last executing test programs: 2.607828279s ago: executing program 0 (id=8046): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@ipv4_newrule={0x2c, 0x1e, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0xf9, 0x1, 0x0, 0x0, 0x7}, [@FRA_DST={0x8, 0x1, @empty}, @FRA_GENERIC_POLICY=@FRA_SUPPRESS_IFGROUP={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x42}, 0x0) 2.38726885s ago: executing program 0 (id=8049): socket$can_bcm(0x1d, 0x2, 0x2) socketpair(0x28, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='freezer.self_freezing\x00', 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f00000001c0)) socket$nl_generic(0x10, 0x3, 0x10) socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$sock_int(r2, 0x1, 0x10, &(0x7f0000000080)=0x9, 0x4) bind$bt_hci(r2, &(0x7f0000000200)={0x1f, 0xfffd, 0x2}, 0x6) recvmmsg(r2, &(0x7f0000004300)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x0, @multicast2}, 0x2}}, 0x26) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e23, 0x1fd6, @remote, 0x200009}, 0x1c) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000081000000000000000000e9ff0000006cc78c4f06dbeff9ec2f53c75900b3ceb73113decac192fc106a3a43a9a845a586a8caaca4"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x10, &(0x7f0000000380)=ANY=[@ANYBLOB="d0873a0a90557cac618f379c2ddcf7b0e3de8b581533cd47f3cc2415803467fc8d0bfc715346de226a69a27c", @ANYBLOB="2cb11b370500bfbd7cb644ae689683fb8b8f7781fe52908d13624058a4a39ba5dcbf3fdd898f28a79f0fcc538e9f601e2dd10d58", @ANYRES64=r0], &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x11, '\x00', 0x0, 0x0, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x200}, 0x94) 2.385332653s ago: executing program 3 (id=8052): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) socket(0x10, 0x3, 0x0) (async) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)=@ipv6_getaddr={0x2c, 0x16, 0x3c2be10bca706f15, 0x0, 0x0, {}, [@IFA_CACHEINFO={0x14}]}, 0x2c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000000)=@framed={{}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x32}}]}, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) 2.276666488s ago: executing program 4 (id=8054): socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r0, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) r2 = socket$kcm(0x29, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000300)) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000380)) sendmsg$tipc(r1, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x2, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xfff3}, {0xffff, 0xffff}, {0x0, 0x6}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_ECN={0x8}]}}]}, 0x3c}}, 0x2000400c) setsockopt$sock_attach_bpf(r0, 0x1, 0xd, &(0x7f00000000c0), 0x4) 2.195898937s ago: executing program 3 (id=8055): r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="580000001400192340834b80040d8c560a067f0200ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000600008000f0fffeffe809005300fff5dd00000010000100080c10000000ffffffffffff", 0x58}], 0x1) r1 = socket$key(0xf, 0x3, 0x2) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001400000018"], 0x44}}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)=[{&(0x7f0000000c80)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36513001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e455fe2bb24ef66970746c7f1f2a5c4c3", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r4, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000780)=""/274, 0x112}, {&(0x7f0000001d00)=""/4042, 0xfca}, {&(0x7f0000000180)=""/205, 0xcd}, {&(0x7f0000000940)=""/200, 0xc8}, {&(0x7f0000000280)=""/204, 0xcc}, {&(0x7f0000000480)=""/238, 0xee}, {&(0x7f00000003c0)=""/170, 0xaa}, {&(0x7f00000000c0)=""/178, 0xb2}], 0x8}, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r5, 0x400452c8, &(0x7f0000000100)) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c9, &(0x7f0000000100)) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendmsg$key(r1, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020100090a0000000000000000000000030006000000000002000000e000000100000000000000000300050000000000020000007f00000100000000000000cf1b0013000300"/80], 0x50}}, 0x0) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) r8 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r9 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r9, 0x400461f5, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r10) ioctl$IOCTL_GET_NCIDEV_IDX(r8, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r10, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r11, @ANYBLOB="010026bd70003c0200000200000008000100", @ANYRES32=r12], 0x1c}}, 0x0) write$nci(r8, &(0x7f00000001c0)=ANY=[@ANYBLOB="6105060e03040105039b16ac37fedcf2b54b5c610a78c742258de47e2d3c134fa7c67ef5d7eb364427fc057b05013be4a341d95365880485ecde0303acb0f5d9415869ee704b753f332f3539e054b4b088ae7106f4399eb804c91245f1c5f7b2175161a6f1b969f4bec13ef3b6c969314362524c70d563ed8fb50b97e3cbc97a009c0a1cf556d1229262e11e82b14967922046da7e1cccc847d61fb44d2b6614dc975eef1a"], 0x61) nanosleep(&(0x7f0000000040)={r6, r7+10000000}, 0x0) 1.887004195s ago: executing program 2 (id=8060): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000003700)={&(0x7f0000003640)={0x40, 0x0, 0x7, 0x101, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFACCT_NAME={0x9, 0x1, 'syz0\x00'}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x3}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x3}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x6}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0x20008000) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001780)={&(0x7f0000000500)=ANY=[@ANYBLOB="cc020000210a0108fdffffff0000000000000000630003"], 0x2cc}}, 0x0) r2 = socket$inet(0x2, 0x2, 0x1) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000040)=0x8, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xb, &(0x7f0000000080)=@framed={{0x18, 0x2, 0x0, 0x0, 0x36dc}, [@printk={@lx, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x6e}}]}, &(0x7f0000000180)='GPL\x00'}, 0x90) bind$inet(r2, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0xa0, 0x0, 0x8, 0x101, 0x0, 0x0, {0x5, 0x0, 0x1}, [@CTA_TIMEOUT_DATA={0x14, 0x4, 0x0, 0x1, @fccp=[@CTA_TIMEOUT_DCCP_TIMEWAIT={0x8, 0x7, 0x1, 0x0, 0x40}, @CTA_TIMEOUT_DCCP_TIMEWAIT={0x8, 0x7, 0x1, 0x0, 0x1}]}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_DATA={0x3c, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x5}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x100}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x7fff}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x80000000}, @CTA_TIMEOUT_UDP_REPLIED={0x8, 0x2, 0x1, 0x0, 0x2}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0xc83}, @CTA_TIMEOUT_UDP_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x8001}]}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8914}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz1\x00'}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xf7}]}, 0xa0}, 0x1, 0x0, 0x0, 0x1}, 0x8000) 1.876256968s ago: executing program 1 (id=8061): r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCSIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r0, 0x8983, &(0x7f0000000000)) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000027c0)=@base={0x4, 0x4, 0x4, 0x10005, 0x800}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000000)={r1, 0xa2, &(0x7f00000003c0)={0x0, 0x0}}, 0x10) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001040)={r2}, 0xc) close(r3) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d8000000180081054e81f782db44b904021d005c06007c09e8fe55a10a0015400100142603600e1208000b0000000401a80016000800014003001100032010fab94dcf5c0461c1d67f6fb2007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace5f17cbec4c2ee5a7cef4090000001f03d9e38bb7912deaa1abce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100215c63bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e97014b6fb237b5aeec6055956ae5804b6a", 0xdd}], 0x1}, 0xd0) 1.699089144s ago: executing program 1 (id=8062): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x7) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bind$alg(r2, &(0x7f00000010c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280-avx2\x00'}, 0x58) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850) socket$kcm(0x11, 0x3, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x488, 0x2c, 0xd3f, 0x870bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x45c, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0x4}]}}, @TCA_BPF_POLICE={0x444, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0x3, 0x8, 0x1, 0x7, 0xd988, 0x3, 0x3, 0xa08b, 0x1, 0x3ff, 0x5, 0x5, 0x6, 0x4, 0x3, 0x92c, 0x7, 0xffffffb2, 0xeaac, 0x2, 0xe13, 0x4, 0x10000, 0xded, 0x8, 0x10000000, 0x7, 0x10001, 0xc6d, 0x88000001, 0x8, 0x7, 0x7, 0x7, 0x5, 0x7, 0x800, 0x9, 0x100, 0x8, 0x9, 0x8, 0x3, 0x5, 0x6, 0xffffff9a, 0x9, 0xd, 0x7, 0x5, 0x13f6, 0x81, 0x53, 0x17, 0x4, 0x1000001, 0x6, 0x4, 0x8, 0x800, 0x86e1, 0x8, 0xfffffff9, 0x5, 0x1, 0x3, 0x5, 0x5, 0x80000000, 0xf3, 0xd, 0x8, 0xfffffff9, 0x800, 0x2726a3ed, 0x6, 0x200004, 0x2, 0x6, 0x8, 0x2, 0x7ff, 0x100, 0x1ff, 0x7, 0x3, 0x8, 0x8, 0x5, 0x2, 0x5, 0x0, 0x4, 0x3, 0x16, 0xff, 0x1, 0xc, 0x9, 0xb, 0x5, 0x8000, 0x5, 0x6, 0x8, 0xfa, 0x3, 0x0, 0x10, 0x1ff, 0x3, 0x4, 0x60000000, 0x8, 0x2, 0x5, 0x3, 0x2, 0x401, 0xa955, 0x5000, 0x1, 0xe6, 0x2, 0x3, 0x6e4, 0x1, 0x5, 0xe, 0xb, 0x6, 0x4, 0x80000001, 0x3, 0x99b, 0x9c4, 0x7f, 0x3, 0x70, 0xff800, 0x1, 0x7, 0x5, 0xff, 0x7, 0x6, 0xfff, 0x800, 0xa3, 0x10000, 0xff, 0x80000000, 0xc, 0x7, 0x8, 0xff, 0x0, 0x80, 0x8, 0x6, 0xe2f3, 0x4, 0x7f, 0x9, 0x1, 0xffff, 0x3, 0x9, 0x9, 0x8, 0x7, 0xfffffc00, 0x0, 0x40, 0x400, 0x64c, 0x8, 0x7, 0x8, 0x6, 0x0, 0x6, 0x5, 0x7ff, 0xfe, 0x7, 0xf30, 0x800, 0x0, 0xee3, 0x2005, 0x4, 0x8, 0x8, 0x1000, 0x8, 0x7, 0xa37f, 0x8, 0x9, 0x3, 0x1, 0xff, 0x8, 0x10000, 0xb, 0xcf9, 0x8, 0xfc, 0x40, 0x3, 0x1731, 0x3b, 0xff, 0x6, 0x6ad880, 0x266d, 0x4007, 0xc28, 0x2, 0x400, 0x7d75, 0x52, 0xd3, 0x8, 0x2, 0x4, 0xfffffff8, 0x200, 0x6, 0x6, 0x8, 0xe, 0xe459, 0x7ff, 0xc7, 0x81, 0x40, 0x0, 0x9, 0x3feb, 0x800, 0x100, 0x100, 0x7, 0xfffffb98, 0xfffffffb, 0x4, 0x20001, 0x3, 0x8, 0x1, 0x15b9, 0x7, 0x100, 0xffffffff]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0xffffffffffffffff, 0x1, 0x7, 0xb, {0x7, 0x2, 0x1, 0x80, 0x6572, 0x6}, {0x2, 0x1, 0x400, 0x8, 0x8}, 0x3, 0x4, 0x7fffffff}}]}]}}]}, 0x488}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f0000001140)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r9, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000001180)='\'', 0x1}], 0x1}, 0x4) socket(0x14, 0x3, 0x4) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000002700090025bd7000ffd3008001000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x4000811}, 0x4000) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000006c0)=@mangle={'mangle\x00', 0x1f, 0x6, 0x4d8, 0x1e8, 0x1e8, 0x0, 0x3a0, 0x0, 0x440, 0x440, 0x440, 0x440, 0x440, 0x6, &(0x7f00000001c0), {[{{@ip={@multicast2, @remote, 0x0, 0xff, 'syzkaller0\x00', 'ipvlan0\x00', {}, {}, 0x2f, 0x0, 0x2}, 0x0, 0xc8, 0xf0, 0x0, {}, [@common=@addrtype={{0x30}, {0x41, 0x68c, 0x0, 0x1}}, @inet=@rpfilter={{0x28}, {0xa}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x0, 0x1}}}, {{@ip={@empty, @multicast2, 0xff, 0xffffff00, 'veth0_to_bridge\x00', 'ip6gretap0\x00', {}, {0xff}, 0x1d}, 0x0, 0x98, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @broadcast, 0x7, 0x8, [0x6, 0x2f, 0xf, 0x10, 0x33, 0x37, 0x9, 0x16, 0x1d, 0x2a, 0x31, 0x32, 0x9, 0x37, 0x5, 0x2e], 0x0, 0xb09, 0x2}}}, {{@uncond, 0x0, 0xe0, 0x118, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00'}}, @common=@socket0={{0x20}}]}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x2, 0x5, 0x1}, {0x3, 0x2, 0x6}, {0x0, 0x4, 0x3}, 0x1, 0x6}}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x800, 0x9e9, @private=0xa010100, 0x4e22}}}, {{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x3, 0x3, @empty, 0x4e23}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x538) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$XFS_IOC_ATTRMULTI_BY_HANDLE(r0, 0x4048587b, &(0x7f0000001000)={{r0, &(0x7f0000000080)='ipvlan0\x00', 0x24c203, &(0x7f0000000240)={@_ha_fsid={[0x9, 0x6]}, {0x4, 0x8, 0x2, 0x1ff}}, 0x0, &(0x7f0000000280)={@_ha_fsid}, &(0x7f00000002c0)=0x649}, 0x8, &(0x7f0000000f00)=[{0x1, 0x7, &(0x7f0000000300)='],\\]+!%@{!)