an invalid length. [ 763.377374][ T7458] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 763.397040][ T7458] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 763.406236][ T7458] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 763.478080][ T7458] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 763.576636][T28652] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 763.584142][T28652] IPv6: NLM_F_CREATE should be set when creating new route [ 763.653472][T28661] netlink: 2 bytes leftover after parsing attributes in process `syz.3.6233'. [ 764.476683][T28684] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6237'. [ 764.792835][T28697] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6238'. [ 765.020442][T28719] validate_nla: 2 callbacks suppressed [ 765.020462][T28719] netlink: 'syz.1.6240': attribute type 1 has an invalid length. [ 765.041676][T28719] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 765.286987][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5820 ms [ 765.295173][ C0] lec:lec_tx_timeout: lec0 [ 765.300321][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 765.308189][T28735] batadv_slave_1: entered promiscuous mode [ 765.574667][T28421] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 765.606493][T28734] batadv_slave_1: left promiscuous mode [ 765.629258][T28421] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 765.658778][T28421] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 765.701221][T28421] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 765.791875][T28763] tipc: Enabling of bearer rejected, failed to enable media [ 766.002758][T28421] 8021q: adding VLAN 0 to HW filter on device bond0 [ 766.056312][T28421] 8021q: adding VLAN 0 to HW filter on device team0 [ 766.080589][T21927] bridge0: port 1(bridge_slave_0) entered blocking state [ 766.088009][T21927] bridge0: port 1(bridge_slave_0) entered forwarding state [ 766.315909][T21927] bridge0: port 2(bridge_slave_1) entered blocking state [ 766.323541][T21927] bridge0: port 2(bridge_slave_1) entered forwarding state [ 766.624128][T28788] bond4 (unregistering): Released all slaves [ 766.717637][T28797] veth0_to_hsr: Caught tx_queue_len zero misconfig [ 767.185366][T28828] geneve2: entered promiscuous mode [ 767.193290][T28787] Bluetooth: hci0: Opcode 0x0401 failed: -4 [ 767.253433][ T36] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 767.300009][T28824] lo speed is unknown, defaulting to 1000 [ 767.306010][ T36] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 767.334927][T28824] gre0 speed is unknown, defaulting to 1000 [ 767.424827][T28421] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 767.459306][ T36] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 767.530791][ T36] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 767.754912][T28421] veth0_vlan: entered promiscuous mode [ 767.782451][T28854] __nla_validate_parse: 7 callbacks suppressed [ 767.782470][T28854] netlink: 120 bytes leftover after parsing attributes in process `syz.2.6265'. [ 767.835566][T28421] veth1_vlan: entered promiscuous mode [ 767.983499][T28421] veth0_macvtap: entered promiscuous mode [ 768.041122][T28421] veth1_macvtap: entered promiscuous mode [ 768.120776][T28421] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 768.162613][T28860] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6266'. [ 768.165998][T28421] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 768.224592][T28858] pimreg: entered allmulticast mode [ 768.256057][ T36] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.266341][ T36] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.293480][ T36] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.331396][ T36] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 768.368128][T28824] wg1 speed is unknown, defaulting to 1000 [ 768.408328][ T5833] Bluetooth: hci0: command 0x0401 tx timeout [ 768.650729][ T127] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 768.677067][ T127] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 768.769007][ T127] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 768.900828][ T127] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 768.953070][T28882] syzkaller0: entered promiscuous mode [ 768.967979][T28882] syzkaller0: entered allmulticast mode [ 769.097770][T28894] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6274'. [ 769.121624][T28894] netlink: 43 bytes leftover after parsing attributes in process `syz.1.6274'. [ 769.142428][T28894] netlink: 'syz.1.6274': attribute type 5 has an invalid length. [ 769.152273][T28898] netlink: 56 bytes leftover after parsing attributes in process `syz.0.6176'. [ 769.173305][T28894] netlink: 43 bytes leftover after parsing attributes in process `syz.1.6274'. [ 769.193947][T28900] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6276'. [ 769.572146][T28914] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6278'. [ 769.718624][T28929] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6280'. [ 770.279449][T28944] lo speed is unknown, defaulting to 1000 [ 770.306969][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 770.315219][ C0] lec:lec_tx_timeout: lec0 [ 770.320832][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 770.329231][T28944] gre0 speed is unknown, defaulting to 1000 [ 770.806102][T28966] vti1: entered promiscuous mode [ 770.835700][T28944] wg1 speed is unknown, defaulting to 1000 [ 770.848725][T28964] syzkaller0: entered promiscuous mode [ 770.854471][T28964] syzkaller0: entered allmulticast mode [ 770.993530][T28972] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.334783][T28989] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6294'. [ 771.837968][T29009] netlink: 'syz.2.6298': attribute type 10 has an invalid length. [ 771.854594][T29009] team0: Port device dummy0 added [ 771.890165][T29012] syzkaller0: entered promiscuous mode [ 771.898207][T29009] netlink: 'syz.2.6298': attribute type 10 has an invalid length. [ 771.898518][T29012] syzkaller0: entered allmulticast mode [ 772.211274][T29009] team0: Port device dummy0 removed [ 772.287437][T29009] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 773.201601][T29062] __nla_validate_parse: 1 callbacks suppressed [ 773.201623][T29062] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6302'. [ 773.918674][T29062] bridge0: port 3(hsr0) entered disabled state [ 773.925704][T29062] bridge0: port 2(bridge_slave_1) entered disabled state [ 773.933921][T29062] bridge0: port 1(bridge_slave_0) entered disabled state [ 773.965564][T29089] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6308'. [ 774.288539][T29062] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 774.320205][T29062] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 774.710436][T29065] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 774.740480][T29069] bridge0: entered promiscuous mode [ 774.810497][T29094] netlink: 212408 bytes leftover after parsing attributes in process `syz.3.6309'. [ 774.833091][T21927] netdevsim netdevsim3 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 774.897543][T21927] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.924075][T21927] netdevsim netdevsim3 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 774.947042][T21927] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 774.964275][T21927] netdevsim netdevsim3 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 774.987531][T21927] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 775.005371][T29103] No such timeout policy "syz1" [ 775.043309][T21927] netdevsim netdevsim3 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 775.068797][T29108] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6311'. [ 775.086985][T21927] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 775.253471][T29116] lo speed is unknown, defaulting to 1000 [ 775.262522][T29110] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6314'. [ 775.301582][T29116] gre0 speed is unknown, defaulting to 1000 [ 775.326986][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 775.335153][ C0] lec:lec_tx_timeout: lec0 [ 775.340341][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 775.682729][T29131] syzkaller0: entered promiscuous mode [ 775.717101][T29131] syzkaller0: entered allmulticast mode [ 776.175268][T29173] Cannot find set identified by id 0 to match [ 776.193674][T29174] Cannot find set identified by id 0 to match [ 778.519301][T29146] syzkaller1: entered promiscuous mode [ 778.528031][T29146] syzkaller1: entered allmulticast mode [ 778.537041][T29116] wg1 speed is unknown, defaulting to 1000 [ 778.547750][T29173] IPVS: Unknown mcast interface: vcan0 [ 778.692489][T29193] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6326'. [ 778.758231][T29152] lo speed is unknown, defaulting to 1000 [ 778.842316][T29198] netlink: 'syz.2.6327': attribute type 3 has an invalid length. [ 778.862382][T29152] gre0 speed is unknown, defaulting to 1000 [ 778.965857][T29198] block nbd2: NBD_DISCONNECT [ 779.281561][T29221] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6332'. [ 779.311102][T29221] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6332'. [ 779.328424][T29221] netlink: 'syz.3.6332': attribute type 13 has an invalid length. [ 779.343918][T29224] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6333'. [ 779.359880][T29221] netlink: 'syz.3.6332': attribute type 11 has an invalid length. [ 779.421617][T29152] wg1 speed is unknown, defaulting to 1000 [ 779.737934][T29198] siw: device registration error -23 [ 779.924124][T29246] netlink: 'syz.3.6336': attribute type 298 has an invalid length. [ 780.203198][T29267] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6337'. [ 780.356940][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 780.365745][ C0] lec:lec_tx_timeout: lec0 [ 780.368636][T29259] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6338'. [ 780.371779][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 780.505284][T29268] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6338'. [ 780.584499][T29280] netlink: 'syz.1.6341': attribute type 4 has an invalid length. [ 780.668570][T29281] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1536) ! [ 780.971137][T29291] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6344'. [ 781.305758][T29312] netlink: 'syz.0.6347': attribute type 1 has an invalid length. [ 781.550442][T29328] Bluetooth: MGMT ver 1.23 [ 781.569854][T29322] lo speed is unknown, defaulting to 1000 [ 781.580018][T29322] gre0 speed is unknown, defaulting to 1000 [ 781.772652][T29332] A link change request failed with some changes committed already. Interface veth1_macvtap may have been left with an inconsistent configuration, please check. [ 781.805951][T29345] netlink: 'syz.4.6355': attribute type 13 has an invalid length. [ 782.433576][T29322] wg1 speed is unknown, defaulting to 1000 [ 782.605362][T29386] bridge_slave_1: left allmulticast mode [ 782.637257][T29386] bridge_slave_1: left promiscuous mode [ 782.649103][T29386] bridge0: port 2(bridge_slave_1) entered disabled state [ 782.701563][T29386] bond0: (slave bond_slave_0): Releasing backup interface [ 782.783235][T29386] bond0: (slave bond_slave_1): Releasing backup interface [ 782.812260][T29386] team0: Port device team_slave_0 removed [ 782.842246][T29386] team0: Port device team_slave_1 removed [ 782.853344][T29386] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 782.888232][T29386] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 782.914016][T29386] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 783.443381][T29425] xt_hashlimit: overflow, try lower: 0/0 [ 783.502999][T29425] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6371'. [ 783.523339][T29425] netlink: 3 bytes leftover after parsing attributes in process `syz.4.6371'. [ 783.701923][T29432] netlink: 'syz.3.6372': attribute type 1 has an invalid length. [ 783.729790][T29432] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6372'. [ 783.936068][T29441] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 783.970685][T29445] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6376'. [ 783.988653][T29441] IPVS: set_ctl: invalid protocol: 59 100.1.1.1:20002 [ 784.005700][T29445] openvswitch: netlink: Flow actions attr not present in new flow. [ 784.153201][T29455] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6378'. [ 784.220438][T29450] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6375'. [ 784.653643][T29474] vlan2: entered allmulticast mode [ 784.664640][T29474] macvtap0: entered allmulticast mode [ 784.677417][T29474] veth0_macvtap: entered allmulticast mode [ 784.924962][T29488] netlink: 16 bytes leftover after parsing attributes in process `syz.0.6382'. [ 785.388253][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 785.396762][ C0] lec:lec_tx_timeout: lec0 [ 785.405398][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 785.442107][T29512] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6387'. [ 785.603799][ T5491] veth1_macvtap: left promiscuous mode [ 785.629037][T29516] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6388'. [ 785.667136][T29516] netlink: 24 bytes leftover after parsing attributes in process `syz.0.6388'. [ 785.709134][T29519] nbd: must specify a device to reconfigure [ 785.729492][T29521] netlink: 40 bytes leftover after parsing attributes in process `syz.0.6388'. [ 785.798332][ T5847] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 785.809843][ T5847] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 785.819090][ T5847] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 785.878723][ T5847] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 785.886993][ T5847] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 785.942802][T29524] lo speed is unknown, defaulting to 1000 [ 785.951088][T29524] gre0 speed is unknown, defaulting to 1000 [ 786.068942][T29528] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6391'. [ 786.267498][T29537] wg1: entered allmulticast mode [ 786.483918][T29524] wg1 speed is unknown, defaulting to 1000 [ 787.928540][ T5833] Bluetooth: hci2: command tx timeout [ 789.110061][T29575] x_tables: ip6_tables: sctp match: only valid for protocol 132 [ 789.163295][T29578] vlan2: entered allmulticast mode [ 789.361451][T29524] chnl_net:caif_netlink_parms(): no params data found [ 789.536240][T29605] __nla_validate_parse: 1 callbacks suppressed [ 789.536261][T29605] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6408'. [ 789.570912][T29524] bridge0: port 1(bridge_slave_0) entered blocking state [ 789.585119][T29524] bridge0: port 1(bridge_slave_0) entered disabled state [ 789.619156][T29524] bridge_slave_0: entered allmulticast mode [ 789.641947][T29524] bridge_slave_0: entered promiscuous mode [ 789.686351][T29524] bridge0: port 2(bridge_slave_1) entered blocking state [ 789.694698][ T9975] IPVS: starting estimator thread 0... [ 789.715629][T29617] netlink: 'syz.1.6411': attribute type 2 has an invalid length. [ 789.721846][T29524] bridge0: port 2(bridge_slave_1) entered disabled state [ 789.724261][T29617] netlink: 164 bytes leftover after parsing attributes in process `syz.1.6411'. [ 789.751393][T29524] bridge_slave_1: entered allmulticast mode [ 789.761800][T29524] bridge_slave_1: entered promiscuous mode [ 789.809070][T29611] lo speed is unknown, defaulting to 1000 [ 789.827518][T29615] IPVS: using max 35 ests per chain, 84000 per kthread [ 789.843225][T29611] gre0 speed is unknown, defaulting to 1000 [ 789.876028][T29524] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 790.018343][ T5833] Bluetooth: hci2: command tx timeout [ 790.093010][T29524] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 790.113349][T29611] wg1 speed is unknown, defaulting to 1000 [ 790.190902][T29524] team0: Port device team_slave_0 added [ 790.215860][T29524] team0: Port device team_slave_1 added [ 790.288586][T29524] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 790.296510][T29524] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 790.328670][T29524] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 790.342265][T29524] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 790.352306][T29524] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 790.380654][T29524] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 790.416964][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 790.421377][T29643] vlan2: entered allmulticast mode [ 790.425243][ C0] lec:lec_tx_timeout: lec0 [ 790.433393][T29643] macvtap0: entered allmulticast mode [ 790.435394][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 790.552865][T29524] hsr_slave_0: entered promiscuous mode [ 790.563576][T29524] hsr_slave_1: entered promiscuous mode [ 790.577111][T29524] debugfs: 'hsr0' already exists in 'hsr' [ 790.583446][T29524] Cannot create hsr debugfs directory [ 790.589445][T29647] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6416'. [ 790.634879][T29646] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 790.664777][T29649] sctp: [Deprecated]: syz.3.6417 (pid 29649) Use of struct sctp_assoc_value in delayed_ack socket option. [ 790.664777][T29649] Use struct sctp_sack_info instead [ 790.752638][T29651] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6418'. [ 790.774060][T29653] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6419'. [ 790.784533][T29653] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6419'. [ 790.795366][T29653] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6419'. [ 790.805671][T29653] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6419'. [ 790.829728][T29651] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6418'. [ 790.869810][T29655] netlink: 'syz.3.6420': attribute type 49 has an invalid length. [ 791.014414][T29661] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 791.024149][T29660] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 791.115622][T29651] bridge0: port 2(bridge_slave_1) entered disabled state [ 791.123432][T29651] bridge0: port 1(bridge_slave_0) entered disabled state [ 791.452212][T29651] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 791.486268][T29651] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 791.604828][T29651] veth0_macvtap: left allmulticast mode [ 791.786859][ T7458] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 791.819541][ T7458] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 791.880938][ T7458] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 791.937518][ T7458] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 792.089977][ T5833] Bluetooth: hci2: command tx timeout [ 792.358145][T29697] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6429'. [ 792.705571][T29702] syzkaller1: entered promiscuous mode [ 792.720426][T29702] syzkaller1: entered allmulticast mode [ 793.115185][T29524] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 793.148923][T29524] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 793.297062][T29524] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 793.374984][T29524] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 793.629709][T29524] 8021q: adding VLAN 0 to HW filter on device bond0 [ 793.903234][T29763] openvswitch: netlink: IP tunnel attribute has 5 unknown bytes. [ 794.029240][T29524] 8021q: adding VLAN 0 to HW filter on device team0 [ 794.051218][T21927] bridge0: port 1(bridge_slave_0) entered blocking state [ 794.059435][T21927] bridge0: port 1(bridge_slave_0) entered forwarding state [ 794.109432][T21927] bridge0: port 2(bridge_slave_1) entered blocking state [ 794.116827][T21927] bridge0: port 2(bridge_slave_1) entered forwarding state [ 794.169804][ T5833] Bluetooth: hci2: command tx timeout [ 794.187993][T29773] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1536) ! [ 794.589444][T29803] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 794.620045][T29524] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 794.638280][T29801] nbd1: detected capacity change from 0 to 63 [ 794.647507][T29804] block nbd1: NBD_DISCONNECT [ 794.652835][T29804] block nbd1: Disconnected due to user request. [ 794.700176][T29804] block nbd1: shutting down sockets [ 794.705712][T29582] blk_print_req_error: 138 callbacks suppressed [ 794.705726][T29582] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 794.729766][T29809] __nla_validate_parse: 19 callbacks suppressed [ 794.729808][T29809] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6464'. [ 794.770526][T29582] buffer_io_error: 138 callbacks suppressed [ 794.770538][T29582] Buffer I/O error on dev nbd1, logical block 0, async page read [ 794.825451][T29813] netlink: 76 bytes leftover after parsing attributes in process `syz.3.6464'. [ 794.839124][T29524] veth0_vlan: entered promiscuous mode [ 794.855786][T29524] veth1_vlan: entered promiscuous mode [ 794.866110][ T25] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 794.878740][ T25] Buffer I/O error on dev nbd1, logical block 1, async page read [ 794.886867][ T25] Buffer I/O error on dev nbd1, logical block 2, async page read [ 794.895481][ T25] Buffer I/O error on dev nbd1, logical block 3, async page read [ 794.905123][T29582] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 794.925464][T29582] Buffer I/O error on dev nbd1, logical block 0, async page read [ 794.933697][T29582] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 794.944451][T29582] Buffer I/O error on dev nbd1, logical block 1, async page read [ 794.952469][T29582] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 794.962800][T29582] Buffer I/O error on dev nbd1, logical block 2, async page read [ 794.972291][T29582] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 794.982211][T29582] Buffer I/O error on dev nbd1, logical block 3, async page read [ 794.990427][T29582] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 795.000165][T29582] Buffer I/O error on dev nbd1, logical block 0, async page read [ 795.008297][T29582] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 795.018288][T29582] Buffer I/O error on dev nbd1, logical block 1, async page read [ 795.037187][T29582] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 795.048124][T29524] veth0_macvtap: entered promiscuous mode [ 795.065328][T29582] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 795.081501][T29582] ldm_validate_partition_table(): Disk read failed. [ 795.104064][T29524] veth1_macvtap: entered promiscuous mode [ 795.107473][T29582] Dev nbd1: unable to read RDB block 0 [ 795.117097][T29582] nbd1: unable to read partition table [ 795.161850][T29582] ldm_validate_partition_table(): Disk read failed. [ 795.199094][T29582] Dev nbd1: unable to read RDB block 0 [ 795.208116][T29524] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 795.212287][T29582] nbd1: unable to read partition table [ 795.240250][T29524] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 795.283593][T29829] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6468'. [ 795.297356][ T1147] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 795.307884][ T1147] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 795.316754][ T1147] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 795.355184][ T1147] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 795.421241][T29832] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 795.433297][T29832] syzkaller1: linktype set to 1 [ 795.457728][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 795.466036][ C0] lec:lec_tx_timeout: lec0 [ 795.472234][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 795.713351][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 795.725963][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 795.829394][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 795.840906][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 795.852332][T29856] netlink: 'syz.3.6476': attribute type 29 has an invalid length. [ 795.880171][T29856] netlink: 68 bytes leftover after parsing attributes in process `syz.3.6476'. [ 796.025982][T29872] netlink: 76 bytes leftover after parsing attributes in process `syz.2.6386'. [ 796.191894][T29882] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 796.308423][T29886] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6481'. [ 796.369168][T29890] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6483'. [ 796.382077][T29890] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6483'. [ 796.382128][T29891] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6483'. [ 796.441652][T29891] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6483'. [ 796.557590][T29897] netlink: 'syz.3.6485': attribute type 13 has an invalid length. [ 796.713917][ T5847] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 796.726666][ T5847] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 796.738680][ T5847] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 796.747516][ T5847] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 796.756130][ T5847] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 796.810635][T29907] lo speed is unknown, defaulting to 1000 [ 796.819918][T29907] gre0 speed is unknown, defaulting to 1000 [ 797.175819][T29907] wg1 speed is unknown, defaulting to 1000 [ 797.182059][T29922] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1536) ! [ 797.311006][T29936] netlink: 'syz.0.6496': attribute type 10 has an invalid length. [ 797.375092][T29941] netlink: 'syz.0.6496': attribute type 10 has an invalid length. [ 797.409942][T29936] team0: Port device dummy0 added [ 797.512088][T29941] team0: Port device dummy0 removed [ 797.595971][T29941] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 797.745920][T29954] netlink: 'syz.2.6499': attribute type 13 has an invalid length. [ 797.779099][T29954] netlink: 'syz.2.6499': attribute type 17 has an invalid length. [ 798.164947][ T7458] veth0_to_bridge: left allmulticast mode [ 798.172115][ T7458] veth0_to_bridge: left promiscuous mode [ 798.179227][ T7458] bridge0: port 3(veth0_to_bridge) entered disabled state [ 798.190053][ T7458] bridge_slave_1: left allmulticast mode [ 798.201020][ T7458] bridge_slave_1: left promiscuous mode [ 798.208390][ T7458] bridge0: port 2(bridge_slave_1) entered disabled state [ 798.219773][ T7458] bridge_slave_0: left allmulticast mode [ 798.225702][ T7458] bridge_slave_0: left promiscuous mode [ 798.232118][ T7458] bridge0: port 1(bridge_slave_0) entered disabled state [ 798.498489][ T1147] smc: removing ib device syz1 [ 798.807687][ T5847] Bluetooth: hci3: command tx timeout [ 798.844834][ T7458] bond2 (unregistering): (slave bridge3): Releasing backup interface [ 799.084106][ T7458] bond1 (unregistering): Released all slaves [ 799.165645][ T7458] bond2 (unregistering): Released all slaves [ 799.231840][ T7458] bond3 (unregistering): Released all slaves [ 799.299993][ T7458] bond4 (unregistering): Released all slaves [ 799.365936][ T7458] bond5 (unregistering): Released all slaves [ 799.489249][ T5964] gre0 speed is unknown, defaulting to 1000 [ 799.494516][T29974] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1536) ! [ 799.509220][ T5964] syz1: Port: 1 Link DOWN [ 799.864189][T29907] chnl_net:caif_netlink_parms(): no params data found [ 800.035401][T30008] __nla_validate_parse: 8 callbacks suppressed [ 800.035422][T30008] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6513'. [ 800.202762][T30018] netlink: 'syz.0.6515': attribute type 10 has an invalid length. [ 800.241949][T30018] netlink: 2 bytes leftover after parsing attributes in process `syz.0.6515'. [ 800.355496][T30018] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 800.377759][T30024] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6516'. [ 800.409108][T30018] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 800.466667][T30018] hsr0: entered promiscuous mode [ 800.493544][T30018] bridge0: port 3(hsr0) entered blocking state [ 800.507133][T30018] bridge0: port 3(hsr0) entered disabled state [ 800.518469][T30018] hsr0: entered allmulticast mode [ 800.523553][T30018] hsr_slave_0: entered allmulticast mode [ 800.557945][T30031] netlink: 'syz.0.6515': attribute type 27 has an invalid length. [ 800.567435][T30033] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6518'. [ 800.570698][T30018] hsr_slave_1: entered allmulticast mode [ 800.886975][ T5847] Bluetooth: hci3: command tx timeout [ 801.368434][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5890 ms [ 801.376950][ C0] lec:lec_tx_timeout: lec0 [ 801.641533][ T7458] tipc: Left network mode [ 801.678406][T29907] bridge0: port 1(bridge_slave_0) entered blocking state [ 801.686274][T29907] bridge0: port 1(bridge_slave_0) entered disabled state [ 801.707884][T30069] netlink: 'syz.2.6524': attribute type 10 has an invalid length. [ 801.715944][T30069] netlink: 2 bytes leftover after parsing attributes in process `syz.2.6524'. [ 801.723195][T29907] bridge_slave_0: entered allmulticast mode [ 801.735862][T29907] bridge_slave_0: entered promiscuous mode [ 801.745717][T29907] bridge0: port 2(bridge_slave_1) entered blocking state [ 801.757030][T29907] bridge0: port 2(bridge_slave_1) entered disabled state [ 801.764559][T29907] bridge_slave_1: entered allmulticast mode [ 801.774316][T29907] bridge_slave_1: entered promiscuous mode [ 801.810174][T30069] hsr0: entered promiscuous mode [ 801.816034][T30069] bridge0: port 3(hsr0) entered blocking state [ 801.838227][T30074] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6527'. [ 801.857433][T30069] bridge0: port 3(hsr0) entered disabled state [ 801.861088][T30075] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6526'. [ 801.864226][T30069] hsr0: entered allmulticast mode [ 801.879919][T30069] hsr_slave_0: entered allmulticast mode [ 801.886117][T30069] hsr_slave_1: entered allmulticast mode [ 801.905729][T30079] netlink: 'syz.3.6528': attribute type 11 has an invalid length. [ 801.934363][T30069] bridge0: port 3(hsr0) entered blocking state [ 801.941175][T30069] bridge0: port 3(hsr0) entered forwarding state [ 802.058748][T30086] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6529'. [ 802.126374][T30076] netlink: 'syz.2.6524': attribute type 27 has an invalid length. [ 802.556406][T29907] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 802.580542][T29907] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 802.669928][T29907] team0: Port device team_slave_0 added [ 802.754106][T30109] nbd: must specify a size in bytes for the device [ 802.790600][T29907] team0: Port device team_slave_1 added [ 802.933015][T29907] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 802.957093][T29907] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 802.987911][ T5847] Bluetooth: hci3: command tx timeout [ 803.045445][T30124] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6535'. [ 803.055688][T29907] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 803.079987][T29907] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 803.109670][T29907] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 803.171679][T29907] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 803.302876][T30109] lo speed is unknown, defaulting to 1000 [ 803.322921][T29907] hsr_slave_0: entered promiscuous mode [ 803.361174][T29907] hsr_slave_1: entered promiscuous mode [ 803.378038][T29907] debugfs: 'hsr0' already exists in 'hsr' [ 803.384317][T29907] Cannot create hsr debugfs directory [ 803.416615][T30109] wg1 speed is unknown, defaulting to 1000 [ 803.581049][T30150] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6540'. [ 804.784616][T30179] openvswitch: netlink: Tunnel attr 4 has unexpected len 0 expected 1 [ 804.899784][ T7458] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 805.047047][ T5847] Bluetooth: hci3: command tx timeout [ 805.404158][ T12] smc: removing ib device syz0 [ 805.786574][T30196] bridge1: entered allmulticast mode [ 806.255856][T30206] netlink: 'syz.3.6548': attribute type 3 has an invalid length. [ 806.833894][T29907] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 806.882476][T29907] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 806.911360][T29907] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 806.973158][T29907] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 807.021189][T30228] pimreg: entered allmulticast mode [ 807.222262][T30228] bond2: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 807.263800][T30228] bond2 (unregistering): Released all slaves [ 807.309393][T30247] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 807.583233][T29907] 8021q: adding VLAN 0 to HW filter on device bond0 [ 807.615593][T29907] 8021q: adding VLAN 0 to HW filter on device team0 [ 807.671550][ T66] bridge0: port 1(bridge_slave_0) entered blocking state [ 807.679042][ T66] bridge0: port 1(bridge_slave_0) entered forwarding state [ 807.778348][ T1147] bridge0: port 2(bridge_slave_1) entered blocking state [ 807.786126][ T1147] bridge0: port 2(bridge_slave_1) entered forwarding state [ 807.964409][T30276] netlink: 84 bytes leftover after parsing attributes in process `syz.2.6560'. [ 808.109564][T30267] bond1: option lacp_active: invalid value (8) [ 808.190627][T30267] bond1 (unregistering): Released all slaves [ 808.337107][T30268] syzkaller1: entered promiscuous mode [ 808.343526][T30268] syzkaller1: entered allmulticast mode [ 809.024965][T30303] vlan2: entered allmulticast mode [ 809.060567][ T1298] lec:lec_start_xmit: lec0:No lecd attached [ 809.080776][T30303] macvtap0: entered allmulticast mode [ 809.086404][T30303] veth0_macvtap: entered allmulticast mode [ 809.109034][T30320] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6569'. [ 809.182232][T30322] netlink: 'syz.0.6567': attribute type 2 has an invalid length. [ 809.203599][T30330] netlink: 'syz.3.6570': attribute type 1 has an invalid length. [ 809.213201][T30322] tipc: Started in network mode [ 809.217522][T30330] netlink: 'syz.3.6570': attribute type 3 has an invalid length. [ 809.228684][T30322] tipc: Node identity 340008, cluster identity 4711 [ 809.230477][T30330] netlink: 224 bytes leftover after parsing attributes in process `syz.3.6570'. [ 809.235999][T30322] tipc: Node number set to 3407880 [ 809.352246][T29907] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 809.358515][T30330] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6570'. [ 809.494618][T29907] veth0_vlan: entered promiscuous mode [ 809.561470][T29907] veth1_vlan: entered promiscuous mode [ 809.659595][T29907] veth0_macvtap: entered promiscuous mode [ 809.703875][T30351] ip6gre0: Caught tx_queue_len zero misconfig [ 809.735408][T30351] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1536) ! [ 809.788849][T29907] veth1_macvtap: entered promiscuous mode [ 809.835504][T29907] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 809.863529][T29907] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 809.998027][T21927] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.078573][T30365] vlan2: entered allmulticast mode [ 810.093837][T30370] xt_l2tp: invalid flags combination: 8 [ 810.123997][T21927] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.151543][T21927] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.225753][T30356] lo speed is unknown, defaulting to 1000 [ 810.270763][T21927] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.456437][T30373] syzkaller1: entered promiscuous mode [ 810.481048][T30385] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6581'. [ 810.495959][T30373] syzkaller1: entered allmulticast mode [ 810.764019][T30390] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6583'. [ 810.857830][ T7458] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 810.888884][ T7458] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 810.939843][ T7458] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 810.950053][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 810.976941][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 810.982505][T30415] xt_CT: You must specify a L4 protocol and not use inversions on it [ 810.986508][T30415] x_tables: duplicate underflow at hook 3 [ 811.046642][T30408] vlan2: entered allmulticast mode [ 811.118228][ T7458] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 811.216047][ T7458] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 811.241743][ T7458] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 811.505216][T30441] vlan0: entered allmulticast mode [ 811.574901][T30439] syzkaller0: entered promiscuous mode [ 811.582751][T30439] syzkaller0: entered allmulticast mode [ 811.645746][T30451] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6594'. [ 811.822192][T30458] netlink: 'syz.4.6596': attribute type 1 has an invalid length. [ 812.003225][T30474] netlink: 'syz.4.6600': attribute type 13 has an invalid length. [ 812.035473][T30472] pimreg: entered allmulticast mode [ 812.043914][T30474] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6600'. [ 812.175394][T30474] bond2: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 812.211219][T30474] bond2: (slave lo): Enslaving as an active interface with an up link [ 812.225406][T30474] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 812.244983][T30489] netlink: 'syz.0.6602': attribute type 2 has an invalid length. [ 812.248974][T30474] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6600'. [ 812.539583][T30503] syzkaller0: entered promiscuous mode [ 812.560743][T30503] syzkaller0: entered allmulticast mode [ 812.604067][T30510] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6609'. [ 812.883335][T30520] netdevsim netdevsim3 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 813.432767][T30551] x_tables: duplicate underflow at hook 3 [ 813.449449][T30520] netdevsim netdevsim3 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 813.616583][T30520] netdevsim netdevsim3 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 813.696650][T30563] __nla_validate_parse: 2 callbacks suppressed [ 813.696671][T30563] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6618'. [ 813.846585][T30520] netdevsim netdevsim3 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 813.931343][T30568] netlink: 'syz.0.6620': attribute type 1 has an invalid length. [ 814.061346][ T66] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 814.154126][T30574] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1536) ! [ 814.186430][T30577] syzkaller0: entered promiscuous mode [ 814.207239][T30577] syzkaller0: entered allmulticast mode [ 814.275206][T30555] lec:lec_atm_close: lec0: Shut down! [ 814.308206][T30520] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 814.418585][T30589] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6624'. [ 814.639233][T30605] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6628'. [ 814.797155][T30612] netlink: 20 bytes leftover after parsing attributes in process `syz.1.6629'. [ 814.903030][T30617] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6632'. [ 815.101429][T30627] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6633'. [ 815.254195][T30633] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1536) ! [ 815.419425][T30639] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6637'. [ 815.451427][T30640] syzkaller0: entered promiscuous mode [ 815.488748][T30640] syzkaller0: entered allmulticast mode [ 815.810499][T30664] netlink: 'syz.0.6642': attribute type 1 has an invalid length. [ 815.827901][T30664] netlink: 224 bytes leftover after parsing attributes in process `syz.0.6642'. [ 816.193207][T30686] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6650'. [ 816.199361][T30690] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6649'. [ 816.317062][T30651] lec:lec_atm_close: lec0: Shut down! [ 816.347279][T30695] netlink: 'syz.4.6653': attribute type 2 has an invalid length. [ 816.373729][T30695] l24): entered promiscuous mode [ 816.436179][T30695] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 816.462236][T30705] openvswitch: netlink: IP tunnel dst address not specified [ 816.581824][T30704] syzkaller0: entered promiscuous mode [ 816.587800][T30704] syzkaller0: entered allmulticast mode [ 816.750392][T30715] nbd1: detected capacity change from 0 to 63 [ 816.765217][T30721] block nbd1: NBD_DISCONNECT [ 816.797175][T30721] block nbd1: Disconnected due to user request. [ 816.823176][T30721] block nbd1: shutting down