\'\x00', &(0x7f0000000340)="4c85188d460bebfcab55eb817b9b87abaa9192407ac0bdc3b2db55b2ba83b20e66bfc520a09ac0f6049bc7387cb06fe8bebdeb6cb921bb18dbb578186d434656df2b89cec2eed95b489d5e0bbccbd605e30bf89bf3cbd85b6a0f84fa39d72634f7b8aa34aae4bcb1653c84e61f10d62b41a0bd9402", 0x75}, {0x3, 0xcd9, &(0x7f00000003c0)='$&[\x00', &(0x7f0000000400)="4deac96f9ecdfeb05b550db385bb85ac4ba6f7643f45ac38200b0b1a81b29c2810556e4263363cdb5a3d290a23d391e2a7c61ce5a8bb59f5ab9f22a7b5bb4c9e6854b9572cb442f93aa73c663e430ea3424f43285a7ead25fd25eae405ca12bd8340c0b3c78a67ad7e3321e2ad89b5631f8524aa52969769f5a48cbd470ea7320b4f181ce55c0a7b1da1025e704b87f51784f59d3892ab316c", 0x99, 0x2a}, {0x1, 0x4, &(0x7f00000004c0)='\'\x00', &(0x7f0000000500)="b928ba3411744d084d10e209e96d6d07aba226663c1ce91850377f8fd839debd20f8191e502779dd162188f20ea57f4ca6831425c8031c3a451238c2491f80ad43f765b10c83ea6a97", 0x49, 0x2}, {0x2, 0xa6, &(0x7f0000000580)='\x00', &(0x7f00000005c0)="cb4aa5a96dbdcac0fd0c4bb0d4b055d5b1973db00f07bc7748a6f204a7fc11f9758d7a985dd6636b1647df8c4603be50b369b6307366f5be8733b4a80f2597cc032c538af306e249ac1c2c64845ad79753c2993fab30436b07c44b2e71ebb67c15a9acf793c4b51d1c8c50b67497e517778c27ce426667f5bd5e65fd60f20dec46b537630fd8d67e2dfe35a25ff496d05d256f8152f043051f83109acf07a57d5f9d47a8a3e440d364c6a3b4c8c80bd495e53f20278a5eb18d26013d", 0xbc, 0x28}, {0x1, 0x9, &(0x7f0000000c00)='CLUSTERIP\x00', &(0x7f0000000c40)="6d805fa82a3d7819fd48bc051edd357046e9085518d28877931192de633dff", 0x1f, 0x8}, {0x1, 0x6d98, &(0x7f0000000c80)='\x00', &(0x7f0000000cc0)="b1339c443116f75004911b1e3e24389e2ee1653f3fee706bafc7743ed5ee6a89e9279cf42a323d68fd9660a2d63c7f807671235bc4fe7d68fb033f07aec81d11051c3efed32ba13f7f52acb744dfcdd8f9265363b4822b43e23158a2e79ecf2af3612a2f9305b7c0409525b125f32d4a6dbfd01ce83d21a6d576ae63b59631bb8308e3615527849ee867f48f6425deae8b13c6b51ce9e8238ada6a19644aa543b11eecbcbb38bd6543664116ab357fe7d303d6234546e91e1485beb3daca2573af6b3d5abd6d2f07677dd1702c9d7c61ead2", 0xd2, 0x10}, {0x1, 0x9279, &(0x7f0000000dc0)='\x00', &(0x7f0000000e00)="1b2a2b0c00631f93cb5000f83ae2", 0xe, 0x28}, {0x2, 0x9, &(0x7f0000000e40)='\\\x00', &(0x7f0000000e80)="1c562f0ff229f902c9aa73a4edc078866f9050c57972393346a9e9756c93de0e1267efd3838076f1168f5dc64c9c44219f18580bb09425b970abf0ffbd023b413b40b77596c40873aa4b55258ce8ecd2a074792b0ed5eeaa01ca3957bc797b68a03447", 0x63, 0x2}]}) sendmsg$NFULNL_MSG_CONFIG(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4800000001040102000000000001040002000002060006400000000006000640000300000a0002000000000702000000080003400000006505000100010000000600064000000000"], 0x48}, 0x1, 0x0, 0x0, 0x44}, 0x0) 1.698531573s ago: executing program 2 (id=8063): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0), 0xa2d40, 0x0) close(r0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x3a1000, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000600)}, 0x0) r1 = socket$phonet(0x23, 0x2, 0x1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r2, &(0x7f0000000940)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000140)="91f8a9849519def28691bbc4173c3d6f357d0272b7319130feaab952ac4703cad04be68907e50e997fc26e4c91ea4feb931647fc5393de25000000000000", 0x3e}, {&(0x7f00000002c0)="4490137c227c56ee66c372f3105eb186dd8062fac2d5b5bfb0ba068e74a8d026bd209da8ffa6a26e3b3f8075704a9d0ef9afda48e71255a747b6d03097385fb05cf8db24609f02d34e76992c9df9fe6888c6c9a4825c6223be6ac54532025af1dea54e527c68b0ff250261953f2da79a78104c2d9e7b16ed86b124078a16387a095607c868db5aa9", 0x88}], 0x2}}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="8f3c958ea6d3703a5c56e93913a020f9026f66b8f2c4079b09368d0aef659314fe95db33da10078d83a4c952fd5a4d48f0efb8a76b6ed740b6ecaba04a666502301fc31030a271f50dd4ec8122145bdee9568c78f09553a6cd170827e6f5fe1460266b9f053aee8e2aa9fb715c6eee29b8e3a86948b952d6135b558c2847e8408c4b30eca1a3d88ebe81", 0x8a}, {&(0x7f0000000440)="641e54552fc8ac277e5a1af598ce926ffb268b38ae1e5e60b060c11881534ecc5923b2b18fa7a89a36a8bbbcdde6ce7d248e6c1b4745c45e03fe23cf96a2056c3381bd28b9", 0x45}], 0x2}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000500)="bfa7307854b5ced8e3fe6181f0b2927a19d82138ebdfce891a6b1f827f737cd9c9d9e485868c81ef8411fecb7091268b200f2bbe9c38590fed1fa09e8e4bc82c3d22ef851d92fdbe7cf1925913265871dd7494fc6bcb405341fe7c235a3423961f545e00c5599d", 0x67}, {&(0x7f0000000780)="4519f0c6108c97e24689ff3b060d35a60b69205421e3a3db6047fb9127bddbb0e4864da0a8952a8c58e98bc326e938e1f9166f236ee16cc9011930dc27b738a009d2450b1715a6f194ff571926afa80dbe98fd655f3f0fc1fe5aabe9f4f859ede02ae210cb0cf4cd51f86c181ca9618a52d70547edb55e056b42fbf74bddee61ffee0468344b142f6f71f23351272b2bc4b59e4ea02eb73830bdf6aa34d444519fc455939cbd4bd0786195411908d0a0045a7f7114e20b2586564035", 0xbc}], 0x2}}], 0x3, 0x2090) setsockopt$sock_int(r2, 0x1, 0x8, &(0x7f0000000600)=0xdfa, 0x4) sendto$inet(r2, &(0x7f0000000a00)="575147b922093ee13e64a63b26ed38a49d6e5fa45795c49aff94b6ce911be44e214ce364db084d8ba2f88d6d1e0c8a3b1c106eea9b0c98895e83de589853815994475d65d2c8135464c7181104b3b55412f20c8ac1f276565b82761cba133bc0c8d378", 0x63, 0x10008095, 0x0, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="ff06050086dd6018232500082c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa0400"/62], 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000040)=0x80, 0x4) ioctl$sock_ifreq(r3, 0x8910, &(0x7f0000000000)={'veth0_vlan\x00', @ifru_ivalue=0x4}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newqdisc={0x24, 0x10, 0x1, 0x70bd25, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xfff1}, {0x0, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x400c800}, 0x24000801) ioctl$sock_netdev_private(r3, 0x89f0, &(0x7f0000000000)) socket$kcm(0x2b, 0x1, 0x0) socket(0x4c496cb9ead80699, 0x4, 0x6) ioctl$SIOCPNDELRESOURCE(r1, 0x89ef, &(0x7f00000000c0)=0x7) ioctl$SIOCSIFHWADDR(r0, 0x8922, &(0x7f0000002280)={'vlan0\x00', @random="21a800"}) 1.486318996s ago: executing program 0 (id=8064): syz_init_net_socket$netrom(0x6, 0x5, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000a00)={0x160, 0x0, 0x2, 0x301, 0x0, 0x0, {0x7, 0x0, 0x2}, [@CTA_EXPECT_NAT={0xc0, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_TUPLE={0x30, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1}, {0x14, 0x4, @mcast1}}}]}, @CTA_EXPECT_NAT_TUPLE={0x7c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, {0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, {0x14, 0x4, @empty}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0xbc}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}]}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}]}, @CTA_EXPECT_NAT={0x74, 0xa, 0x0, 0x1, [@CTA_EXPECT_NAT_TUPLE={0x50, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private2={0xfc, 0x2, '\x00', 0x1}}, {0x14, 0x4, @loopback}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x6}}]}, @CTA_EXPECT_NAT_DIR={0x8}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8, 0x1, 0x1, 0x0, 0x1}, @CTA_EXPECT_NAT_DIR={0x8}]}, @CTA_EXPECT_HELP_NAME={0xe, 0x6, 'sip-20000\x00'}, @CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x3}]}, 0x160}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0), 0x0, 0x2000, &(0x7f0000003700)={0x77359400}) r1 = socket$inet6(0xa, 0x3, 0x7) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1}, 0x18) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=@ipv6_newaddr={0x34, 0x14, 0x1, 0x0, 0x0, {}, [@IFA_ADDRESS={0x14, 0x1, @mcast1}, @IFA_FLAGS={0x8, 0x8, 0x402}]}, 0x34}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000009c0)=@ipv6_deladdrlabel={0x1c, 0x49, 0x20, 0x70bd27, 0x25dfdbfd, {0xa, 0x0, 0xdf}}, 0x1c}}, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f00000006c0), r0) socket$inet6_tcp(0xa, 0x1, 0x0) 1.440173172s ago: executing program 2 (id=8065): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@struct={0x0, 0x0, 0x0, 0xe, 0x1}, @enum]}}, 0x0, 0x32}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000001c0)={r0, 0x20, &(0x7f0000000180)={&(0x7f0000000040)=""/171, 0xab, 0x0, &(0x7f0000000100)=""/108, 0x6c}}, 0x10) r1 = accept$inet(0xffffffffffffffff, &(0x7f0000000240), &(0x7f0000000280)=0x10) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x4e22, @broadcast}, 0x10) 1.343366892s ago: executing program 2 (id=8066): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x10) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x6c, 0x4, 0x0, 0x1, [{0x68, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x58, 0x2, 0x0, 0x1, [@NFTA_INNER_TYPE={0x8, 0x2, 0x1, 0x0, 0x84}, @NFTA_INNER_FLAGS={0x8, 0x3, 0x1, 0x0, 0x7}, @NFTA_INNER_HDRSIZE={0x8, 0x4, 0x1, 0x0, 0xf}, @NFTA_INNER_NUM={0x8}, @NFTA_INNER_EXPR={0x34, 0x5, 0x0, 0x1, @payload={{0xc}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_PAYLOAD_LEN={0x8, 0x4, 0x1, 0x0, 0x56}, @NFTA_PAYLOAD_OFFSET={0x8, 0x3, 0x1, 0x0, 0xb9}, @NFTA_PAYLOAD_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_PAYLOAD_BASE={0x8, 0x2, 0x1, 0x0, 0x4}]}}}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0xc0}}, 0x0) (async, rerun: 64) r1 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 64) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), r1) (async) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x38, r2, 0x1, 0x70bd28, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x4, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x7, 0x7, 0x100, 0x9b, 0xfffa, 0xe, 0x401]}}]}]}]}, 0x38}}, 0x2400c090) 1.186591163s ago: executing program 2 (id=8067): bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x12, 0x22, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, 0xf, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20000841, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @empty}, 0x1c) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@ipv6_newroute={0x48, 0x18, 0x1, 0x70bd2c, 0x0, {0xa, 0x10, 0x0, 0x0, 0xfc, 0x2, 0xff}, [@RTA_OIF={0x8, 0x4, r1}, @RTA_GATEWAY={0x14, 0x5, @ipv4={'\x00', '\xff\xff', @local}}, @RTA_ENCAP={0x10, 0x16, 0x0, 0x1, @SEG6_LOCAL_SRH={0xc, 0x2, {0x3c, 0x0, 0x4, 0x0, 0x6, 0x30, 0x2}}}]}, 0x48}}, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000440)={&(0x7f00000002c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x2c, 0x2c, 0x6, [@enum={0x7, 0x4, 0x0, 0x6, 0x4, [{0xa}, {0x5, 0xfc}, {0x2, 0x9}, {0x4, 0x5}]}]}, {0x0, [0x5f, 0x2e, 0x5f, 0x5f]}}, &(0x7f0000000340)=""/237, 0x4a, 0xed, 0x0, 0x8}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000480)=@bloom_filter={0x1e, 0x1000, 0xa, 0x7, 0x2285, 0xffffffffffffffff, 0x1, '\x00', r1, r4, 0x4, 0x0, 0x5, 0x9}, 0x50) r5 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_TABLE(r5, 0x29, 0xcf, &(0x7f0000000240)=0xfc, 0x4) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) socket(0x29, 0x2, 0x7) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="6000000010000304000300"/20, @ANYRES32=0x0, @ANYBLOB="00000000010000003000128009000100766c616e00000000200002800c0002001e0000001f00000006000100fc0f00000600050088a8000008000500", @ANYRES32=r8, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r8], 0x60}}, 0x8000) sendmsg$IPSET_CMD_TYPE(r7, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="540000000d0601030000000000000000020000070d000300686173683a6e65740000000005000500010000000500010007000000050001000700000005000500000000000500010007000000050005000a00000061b2b0b135e2199c5ac7f61509931b163f20d4a5a2e78a29f4181f041caf7c5f79bfa66b160dee411b0344e046d58685743f73d349a9c30bfa41ab80ecca1e914c461b82d8870fd2e42b7b43f4e16d51564a696809b16e04d3a538a159596de6562063c09d635f1a20d2f50b454b1eb600000000000002c8ba5f41abbd"], 0x54}, 0x1, 0x0, 0x0, 0x20044041}, 0x20000000) 1.152982119s ago: executing program 3 (id=8068): r0 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={0x0, 0x6, 0x5, 0x0, 0x1ff, 0xf}, &(0x7f0000000040)=0x14) (async) r1 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_qrtr_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000080)={'bridge_slave_0\x00'}) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f00000000c0)=0x0) sendmsg(r0, &(0x7f0000000600)={&(0x7f0000000100)=@nfc_llcp={0x27, r2, 0x0, 0x7, 0x3, 0x47, "f5a9ae4ad9fe6385da82995bc51e96b39f11dcb1a029b142246de47af53332259ec548c9f992e18db748a22badf16f0367345b9d456ed3b7b8c93591014c92", 0x7}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000180)="59dbdf0cbc56baff0400e9c7fb33300b4cdb857aec387393e09e9e65e682e69bdb6bc5ffdcff5ea10f", 0x29}, {&(0x7f00000001c0)="faa480599617a3940c73a2b10c883dcada0d6dc0c2c40444d51b6a4bba9a6d9983a421362af9705e7a96c0eb219159ef52863c143a413bef80bb53383bc3889182e08e2ad2136c376e8dc278b5360355b06b4c", 0x53}, {&(0x7f0000000240)="e1d84b0d88e77c658ca48d9501876f2eb14802c89ee88ac16e29f66e7827095592bb4d8b7763c9349050b0af4d24c16edcb265d5c39508130512ceeaaa0af53278c472671ff9dfb44c628f26abfa1981084b2ec25a26b8472deca7bd9c74b7217a9525a1838debae7051939ddef08752c9707a9f9206cabe61ddaf46f6e9f347ecd557a231a4e15fcbcd41f3b82c4171660143fe46c825ed4f6af9aa6ae9b6692f3d180aaa356f247c9b524ef7b74f1c6e493b2c501e19d7cd8fd6bc070fe6ef86ea3d7b66f4463df4419116510192fddbf02fe49b4887941d3eaa1991ced7135daedce08da369dc97b3f8dbe24e6ef114baf1ce37fae2", 0xf7}, {&(0x7f0000000340)="1ec5b9cb488e50d55e6145dfb1a7b735a720307ed94d5099e0aad7a9148c0e06945dc87220949678700e412826d49e160b3c9762beb0970bdf77bee5abd256c9352495bc0d73c0d2db221baaa88faa11947650d3815cadeb5c357938d4147e4d5bb832c39037002bb4129f3dc2333b8ad865816d4c4fb3da045baace02a7b880506d3a8ca6f9d016fb8115d17d2949c6e6fd93a7830d99e7984c4be0efbb5e2f521b7652870690fdb5e20f2379c61701ad1d184e63ab9c6162b6cff3fe69b75e280a969ae3fd0edd4ca361acbc5e45a0468f863da0e73b19af071606d123c1e4249940aadd720a9847eae49f48715b1872da25", 0xf3}, {&(0x7f0000000440)="8e4ae650746d4207427d35de76beba34f0f0b94f7046984a1ae4989f1f50e2eb235c4801135267ee71924314e1f243dd9125b44af59244812592abb693f26c90f3100e31fa62ba7fc3f09d4850d1a3fa9f17c632b0f9a83463d9aac44f", 0x5d}, {&(0x7f00000004c0)="ab2f609e9bd0e0abe45b7de1fd0bca6334f8f8e51cf69d61b90be35d3fa1f1418002f352fa2aff305c32f8518c8bc2de0a00657bbf730392f868309d91fcfb83ac35ebbf171de4833c17b1910888dafbd20c4eb7462b943b1eee56fe1590d49051bebf0f09c76aa7b2bfbf4992cf70de41c103e544bba16fbb", 0x79}, {&(0x7f0000000540)="fa1eecac6d89", 0x6}], 0x7}, 0x4000805) (async) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000640)='pimreg1\x00', 0x10) (async) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x488, &(0x7f0000000680)={{0x1d, @rand_addr=0x64010101, 0x9912, 0x2, 'none\x00', 0x31, 0xffff, 0x5b}, {@multicast1, 0x4e22, 0x4, 0x6, 0xa1a, 0x7}}, 0x44) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000700)={r0}) sendmsg$nl_crypto(r3, &(0x7f00000008c0)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000880)={&(0x7f0000000780)=@upd={0xf0, 0x12, 0x400, 0x70bd2c, 0x25dfdbfb, {{'authencesn(sha512-generic,lrw-camellia-asm)\x00'}, '\x00', '\x00', 