sockets [ 816.859357][ C1] blk_print_req_error: 136 callbacks suppressed [ 816.859379][ C1] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 816.875734][ C1] buffer_io_error: 138 callbacks suppressed [ 816.875755][ C1] Buffer I/O error on dev nbd1, logical block 0, async page read [ 816.897015][ C1] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 816.907274][ C1] Buffer I/O error on dev nbd1, logical block 1, async page read [ 816.915192][ C1] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 816.924857][ C1] Buffer I/O error on dev nbd1, logical block 2, async page read [ 816.933358][ C1] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 816.943591][ C1] Buffer I/O error on dev nbd1, logical block 3, async page read [ 816.974254][T29950] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 816.987087][T29950] Buffer I/O error on dev nbd1, logical block 0, async page read [ 817.008326][T29950] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 817.024191][T29950] Buffer I/O error on dev nbd1, logical block 1, async page read [ 817.034338][T29950] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 817.066267][T29950] Buffer I/O error on dev nbd1, logical block 2, async page read [ 817.107066][T29950] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 817.148275][T29950] Buffer I/O error on dev nbd1, logical block 3, async page read [ 817.156401][T29950] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 817.194867][T29950] Buffer I/O error on dev nbd1, logical block 0, async page read [ 817.257065][T29950] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 817.266769][T29950] Buffer I/O error on dev nbd1, logical block 1, async page read [ 817.344795][T29950] ldm_validate_partition_table(): Disk read failed. [ 817.386872][T29950] Dev nbd1: unable to read RDB block 0 [ 817.434162][T29950] nbd1: unable to read partition table [ 817.485861][T29950] ldm_validate_partition_table(): Disk read failed. [ 817.506311][T29950] Dev nbd1: unable to read RDB block 0 [ 817.513593][T29950] nbd1: unable to read partition table [ 817.545204][T30763] syzkaller0: entered promiscuous mode [ 817.572865][T30763] syzkaller0: entered allmulticast mode [ 817.726014][T29582] udevd[29582]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 817.757645][T30764] udevd[30764]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 817.786233][T30769] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 817.873750][T30744] lec:lec_atm_close: lec0: Shut down! [ 817.911615][T30776] xfrm1: entered promiscuous mode [ 817.920183][T30776] xfrm1: entered allmulticast mode [ 818.672241][T29084] IPVS: starting estimator thread 0... [ 818.777014][T30820] IPVS: using max 30 ests per chain, 72000 per kthread [ 818.850240][T30828] tipc: Started in network mode [ 818.874332][T30828] tipc: Node identity 0ee5c0f1966b, cluster identity 4711 [ 818.892916][T30828] tipc: Enabled bearer , priority 0 [ 818.912570][T30829] syzkaller0: entered promiscuous mode [ 818.937694][T30829] syzkaller0: entered allmulticast mode [ 818.956429][T30834] __nla_validate_parse: 11 callbacks suppressed [ 818.956450][T30834] netlink: 64 bytes leftover after parsing attributes in process `syz.3.6694'. [ 819.003859][T30828] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6695'. [ 819.016699][T30832] A link change request failed with some changes committed already. Interface ip6gre0 may have been left with an inconsistent configuration, please check. [ 819.043636][T29084] hid-generic 0005:0D36:0006.0002: item fetching failed at offset 0/1 [ 819.053666][T30827] tipc: Resetting bearer [ 819.068486][T29084] hid-generic 0005:0D36:0006.0002: probe with driver hid-generic failed with error -22 [ 819.107055][T30827] tipc: Disabling bearer [ 819.129936][T30839] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6697'. [ 819.146680][T30839] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6697'. [ 819.287188][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 819.610843][T30874] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6708'. [ 819.830349][T30886] netlink: 212348 bytes leftover after parsing attributes in process `syz.3.6711'. [ 820.169480][T30871] lec:lec_atm_close: lec0: Shut down! [ 820.187955][T30901] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6714'. [ 820.483978][T30911] netlink: 'syz.0.6719': attribute type 7 has an invalid length. [ 820.494352][T30911] netlink: 'syz.0.6719': attribute type 8 has an invalid length. [ 820.572818][T30917] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6721'. [ 820.662572][T30924] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6722'. [ 821.133181][T30946] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6731'. [ 821.255065][T30950] x_tables: duplicate underflow at hook 2 [ 821.560317][T30971] netlink: 'syz.3.6739': attribute type 39 has an invalid length. [ 821.733284][T30983] x_tables: ip6_tables: TCPOPTSTRIP target: only valid in mangle table, not raw [ 821.776473][T30984] lo speed is unknown, defaulting to 1000 [ 822.872070][T31027] sctp: [Deprecated]: syz.0.6758 (pid 31027) Use of struct sctp_assoc_value in delayed_ack socket option. [ 822.872070][T31027] Use struct sctp_sack_info instead [ 823.247120][T31018] lec:lec_atm_close: lec0: Shut down! [ 823.574128][T31071] lo: Caught tx_queue_len zero misconfig [ 823.708692][T31079] netlink: 'syz.2.6772': attribute type 13 has an invalid length. [ 823.718996][T31079] netlink: 'syz.2.6772': attribute type 12 has an invalid length. [ 823.780073][T31080] netlink: 'syz.2.6772': attribute type 13 has an invalid length. [ 823.799393][T31080] netlink: 'syz.2.6772': attribute type 12 has an invalid length. [ 824.097242][T31092] nbd2: detected capacity change from 0 to 63 [ 824.123031][T31096] block nbd2: NBD_DISCONNECT [ 824.131139][T31096] block nbd2: Disconnected due to user request. [ 824.177031][T31097] syzkaller0: entered promiscuous mode [ 824.183074][T31096] block nbd2: shutting down sockets [ 824.189028][T31097] syzkaller0: entered allmulticast mode [ 824.205043][ C1] blk_print_req_error: 138 callbacks suppressed [ 824.205065][ C1] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 824.222067][ C1] buffer_io_error: 138 callbacks suppressed [ 824.222088][ C1] Buffer I/O error on dev nbd2, logical block 0, async page read [ 824.236295][ C1] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 824.247087][ C1] Buffer I/O error on dev nbd2, logical block 1, async page read [ 824.255271][ C1] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 824.265174][ C1] Buffer I/O error on dev nbd2, logical block 2, async page read [ 824.273223][ C1] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 824.282868][ C1] Buffer I/O error on dev nbd2, logical block 3, async page read [ 824.300651][T30764] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 824.310579][T30764] Buffer I/O error on dev nbd2, logical block 0, async page read [ 824.319375][T30764] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 824.329858][T30764] Buffer I/O error on dev nbd2, logical block 1, async page read [ 824.339051][T30764] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 824.349386][T30764] Buffer I/O error on dev nbd2, logical block 2, async page read [ 824.357885][T30764] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 824.368284][T30764] Buffer I/O error on dev nbd2, logical block 3, async page read [ 824.377046][T30764] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 824.386718][T30764] Buffer I/O error on dev nbd2, logical block 0, async page read [ 824.395862][T30764] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 824.406425][T30764] Buffer I/O error on dev nbd2, logical block 1, async page read [ 824.437655][T30764] ldm_validate_partition_table(): Disk read failed. [ 824.452314][T30764] Dev nbd2: unable to read RDB block 0 [ 824.464747][T30764] nbd2: unable to read partition table [ 824.486638][T30764] ldm_validate_partition_table(): Disk read failed. [ 824.501124][T30764] Dev nbd2: unable to read RDB block 0 [ 824.535585][T30764] nbd2: unable to read partition table [ 824.728645][T31100] netlink: 'syz.1.6779': attribute type 1 has an invalid length. [ 827.231118][T31100] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 827.326158][T31106] syz_tun: entered allmulticast mode [ 827.344452][T31106] syz_tun: left allmulticast mode [ 827.428509][T31128] __nla_validate_parse: 7 callbacks suppressed [ 827.428532][T31128] netlink: 32 bytes leftover after parsing attributes in process `syz.0.6783'. [ 827.703890][T31143] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6785'. [ 827.801986][T31149] netlink: 20 bytes leftover after parsing attributes in process `syz.0.6790'. [ 827.922778][T31138] tipc: Started in network mode [ 827.958229][T31138] tipc: Node identity fac34ad7a5e5, cluster identity 4711 [ 827.965736][T31138] tipc: Enabled bearer , priority 0 [ 827.996490][T31153] vlan2: entered allmulticast mode [ 828.074850][T31144] syzkaller0: entered promiscuous mode [ 828.097126][T31144] syzkaller0: entered allmulticast mode [ 828.163195][T31138] tipc: Resetting bearer [ 828.204278][T31160] bridge0: port 1(bridge_slave_0) entered disabled state [ 828.255065][T31160] bridge_slave_0 (unregistering): left allmulticast mode [ 828.285332][T31160] bridge_slave_0 (unregistering): left promiscuous mode [ 828.293259][T31146] lec:lec_atm_close: lec0: Shut down! [ 828.297157][T31160] bridge0: port 1(bridge_slave_0) entered disabled state [ 828.334527][T31138] tipc: Resetting bearer [ 828.362890][T31138] tipc: Disabling bearer [ 828.521583][T31170] netlink: 'syz.3.6796': attribute type 10 has an invalid length. [ 828.560650][T31174] netlink: 'syz.0.6798': attribute type 1 has an invalid length. [ 828.571966][T31170] netlink: 2 bytes leftover after parsing attributes in process `syz.3.6796'. [ 828.585648][T31173] netlink: 212340 bytes leftover after parsing attributes in process `syz.1.6797'. [ 828.595854][T31173] openvswitch: netlink: Message has 16 unknown bytes. [ 828.640897][T31170] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 828.652518][T31170] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 828.752335][T31176] netlink: 'syz.3.6796': attribute type 27 has an invalid length. [ 828.755104][T31184] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6803'. [ 828.763771][T31185] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 828.869823][T31185] xt_cgroup: path and classid specified [ 828.885851][T31185] IPVS: set_ctl: invalid protocol: 51 255.255.255.255:20004 [ 828.953510][T31193] vlan0: entered allmulticast mode [ 829.088626][T31202] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 829.096845][T31202] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 829.227564][T31201] netlink: 'syz.1.6806': attribute type 12 has an invalid length. [ 829.628544][T31222] bridge0: port 2(bridge_slave_1) entered disabled state [ 829.841653][T31234] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6815'. [ 829.920862][T31242] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6816'. [ 829.931934][T31243] netlink: 72 bytes leftover after parsing attributes in process `syz.4.6815'. [ 830.029416][T31249] netlink: 'syz.0.6818': attribute type 10 has an invalid length. [ 830.060612][T31247] bridge1: entered promiscuous mode [ 830.066326][T31247] bridge1: entered allmulticast mode [ 830.071991][T31249] netlink: 2 bytes leftover after parsing attributes in process `syz.0.6818'. [ 830.104564][T31247] team0: Failed to send port change of device bridge1 via netlink (err -105) [ 830.131095][T31247] team0: Failed to send options change via netlink (err -105) [ 830.172026][T31247] team0: Port device bridge1 added [ 830.262789][T31256] vlan2: entered allmulticast mode [ 830.268467][T31250] netlink: 'syz.0.6818': attribute type 27 has an invalid length. [ 830.931388][T31276] nbd1: detected capacity change from 0 to 63 [ 830.976017][T31284] block nbd1: NBD_DISCONNECT [ 830.981271][T31284] block nbd1: Disconnected due to user request. [ 831.006079][T31284] block nbd1: shutting down sockets [ 831.041788][ C1] blk_print_req_error: 138 callbacks suppressed [ 831.041812][ C1] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 831.058464][ C1] buffer_io_error: 138 callbacks suppressed [ 831.058484][ C1] Buffer I/O error on dev nbd1, logical block 0, async page read [ 831.075868][ C1] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 831.085883][ C1] Buffer I/O error on dev nbd1, logical block 1, async page read [ 831.094143][ C1] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 831.103793][ C1] Buffer I/O error on dev nbd1, logical block 2, async page read [ 831.111860][ C1] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 831.122045][ C1] Buffer I/O error on dev nbd1, logical block 3, async page read [ 831.137213][T30764] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 831.159719][T30764] Buffer I/O error on dev nbd1, logical block 0, async page read [ 831.222141][T30764] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 831.262659][T30764] Buffer I/O error on dev nbd1, logical block 1, async page read [ 831.329638][T30764] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 831.357864][T31295] veth5: entered allmulticast mode [ 831.370508][T31295] bond3: (slave veth5): Enslaving as an active interface with an up link [ 831.377248][T30764] Buffer I/O error on dev nbd1, logical block 2, async page read [ 831.402818][T30764] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 831.415496][T30764] Buffer I/O error on dev nbd1, logical block 3, async page read [ 831.429028][T30764] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 831.442987][T30764] Buffer I/O error on dev nbd1, logical block 0, async page read [ 831.452856][T31298] bond3 (unregistering): (slave veth5): Releasing backup interface [ 831.469956][T30764] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 831.483375][T31298] bond3 (unregistering): Released all slaves [ 831.507091][T30764] Buffer I/O error on dev nbd1, logical block 1, async page read [ 831.531434][T31299] lo speed is unknown, defaulting to 1000 [ 831.544868][T30764] ldm_validate_partition_table(): Disk read failed. [ 831.582582][T30764] Dev nbd1: unable to read RDB block 0 [ 831.589267][T30764] nbd1: unable to read partition table [ 831.602133][T30764] ldm_validate_partition_table(): Disk read failed. [ 831.681825][T30764] Dev nbd1: unable to read RDB block 0 [ 831.700727][T30764] nbd1: unable to read partition table [ 832.147809][T31333] nbd2: detected capacity change from 0 to 63 [ 832.159792][T31340] block nbd2: NBD_DISCONNECT [ 832.165700][T31340] block nbd2: Disconnected due to user request. [ 832.179645][T31340] block nbd2: shutting down sockets [ 832.213503][T30764] ldm_validate_partition_table(): Disk read failed. [ 832.228292][T30764] Dev nbd2: unable to read RDB block 0 [ 832.256398][T30764] nbd2: unable to read partition table [ 832.283219][T30764] ldm_validate_partition_table(): Disk read failed. [ 832.305467][T30764] Dev nbd2: unable to read RDB block 0 [ 832.324760][T30764] nbd2: unable to read partition table [ 832.653069][T31360] __nla_validate_parse: 7 callbacks suppressed [ 832.653091][T31360] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6850'. [ 832.738395][T31362] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6851'. [ 832.753749][T31363] netlink: 'syz.2.6851': attribute type 1 has an invalid length. [ 832.764062][T31363] netlink: 224 bytes leftover after parsing attributes in process `syz.2.6851'. [ 833.081109][T31378] netlink: 76 bytes leftover after parsing attributes in process `syz.0.6856'. [ 833.091597][T31378] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 833.142492][T31378] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6856'. [ 833.257728][T31382] nbd1: detected capacity change from 0 to 63 [ 833.273181][T31386] block nbd1: NBD_DISCONNECT [ 833.296927][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 833.305626][ C0] lec:lec_tx_timeout: lec0 [ 833.311140][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 833.318272][T31386] block nbd1: Disconnected due to user request. [ 833.334074][T31386] block nbd1: shutting down sockets [ 833.401338][T31380] netlink: 'syz.0.6856': attribute type 1 has an invalid length. [ 833.410203][T31380] netlink: 'syz.0.6856': attribute type 3 has an invalid length. [ 833.419254][T30764] ldm_validate_partition_table(): Disk read failed. [ 833.428317][T31380] netlink: 'syz.0.6856': attribute type 1 has an invalid length. [ 833.437357][T30764] Dev nbd1: unable to read RDB block 0 [ 833.445139][T30764] nbd1: unable to read partition table [ 833.447464][T31380] netlink: 140 bytes leftover after parsing attributes in process `syz.0.6856'. [ 833.483320][T30764] ldm_validate_partition_table(): Disk read failed. [ 833.524857][T30764] Dev nbd1: unable to read RDB block 0 [ 833.546407][T30764] nbd1: unable to read partition table [ 833.559623][T31399] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6861'. [ 833.609689][T31402] netlink: 48 bytes leftover after parsing attributes in process `syz.0.6862'. [ 833.887483][T31414] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6867'. [ 833.899772][T31413] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6869'. [ 834.172410][T31425] bridge0: port 3(hsr0) entered disabled state [ 834.179317][T31425] bridge0: port 1(bridge_slave_0) entered disabled state [ 834.315544][T31425] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 834.322901][T31439] can: request_module (can-proto-0) failed. [ 834.339583][T31425] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 834.526299][T31425] veth0_macvtap: left allmulticast mode [ 834.663220][ T7458] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.713887][ T7458] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.735447][ T7458] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 834.955587][ T7458] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 835.093564][T31476] macvlan2: entered promiscuous mode [ 835.118772][T31476] macvlan2: entered allmulticast mode [ 835.134787][T31476] veth1_to_batadv: entered allmulticast mode [ 835.172074][T31474] lo speed is unknown, defaulting to 1000 [ 835.456372][T31495] netlink: 'syz.4.6889': attribute type 6 has an invalid length. [ 835.481788][T31498] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 835.598001][T31503] syzkaller1: entered promiscuous mode [ 835.609911][T31503] syzkaller1: entered allmulticast mode [ 835.784188][T31521] netdevsim netdevsim4: Direct firmware load for  failed with error -2 [ 835.837660][T31521] netdevsim netdevsim4: Falling back to sysfs fallback for:  [ 835.882584][T31520] netdevsim netdevsim4: Direct firmware load for  failed with error -2 [ 835.906288][T31520] netdevsim netdevsim4: Falling back to sysfs fallback for:  [ 836.022832][T31538] netlink: 'syz.0.6901': attribute type 20 has an invalid length. [ 836.063152][T31538] netlink: 'syz.0.6901': attribute type 20 has an invalid length. [ 836.085815][ T66] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 836.098544][ T66] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 836.114770][ T66] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 836.152151][T31547] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 836.170156][T31542] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 836.227316][ T66] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 836.280144][T31554] netlink: 'syz.0.6906': attribute type 1 has an invalid length. [ 836.298298][T31555] netlink: 'syz.0.6906': attribute type 1 has an invalid length. [ 836.517463][T31567] netlink: 'syz.1.6907': attribute type 16 has an invalid length. [ 836.745483][T31566] syzkaller0: entered promiscuous mode [ 836.752960][T31566] syzkaller0: entered allmulticast mode [ 836.927956][T31567] netlink: 'syz.1.6907': attribute type 1 has an invalid length. [ 837.009571][T31596] vlan2: entered allmulticast mode [ 838.053887][T31620] lec:lec_atm_close: lec0: Shut down! [ 838.071668][T31643] netlink: 'syz.4.6926': attribute type 1 has an invalid length. [ 838.121789][T31643] bond3: (slave geneve3): making interface the new active one [ 838.132993][T31643] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 838.143563][ T1147] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 838.153081][ T1147] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 838.166315][ T1147] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 838.178195][ T1147] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 838.278198][T31649] __nla_validate_parse: 11 callbacks suppressed [ 838.278219][T31649] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6929'. [ 838.778619][T31688] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6939'. [ 838.788619][T31688] netlink: 'syz.2.6939': attribute type 25 has an invalid length. [ 838.797055][T31688] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6939'. [ 839.002281][T31702] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6945'. [ 839.007007][T31683] nbd3: detected capacity change from 0 to 63 [ 839.043482][T31693] block nbd3: NBD_DISCONNECT [ 839.060375][T31693] block nbd3: Disconnected due to user request. [ 839.066852][T31693] block nbd3: shutting down sockets [ 839.137188][ C1] blk_print_req_error: 431 callbacks suppressed [ 839.137214][ C1] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 839.153430][ C1] buffer_io_error: 434 callbacks suppressed [ 839.153450][ C1] Buffer I/O error on dev nbd3, logical block 0, async page read [ 839.167413][ C1] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 839.176995][ C1] Buffer I/O error on dev nbd3, logical block 1, async page read [ 839.185106][ C1] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 839.195022][ C1] Buffer I/O error on dev nbd3, logical block 2, async page read [ 839.203320][ C1] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 839.213491][ C1] Buffer I/O error on dev nbd3, logical block 3, async page read [ 839.247070][T30764] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 839.269323][T30764] Buffer I/O error on dev nbd3, logical block 0, async page read [ 839.290399][T30764] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 839.330750][T30764] Buffer I/O error on dev nbd3, logical block 1, async page read [ 839.362538][T30764] I/O error, dev nbd3, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 839.376087][T31712] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6950'. [ 839.400154][T30764] Buffer I/O error on dev nbd3, logical block 2, async page read [ 839.457143][T30764] I/O error, dev nbd3, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 839.484108][T30764] Buffer I/O error on dev nbd3, logical block 3, async page read [ 839.527299][T30764] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 839.538780][T31724] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6954'. [ 839.550102][T30764] Buffer I/O error on dev nbd3, logical block 0, async page read [ 839.579582][T30764] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 839.608645][T31734] netlink: 48 bytes leftover after parsing attributes in process `syz.3.6957'. [ 839.618102][T30764] Buffer I/O error on dev nbd3, logical block 1, async page read [ 839.647191][T30764] ldm_validate_partition_table(): Disk read failed. [ 839.654285][T30764] Dev nbd3: unable to read RDB block 0 [ 839.671551][T30764] nbd3: unable to read partition table [ 839.697000][T31739] xt_hashlimit: overflow, try lower: 0/0 [ 839.711333][T31738] netlink: 'syz.0.6959': attribute type 1 has an invalid length. [ 839.731005][T30764] ldm_validate_partition_table(): Disk read failed. [ 839.757447][T30764] Dev nbd3: unable to read RDB block 0 [ 839.768992][T30764] nbd3: unable to read partition table [ 839.771008][T31744] netlink: 100 bytes leftover after parsing attributes in process `syz.1.6958'. [ 839.807088][T31738] bond3: (slave bridge1): making interface the new active one [ 839.819153][T31738] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 839.841938][T31738] bond3: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 840.135780][T31754] bond3: option fail_over_mac: invalid value (127) [ 840.155758][T31754] bond3 (unregistering): Released all slaves [ 840.522741][T31781] netlink: 68 bytes leftover after parsing attributes in process `syz.1.6972'. [ 840.639185][T31792] openvswitch: netlink: Flow key attr not present in new flow. [ 840.640032][T31790] ip6gre1: entered promiscuous mode [ 840.654784][T31792] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6977'. [ 841.875483][T31861] bond1: entered promiscuous mode [ 841.883782][T31861] 8021q: adding VLAN 0 to HW filter on device bond1 [ 842.448878][T31884] bond4 (unregistering): Released all slaves [ 842.702432][T31902] bond4: entered allmulticast mode [ 842.708595][T31902] 8021q: adding VLAN 0 to HW filter on device bond4 [ 842.716611][T31904] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1448) ! [ 843.099918][T31935] team0: entered promiscuous mode [ 843.105187][T31935] team_slave_0: entered promiscuous mode [ 843.138877][T31942] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 843.147101][T31935] team_slave_1: entered promiscuous mode [ 843.154704][T31935] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 843.277811][T31950] xt_hashlimit: size too large, truncated to 1048576 [ 843.286951][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5240 ms [ 843.295646][ C0] lec:lec_tx_timeout: lec0 [ 843.325277][T31946] vlan0: entered allmulticast mode [ 843.414335][T31953] –: renamed from vxcan1 [ 843.548036][T31961] netlink: 'syz.2.7030': attribute type 39 has an invalid length. [ 843.632111][T31969] sctp: [Deprecated]: syz.3.7029 (pid 31969) Use of struct sctp_assoc_value in delayed_ack socket option. [ 843.632111][T31969] Use struct sctp_sack_info instead [ 843.747426][T31971] geneve2: entered promiscuous mode [ 843.762871][T31974] __nla_validate_parse: 15 callbacks suppressed [ 843.762886][T31974] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7033'. [ 843.832373][T31976] netlink: 48 bytes leftover after parsing attributes in process `syz.2.7035'. [ 843.859113][T31979] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7034'. [ 843.870285][T31979] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7034'. [ 844.878178][T32008] vlan2: entered allmulticast mode [ 845.231981][T32024] netlink: 48 bytes leftover after parsing attributes in process `syz.2.7047'. [ 845.573171][T32037] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7049'. [ 846.967060][ T5833] Bluetooth: hci1: command 0x0406 tx timeout [ 847.273511][T31996] Set syz1 is full, maxelem 65536 reached [ 848.691158][T32026] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7048'. [ 848.792836][T32051] netlink: 'syz.1.7054': attribute type 1 has an invalid length. [ 848.841532][T32053] netlink: 'syz.3.7055': attribute type 10 has an invalid length. [ 