0x400}, [{0x8, 0x1, 0x62}, {0x8, 0x1, 0x70f}]}, 0xf0}, 0x1, 0x0, 0x0, 0x80}, 0x4) (async) r4 = accept4$nfc_llcp(r3, &(0x7f0000000900), &(0x7f0000000980)=0x60, 0x0) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000a40)={0xa, &(0x7f00000009c0)=[{0x0, 0x2, 0x7, 0x9}, {0x7f, 0x8, 0x6, 0x9}, {0xfff5, 0x8, 0x17, 0x8000}, {0x40, 0xff, 0x7, 0x8}, {0x1000, 0x5, 0x4}, {0x200, 0x9, 0x26, 0xfffffffd}, {0x6, 0x45, 0x0, 0x40}, {0x0, 0x0, 0x7, 0x5d906311}, {0x6, 0x9, 0x5, 0xc0f1}, {0x718, 0x2, 0x8, 0xf82}]}, 0x10) recvfrom(r0, &(0x7f0000000a80)=""/4096, 0x1000, 0x40002000, &(0x7f0000001a80)=@generic={0x1f, "d7ae58cc894cfc57d829dcb1cc79be29231ec1dd21b7d95bc220a949338f24c4f2ae2921b095aa91cb95b5fb03bef6592ac40d273256d7d2b2234134de03deda6c0138386e1cd3836359d306ab9c05c9a53ee2a1df24f3089319d29980b325317383a977a920472559ed5df9a061deaa0f3e6714e51c646d541830636a5b"}, 0x80) sendmsg$tipc(r3, &(0x7f0000001d80)={&(0x7f0000001b00)=@nameseq={0x1e, 0x1, 0x2, {0x0, 0x1, 0x4}}, 0x10, &(0x7f0000001d40)=[{&(0x7f0000001b40)="622bb8cd175fd1c4f4db5a79544600fd87416becd2b8b5d290c183ac4901f11489357277ec4f8868a5072ff88964f76fd788d37d5a64477e230ef96c56ad49bade9cc62bd26a8273234a67257b5ba34050e24a1c67bf11626549e92e22afa48e403be3478719a747603ba238e9e3d3ed88ea44bf46b990fc08d2a7139b432248671035894fe604e8a34b794b4bb593e05d253f6159971a85e845dd886b8cfd427269604b59ac03dba5d79ae03d61860469c2040e889a8ae6cabfbe0fc3ec96e8437ee3144b50653a9870e89b7d16599efed32b484c6842f4277f5400f04528", 0xdf}, {&(0x7f0000001c40)="31b172675fb1f209798477f3548ac9210c534b183b953546425f998d392995e4f3dab3fd5caacc04803bad422d78c8c632d94e3e3d21b1705ee0e141fbc77ad882bf89baf7a9ba8a78995837f1cc020baea521be6ab7303a1b5518ee6d0eda58573c179da39971d6b6674cacf20f98ba13864d911ff4f73cc6fe301f53887b390c6ebbc55fb41750889a8dba127740e87af64b83b8e53889d46a5af47b0a8e49782870051ae742e443572fc3602be711443b7b2b142e01be372f703f8dde4aee105113e5a4497202c5bc9dc84b8bbe6c87cd2340d8b6c3edaf49380aead301c0", 0xe0}], 0x2, 0x0, 0x0, 0x40000}, 0x4080) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001e00), 0xffffffffffffffff) (async, rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000001e40)={'wlan1\x00', 0x0}) (rerun: 32) sendmsg$NL80211_CMD_CRIT_PROTOCOL_STOP(r5, &(0x7f0000001f00)={&(0x7f0000001dc0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001ec0)={&(0x7f0000001e80)={0x28, r6, 0x20, 0x70bd27, 0x25dfdbff, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x5, 0x80}}}}, ["", "", "", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40001}, 0x4004080) (async) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r3, &(0x7f0000002000)={&(0x7f0000001f40)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001fc0)={&(0x7f0000001f80)={0x40, r6, 0x300, 0x70bd25, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}]}, 0x40}, 0x1, 0x0, 0x0, 0x20004808}, 0x48000) (async) r8 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002080), r3) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r3, &(0x7f0000002140)={&(0x7f0000002040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000002100)={&(0x7f00000020c0)={0x24, r8, 0x20, 0x70bd28, 0x25dfdbfb, {}, [@ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x9}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x6c2c}]}, 0x24}}, 0x40) (async) syz_emit_ethernet(0x5e, &(0x7f0000002180)={@local, @broadcast, @val={@val={0x88a8, 0x0, 0x1, 0x2}, {0x8100, 0x2, 0x1, 0x2}}, {@canfd={0xd, {{0x1, 0x0, 0x1}, 0x19, 0x3, 0x0, 0x0, "588225af8b1c9808bd9a4c3c603eabea9ede702f50f514aca39d47f78816fada348aa7c5f296753f6714d2dd9cfb17cc03c63c6fd95f5a1af6bfa27eba977441"}}}}, &(0x7f0000002200)={0x1, 0x1, [0xff3, 0xf8c, 0xbce, 0x42a]}) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000002240)={0xffffffffffffffff}) sendto$unix(r9, &(0x7f0000002280)="9718576eb5db2dd9ad45d8ea74e5bcc617b78bcf90474667b4db827a37e04f7b24e54e1e057059e007e571e24d5d94e32d0d79c1ac34b5f5792886c86d69885aee2f2d8cb18c4648b32ee5d1d657fa1c029e4713b14580c8c9c1a1ff82334a7da3046b65e5706f6c3cc17039980286a859d3423c8e601d47c2416205cc798e8458247fdfe9979cbe70fb674cb5700b3afb8b9e89470d12917b4aaf0f8cc8588345442819dc6f2616ed64d8c9278238d44cc36781051baafcd9c3e82b5aac45efb767e23dab2a37d45f4ff956ec933f7219664ad4a8ddd37efd9d274524a0d2f1fba9e78408faa86c415ab4a4b4a9afc0c1", 0xf1, 0x840, &(0x7f0000002380)=@file={0x0, './file0\x00'}, 0x6e) (async) r10 = openat$6lowpan_enable(0xffffffffffffff9c, &(0x7f0000002400), 0x2, 0x0) write$6lowpan_enable(r10, &(0x7f0000002440)='0', 0x1) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000002480)=@bloom_filter={0x1e, 0xd9, 0x4, 0x9, 0x3100, 0xffffffffffffffff, 0xffff0001, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4, 0x1, 0xa}, 0x50) (async) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000002500)={'vlan0\x00', 0x0}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000002580)={0x1b, 0x0, 0x0, 0x3, 0x0, r12, 0x2, '\x00', r13, 0xffffffffffffffff, 0x5, 0x3, 0x2}, 0x50) 1.067899391s ago: executing program 4 (id=8069): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f0000003880)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c9f4cef7f9606056fe5c34664c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbcebddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cfd7c3a1d37a6ab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ed8dba2f23b01a9aeb980aff9fa3a64709270c701db801f44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af4c0eb97fca585ec6bf58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75055df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83766b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef3b7cda42013d53046da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b556381768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea2a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f76062adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b441233151122b41a8d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225c380fac12f8205d182f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd1f539bd43007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711d7219ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a26c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29754f928c59306ce105ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42ddd5f393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc05bea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efdb36b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800000000000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351ba332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d96ee1b84bb64b14aebc6b5194c55dd6890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b07838a3ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a139d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fcc49a729f11ab377f7132c543d29646a9378eea0761b7ed9d2172e33ed87c6513c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8dc0d472672286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8455029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a82a6ef09d0ed9829dec16ab67a4f59a504e09f55ab82bbd405087a17a229a149c53ee9145500db213cb36489a10957739e481a756e65bde579bbbfb404213f661eeaaffacbcfbfd60b1a715c366da2b37ac7e9e3033f8ec04db1c2412e02ccd0617d9fb646c4897750d068c936c3558a94b05d7c65c0d458c0d70d0aa864bc1e324d3f69b1b4061627da875a4b5c2668ab0990623fe6f3b54cd1c79da4baf256f88750c18486330589473e267fa44e220cf40db662b570c2a2fbba9a34a3dd7bbd8368fe506daa62b45797d4b397905a69e58eb436c08cc78963197adb1b16ad83a1a9b420e74c6bcdf1ed0b306141a83bf1268e954ad069257fbfaa1a7ea582badc1a7f2a5b0965f3535872d85c0bc3a233a3ea85df6a8ed76f0f803d54b7bef77d8ea71621f8a78dd17c3b58c5c7476ed6191acbb949e77f7cac81c543f7751e5e1000"/4545], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)=ANY=[@ANYRES32=r1, @ANYRES32, @ANYBLOB="000000008029000000000000", @ANYRES32=r1, @ANYBLOB, @ANYRES64=0x0], 0x20) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xb, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r3, 0x4) sendmsg$NL80211_CMD_NEW_INTERFACE(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16, @ANYBLOB='\t\r'], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, &(0x7f0000000040)=0x1) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@mpls_delroute={0x30, 0x18, 0x9, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_VIA={0x4, 0x12, {0x0, "f1b9a81697008d68a0328c49d2ee"}}]}, 0x30}}, 0x0) 951.584062ms ago: executing program 1 (id=8070): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="14000000100001000000000000000000198fe4400c2d170500000a40000000090a0104000000000000000308000540000000020900020073797a310000000008000a40fffffffc0800034000000010400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000804700018006000100d10300002c0000000e0a010280000000000000000a0000000900010073797a310000000009e5010073797a3100000000140000001100010000000000000000000100000a00"/219], 0xd4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 951.264073ms ago: executing program 3 (id=8071): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) listen(r0, 0x2) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5", 0x4) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) syz_emit_ethernet(0xb0, &(0x7f0000000cc0)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x7a, 0x6, 0x1, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x9, 0xc2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0xf, "7c68adbe000000000000000000"}]}}, {"a9886a32a4331a04abdd4e9348e0e2e121b4cb62859b227ed37387ac6cd5e0ebef7a3e11934785346872be461f121a76f1a21dbf27a059239e14a0d3aca9a026a554a0a8733943d8d7dc1683d93c760e287f3f3c459c"}}}}}}}, 0x0) 882.805915ms ago: executing program 4 (id=8072): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r0, 0x0) r1 = socket$kcm(0x29, 0x2, 0x0) write$cgroup_pressure(r1, &(0x7f0000000140)={'full'}, 0xfffffdef) sendmsg$kcm(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x20000818) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="2001000012001307"], 0x120}}, 0x0) recvmmsg(r2, &(0x7f0000002640)=[{{0x0, 0x0, 0x0}, 0x81}], 0x1, 0x10020, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x7, &(0x7f0000000340), 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000071000000000000000000000000000000d9130cc61c109bb38b1a20189df76ff6e84258caba5044596a7dbd60a49fa067bf6599e64880bd6e8a8109989a9d8d16e2fa41932b2ef8bbdeb4a6d064f05344c28863f5aad08b3fc8144428186ec1b90a708fd4f92f257b11968fc8017bb78537"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x30, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 769.784199ms ago: executing program 1 (id=8073): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x59) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a00)=ANY=[@ANYBLOB="1400000010007c0000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000010900020073797a310000000008000a40fffffffc400000000e0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c000180050001"], 0xa4}}, 0x40) 564.143176ms ago: executing program 3 (id=8074): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=@allocspi={0x104, 0x16, 0x1, 0x0, 0x0, {{{@in6=@local, @in=@multicast1}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x33}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x1}, 0x0, 0x0, 0xa}}, [@mark={0xc, 0x15, {0x35075b, 0xfffffffa}}]}, 0x104}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0x2, 0xd, 0x2) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWSET={0x30, 0x12, 0xa, 0x9, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x58}}, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x33}, @in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x29}}, {}, {}, {}, 0x0, 0x0, 0xa}}}, 0xf8}}, 0x0) 563.546579ms ago: executing program 1 (id=8075): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x48) (async) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000600)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) (async, rerun: 32) r2 = accept4(r1, 0x0, 0x0, 0x0) (rerun: 32) sendmsg$alg(r2, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x890}, 0x0) recvmmsg(r2, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000500)=""/229, 0xe5}], 0x1}}], 0x1, 0x60, 0x0) (async) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x3, 0x14, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x45}}, @printk={@ld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1}}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r3, 0x0, 0xe, 0x0, &(0x7f00000002c0)="e02742e86c0d85ff9782762f0800", 0x0, 0x40000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 563.175929ms ago: executing program 4 (id=8076): r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="140000001d0001"], 0x14}}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000480)=ANY=[], 0x18}}, 0x20004000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newlink={0x40, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x0, 0x291c9}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_QUERY_INTVL={0xc, 0x21, 0x20000000000080}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x34041043}, 0x4004000) (async) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e00"], 0x50}}, 0x4008840) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDPRL(r1, 0x89f5, &(0x7f00000000c0)={'sit0\x00', &(0x7f0000000040)={@rand_addr=0x64010100, 0x0, 0x0, 0x20, 0x0, [{}, {@private}]}}) (async) r2 = socket$nl_audit(0x10, 0x3, 0x9) bind$netlink(r2, &(0x7f0000000140)={0x10, 0x0, 0x25dfdbff, 0x400000}, 0xc) (async, rerun: 64) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (rerun: 64) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c00028005000100000000000800074000000002180006801400040020010000000000000000000000000001"], 0xac}}, 0x0) (async) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0xac, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_NAT_SRC={0x18, 0x6, 0x0, 0x1, [@CTA_NAT_V6_MINIP={0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}]}, 0xac}}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000140), r5) sendmsg$NET_DM_CMD_STOP(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)={0x14, r6, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}}, 0x800) (async) sendmsg$NET_DM_CMD_START(r4, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x14, r6, 0x702, 0x70bd28, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000041) r7 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r7, 0x29, 0x38, &(0x7f00000000c0)=0x86, 0x4) syz_emit_ethernet(0x4e, &(0x7f00000020c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3986dd6c370c8900182b01fe800000000000000000000000000025fe8000000000000000000000000000aaff"], 0x0) recvmmsg(r7, &(0x7f0000002100)=[{{0x0, 0x0, 0x0}, 0xffff}], 0x1, 0x40010142, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r8, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="14000000000000000800000001000000", @ANYRES32=r9, @ANYBLOB='\x00\x00\x00\x00'], 0x18}, 0x0) setsockopt$SO_ATTACH_FILTER(r9, 0x1, 0x4c, &(0x7f000002eff0)={0x133, &(0x7f0000000000)=[{}]}, 0x10) (async) recvmmsg(r9, &(0x7f0000007340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=""/61, 0x11}}], 0x1, 0x0, 0x0) (async) sendmmsg(0xffffffffffffffff, &(0x7f00000002c0), 0x40000000000009f, 0x0) 562.752229ms ago: executing program 0 (id=8077): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket(0x10, 0x80003, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) splice(r4, 0x0, r3, 0x0, 0x406f413, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x3, 0x3, &(0x7f0000000040)=@framed={{0x45, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x63}}, &(0x7f0000000000)='GPL\x00'}, 0x90) write(r2, &(0x7f0000000000)="240000001a005f0214f9f407000904000a000000fe0000000000000008000f00fd000000", 0x85) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000001000010025bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="65bf30e156cff13a29001b00"/23], 0x28}, 0x1, 0x0, 0x0, 0x40845}, 0x4000000) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) getpid() r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x14, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x22}, 0x94) recvfrom$rxrpc(r2, &(0x7f0000000280)=""/158, 0x9e, 0x20, 0x0, 0x0) r6 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000200)={r5, 0xffffffffffffffff, 0x11, 0x0, @void}, 0x10) ioctl$BTRFS_IOC_QUOTA_RESCAN(r6, 0x4040942c, &(0x7f0000000440)={0x0, 0x5, [0xf, 0x10, 0xffffffff80000000, 0x4, 0x6, 0xffffffff]}) close(0xffffffffffffffff) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x40004) syz_genetlink_get_family_id$ipvs(&(0x7f0000000400), r2) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000b40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f00000008c0)="99cc6a27d9685c66b6dc476a3dd9c7af61e29d8168b55116c6710445eee400542c40b9319e855c7c6b95a3d67d6b1df6a2a8caf13728d2f90366324e30f5ae53097ce2980d1fcd7ada3d16733577642cd12b0d01d9cd1b4582f4fadf8eb90e037334", 0x62}, {&(0x7f0000000980)="437ef70cd5d9cf63ea0472f97821c07884214f7d2bd40df11c014d52aede", 0x1e}], 0x2}}], 0x2, 0x20005040) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$sock_proto_private(r7, 0x8b20, &(0x7f0000000080)) poll(&(0x7f0000000080)=[{r1, 0xe101}], 0x1, 0x2) splice(r1, &(0x7f0000000480)=0x7, r0, &(0x7f00000004c0)=0x6960, 0x1, 0x4) sendmsg$nl_route(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140028bd7000fc000800000000000079d0df2500"/29], 0x14}, 0x1, 0x0, 0x0, 0x8014}, 0x24004000) 561.661729ms ago: executing program 3 (id=8078): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000020c0)=[@in6={0xa, 0x0, 0x0, @remote, 0x34}]}, &(0x7f0000002100)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a84000000060a0b0400000000000000000200000058000480540001800a0001006d617463680000004400028008000240000000002c0003005c8f022482395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad0900010069707673000000000900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a7d66d62e6d51d63c42185680ab370d0b0defdab1ce98fbdc79fe33bd4618b1d209212baa6c54ed96904fc13330f87ba17c8e3e92c62635e0c81187808887e596693dc884024fd201134fca42d2da2895ba8a41e97f704c8c0c374cfbf692636eb9c51ecaa6d6e65bb0f588"], 0xac}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x100004, '\x00', 0x0, 0x0, 0x2}, 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)={0x1c, r4, 0xa3959ba9c9468c63, 0x6, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40010}, 0x24000000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'vlan1\x00', 0x0}) ioctl$sock_inet6_SIOCDELRT(r0, 0x890c, &(0x7f00000004c0)={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @private2={0xfc, 0x2, '\x00', 0x1}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x3, 0x4, 0xa97c, 0x500, 0xffffffffffffffff, 0x40001, r7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000010040b7080000000000007b8af8ff00000000b7080000000000107b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r2, @ANYBLOB="0000000002000000b705000008000000850000005e00000095"], &(0x7f00000001c0)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0xa}, 0x94) 427.980452ms ago: executing program 4 (id=8079): r0 = socket$inet6(0xa, 0x802, 0x88) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00', 0x0}) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$inet6_icmp(0xa, 0x2, 0x3a) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r4, 0x8983, &(0x7f0000000000)={0x8, 'veth0\x00', {'veth1_to_hsr\x00'}, 0x4}) bind$unix(r3, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r3, 0x0) listen(r3, 0x802) sendto$packet(r1, &(0x7f0000007800)="10030600e0ff020004004788aa96a17f4b0887c225a064e4a4edfa593bdef8bc649168c21579b21f7cc3af00faed6c564ce4b0f1342364cf7f1080d6fb", 0x3d, 0x0, &(0x7f0000000140)={0x11, 0x3, r2, 0x1, 0xfc, 0x6, @multicast}, 0x14) setsockopt$inet6_udp_int(r0, 0x11, 0x100000000a, &(0x7f0000000040)=0x800000001, 0x4) recvfrom$inet6(r0, &(0x7f0000000600)=""/175, 0xaf, 0x40000022, &(0x7f0000000140)={0xa, 0x4e24, 0x4, @empty, 0x7f}, 0x1c) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a6c000000060a0904000000000000000002000000400004803c0001800e000100696d6d656469617465000000280002801c0002801800028008000180fffffffd0900070000007a320000000008000140000000000900010073797a30000000000900020073797a32"], 0xa8}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r6) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000280)={'wlan1\x00', 0x0}) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="63636500000016dcdf254f00000008000300", @ANYRES32=r8, @ANYBLOB="24007a800c0003000900002e7e000000140001007aa1942f22475b438485542846186755"], 0x40}, 0x1, 0x0, 0x0, 0x40010}, 0x24000000) readv(r0, &(0x7f0000000100)=[{&(0x7f0000000000)=""/48, 0x30}, {&(0x7f0000000080)=""/85, 0x55}], 0x2) socket$inet6(0xa, 0xa, 0x9) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r10, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r11 = socket(0x400000000010, 0x3, 0x0) r12 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r11, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r13, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000940)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd25, 0xa000, {0x0, 0x0, 0x0, r13, {0xe, 0x7}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_ARP_THA={0xa, 0x41, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x37}}, @TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x806}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x4e23, 0xcc08, @mcast1, 0x2}, 0x1c) 427.500309ms ago: executing program 0 (id=8080): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x3}, 0x90) r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000080)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0xa0, 0x7b, 0xa, 0xff00}, [@call={0x1d, 0xa}, @exit, @map_fd={0x18, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x10, 0x0, 0x0, 0x25000000}, @generic]}, &(0x7f0000000140)='GPL\x00', 0xa, 0xffa0, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x47, 0x10, 0x0, 0x1e}, 0x2d) (async, rerun: 64) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) (rerun: 64) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000040)={0x208001}, 0x8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) (async) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000000)={0x6, 0x9, 0x0, 0x6, 0x8, 0x22, 0xf, 0xb, 0x0}, &(0x7f0000000200)=0x20) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r5, 0x84, 0x77, &(0x7f0000000280)={r6, 0xfffe, 0x5, [0x7fff, 0x80, 0xf342, 0x4, 0x7]}, 0x12) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x28, r4, 0x13, 0x70bd2a, 0x25dfdbfd, {}, [@BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @random="87f1ee1930b7"}, @BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}]}, 0x28}, 0x1, 0x0, 0x0, 0x40080}, 0x4000000) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="050000000000000000e02c00000008000300", @ANYRES32=r10, @ANYBLOB='\b\x00'], 0x24}, 0x1, 0x0, 0x0, 0x4008890}, 0x48000) (async, rerun: 32) shutdown(r1, 0x0) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r0, 0x8b1a, &(0x7f0000000040)) 246.490701ms ago: executing program 0 (id=8081): r0 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IEEE802154_LIST_IFACE(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x58, r0, 0x100, 0x70bd27, 0x25dfdbff, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_DEV_INDEX={0x8}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan4\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20040090) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), r1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f00000001c0), r2) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000240), r2) sendmsg$NBD_CMD_DISCONNECT(r1, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x34, r3, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f00000005c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000580)={&(0x7f00000004c0)={0xb0, r3, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@NBD_ATTR_BACKEND_IDENTIFIER={0x8, 0xa, 'nbd\x00'}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x9}, @NBD_ATTR_CLIENT_FLAGS={0xc}, @NBD_ATTR_SOCKETS={0x40, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r4}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r5}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r6}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r9}}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x434}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0xf}, @NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x108}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x401}, @NBD_ATTR_SIZE_BYTES={0xc}]}, 0xb0}, 0x1, 0x0, 0x0, 0x20008880}, 0x0) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000600), r2) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000680)=@generic={&(0x7f0000000640)='./file0\x00', 0x0, 0x8}, 0x18) r10 = openat$cgroup(0xffffffffffffffff, &(0x7f00000006c0)='syz1\x00', 0x200002, 0x0) r11 = openat$cgroup_ro(r10, &(0x7f0000000700)='blkio.throttle.io_service_bytes\x00', 0x0, 0x0) r12 = syz_genetlink_get_family_id$nfc(&(0x7f0000000780), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r11, 0x0, &(0x7f00000007c0)=0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r11, 0x0, &(0x7f0000000800)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f00000008c0)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x2c, r12, 0x300, 0x70bd28, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r13}, @NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r14}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r15 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000940), r1) sendmsg$NLBL_MGMT_C_REMOVEDEF(r1, &(0x7f0000000a40)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000a00)={&(0x7f0000000980)={0x68, r15, 0x20, 0x70bd2b, 0x25dfdbfc, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @private0}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @local}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @local}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x3}, @NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @private0={0xfc, 0x0, '\x00', 0x1}}]}, 0x68}, 0x1, 0x0, 0x0, 0x8008}, 0x21) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r7, 0xf503, 0x0) r16 = syz_genetlink_get_family_id$tipc(&(0x7f0000000ac0), r11) sendmsg$TIPC_CMD_SET_NETID(r11, &(0x7f0000000b80)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x24, r16, 0x300, 0x70bd2b, 0x25dfdbfd, {{}, {}, {0x8, 0x2, 0x9}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40090}, 0x1) recvfrom$netrom(r11, &(0x7f0000000bc0)=""/169, 0xa9, 0x1, &(0x7f0000000c80)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x4}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default]}, 0x48) r17 = socket(0x2, 0x80000, 0xf3) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r17, 0x84, 0x75, &(0x7f0000000d80)={0x0, 0x4}, &(0x7f0000000dc0)=0x8) 245.523887ms ago: executing program 2 (id=8082): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e000000040000000400000003"], 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000030000005800018044000400200001e6f8b1830149b12e00000001d900000000000000000000000100000000200002000a00000000000000fe800000000000000004000000000000000000000d0001007564703a73"], 0x6c}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x15, 0x1c, &(0x7f0000000400)=ANY=[@ANYBLOB="180800006f0000000000000000000025d5418375", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bc0908000000000035090100000000009500000000070000b7020000000000007b9a00fe000000006609000000000000dbaaf0ff50000000bf8620000000000007080000f8ffffffbfa400000000000007040000f0ffffff770000000800000018220000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7050000180000084609f0ff76000000bf9800000000000056080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 85.168028ms ago: executing program 1 (id=8083): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r2, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r3, &(0x7f00000004c0)={{0x6, @rose, 0x1}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) listen(r3, 0x80) accept$netrom(r3, &(0x7f0000000000)={{0x3, @rose}, [@rose, @default, @default, @default, @remote, @null, @rose, @rose]}, &(0x7f0000000080)=0x48) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000680)={0x0, ""/256, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_SCRUB(r2, 0xc400941b, &(0x7f0000000880)={0x0, 0xffffffffffffffff, 0x55e55464, 0x1}) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r3, 0x5000943f, &(0x7f0000000c80)={{r2}, r4, 0x4, @inherit={0x58, &(0x7f0000000100)={0x0, 0x2, 0x1, 0x9, {0x14, 0x9, 0xc, 0xd, 0x9}, [0x10001, 0x7]}}, @devid=r5}) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a000800", @ANYRES32=r6, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@ipv4_newaddr={0x20, 0x14, 0x1, 0x70bd28, 0x25dfdbfc, {0x2, 0x20, 0x1, 0xc8, r6}, [@IFA_LOCAL={0x8, 0x2, @local}]}, 0x20}}, 0x40000c0) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r8, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f0000000280)={r8, r8, 0x2, 0x0, 0x0, 0x9, 0xae, 0xb57, 0x5, 0xc336, 0x1, 0xb, 'syz0\x00'}) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x40, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3806}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @vti={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VTI_REMOTE={0x8, 0x5, @private=0xa010102}]}}}, @IFLA_MASTER={0x8, 0xa, r6}]}, 0x40}}, 0x440b0) 0s ago: executing program 4 (id=8084): r0 = socket$kcm(0x23, 0x2, 0x0) sendmsg$sock(r0, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000240)=0x9, 0x4) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="1c0000f500000000000000862dfdff00000065"], 0x78) recvmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20) r3 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r3, 0x89e3, &(0x7f0000000080)={0x0, 0x0, 0x4, 0x0, 0xfffffffc}) ioctl$SIOCX25SDTEFACILITIES(r3, 0x89eb, &(0x7f0000000040)={0x55b, 0x800, 0x4, 0xc7, 0xb4, 0x22, 0x20, "6af3240d98a25f173e5b403c283c0f28678182e4", "096e07a25196fa13eb1c4e4d6f246fcf0b59182d"}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r4) sendmsg$ETHTOOL_MSG_FEATURES_SET(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000002040)={0x4c, r5, 0x1, 0x70bd27, 0x0, {}, [@ETHTOOL_A_FEATURES_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_FEATURES_WANTED={0x18, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@ETHTOOL_A_BITSET_BIT_INDEX={0x8, 0x1, 0x2}, @ETHTOOL_A_BITSET_BIT_VALUE={0x4}]}]}]}]}, 0x4c}}, 0x0) kernel console output (not intermixed with test programs): T5816] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 637.694688][T28018] lo speed is unknown, defaulting to 1000 [ 637.733031][ T5139] block nbd2: Receive control failed (result -32) [ 637.979640][T28032] openvswitch: netlink: Unexpected mask (mask=2020040, allowed=2010048) [ 637.988759][T28032] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6148'. [ 638.036020][T28034] netlink: 'syz.4.6150': attribute type 3 has an invalid length. [ 638.052614][T28034] netlink: 'syz.4.6150': attribute type 3 has an invalid length. [ 638.252961][T28045] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6154'. [ 638.293914][T28045] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6154'. [ 638.488744][T28058] smc: net device team0 applied user defined pnetid SYZ2 [ 638.654743][T28018] chnl_net:caif_netlink_parms(): no params data found [ 638.843988][T28078] syzkaller0: entered promiscuous mode [ 638.849488][T28078] syzkaller0: entered allmulticast mode [ 638.975906][T28018] bridge0: port 1(bridge_slave_0) entered blocking state [ 638.985100][T28018] bridge0: port 1(bridge_slave_0) entered disabled state [ 638.992309][T28018] bridge_slave_0: entered allmulticast mode [ 639.002199][T28018] bridge_slave_0: entered promiscuous mode [ 639.046790][T28018] bridge0: port 2(bridge_slave_1) entered blocking state [ 639.054697][T28018] bridge0: port 2(bridge_slave_1) entered disabled state [ 639.062076][T28018] bridge_slave_1: entered allmulticast mode [ 639.071063][T28018] bridge_slave_1: entered promiscuous mode [ 639.109700][T28105] netlink: 'syz.4.6172': attribute type 3 has an invalid length. [ 639.157267][T28018] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 639.195824][T28018] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 639.296096][T28018] team0: Port device team_slave_0 added [ 639.327085][T28018] team0: Port device team_slave_1 added [ 639.337450][T28115] openvswitch: netlink: Unexpected mask (mask=240, allowed=10048) [ 639.451403][T28018] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 639.459799][T28018] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 639.486642][T28018] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 639.545930][ T5139] Bluetooth: hci3: command tx timeout [ 639.552449][T28018] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 639.586231][T28018] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 639.662334][T28018] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 639.838504][T28018] hsr_slave_0: entered promiscuous mode [ 639.845323][T28018] hsr_slave_1: entered promiscuous mode [ 639.864537][T28018] debugfs: 'hsr0' already exists in 'hsr' [ 639.884862][T28018] Cannot create hsr debugfs directory [ 639.923757][T23740] team0: left allmulticast mode [ 639.943555][T23740] team_slave_0: left allmulticast mode [ 639.951974][T23740] team_slave_1: left allmulticast mode [ 639.962164][T23740] team0: left promiscuous mode [ 639.982298][T23740] team_slave_0: left promiscuous mode [ 639.993317][T23740] team_slave_1: left promiscuous mode [ 640.000925][T23740] bridge0: port 3(team0) entered disabled state [ 640.025515][T23740] bridge_slave_1: left allmulticast mode [ 640.031214][T23740] bridge_slave_1: left promiscuous mode [ 640.039508][T23740] bridge0: port 2(bridge_slave_1) entered disabled state [ 640.054640][T23740] bridge_slave_0: left allmulticast mode [ 640.060331][T23740] bridge_slave_0: left promiscuous mode [ 640.066374][T23740] bridge0: port 1(bridge_slave_0) entered disabled state [ 640.101404][T28165] netlink: 'syz.3.6189': attribute type 29 has an invalid length. [ 640.237848][T23740] bond5 (unregistering): (slave gretap1): Releasing active interface [ 640.277584][T23740] bond1 (unregistering): (slave geneve2): Releasing active interface [ 640.397539][T23740] bond2 (unregistering): (slave bridge2): Releasing backup interface [ 640.668128][T23740] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 640.678564][T23740] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 640.688741][T23740] bond0 (unregistering): Released all slaves [ 640.698784][T23740] bond1 (unregistering): Released all slaves [ 640.712888][T23740] bond2 (unregistering): Released all slaves [ 640.725950][T23740] bond3 (unregistering): Released all slaves [ 640.738972][T23740] bond4 (unregistering): Released all slaves [ 640.766254][T23740] bond5 (unregistering): Released all slaves [ 640.778665][T23740] bond6 (unregistering): Released all slaves [ 640.796404][T23740] bond7 (unregistering): Released all slaves [ 640.808799][T23740] bond8 (unregistering): Released all slaves [ 640.831430][T23740] bond9 (unregistering): Released all slaves [ 640.882961][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 640.891046][ C1] lec:lec_tx_timeout: lec0 [ 640.896576][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 640.968620][T28173] __nla_validate_parse: 6 callbacks suppressed [ 640.968636][T28173] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6190'. [ 641.079502][T23740] : left promiscuous mode [ 641.149123][T28181] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6191'. [ 641.185342][T28183] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 641.204524][T28184] netlink: 16 bytes leftover after parsing attributes in process `syz.2.6191'. [ 641.236957][T23740] tipc: Disabling bearer [ 641.254679][T23740] tipc: Left network mode [ 641.336009][T23740] IPVS: stopping master sync thread 20723 ... [ 641.623595][ T5816] Bluetooth: hci3: command tx timeout [ 642.300168][T28234] delete_channel: no stack [ 642.318258][T28240] ipt_ECN: cannot use operation on non-tcp rule [ 642.338761][T28240] sctp: [Deprecated]: syz.0.6203 (pid 28240) Use of int in max_burst socket option. [ 642.338761][T28240] Use struct sctp_assoc_value instead [ 642.554299][T28252] netlink: 'syz.4.6209': attribute type 1 has an invalid length. [ 642.562104][T28252] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 642.641911][T23740] hsr_slave_0: left promiscuous mode [ 642.666319][T28261] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6211'. [ 642.830947][T23740] team0 (unregistering): Port device team_slave_1 removed [ 642.860868][T23740] team0 (unregistering): Port device team_slave_0 removed [ 643.185416][T28280] Cannot find add_set index 0 as target [ 643.264836][T28286] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6215'. [ 643.425661][T28018] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 643.449314][T28018] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 643.496832][T28018] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 643.563076][T28018] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 643.718713][ T5816] Bluetooth: hci3: command tx timeout [ 643.955995][T28018] 8021q: adding VLAN 0 to HW filter on device bond0 [ 643.980077][T28324] netlink: 'syz.2.6221': attribute type 15 has an invalid length. [ 644.031343][T28326] netlink: 'syz.2.6221': attribute type 3 has an invalid length. [ 644.145111][T28018] 8021q: adding VLAN 0 to HW filter on device team0 [ 644.181023][T23742] bridge0: port 1(bridge_slave_0) entered blocking state [ 644.188303][T23742] bridge0: port 1(bridge_slave_0) entered forwarding state [ 644.267235][T23740] bridge0: port 2(bridge_slave_1) entered blocking state [ 644.274534][T23740] bridge0: port 2(bridge_slave_1) entered forwarding state [ 644.302528][T28350] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6228'. [ 644.325474][T28349] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6228'. [ 644.351508][T28352] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6229'. [ 644.369269][T28018] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 644.618132][T28363] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6230'. [ 644.896575][T28018] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 644.976995][T28394] tipc: Started in network mode [ 644.991296][T28394] tipc: Node identity fe800000000000000000000000000014, cluster identity 4711 [ 645.036288][T28394] tipc: Enabled bearer , priority 10 [ 645.068857][T28402] netlink: 'syz.3.6240': attribute type 4 has an invalid length. [ 645.078136][T28402] netlink: 152 bytes leftover after parsing attributes in process `syz.3.6240'. [ 645.149826][T28402] `: renamed from bond0 (while UP) [ 645.246099][T28018] veth0_vlan: entered promiscuous mode [ 645.283163][T28018] veth1_vlan: entered promiscuous mode [ 645.335999][T28417] vlan3: entered promiscuous mode [ 645.364979][T28417] bridge0: entered promiscuous mode [ 645.409637][T28018] veth0_macvtap: entered promiscuous mode [ 645.451498][T28018] veth1_macvtap: entered promiscuous mode [ 645.501154][T28018] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 645.549706][T28018] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 645.584773][T28428] netlink: 'syz.4.6246': attribute type 1 has an invalid length. [ 645.603833][T23740] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 645.683584][T23740] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 645.698940][T28435] Cannot find add_set index 0 as target [ 645.709367][T23740] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 645.740457][T23740] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 645.783379][ T5816] Bluetooth: hci3: command tx timeout [ 645.879700][T28453] netlink: 'syz.0.6250': attribute type 1 has an invalid length. [ 645.986872][T23742] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 646.026787][T23742] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 646.099801][T23740] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 646.144012][T23740] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 646.153488][T13789] tipc: Node number set to 4269801492 [ 646.292040][T28470] tipc: Enabled bearer , priority 0 [ 646.316206][T28475] __nla_validate_parse: 2 callbacks suppressed [ 646.316223][T28475] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6256'. [ 646.379051][T28470] syzkaller0: entered promiscuous mode [ 646.385347][T28470] syzkaller0: entered allmulticast mode [ 646.391601][T28470] tipc: Resetting bearer [ 