848.860023][T32051] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 848.877296][T32053] netlink: 2 bytes leftover after parsing attributes in process `syz.3.7055'. [ 848.966626][T32057] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7056'. [ 849.019104][T32062] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7056'. [ 849.093577][T32055] netlink: 'syz.3.7055': attribute type 27 has an invalid length. [ 849.150396][T32059] netlink: 'syz.4.7057': attribute type 13 has an invalid length. [ 849.260565][T32068] lo speed is unknown, defaulting to 1000 [ 849.383055][T32071] lo speed is unknown, defaulting to 1000 [ 849.418286][T32073] netlink: 156 bytes leftover after parsing attributes in process `syz.4.7060'. [ 849.446260][T32073] netlink: 156 bytes leftover after parsing attributes in process `syz.4.7060'. [ 850.427646][T32117] nbd0: detected capacity change from 0 to 63 [ 850.439857][T32124] block nbd0: NBD_DISCONNECT [ 850.458040][T32124] block nbd0: Disconnected due to user request. [ 850.471165][T31952] blk_print_req_error: 138 callbacks suppressed [ 850.471185][T31952] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 850.490057][T31952] buffer_io_error: 138 callbacks suppressed [ 850.490076][T31952] Buffer I/O error on dev nbd0, logical block 0, async page read [ 850.504491][T31952] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 850.518885][T31952] Buffer I/O error on dev nbd0, logical block 1, async page read [ 850.527082][T31952] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 850.537566][T31952] Buffer I/O error on dev nbd0, logical block 2, async page read [ 850.545549][T31952] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 850.556425][T31952] Buffer I/O error on dev nbd0, logical block 3, async page read [ 850.566338][T31952] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 850.576936][T31952] Buffer I/O error on dev nbd0, logical block 0, async page read [ 850.584945][T31952] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 850.595344][T31952] Buffer I/O error on dev nbd0, logical block 1, async page read [ 850.603814][T31952] I/O error, dev nbd0, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 850.615601][T32124] block nbd0: shutting down sockets [ 850.659999][T31952] Buffer I/O error on dev nbd0, logical block 2, async page read [ 850.715349][ T1677] I/O error, dev nbd0, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 850.725940][ T1677] Buffer I/O error on dev nbd0, logical block 3, async page read [ 850.735410][T31952] I/O error, dev nbd0, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 850.746278][T31952] Buffer I/O error on dev nbd0, logical block 0, async page read [ 850.754905][T31952] I/O error, dev nbd0, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 850.765459][T31952] Buffer I/O error on dev nbd0, logical block 1, async page read [ 850.776636][T31952] ldm_validate_partition_table(): Disk read failed. [ 850.784603][T31952] Dev nbd0: unable to read RDB block 0 [ 850.790918][T31952] nbd0: unable to read partition table [ 850.810538][T31952] ldm_validate_partition_table(): Disk read failed. [ 850.818012][T31952] Dev nbd0: unable to read RDB block 0 [ 850.824320][T31952] nbd0: unable to read partition table [ 850.912216][T32135] netlink: 'syz.4.7075': attribute type 10 has an invalid length. [ 850.940040][T32135] netlink: 2 bytes leftover after parsing attributes in process `syz.4.7075'. [ 851.201362][T32138] netlink: 'syz.4.7075': attribute type 27 has an invalid length. [ 853.148842][T32109] bridge0: entered promiscuous mode [ 853.155586][T32109] team0: Port device bridge0 added [ 853.162587][T32118] team0: left promiscuous mode [ 853.167768][T32118] team_slave_0: left promiscuous mode [ 853.173837][T32118] team_slave_1: left promiscuous mode [ 853.180337][T32118] bridge0: left promiscuous mode [ 853.246177][T32135] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 853.269290][T32135] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 853.492900][T32159] netlink: 224 bytes leftover after parsing attributes in process `syz.0.7082'. [ 853.538986][T32153] vlan2: entered allmulticast mode [ 853.721669][T32166] syzkaller0: entered promiscuous mode [ 853.731732][T32166] syzkaller0: entered allmulticast mode [ 853.853184][T32172] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7086'. [ 853.975072][T32175] IPVS: set_ctl: invalid protocol: 135 172.20.20.170:20004 [ 854.060057][T32176] block nbd0: Unsupported socket: should be TCP or UNIX. [ 854.224797][T32176] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7088'. [ 854.274884][T32187] netlink: 'syz.2.7090': attribute type 10 has an invalid length. [ 854.315737][T32187] netlink: 2 bytes leftover after parsing attributes in process `syz.2.7090'. [ 854.339243][T32187] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 854.352220][T32187] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 854.507193][T32193] netlink: 'syz.2.7090': attribute type 27 has an invalid length. [ 854.689453][T32208] netlink: 52 bytes leftover after parsing attributes in process `syz.0.7093'. [ 854.768516][T32214] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7095'. [ 855.137588][T32218] xfrm0: entered allmulticast mode [ 855.252318][T32225] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 855.259850][T32225] IPv6: NLM_F_CREATE should be set when creating new route [ 855.267313][T32225] IPv6: NLM_F_CREATE should be set when creating new route [ 855.278058][T32224] netlink: 16146 bytes leftover after parsing attributes in process `syz.1.7099'. [ 855.337906][T32223] A link change request failed with some changes committed already. Interface macvlan0 may have been left with an inconsistent configuration, please check. [ 855.385587][T32236] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7101'. [ 855.459414][T32236] 8021q: adding VLAN 0 to HW filter on device bond1 [ 855.603160][T32229] macsec1: entered promiscuous mode [ 855.614292][T32243] nbd1: detected capacity change from 0 to 63 [ 855.650373][T32252] block nbd1: NBD_DISCONNECT [ 855.659128][T32229] bond1: entered promiscuous mode [ 855.686084][T32252] block nbd1: Disconnected due to user request. [ 855.714790][T32229] bond1: left promiscuous mode [ 855.721162][T32252] block nbd1: shutting down sockets [ 855.870045][ C1] blk_print_req_error: 138 callbacks suppressed [ 855.870068][ C1] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 855.886964][ C1] buffer_io_error: 138 callbacks suppressed [ 855.886989][ C1] Buffer I/O error on dev nbd1, logical block 0, async page read [ 855.901478][ C1] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 855.911289][ C1] Buffer I/O error on dev nbd1, logical block 1, async page read [ 855.920145][ C1] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 855.930655][ C1] Buffer I/O error on dev nbd1, logical block 2, async page read [ 855.938894][ C1] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 855.948983][ C1] Buffer I/O error on dev nbd1, logical block 3, async page read [ 855.975208][T31952] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 855.985724][T31952] Buffer I/O error on dev nbd1, logical block 0, async page read [ 855.994275][T31952] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 856.004542][T31952] Buffer I/O error on dev nbd1, logical block 1, async page read [ 856.037462][T31952] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 856.052392][T31952] Buffer I/O error on dev nbd1, logical block 2, async page read [ 856.061948][T31952] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 856.097252][T31952] Buffer I/O error on dev nbd1, logical block 3, async page read [ 856.105386][T31952] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 856.168272][T31952] Buffer I/O error on dev nbd1, logical block 0, async page read [ 856.176730][T31952] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 856.237196][T31952] Buffer I/O error on dev nbd1, logical block 1, async page read [ 856.359734][T32269] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7108'. [ 856.363680][T31952] ldm_validate_partition_table(): Disk read failed. [ 856.401308][T31952] Dev nbd1: unable to read RDB block 0 [ 856.423123][T31952] nbd1: unable to read partition table [ 856.444330][T31952] ldm_validate_partition_table(): Disk read failed. [ 856.484690][T31952] Dev nbd1: unable to read RDB block 0 [ 856.510134][T31952] nbd1: unable to read partition table [ 856.556226][T32248] lec:lec_atm_close: lec0: Shut down! [ 856.665894][T32284] netlink: 'syz.2.7111': attribute type 10 has an invalid length. [ 856.698038][T32284] netlink: 2 bytes leftover after parsing attributes in process `syz.2.7111'. [ 856.830792][T32278] netlink: 'syz.4.7107': attribute type 2 has an invalid length. [ 856.870412][T32278] netlink: 132 bytes leftover after parsing attributes in process `syz.4.7107'. [ 856.882193][T32292] netlink: 'syz.2.7111': attribute type 27 has an invalid length. [ 856.912686][T32278] netlink: 20 bytes leftover after parsing attributes in process `syz.4.7107'. [ 857.088102][T32295] can: request_module (can-proto-0) failed. [ 857.093514][T32298] netlink: 'syz.3.7114': attribute type 2 has an invalid length. [ 857.107908][T32298] úÁàél24): entered promiscuous mode [ 857.624952][T32322] syzkaller0: entered promiscuous mode [ 857.647452][T32322] syzkaller0: entered allmulticast mode [ 857.763543][T32334] netlink: 'syz.2.7120': attribute type 2 has an invalid length. [ 857.789792][T32329] sch_tbf: peakrate 11 is lower than or equals to rate 996173156578218475 ! [ 858.299937][T32362] openvswitch: netlink: Unexpected mask (mask=2200040, allowed=2010048) [ 858.419053][T32366] netlink: 'syz.4.7130': attribute type 10 has an invalid length. [ 858.528934][T32375] netlink: 'syz.4.7130': attribute type 27 has an invalid length. [ 858.600326][T32376] syzkaller0: entered promiscuous mode [ 858.606195][T32376] syzkaller0: entered allmulticast mode [ 858.620520][T32376] 0: reclassify loop, rule prio 0, protocol 800 [ 859.062461][T32364] lec:lec_atm_close: lec0: Shut down! [ 859.070511][T32364] FAULT_INJECTION: forcing a failure. [ 859.070511][T32364] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 859.084414][T32364] CPU: 0 UID: 0 PID: 32364 Comm: syz.2.7129 Not tainted syzkaller #0 PREEMPT(full) [ 859.084438][T32364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 859.084450][T32364] Call Trace: [ 859.084457][T32364] [ 859.084465][T32364] dump_stack_lvl+0xe8/0x150 [ 859.084492][T32364] should_fail_ex+0x412/0x560 [ 859.084521][T32364] _copy_to_user+0x31/0xb0 [ 859.084545][T32364] simple_read_from_buffer+0xe1/0x170 [ 859.084572][T32364] proc_fail_nth_read+0x1bb/0x230 [ 859.084597][T32364] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 859.084624][T32364] ? rw_verify_area+0x2a6/0x4d0 [ 859.084643][T32364] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 859.084666][T32364] vfs_read+0x20c/0xa70 [ 859.084809][T32364] ? fdget_pos+0x246/0x320 [ 859.084831][T32364] ? __pfx___mutex_lock+0x10/0x10 [ 859.084857][T32364] ? __pfx_vfs_read+0x10/0x10 [ 859.084877][T32364] ? __fget_files+0x2a/0x420 [ 859.084895][T32364] ? __fget_files+0x3a0/0x420 [ 859.084908][T32364] ? __fget_files+0x2a/0x420 [ 859.084931][T32364] ksys_read+0x150/0x270 [ 859.084950][T32364] ? __pfx_ksys_read+0x10/0x10 [ 859.084974][T32364] do_syscall_64+0x14d/0xf80 [ 859.084991][T32364] ? trace_irq_disable+0x3b/0x150 [ 859.085005][T32364] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.085023][T32364] ? clear_bhb_loop+0x40/0x90 [ 859.085044][T32364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 859.085060][T32364] RIP: 0033:0x7f1bfa35d04e [ 859.085077][T32364] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 859.085091][T32364] RSP: 002b:00007f1bfb2bbfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 859.085113][T32364] RAX: ffffffffffffffda RBX: 00007f1bfb2bc6c0 RCX: 00007f1bfa35d04e [ 859.085126][T32364] RDX: 000000000000000f RSI: 00007f1bfb2bc0a0 RDI: 000000000000000e [ 859.085137][T32364] RBP: 00007f1bfb2bc090 R08: 0000000000000000 R09: 0000000000000000 [ 859.085148][T32364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 859.085158][T32364] R13: 00007f1bfa616038 R14: 00007f1bfa615fa0 R15: 00007ffef69bda88 [ 859.085185][T32364] [ 859.555580][T32381] netlink: 'syz.3.7133': attribute type 1 has an invalid length. [ 859.583723][T32381] __nla_validate_parse: 5 callbacks suppressed [ 859.583744][T32381] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7133'. [ 859.668315][T32381] netlink: 'syz.3.7133': attribute type 32 has an invalid length. [ 859.874098][T32398] netlink: 830 bytes leftover after parsing attributes in process `syz.3.7137'. [ 859.975599][T32398] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7137'. [ 860.014670][T32402] ip6gretap0: entered promiscuous mode [ 860.067712][T32398] bond3: entered promiscuous mode [ 860.105262][T32398] 8021q: adding VLAN 0 to HW filter on device bond3 [ 860.139849][T32398] bond3 (unregistering): Released all slaves [ 860.269547][T32412] netlink: 'syz.2.7142': attribute type 10 has an invalid length. [ 860.278640][T32412] netlink: 2 bytes leftover after parsing attributes in process `syz.2.7142'. [ 860.447111][T32412] netlink: 'syz.2.7142': attribute type 27 has an invalid length. [ 860.485733][T32417] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7144'. [ 860.939192][T32420] ip6gretap1: left allmulticast mode [ 860.946825][T32420] geneve2: left promiscuous mode [ 860.972990][T32420] xfrm1: left