646.531860][T28468] tipc: Resetting bearer [ 647.232998][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 6330 ms [ 647.241111][ C1] lec:lec_tx_timeout: lec0 [ 647.246091][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 648.047859][T28468] tipc: Disabling bearer [ 648.061901][T28485] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 648.248840][T28515] x_tables: unsorted entry at hook 3 [ 648.353368][T13781] lo speed is unknown, defaulting to 1000 [ 648.557713][T28533] : entered promiscuous mode [ 648.609729][T28536] vlan1: entered allmulticast mode [ 648.637354][T28536] veth0_vlan: entered allmulticast mode [ 648.692865][T28541] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6272'. [ 648.733119][T28541] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6272'. [ 648.742111][T28541] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6272'. [ 648.765018][T28546] IPv6: Can't replace route, no match found [ 648.785790][T28544] tipc: Enabling of bearer rejected, failed to enable media [ 649.172013][T28577] netlink: 'syz.4.6283': attribute type 3 has an invalid length. [ 649.193894][T28580] netlink: 'syz.1.6282': attribute type 32 has an invalid length. [ 649.214647][T28580] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6282'. [ 649.227248][T28578] netlink: 4 bytes leftover after parsing attributes in process `syz.3.6281'. [ 649.270248][T28590] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6283'. [ 649.307575][T28571] 8021q: adding VLAN 0 to HW filter on device bond0 [ 649.350443][T28596] xt_bpf: check failed: parse error [ 649.356019][T28580] bond1: option coupled_control: invalid value (52) [ 649.370682][T28580] bond1 (unregistering): Released all slaves [ 649.638586][T28618] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 649.846166][T28630] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6297'. [ 650.149196][T28649] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6304'. [ 650.478162][T28671] netlink: 252 bytes leftover after parsing attributes in process `syz.1.6313'. [ 650.496191][T28671] vxcan2: entered allmulticast mode [ 650.579185][T28677] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 650.660965][T28677] syzkaller0: entered promiscuous mode [ 650.670433][T28677] syzkaller0: entered allmulticast mode [ 652.210683][T28679] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 652.337152][T28722] xt_l2tp: v2 doesn't support IP mode [ 652.436640][T28731] nbd: must specify an index to disconnect [ 652.470187][T28735] nbd: must specify an index to disconnect [ 652.556475][T28744] netlink: 'syz.4.6332': attribute type 29 has an invalid length. [ 652.567787][T28744] __nla_validate_parse: 4 callbacks suppressed [ 652.567803][T28744] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6332'. [ 652.590301][T28745] netlink: 44 bytes leftover after parsing attributes in process `syz.0.6331'. [ 652.652300][T28751] netlink: 132 bytes leftover after parsing attributes in process `syz.0.6335'. [ 652.808024][T28760] netlink: 256 bytes leftover after parsing attributes in process `syz.1.6338'. [ 652.970586][T28779] xt_l2tp: v2 doesn't support IP mode [ 652.992952][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5750 ms [ 653.000990][ C1] lec:lec_tx_timeout: lec0 [ 653.006138][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 653.136751][T28796] xt_l2tp: invalid flags combination: 8 [ 653.307641][T28806] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 653.343646][T28809] netlink: 'syz.3.6351': attribute type 9 has an invalid length. [ 653.358415][T28808] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 653.444646][T28811] netlink: 'syz.1.6353': attribute type 29 has an invalid length. [ 653.488571][T28811] netlink: 'syz.1.6353': attribute type 29 has an invalid length. [ 653.503961][T28811] netlink: 500 bytes leftover after parsing attributes in process `syz.1.6353'. [ 653.596478][T28822] netlink: 'syz.2.6358': attribute type 1 has an invalid length. [ 653.598292][T28825] ipvlan2: entered allmulticast mode [ 653.611864][T28825] batadv_slave_1: entered allmulticast mode [ 653.635045][T28825] batman_adv: batadv0: Adding interface: ipvlan2 [ 653.651002][T28825] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 653.683629][T28825] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 653.696801][T28825] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 653.708615][T28825] batman_adv: batadv0: Interface activated: ipvlan2 [ 653.731171][T28826] ipvlan3: entered allmulticast mode [ 653.747634][T28826] batman_adv: batadv0: Adding interface: ipvlan3 [ 653.763329][T28826] batman_adv: batadv0: The MTU of interface ipvlan3 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 653.800896][T28826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 653.808830][T13784] IPVS: starting estimator thread 0... [ 653.817617][T28826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 653.831215][T28826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: ipvlan2 [ 653.842310][T28826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 653.853769][T28826] batman_adv: batadv0: Interface activated: ipvlan3 [ 653.902463][T28822] bond2: entered promiscuous mode [ 653.909097][T28822] 8021q: adding VLAN 0 to HW filter on device bond2 [ 653.916998][T28839] IPVS: using max 30 ests per chain, 72000 per kthread [ 653.945688][T28835] bond2: (slave bridge2): making interface the new active one [ 653.953849][T28835] bridge2: entered promiscuous mode [ 653.966593][T28835] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 654.194278][T28859] xt_policy: output policy not valid in PREROUTING and INPUT [ 654.215321][T28863] geneve2: entered promiscuous mode [ 654.310958][T28870] Bluetooth: MGMT ver 1.23 [ 654.318625][T28870] netlink: 'syz.1.6372': attribute type 11 has an invalid length. [ 654.543743][T28893] netlink: 256 bytes leftover after parsing attributes in process `syz.3.6379'. [ 654.776869][T28905] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6380'. [ 654.899897][T28917] netlink: 'syz.1.6383': attribute type 4 has an invalid length. [ 654.927328][T28918] netlink: 'syz.1.6383': attribute type 4 has an invalid length. [ 654.983474][T28923] netlink: 244 bytes leftover after parsing attributes in process `syz.0.6385'. [ 654.995118][T28927] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6384'. [ 655.194324][T28941] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6388'. [ 655.197708][T28936] vlan4: entered promiscuous mode [ 655.211374][T28936] vlan4: entered allmulticast mode [ 655.216663][T28936] hsr_slave_1: entered allmulticast mode [ 655.322211][T28943] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 655.427091][T28947] syzkaller0: entered promiscuous mode [ 655.444099][T28947] syzkaller0: entered allmulticast mode [ 655.456164][T28952] Unsupported ieee802154 address type: 0 [ 655.469475][T28949] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 656.116081][T28999] openvswitch: netlink: Key 2 has unexpected len 8 expected 4 [ 656.205727][T29003] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 656.230939][T29004] syzkaller0: entered promiscuous mode [ 656.248332][T29004] syzkaller0: entered allmulticast mode [ 656.401593][T29018] openvswitch: netlink: Flow actions attr not present in new flow. [ 656.487843][T29027] syzkaller1: entered promiscuous mode [ 656.494645][T29027] syzkaller1: entered allmulticast mode [ 656.611216][T29033] xt_l2tp: v2 sid > 0xffff: 1114112 [ 656.661723][T29037] openvswitch: netlink: IP tunnel dst address not specified [ 656.671641][T29038] netlink: 'syz.3.6422': attribute type 1 has an invalid length. [ 656.856945][T29056] tunl0: entered promiscuous mode [ 656.868339][T29057] netlink: 'syz.4.6429': attribute type 5 has an invalid length. [ 656.872438][T29056] netlink: 'syz.1.6427': attribute type 3 has an invalid length. [ 656.893421][T29057] netlink: 'syz.4.6429': attribute type 5 has an invalid length. [ 656.901947][T29057] netlink: 'syz.4.6429': attribute type 5 has an invalid length. [ 656.910533][T29057] netlink: 'syz.4.6429': attribute type 5 has an invalid length. [ 656.912624][T29058] workqueue: Failed to create a rescuer kthread for wq "bond2": -EINTR [ 657.007470][T29069] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 657.177453][T29080] netlink: 'syz.4.6436': attribute type 13 has an invalid length. [ 657.291593][T29087] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 657.470766][T29094] syzkaller0: entered promiscuous mode [ 657.489549][T29094] syzkaller0: entered allmulticast mode [ 657.550958][ T5139] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 657.571014][ T5139] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 657.580420][ T5139] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 657.592175][ T5139] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 657.604230][ T5139] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 657.785087][T29097] syzkaller0: entered promiscuous mode [ 657.792314][T29097] syzkaller0: entered allmulticast mode [ 657.804781][T29106] __nla_validate_parse: 14 callbacks suppressed [ 657.804794][T29106] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6444'. [ 658.752951][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5740 ms [ 658.761051][ C1] lec:lec_tx_timeout: lec0 [ 658.766714][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 659.287356][T29095] lo speed is unknown, defaulting to 1000 [ 659.408316][T29118] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.458443][T29125] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6448'. [ 659.471766][T29124] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6448'. [ 659.528745][T29134] netlink: 'syz.3.6450': attribute type 1 has an invalid length. [ 659.571050][T29130] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 659.670613][T29140] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6452'. [ 659.699014][T29118] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.719670][ T5816] Bluetooth: hci4: command tx timeout [ 659.779814][T29147] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6455'. [ 659.838205][T29150] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6456'. [ 659.894654][T29118] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.917133][T29147] vlan2: entered promiscuous mode [ 659.925648][T29147] bridge0: entered promiscuous mode [ 659.942730][T29150] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6456'. [ 659.957037][T29153] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6457'. [ 659.967915][T29153] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6457'. [ 659.994898][T29118] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 660.041084][T29156] netlink: 'syz.3.6457': attribute type 13 has an invalid length. [ 660.053421][T29150] netlink: 144 bytes leftover after parsing attributes in process `syz.4.6456'. [ 660.075041][T29155] syzkaller0: entered promiscuous mode [ 660.080548][T29155] syzkaller0: entered allmulticast mode [ 660.104580][T29156] veth0_macvtap: left promiscuous mode [ 660.110242][T29156] macvtap0: entered allmulticast mode [ 660.123982][T29156] macvtap0: refused to change device tx_queue_len [ 660.310469][T23741] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 660.346272][T23742] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 660.401134][T23741] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 660.452694][T23744] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 660.483731][T29095] chnl_net:caif_netlink_parms(): no params data found [ 661.038806][T29095] bridge0: port 1(bridge_slave_0) entered blocking state [ 661.065043][T29095] bridge0: port 1(bridge_slave_0) entered disabled state [ 661.086355][T29095] bridge_slave_0: entered allmulticast mode [ 661.110057][T29213] netlink: 'syz.2.6472': attribute type 1 has an invalid length. [ 661.124780][T29095] bridge_slave_0: entered promiscuous mode [ 661.151859][T29095] bridge0: port 2(bridge_slave_1) entered blocking state [ 661.177473][T29095] bridge0: port 2(bridge_slave_1) entered disabled state [ 661.199843][T29095] bridge_slave_1: entered allmulticast mode [ 661.225681][T29095] bridge_slave_1: entered promiscuous mode [ 661.420649][T29095] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 661.476589][T29095] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 661.593474][T29095] team0: Port device team_slave_0 added [ 661.629412][T29095] team0: Port device team_slave_1 added [ 661.724085][T29095] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 661.731069][T29095] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 661.784753][ T5816] Bluetooth: hci4: command tx timeout [ 661.796961][T29095] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 661.826674][T29095] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 661.873659][T29095] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 661.909037][T29095] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 662.049572][T29277] netlink: 'syz.2.6488': attribute type 13 has an invalid length. [ 662.077735][T29273] wireguard0: entered promiscuous mode [ 662.083661][T29273] wireguard0: entered allmulticast mode [ 662.091835][T29273] team0: Device wireguard0 is of different type [ 662.101522][T29283] netlink: 'syz.2.6488': attribute type 1 has an invalid length. [ 662.114543][T29283] netlink: 'syz.2.6488': attribute type 16 has an invalid length. [ 662.122523][T29283] netlink: 'syz.2.6488': attribute type 17 has an invalid