promiscuous mode [ 860.978569][T32420] xfrm1: left allmulticast mode [ 860.984904][T32420] bridge1: left promiscuous mode [ 860.991411][T32420] bridge1: left allmulticast mode [ 860.999748][T32420] veth5: left allmulticast mode [ 861.049965][ T127] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 861.061320][ T127] netdevsim netdevsim4 netdevsim0: unset [1, 1] type 2 family 0 port 20004 - 0 [ 861.118598][ T127] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 861.129680][ T127] netdevsim netdevsim4 netdevsim1: unset [1, 1] type 2 family 0 port 20004 - 0 [ 861.141573][ T127] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 861.151928][ T127] netdevsim netdevsim4 netdevsim2: unset [1, 1] type 2 family 0 port 20004 - 0 [ 861.162215][ T127] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 861.175328][ T127] netdevsim netdevsim4 netdevsim3: unset [1, 1] type 2 family 0 port 20004 - 0 [ 861.232618][T32441] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7148'. [ 861.400057][T32451] netlink: 48 bytes leftover after parsing attributes in process `syz.2.7152'. [ 861.433138][T32455] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7153'. [ 861.439761][T32454] xt_l2tp: v2 sid > 0xffff: 4294967293 [ 861.446108][T32455] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7153'. [ 861.489390][T32459] openvswitch: netlink: Actions may not be safe on all matching packets [ 861.562647][T32466] netlink: 'syz.2.7156': attribute type 10 has an invalid length. [ 861.572072][T32461] block nbd0: server does not support multiple connections per device. [ 861.588772][T32466] netlink: 2 bytes leftover after parsing attributes in process `syz.2.7156'. [ 861.600941][T32461] block nbd0: shutting down sockets [ 861.615831][T32467] lo speed is unknown, defaulting to 1000 [ 861.771673][T32470] netlink: 'syz.2.7156': attribute type 27 has an invalid length. [ 861.785033][T32474] lo speed is unknown, defaulting to 1000 [ 862.327901][ T5847] Bluetooth: hci5: command 0x0406 tx timeout [ 862.481740][T32502] netlink: 'syz.3.7167': attribute type 1 has an invalid length. [ 862.573335][ T5833] Bluetooth: hci3: command tx timeout [ 862.597988][T32502] 8021q: adding VLAN 0 to HW filter on device bond3 [ 862.682366][T32507] bond3: (slave geneve3): making interface the new active one [ 862.692102][T32518] netlink: 'syz.4.7172': attribute type 10 has an invalid length. [ 862.702202][T32507] bond3: (slave geneve3): Enslaving as an active interface with an up link [ 862.719191][T32518] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 862.719749][T32510] netlink: 'syz.0.7170': attribute type 1 has an invalid length. [ 862.733500][T32518] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 862.848152][T32516] nbd1: detected capacity change from 0 to 63 [ 862.856652][T32520] block nbd1: NBD_DISCONNECT [ 862.862389][T32520] block nbd1: Disconnected due to user request. [ 862.880910][T32520] block nbd1: shutting down sockets [ 862.880950][T32411] blk_print_req_error: 138 callbacks suppressed [ 862.880964][T32411] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 862.956588][T32411] buffer_io_error: 138 callbacks suppressed [ 862.956607][T32411] Buffer I/O error on dev nbd1, logical block 0, async page read [ 863.059929][ T1677] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 3 prio class 2 [ 863.068164][T32534] netlink: 'syz.4.7172': attribute type 27 has an invalid length. [ 863.069954][ T1677] Buffer I/O error on dev nbd1, logical block 1, async page read [ 863.089660][ T1677] Buffer I/O error on dev nbd1, logical block 2, async page read [ 863.107015][ T1677] Buffer I/O error on dev nbd1, logical block 3, async page read [ 863.115324][T32411] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 863.125655][T32411] Buffer I/O error on dev nbd1, logical block 0, async page read [ 863.134824][T32411] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 863.144961][T32411] Buffer I/O error on dev nbd1, logical block 1, async page read [ 863.153833][T32411] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 863.164693][T32411] Buffer I/O error on dev nbd1, logical block 2, async page read [ 863.173351][T32411] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 863.184382][T32411] Buffer I/O error on dev nbd1, logical block 3, async page read [ 863.192724][T32411] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 863.203297][T32411] Buffer I/O error on dev nbd1, logical block 0, async page read [ 863.212364][T32411] I/O error, dev nbd1, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 863.222478][T32411] Buffer I/O error on dev nbd1, logical block 1, async page read [ 863.230716][T32411] I/O error, dev nbd1, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 863.241497][T32411] I/O error, dev nbd1, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 863.252536][T32411] ldm_validate_partition_table(): Disk read failed. [ 863.261186][T32411] Dev nbd1: unable to read RDB block 0 [ 863.268202][T32411] nbd1: unable to read partition table [ 863.284170][T32411] ldm_validate_partition_table(): Disk read failed. [ 863.291821][T32411] Dev nbd1: unable to read RDB block 0 [ 863.298655][T32411] nbd1: unable to read partition table [ 863.736379][T32554] netlink: zone id is out of range [ 863.742005][T32554] netlink: del zone limit has 8 unknown bytes [ 863.946756][T32577] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 864.287820][T32573] lec:lec_atm_close: lec0: Shut down! [ 864.970660][T32616] validate_nla: 2 callbacks suppressed [ 864.970680][T32616] netlink: 'syz.4.7199': attribute type 83 has an invalid length. [ 864.981537][T32619] __nla_validate_parse: 7 callbacks suppressed [ 864.981558][T32619] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7200'. [ 865.011098][T32619] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7200'. [ 865.564316][T32667] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7207'. [ 865.650285][T32667] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7207'. [ 865.781727][T32674] openvswitch: netlink: Tunnel attr 78 out of range max 16 [ 865.793253][T32675] openvswitch: netlink: Tunnel attr 78 out of range max 16 [ 865.833068][T32667] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7207'. [ 865.854400][T32678] netlink: 'syz.3.7210': attribute type 10 has an invalid length. [ 865.863740][T32678] netlink: 2 bytes leftover after parsing attributes in process `syz.3.7210'. [ 865.867062][T32667] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7207'. [ 865.945034][T32682] netlink: 32 bytes leftover after parsing attributes in process `syz.2.7212'. [ 865.954890][T32682] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7212'. [ 865.997642][T32690] netlink: 'syz.3.7210': attribute type 27 has an invalid length. [ 866.100694][T32696] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7213'. [ 866.615505][T32710] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 866.914425][T32730] openvswitch: netlink: IPv4 tun info is not correct [ 866.923966][T32735] openvswitch: netlink: IPv4 tun info is not correct [ 867.075534][T32745] IPv6: NLM_F_CREATE should be specified when creating new route [ 867.101407][T32745] netlink: 'syz.4.7228': attribute type 21 has an invalid length. [ 867.133827][T32745] IPv6: NLM_F_CREATE should be specified when creating new route [ 867.354037][T32761] netlink: zone id is out of range [ 867.363975][T32761] netlink: get zone limit has 4 unknown bytes [ 867.730603][ T315] netlink: 'syz.1.7240': attribute type 1 has an invalid length. [ 867.864091][ T320] 8021q: adding VLAN 0 to HW filter on device bond6 [ 867.909519][ T320] bond6 (unregistering): Released all slaves [ 868.406016][ T321] lec:lec_atm_close: lec0: Shut down! [ 868.627593][ T366] veth0_macvtap: left promiscuous mode [ 868.898679][ T383] nbd2: detected capacity change from 0 to 63 [ 868.907636][ T377] block nbd2: NBD_DISCONNECT [ 868.951826][ T377] block nbd2: Disconnected due to user request. [ 868.967841][ T377] block nbd2: shutting down sockets [ 869.019296][ C1] blk_print_req_error: 136 callbacks suppressed [ 869.019320][ C1] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 869.035950][ C1] buffer_io_error: 138 callbacks suppressed [ 869.035966][ C1] Buffer I/O error on dev nbd2, logical block 0, async page read [ 869.050264][ C1] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 869.060373][ C1] Buffer I/O error on dev nbd2, logical block 1, async page read [ 869.068608][ C1] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 869.078615][ C1] Buffer I/O error on dev nbd2, logical block 2, async page read [ 869.086797][ C1] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 869.096621][ C1] Buffer I/O error on dev nbd2, logical block 3, async page read [ 869.105080][ T384] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 869.175277][ T384] Buffer I/O error on dev nbd2, logical block 0, async page read [ 869.243875][ T384] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 869.274228][ T384] Buffer I/O error on dev nbd2, logical block 1, async page read [ 869.302339][ T384] I/O error, dev nbd2, sector 4 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 869.327366][ T384] Buffer I/O error on dev nbd2, logical block 2, async page read [ 869.337885][ T384] I/O error, dev nbd2, sector 6 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 869.402361][ T384] Buffer I/O error on dev nbd2, logical block 3, async page read [ 869.417145][ T384] I/O error, dev nbd2, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 869.461306][ T384] Buffer I/O error on dev nbd2, logical block 0, async page read [ 869.491756][ T384] I/O error, dev nbd2, sector 2 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 869.531736][ T384] Buffer I/O error on dev nbd2, logical block 1, async page read [ 869.532216][ T410] syzkaller0: entered promiscuous mode [ 869.557341][ T384] ldm_validate_partition_table(): Disk read failed. [ 869.576851][ T410] syzkaller0: entered allmulticast mode [ 869.585557][ T384] Dev nbd2: unable to read RDB block 0 [ 869.605692][ T384] nbd2: unable to read partition table [ 869.636820][ T384] ldm_validate_partition_table(): Disk read failed. [ 869.654199][ T421] syzkaller0: entered promiscuous mode [ 869.671768][ T384] Dev nbd2: unable to read RDB block 0 [ 869.691925][ T384] nbd2: unable to read partition table [ 869.698190][ T421] syzkaller0: entered allmulticast mode [ 870.101155][ T444] Bluetooth: MGMT ver 1.23 [ 870.122537][ T439] __nla_validate_parse: 48 callbacks suppressed [ 870.122560][ T439] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7276'. [ 870.241823][ T5491] veth0_macvtap: entered promiscuous mode [ 870.290607][ T453] FAULT_INJECTION: forcing a failure. [ 870.290607][ T453] name failslab, interval 1, probability 0, space 0, times 0 [ 870.306775][ T453] CPU: 0 UID: 0 PID: 453 Comm: syz.2.7280 Not tainted syzkaller #0 PREEMPT(full) [ 870.306803][ T453] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 870.306815][ T453] Call Trace: [ 870.306824][ T453] [ 870.306832][ T453] dump_stack_lvl+0xe8/0x150 [ 870.306866][ T453] should_fail_ex+0x412/0x560 [ 870.306895][ T453] should_failslab+0xa8/0x100 [ 870.306919][ T453] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 870.306939][ T453] ? __alloc_skb+0x1d0/0x7d0 [ 870.306958][ T453] ? __local_bh_enable_ip+0xd0/0x130 [ 870.306981][ T453] __alloc_skb+0x1d0/0x7d0 [ 870.307008][ T453] rtmsg_ifa+0xf8/0x1f0 [ 870.307034][ T453] __inet_del_ifa+0x82c/0xfe0 [ 870.307069][ T453] devinet_ioctl+0xb55/0x1b30 [ 870.307098][ T453] ? __pfx_devinet_ioctl+0x10/0x10 [ 870.307124][ T453] ? get_user_ifreq+0x12b/0x180 [ 870.307144][ T453] inet_ioctl+0x42a/0x560 [ 870.307179][ T453] ? __pfx_inet_ioctl+0x10/0x10 [ 870.307220][ T453] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 870.307249][ T453] sock_do_ioctl+0x101/0x320 [ 870.307270][ T453] ? __pfx_sock_do_ioctl+0x10/0x10 [ 870.307286][ T453] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 870.307318][ T453] sock_ioctl+0x5c6/0x7f0 [ 870.307339][ T453] ? __pfx_sock_ioctl+0x10/0x10 [ 870.307356][ T453] ? __fget_files+0x2a/0x420 [ 870.307372][ T453] ? __fget_files+0x3a0/0x420 [ 870.307388][ T453] ? __fget_files+0x2a/0x420 [ 870.307409][ T453] ? bpf_lsm_file_ioctl+0x9/0x20 [ 870.307432][ T453] ? __pfx_sock_ioctl+0x10/0x10 [ 870.307450][ T453] __se_sys_ioctl+0xfc/0x170 [ 870.307472][ T453] do_syscall_64+0x14d/0xf80 [ 870.307491][ T453] ? trace_irq_disable+0x3b/0x150 [ 870.307507][ T453] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.307527][ T453] ? clear_bhb_loop+0x40/0x90 [ 870.307550][ T453] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 870.307569][ T453] RIP: 0033:0x7f1bfa39c819 [ 870.307588][ T453] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 870.307604][ T453] RSP: 002b:00007f1bfb2bc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 870.307627][ T453] RAX: ffffffffffffffda RBX: 00007f1bfa615fa0 RCX: 00007f1bfa39c819 [ 870.307641][ T453] RDX: 0000200000000040 RSI: 0000000000008916 RDI: 0000000000000003 [ 870.307652][ T453] RBP: 00007f1bfb2bc090 R08: 0000000000000000 R09: 0000000000000000 [ 870.307663][ T453] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 870.307674][ T453] R13: 00007f1bfa616038 R14: 00007f1bfa615fa0 R15: 00007ffef69bda88 [ 870.307706][ T453] [ 870.624463][ T450] 8021q: VLANs not supported on caif0 [ 871.008081][ T463] bond0: (slave dummy0): Releasing backup interface [ 871.432327][ T485] syzkaller0: entered promiscuous mode [ 