length. [ 662.258684][T29283] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 662.291469][T29095] hsr_slave_0: entered promiscuous mode [ 662.305182][T29095] hsr_slave_1: entered promiscuous mode [ 662.311767][T29095] debugfs: 'hsr0' already exists in 'hsr' [ 662.318057][T29095] Cannot create hsr debugfs directory [ 662.455260][ T5820] IPVS: starting estimator thread 0... [ 662.564448][T29295] IPVS: using max 31 ests per chain, 74400 per kthread [ 662.645002][T29095] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 662.690292][T29265] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 662.704907][T29265] Bluetooth: hci5: Error when powering off device on rfkill (-4) [ 662.731676][T29265] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 662.752649][T29265] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 662.817105][T29095] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 662.911628][T29314] __nla_validate_parse: 7 callbacks suppressed [ 662.911647][T29314] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6494'. [ 662.939675][T29314] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6494'. [ 662.949896][T29314] netlink: 2 bytes leftover after parsing attributes in process `syz.4.6494'. [ 662.959901][T29314] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6494'. [ 662.970361][T29314] netlink: 2 bytes leftover after parsing attributes in process `syz.4.6494'. [ 662.985120][T29318] netlink: 220 bytes leftover after parsing attributes in process `syz.4.6494'. [ 663.005461][T29265] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 663.006248][T29095] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 663.032720][T29265] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 663.154243][T29095] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 663.276114][T29265] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 663.282052][T29265] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 663.644907][T29095] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 663.773239][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 663.781272][ C1] lec:lec_tx_timeout: lec0 [ 663.786556][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 663.794338][T29095] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 663.808242][T29095] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 663.831427][T29095] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 664.058246][T29381] netlink: 12 bytes leftover after parsing attributes in process `syz.4.6507'. [ 664.125062][T29381] netlink: 'syz.4.6507': attribute type 1 has an invalid length. [ 664.146405][T29381] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6507'. [ 664.167272][T29095] 8021q: adding VLAN 0 to HW filter on device bond0 [ 664.212154][T29095] 8021q: adding VLAN 0 to HW filter on device team0 [ 664.271317][T29390] netlink: 'syz.4.6507': attribute type 1 has an invalid length. [ 664.305191][T23738] bridge0: port 1(bridge_slave_0) entered blocking state [ 664.312367][T23738] bridge0: port 1(bridge_slave_0) entered forwarding state [ 664.331480][T23742] bridge0: port 2(bridge_slave_1) entered blocking state [ 664.338683][T23742] bridge0: port 2(bridge_slave_1) entered forwarding state [ 664.765940][T29416] openvswitch: netlink: Duplicate or invalid key (type 0). [ 664.816582][T29416] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 664.843701][T29416] netlink: 'syz.2.6514': attribute type 1 has an invalid length. [ 664.924592][T29095] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 665.147062][T29440] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6520'. [ 665.166821][T29095] veth0_vlan: entered promiscuous mode [ 665.202363][T29095] veth1_vlan: entered promiscuous mode [ 665.340444][T29095] veth0_macvtap: entered promiscuous mode [ 665.389706][T29095] veth1_macvtap: entered promiscuous mode [ 665.459184][T29095] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 665.482301][T29457] netlink: 212368 bytes leftover after parsing attributes in process `syz.3.6525'. [ 665.489921][T29095] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 665.561737][T23742] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 665.603150][T23742] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 665.645301][T23742] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 665.705339][T23742] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 665.946483][T23742] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 665.968518][T23742] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 666.105197][T23741] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 666.140757][T23741] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 666.444592][T29514] af_packet: tpacket_rcv: packet too big, clamped from 64 to 4294967272. macoff=96 [ 666.578995][T29525] bond2: option lacp_active: mode dependency failed, not supported in mode balance-rr(0) [ 666.594340][T29525] bond2 (unregistering): Released all slaves [ 667.044887][T29571] lo: Caught tx_queue_len zero misconfig [ 667.146538][T29575] syzkaller1: entered promiscuous mode [ 667.152116][T29575] syzkaller1: entered allmulticast mode [ 667.643870][T29621] delete_channel: no stack [ 667.914793][T29633] Cannot find add_set index 0 as target [ 668.052432][T29653] __nla_validate_parse: 9 callbacks suppressed [ 668.052453][T29653] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6570'. [ 668.135586][T29653] vlan2: entered promiscuous mode [ 668.152315][T29653] bridge0: entered promiscuous mode [ 668.227085][T29662] tipc: Enabling of bearer rejected, failed to enable media [ 668.276622][T29669] netlink: 165 bytes leftover after parsing attributes in process `syz.0.6573'. [ 668.331039][T29671] xt_hashlimit: size too large, truncated to 1048576 [ 668.407788][T29682] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6576'. [ 668.495936][T29682] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6576'. [ 668.553999][T29693] netlink: 204 bytes leftover after parsing attributes in process `syz.4.6578'. [ 668.565771][T29692] syzkaller1: entered promiscuous mode [ 668.571272][T29692] syzkaller1: entered allmulticast mode [ 668.629184][T29692] netlink: 104 bytes leftover after parsing attributes in process `syz.1.6579'. [ 668.711559][T29702] netlink: 48 bytes leftover after parsing attributes in process `syz.4.6581'. [ 668.793330][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 668.801423][ C1] lec:lec_tx_timeout: lec0 [ 668.806348][ C1] lec:lec_start_xmit: lec0:No lecd attached [ 668.844705][T29710] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6583'. [ 668.877938][T29710] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6583'. [ 668.909118][T29710] syzkaller0: entered promiscuous mode [ 668.917622][T29710] syzkaller0: entered allmulticast mode [ 669.035012][T29717] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6585'. [ 669.099531][T29726] syzkaller1: entered promiscuous mode [ 669.127862][T29726] syzkaller1: entered allmulticast mode [ 669.402776][T29739] geneve2: entered promiscuous mode [ 669.408758][T29739] geneve2: entered allmulticast mode [ 669.417331][T29746] netlink: 'syz.1.6593': attribute type 33 has an invalid length. [ 669.446903][T23741] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.503041][T23741] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.527802][T23741] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.570763][T29746] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 669.676149][T29746] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 669.733354][T23741] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 669.750154][T29758] netlink: 'syz.3.6594': attribute type 4 has an invalid length. [ 670.029510][T29791] netlink: 'syz.1.6603': attribute type 7 has an invalid length. [ 670.046721][T29791] netlink: 'syz.1.6603': attribute type 8 has an invalid length. [ 670.154229][T29801] veth3: entered promiscuous mode [ 670.306476][T29817] syzkaller1: entered promiscuous mode [ 670.312002][T29817] syzkaller1: entered allmulticast mode [ 671.189267][T29882] netlink: 'syz.4.6627': attribute type 10 has an invalid length. [ 671.204525][T29886] netlink: 'syz.3.6626': attribute type 10 has an invalid length. [ 671.228820][T29886] bridge0: port 2(bridge_slave_1) entered disabled state [ 671.253276][T29886] bridge_slave_1: left allmulticast mode [ 671.258961][T29886] bridge_slave_1: left promiscuous mode [ 671.266300][T29889] netlink: 'syz.3.6626': attribute type 7 has an invalid length. [ 671.274363][T29886] bridge0: port 2(bridge_slave_1) entered disabled state [ 671.281680][T29889] netlink: 'syz.3.6626': attribute type 8 has an invalid length. [ 671.321526][T29886] `: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 672.242305][T29950] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 672.329513][T29938] syzkaller0: entered promiscuous mode [ 672.351338][T29938] syzkaller0: entered allmulticast mode [ 673.815142][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 673.823166][ C1] lec:lec_tx_timeout: lec0 [ 674.185517][T29977] bond2: entered promiscuous mode [ 674.190934][T29977] bond2: entered allmulticast mode [ 674.196801][T29977] 8021q: adding VLAN 0 to HW filter on device bond2 [ 674.411328][T29997] __nla_validate_parse: 18 callbacks suppressed [ 674.411349][T29997] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6663'. [ 674.435691][T29998] openvswitch: netlink: VXLAN extension 0 has unexpected len 2 expected 0 [ 674.538441][T30017] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6664'. [ 674.632486][T30003] bridge3: port 1(veth5) entered blocking state [ 674.640707][T30003] bridge3: port 1(veth5) entered disabled state [ 674.647945][T30003] veth5: entered allmulticast mode [ 674.655985][T30003] veth5: entered promiscuous mode [ 674.816589][T30033] syzkaller0: entered promiscuous mode [ 674.867213][T30033] syzkaller0: entered allmulticast mode [ 674.943490][T30040] netlink: 'syz.4.6674': attribute type 33 has an invalid length. [ 674.954770][T30041] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6673'. [ 675.097293][T30040] bond3: option broadcast_neighbor: mode dependency failed, not supported in mode balance-rr(0) [ 675.109864][T30040] bond3 (unregistering): Released all slaves [ 675.645290][T30070] netlink: 8 bytes leftover after parsing attributes in process `syz.0.6683'. [ 677.074734][T30090] wg1: entered promiscuous mode [ 677.080419][T30090] wg1: entered allmulticast mode [ 677.085537][T30093] netlink: 'syz.2.6685': attribute type 1 has an invalid length. [ 677.085559][T30093] netlink: 'syz.2.6685': attribute type 1 has an invalid length. [ 677.170834][T30095] netlink: 164 bytes leftover after parsing attributes in process `syz.0.6686'. [ 677.216749][T30099] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6688'. [ 677.234136][T30101] netlink: 'syz.4.6689': attribute type 1 has an invalid length. [ 677.279196][T30101] 8021q: adding VLAN 0 to HW filter on device bond3 [ 677.292421][T30099] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6688'. [ 677.295165][T30101] bond3: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 677.303788][T30099] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6688'. [ 677.323589][T30101] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6689'. [ 677.339908][T30107] netlink: 'syz.0.6691': attribute type 1 has an invalid length. [ 677.381711][T30099] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6688'. [ 677.711283][T30133] IPv6: NLM_F_CREATE should be specified when creating new route [ 677.854657][T30151] sctp: [Deprecated]: syz.0.6708 (pid 30151) Use of int in max_burst socket option. [ 677.854657][T30151] Use struct sctp_assoc_value instead [ 677.995359][T30160] openvswitch: netlink: Unexpected mask (mask=240040, allowed=10048) [ 678.091060][T30167] syzkaller0: entered allmulticast mode [ 678.116660][T30167] syzkaller0 (unregistering): left allmulticast mode [ 678.187478][T30173] netlink: 'syz.1.6716': attribute type 11 has an invalid length. [ 678.245034][T30173] syzkaller1: entered promiscuous mode [ 678.267071][T30173] syzkaller1: entered allmulticast mode [ 678.277524][T30173] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 1647 [ 678.792060][T30216] pim6reg527: entered allmulticast mode [ 679.060976][T30248] netlink: 'syz.4.6735': attribute type 12 has an invalid length. [ 679.229578][T30262] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 679.320481][T30265] syzkaller0: entered promiscuous mode [ 679.340681][T30265] syzkaller0: entered allmulticast mode [ 679.434671][T30281] __nla_validate_parse: 10 callbacks suppressed [ 679.434689][T30281] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6746'. [ 679.527717][T30283] team0: Device ip6gre2 is of different type [ 679.556049][T30287] netlink: 256 bytes leftover after parsing attributes in process `syz.0.6749'. [ 679.577718][T30288] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6748'. [ 679.786039][T30300] syzkaller0: entered promiscuous mode [ 679.791635][T30300] syzkaller0: entered allmulticast mode [ 679.988446][T30312] bond4: option lacp_rate: mode dependency failed, not supported in mode active-backup(1) [ 680.009542][T30312] bond4 (unregistering): Released all slaves [ 680.251320][T30339] netlink: 232 bytes leftover after parsing attributes in process `syz.0.6765'. [ 680.283482][T30332] veth5: entered allmulticast mode [ 680.353744][T30345] tap0: tun_chr_ioctl cmd 1074025672 [ 