871.447070][ T485] syzkaller0: entered allmulticast mode [ 871.874014][ T506] tipc: Enabling of bearer rejected, failed to enable media [ 871.905041][ T513] x_tables: ip6_tables: TCPOPTSTRIP target: only valid for protocol 6 [ 871.965759][ T508] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_rx_wq": -EINTR [ 872.575232][ T551] syzkaller0: entered promiscuous mode [ 872.607690][ T551] syzkaller0: entered allmulticast mode [ 873.142749][ T581] netlink: 7 bytes leftover after parsing attributes in process `syz.4.7312'. [ 873.200363][ T581] netlink: 'syz.4.7312': attribute type 4 has an invalid length. [ 873.329502][ T589] bond4: invalid ARP target 0.0.0.0 specified for addition [ 873.348827][ T591] nbd2: detected capacity change from 0 to 63 [ 873.358368][ T593] block nbd2: NBD_DISCONNECT [ 873.363500][ T593] block nbd2: Disconnected due to user request. [ 873.375403][ T593] block nbd2: shutting down sockets [ 873.382490][ T384] ldm_validate_partition_table(): Disk read failed. [ 873.391596][ T589] bond4: option arp_ip_target: invalid value (0) [ 873.399149][ T384] Dev nbd2: unable to read RDB block 0 [ 873.405596][ T384] nbd2: unable to read partition table [ 873.417473][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5020 ms [ 873.425763][ C0] lec:lec_tx_timeout: lec0 [ 873.430940][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 873.439540][ T589] bond4 (unregistering): Released all slaves [ 873.458330][ T384] ldm_validate_partition_table(): Disk read failed. [ 873.473423][ T384] Dev nbd2: unable to read RDB block 0 [ 873.488974][ T384] nbd2: unable to read partition table [ 873.871226][ T614] syzkaller0: entered promiscuous mode [ 873.877531][ T614] syzkaller0: entered allmulticast mode [ 873.952656][ T612] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7320'. [ 874.081190][ T622] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7323'. [ 874.216779][ T624] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7325'. [ 874.513104][ T650] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7330'. [ 874.973688][ T664] syzkaller0: entered promiscuous mode [ 874.983332][ T664] syzkaller0: entered allmulticast mode [ 875.089288][ T662] netlink: 20 bytes leftover after parsing attributes in process `syz.0.7334'. [ 875.359077][ T678] lo speed is unknown, defaulting to 1000 [ 875.940583][ T702] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 875.983170][ T701] syzkaller0: entered promiscuous mode [ 875.990616][ T701] syzkaller0: entered allmulticast mode [ 876.043944][ T710] netlink: 'syz.1.7349': attribute type 3 has an invalid length. [ 876.074906][ T710] netlink: 3 bytes leftover after parsing attributes in process `syz.1.7349'. [ 876.121488][ T712] Cannot find set identified by id 0 to match [ 876.224277][ T725] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7351'. [ 876.340952][ T725] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 876.504161][ T742] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7356'. [ 876.590203][ T742] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7356'. [ 876.818134][ T754] netlink: 'syz.4.7359': attribute type 1 has an invalid length. [ 876.826542][ T754] netlink: 96 bytes leftover after parsing attributes in process `syz.4.7359'. [ 876.859372][ T756] vlan2: entered allmulticast mode [ 876.867447][ T754] netlink: 658 bytes leftover after parsing attributes in process `syz.4.7359'. [ 876.910796][ T760] syzkaller0: entered promiscuous mode [ 876.937251][ T760] syzkaller0: entered allmulticast mode [ 877.023578][ T768] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7363'. [ 877.335821][ T782] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7370'. [ 877.356327][ T782] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7370'. [ 877.357589][ T784] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 877.602460][ T807] xt_hashlimit: max too large, truncated to 1048576 [ 877.629789][ T800] vlan0: entered allmulticast mode [ 877.959009][ T822] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1536) ! [ 878.062655][ T830] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7385'. [ 878.075602][ T831] tc_dump_action: action bad kind [ 878.113043][ T833] lo speed is unknown, defaulting to 1000 [ 878.132427][ T835] netlink: 'syz.4.7386': attribute type 2 has an invalid length. [ 878.316125][ T850] netlink: 'syz.4.7389': attribute type 1 has an invalid length. [ 878.447453][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 878.456145][ C0] lec:lec_tx_timeout: lec0 [ 878.485742][ T855] netlink: 'syz.1.7391': attribute type 1 has an invalid length. [ 878.563854][ T864] netlink: 'syz.1.7391': attribute type 1 has an invalid length. [ 881.485087][ T855] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 881.485898][ T863] tipc: Started in network mode [ 881.500982][ T863] tipc: Node identity 6291767737ed, cluster identity 4711 [ 881.508504][ T863] tipc: Enabled bearer , priority 0 [ 881.621589][ T863] tipc: Disabling bearer [ 881.628692][ T899] __nla_validate_parse: 3 callbacks suppressed [ 881.628709][ T899] netlink: 112 bytes leftover after parsing attributes in process `syz.0.7395'. [ 881.690614][ T904] sch_tbf: burst 0 is lower than device ip6gre0 mtu (1536) ! [ 881.863088][ T921] 0: reclassify loop, rule prio 0, protocol 700 [ 881.870389][ T927] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 881.955612][ T931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7399'. [ 881.969221][ T933] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 881.975717][ T931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7399'. [ 882.002380][ T931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7399'. [ 882.014513][ T931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7399'. [ 882.025316][ T931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7399'. [ 882.065745][ T931] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7399'. [ 882.086183][ T931] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7399'. [ 882.110472][ T931] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7399'. [ 882.131547][ T931] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7399'. [ 882.147743][ T937] tipc: Started in network mode [ 882.153533][ T937] tipc: Node identity be2a9e12d9bd, cluster identity 4711 [ 882.161671][ T937] tipc: Enabled bearer , priority 0 [ 882.215866][ T937] syzkaller0: entered promiscuous mode [ 882.223014][ T937] syzkaller0: entered allmulticast mode [ 882.229507][ T937] tipc: Resetting bearer [ 882.250762][ T936] tipc: Resetting bearer [ 882.541475][ T960] [ 882.544029][ T960] ====================================================== [ 882.551080][ T960] WARNING: possible circular locking dependency detected [ 882.558545][ T960] syzkaller #0 Not tainted [ 882.563464][ T960] ------------------------------------------------------ [ 882.570929][ T960] syz.3.7408/960 is trying to acquire lock: [ 882.576828][ T960] ffffffff8fd48158 (nr_neigh_list_lock){+...}-{3:3}, at: nr_remove_neigh+0x25/0xe0 [ 882.586711][ T960] [ 882.586711][ T960] but task is already holding lock: [ 882.594247][ T960] ffff88805789fe70 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 882.604117][ T960] [ 882.604117][ T960] which lock already depends on the new lock. [ 882.604117][ T960] [ 882.615213][ T960] [ 882.615213][ T960] the existing dependency chain (in reverse order) is: [ 882.624756][ T960] [ 882.624756][ T960] -> #2 (&nr_node->node_lock){+...}-{3:3}: [ 882.632856][ T960] _raw_spin_lock_bh+0x36/0x50 [ 882.638232][ T960] nr_rt_device_down+0x153/0x860 [ 882.643788][ T960] nr_device_event+0x137/0x150 [ 882.649162][ T960] notifier_call_chain+0x1be/0x400 [ 882.655164][ T960] __dev_notify_flags+0x16d/0x310 [ 882.660998][ T960] netif_change_flags+0xe8/0x1a0 [ 882.666668][ T960] dev_change_flags+0x130/0x260 [ 882.672559][ T960] dev_ioctl+0x7b4/0x1150 [ 882.677603][ T960] sock_do_ioctl+0x23e/0x320 [ 882.682803][ T960] sock_ioctl+0x5c6/0x7f0 [ 882.687748][ T960] __se_sys_ioctl+0xfc/0x170 [ 882.692939][ T960] do_syscall_64+0x14d/0xf80 [ 882.698249][ T960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.704698][ T960] [ 882.704698][ T960] -> #1 (nr_node_list_lock){+...}-{3:3}: [ 882.712869][ T960] _raw_spin_lock_bh+0x36/0x50 [ 882.718421][ T960] nr_rt_device_down+0xbe/0x860 [ 882.724160][ T960] nr_device_event+0x137/0x150 [ 882.729701][ T960] notifier_call_chain+0x1be/0x400 [ 882.735597][ T960] __dev_notify_flags+0x16d/0x310 [ 882.741528][ T960] netif_change_flags+0xe8/0x1a0 [ 882.747202][ T960] dev_change_flags+0x130/0x260 [ 882.752784][ T960] dev_ioctl+0x7b4/0x1150 [ 882.757749][ T960] sock_do_ioctl+0x23e/0x320 [ 882.763056][ T960] sock_ioctl+0x5c6/0x7f0 [ 882.768007][ T960] __se_sys_ioctl+0xfc/0x170 [ 882.773276][ T960] do_syscall_64+0x14d/0xf80 [ 882.778642][ T960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.785484][ T960] [ 882.785484][ T960] -> #0 (nr_neigh_list_lock){+...}-{3:3}: [ 882.793845][ T960] __lock_acquire+0x15a5/0x2cf0 [ 882.799670][ T960] lock_acquire+0xf0/0x2e0 [ 882.804614][ T960] _raw_spin_lock_bh+0x36/0x50 [ 882.810354][ T960] nr_remove_neigh+0x25/0xe0 [ 882.816085][ T960] nr_add_node+0x1e41/0x2630 [ 882.821370][ T960] nr_rt_ioctl+0xe59/0xf90 [ 882.826397][ T960] sock_do_ioctl+0x101/0x320 [ 882.831517][ T960] sock_ioctl+0x5c6/0x7f0 [ 882.836718][ T960] __se_sys_ioctl+0xfc/0x170 [ 882.842179][ T960] do_syscall_64+0x14d/0xf80 [ 882.847376][ T960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.853878][ T960] [ 882.853878][ T960] other info that might help us debug this: [ 882.853878][ T960] [ 882.864282][ T960] Chain exists of: [ 882.864282][ T960] nr_neigh_list_lock --> nr_node_list_lock --> &nr_node->node_lock [ 882.864282][ T960] [ 882.878624][ T960] Possible unsafe locking scenario: [ 882.878624][ T960] [ 882.886263][ T960] CPU0 CPU1 [ 882.891724][ T960] ---- ---- [ 882.897269][ T960] lock(&nr_node->node_lock); [ 882.902076][ T960] lock(nr_node_list_lock); [ 882.909526][ T960] lock(&nr_node->node_lock); [ 882.917509][ T960] lock(nr_neigh_list_lock); [ 882.922546][ T960] [ 882.922546][ T960] *** DEADLOCK *** [ 882.922546][ T960] [ 882.930934][ T960] 1 lock held by syz.3.7408/960: [ 882.936123][ T960] #0: ffff88805789fe70 (&nr_node->node_lock){+...}-{3:3}, at: nr_add_node+0x1039/0x2630 [ 882.946230][ T960] [ 882.946230][ T960] stack backtrace: [ 882.952463][ T960] CPU: 0 UID: 0 PID: 960 Comm: syz.3.7408 Not tainted syzkaller #0 PREEMPT(full) [ 882.952486][ T960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 882.952497][ T960] Call Trace: [ 882.952505][ T960] [ 882.952514][ T960] dump_stack_lvl+0xe8/0x150 [ 882.952539][ T960] print_circular_bug+0x2e1/0x300 [ 882.952564][ T960] check_noncircular+0x12e/0x150 [ 882.952589][ T960] __lock_acquire+0x15a5/0x2cf0 [ 882.952614][ T960] ? __lock_acquire+0x6b5/0x2cf0 [ 882.952635][ T960] lock_acquire+0xf0/0x2e0 [ 882.952653][ T960] ? nr_remove_neigh+0x25/0xe0 [ 882.952675][ T960] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 882.952691][ T960] ? nr_remove_neigh+0x25/0xe0 [ 882.952711][ T960] _raw_spin_lock_bh+0x36/0x50 [ 882.952726][ T960] ? nr_remove_neigh+0x25/0xe0 [ 882.952745][ T960] nr_remove_neigh+0x25/0xe0 [ 882.952766][ T960] nr_add_node+0x1e41/0x2630 [ 882.952788][ T960] ? nr_call_to_digi+0x126/0x1b0 [ 882.952808][ T960] nr_rt_ioctl+0xe59/0xf90 [ 882.952830][ T960] ? kasan_quarantine_put+0xbb/0x1f0 [ 882.952847][ T960] ? __pfx_nr_rt_ioctl+0x10/0x10 [ 882.952869][ T960] ? apparmor_capable+0x126/0x170 [ 882.952889][ T960] ? capable+0x88/0xe0 [ 882.952910][ T960] ? nr_ioctl+0x1b1/0x3b0 [ 882.952927][ T960] sock_do_ioctl+0x101/0x320 [ 882.952945][ T960] ? __pfx_sock_do_ioctl+0x10/0x10 [ 882.952960][ T960] ? do_futex+0x395/0x420 [ 882.952985][ T960] sock_ioctl+0x5c6/0x7f0 [ 882.953001][ T960] ? __pfx_sock_ioctl+0x10/0x10 [ 882.953016][ T960] ? __fget_files+0x2a/0x420 [ 882.953029][ T960] ? __fget_files+0x3a0/0x420 [ 882.953042][ T960] ? __fget_files+0x2a/0x420 [ 882.953057][ T960] ? bpf_lsm_file_ioctl+0x9/0x20 [ 882.953078][ T960] ? __pfx_sock_ioctl+0x10/0x10 [ 882.953093][ T960] __se_sys_ioctl+0xfc/0x170 [ 882.953112][ T960] do_syscall_64+0x14d/0xf80 [ 882.953130][ T960] ? trace_irq_disable+0x3b/0x150 [ 882.953149][ T960] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.953165][ T960] ? clear_bhb_loop+0x40/0x90 [ 882.953181][ T960] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 882.953197][ T960] RIP: 0033:0x7fdde6f9c819 [ 882.953212][ T960] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 882.953227][ T960] RSP: 002b:00007fdde7e10028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 882.953246][ T960] RAX: ffffffffffffffda RBX: 00007fdde7216090 RCX: 00007fdde6f9c819 [ 882.953257][ T960] RDX: 00002000000001c0 RSI: 000000000000890b RDI: 0000000000000006 [ 882.953268][ T960] RBP: 00007fdde7032c91 R08: 0000000000000000 R09: 0000000000000000 [ 882.953278][ T960] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 882.953288][ T960] R13: 00007fdde7216128 R14: 00007fdde7216090 R15: 00007ffc04e72838 [ 882.953305][ T960] [ 883.251180][ T962] netlink: 'syz.4.7409': attribute type 10 has an invalid length. [ 883.472527][ T965] netlink: 'syz.4.7409': attribute type 27 has an invalid length. [ 885.452596][ T936] tipc: Disabling bearer [ 885.471999][ T5964] tipc: Node number set to 1737989650 [ 885.944601][ T9226] lec:lec_start_xmit: lec0:No lecd attached [ 891.297004][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5350 ms [ 891.305233][ C0] lec:lec_tx_timeout: lec0