680.359078][T30345] tap0: ignored: set checksum disabled [ 680.411926][T30354] tipc: Started in network mode [ 680.417552][T30354] tipc: Node identity aaaaaaaaaa32, cluster identity 4711 [ 680.428404][T30354] tipc: Enabled bearer , priority 10 [ 680.485085][T30359] netlink: 16 bytes leftover after parsing attributes in process `syz.1.6772'. [ 680.506781][T30359] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6772'. [ 680.541139][T30359] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6772'. [ 680.749714][T30372] netlink: 'syz.4.6775': attribute type 1 has an invalid length. [ 680.804571][T30372] 8021q: adding VLAN 0 to HW filter on device bond4 [ 680.845951][T30382] bond4: (slave geneve3): making interface the new active one [ 680.875075][T30382] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 680.894917][T30384] netlink: 'syz.1.6779': attribute type 1 has an invalid length. [ 680.927371][T23743] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20004 - 0 [ 680.945656][T23743] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20004 - 0 [ 680.970139][T23743] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20004 - 0 [ 681.007099][T23743] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20004 - 0 [ 681.099868][T30394] netlink: 12 bytes leftover after parsing attributes in process `syz.3.6784'. [ 681.117631][T30397] openvswitch: netlink: ufid size 17 bytes exceeds the range (1, 16) [ 681.131381][T30399] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6786'. [ 681.140601][T30397] openvswitch: netlink: Flow get message rejected, Key attribute missing. [ 681.153264][T30399] netlink: 28 bytes leftover after parsing attributes in process `syz.2.6786'. [ 681.200119][T30394] 8021q: adding VLAN 0 to HW filter on device bond3 [ 681.596569][T13781] tipc: Node number set to 10005162 [ 681.854519][T30451] netlink: 'syz.4.6799': attribute type 2 has an invalid length. [ 681.864567][T30456] sctp: [Deprecated]: syz.1.6797 (pid 30456) Use of int in max_burst socket option. [ 681.864567][T30456] Use struct sctp_assoc_value instead [ 681.904720][T30456] netlink: 'syz.1.6797': attribute type 1 has an invalid length. [ 682.745989][T30522] netlink: 'syz.2.6811': attribute type 1 has an invalid length. [ 682.928178][T30539] syzkaller0: entered promiscuous mode [ 682.937558][T30539] syzkaller0: entered allmulticast mode [ 683.101066][T30549] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 683.276509][T30565] 8021q: adding VLAN 0 to HW filter on device bond1 [ 683.299119][T30565] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 683.309183][T30568] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 683.320494][T30568] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 683.329448][T30568] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 683.337062][T30568] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 683.359489][T30573] syzkaller0: entered promiscuous mode [ 683.365414][T30573] syzkaller0: entered allmulticast mode [ 683.377400][T30565] bond1 (unregistering): (slave dummy0): Releasing backup interface [ 683.389130][T30565] bond1 (unregistering): Released all slaves [ 683.407000][T30572] netlink: 'syz.1.6830': attribute type 29 has an invalid length. [ 683.422350][T30572] netlink: 'syz.1.6830': attribute type 29 has an invalid length. [ 683.432417][T30572] netlink: 'syz.1.6830': attribute type 29 has an invalid length. [ 683.444962][T30572] netlink: 'syz.1.6830': attribute type 29 has an invalid length. [ 683.453494][T30572] netlink: 'syz.1.6830': attribute type 29 has an invalid length. [ 683.588415][T30589] Cannot find add_set index 0 as target [ 683.716661][T30596] syzkaller0: entered promiscuous mode [ 683.722163][T30596] syzkaller0: entered allmulticast mode [ 683.835825][T30601] xfrm1: entered promiscuous mode [ 683.840958][T30601] xfrm1: entered allmulticast mode [ 684.186374][T30625] bond2: entered promiscuous mode [ 684.191626][T30625] bond2: entered allmulticast mode [ 684.197897][T30625] 8021q: adding VLAN 0 to HW filter on device bond2 [ 684.285979][T30637] Cannot find del_set index 3 as target [ 684.323486][T23737] netdevsim netdevsim3 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.332036][T23737] netdevsim netdevsim3 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.363074][T23737] netdevsim netdevsim3 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.383377][T23737] netdevsim netdevsim3 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 684.395565][T30640] syzkaller0: entered promiscuous mode [ 684.408126][T30640] syzkaller0: entered allmulticast mode [ 684.520887][T30656] __nla_validate_parse: 81 callbacks suppressed [ 684.520906][T30656] netlink: 16 bytes leftover after parsing attributes in process `syz.3.6852'. [ 684.576993][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 684.602457][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 684.619976][T30663] netlink: 132 bytes leftover after parsing attributes in process `syz.4.6854'. [ 684.652789][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 684.684991][T30669] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6858'. [ 684.830919][T30677] syzkaller0: entered promiscuous mode [ 684.842000][T30677] syzkaller0: entered allmulticast mode [ 684.859421][T30677] netlink: 44 bytes leftover after parsing attributes in process `syz.1.6861'. [ 684.887754][T30677] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6861'. [ 685.044278][T30658] infiniband syz2: set active [ 685.050036][T30658] infiniband syz2: added ip6_vti0 [ 685.082176][T13781] ip6_vti0 speed is unknown, defaulting to 1000 [ 685.103265][T30658] RDS/IB: syz2: added [ 685.113455][T30658] smc: adding ib device syz2 with port count 1 [ 685.119667][T30658] smc: ib device syz2 port 1 has no pnetid [ 685.130694][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 685.139391][T13787] ip6_vti0 speed is unknown, defaulting to 1000 [ 685.177219][T30697] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6866'. [ 685.312091][T30705] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6868'. [ 685.436945][T30711] netlink: 210020 bytes leftover after parsing attributes in process `syz.2.6871'. [ 685.459288][T30711] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6871'. [ 685.497999][T30717] netlink: 48 bytes leftover after parsing attributes in process `syz.1.6870'. [ 685.566019][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 685.629827][ T1297] lec:lec_start_xmit: lec0:No lecd attached [ 685.895216][T30740] IPVS: set_ctl: invalid protocol: 59 255.255.255.255:20004 [ 686.080003][T30758] IPVS: set_ctl: invalid protocol: 117 172.20.20.170:20000 [ 686.120363][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 686.530695][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 686.535859][T30790] syzkaller0: entered promiscuous mode [ 686.542590][T30790] syzkaller0: entered allmulticast mode [ 686.707315][T30796] dvmrp0: entered allmulticast mode [ 686.832716][T30800] bridge0: port 1(bridge_slave_0) entered disabled state [ 686.843609][T30800] bridge0: port 1(bridge_slave_0) entered blocking state [ 686.850853][T30800] bridge0: port 1(bridge_slave_0) entered forwarding state [ 687.022834][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 687.094640][T30814] validate_nla: 9 callbacks suppressed [ 687.094657][T30814] netlink: 'syz.2.6902': attribute type 6 has an invalid length. [ 687.162536][T30823] netlink: 'syz.2.6902': attribute type 6 has an invalid length. [ 687.265086][T30832] netlink: 'syz.1.6906': attribute type 1 has an invalid length. [ 687.337729][T30838] Bluetooth: MGMT ver 1.23 [ 687.469570][T30852] xt_TCPMSS: Only works on TCP SYN packets [ 687.488129][T30849] syzkaller0: entered promiscuous mode [ 687.495196][T30849] syzkaller0: entered allmulticast mode [ 688.917707][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 689.119945][T30870] can-isotp: isotp_sendmsg: can_send_ret -ENETDOWN [ 689.279232][T30875] netlink: 'syz.1.6918': attribute type 4 has an invalid length. [ 689.409252][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 689.758645][T30904] __nla_validate_parse: 6 callbacks suppressed [ 689.758662][T30904] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6928'. [ 689.818971][T30907] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6927'. [ 689.830130][T30907] netlink: 28 bytes leftover after parsing attributes in process `syz.3.6927'. [ 689.865587][T30903] syzkaller0: entered promiscuous mode [ 689.871146][T30903] syzkaller0: entered allmulticast mode [ 689.921195][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 690.188191][T30929] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6935'. [ 690.252238][T30928] netlink: 56 bytes leftover after parsing attributes in process `syz.4.6933'. [ 690.315499][T30928] bond5 (unregistering): Released all slaves [ 690.337112][T30933] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 690.354752][T30658] ip6_vti0 speed is unknown, defaulting to 1000 [ 690.449276][T30936] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6938'. [ 690.517239][T30941] netlink: 'syz.4.6940': attribute type 2 has an invalid length. [ 690.540019][T30941] netlink: 244 bytes leftover after parsing attributes in process `syz.4.6940'. [ 690.663042][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5030 ms [ 690.671388][ C1] lec:lec_tx_timeout: lec0 [ 690.890406][T30962] netlink: 'syz.0.6944': attribute type 2 has an invalid length. [ 690.921778][T30964] IPVS: sync thread started: state = MASTER, mcast_ifn = geneve1, syncid = 0, id = 0 [ 690.933097][T30962] netlink: 119 bytes leftover after parsing attributes in process `syz.0.6944'. [ 691.095936][T30936] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 691.418256][T31000] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 691.425312][T31000] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 691.439723][T31003] netlink: 28 bytes leftover after parsing attributes in process `syz.0.6958'. [ 691.800185][T31025] IPVS: set_ctl: invalid protocol: 136 172.20.20.187:0 [ 692.029464][T31035] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6967'. [ 692.091589][T31042] netlink: 'syz.4.6970': attribute type 1 has an invalid length. [ 692.113267][T31042] netlink: 'syz.4.6970': attribute type 1 has an invalid length. [ 692.121033][T31042] netlink: 'syz.4.6970': attribute type 2 has an invalid length. [ 692.257776][T31054] netlink: 'syz.1.6974': attribute type 1 has an invalid length. [ 692.343941][T31054] bond3: (slave gretap2): making interface the new active one [ 692.352188][T31054] bond3: (slave gretap2): Enslaving as an active interface with an up link [ 692.750845][T31077] netlink: 'syz.3.6979': attribute type 3 has an invalid length. [ 694.472383][T31111] xt_nfacct: accounting object `\$‚9ZúM#íü¾mUµ|±^cÁ\F9YⳈ«ÃÖ' does not exist [ 694.692625][T31129] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 694.840733][T31138] netlink: 'syz.2.7000': attribute type 2 has an invalid length. [ 694.850562][T31138] __nla_validate_parse: 8 callbacks suppressed [ 694.850579][T31138] netlink: 84 bytes leftover after parsing attributes in process `syz.2.7000'. [ 694.867536][T31138] netlink: 84 bytes leftover after parsing attributes in process `syz.2.7000'. [ 694.877216][T31138] A link change request failed with some changes committed already. Interface syz_tun may have been left with an inconsistent configuration, please check. [ 695.112394][T31155] netlink: 'syz.2.7005': attribute type 1 has an invalid length. [ 695.341523][T31173] rdma_rxe: rxe_newlink: rxe creation allowed on top of a real device only [ 695.615648][T31195] netlink: 40 bytes leftover after parsing attributes in process `syz.2.7017'. [ 695.733294][T20156] lec:lec_start_xmit: lec0:No lecd attached [ 695.760062][T31208] netlink: 'syz.3.7020': attribute type 1 has an invalid length. [ 695.885916][T31212] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7021'. [ 695.960399][T31222] netlink: 'syz.4.7025': attribute type 1 has an invalid length. [ 696.019307][T31222] 8021q: adding VLAN 0 to HW filter on device bond5 [ 696.214146][T31226] bond5: (slave gretap1): making interface the new active one [ 696.243801][T31226] bond5: (slave gretap1): Enslaving as an active interface with an up link [ 696.410001][T31242] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7031'. [ 696.420611][T31237] sctp: [Deprecated]: syz.2.7029 (pid 31237) Use of int in max_burst socket option. [ 696.420611][T31237] Use struct sctp_assoc_value instead [ 696.612176][T31256] netlink: 'syz.4.7034': attribute type 4 has an invalid length. [ 696.676225][T31262] geneve2: entered promiscuous mode [ 696.681596][T31262] geneve2: entered allmulticast mode [ 696.728953][T23742] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 19999 - 0 [ 696.730065][T31264] xt_socket: unknown flags 0x50 [ 696.738192][T23742] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 19999 - 0 [ 696.751463][T23742] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 19999 - 0 [ 696.765949][T31262] netlink: 'syz.2.7035': attribute type 11 has an invalid length. [ 696.808336][T23742] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 19999 - 0 [ 696.928547][T31275] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7037'. [ 697.047164][T31282] IPv6: NLM_F_CREATE should be specified when creating new route [ 697.261132][T31299] tipc: Enabled bearer , priority 0 [ 697.342655][T31293] syzkaller0: entered promiscuous mode [ 697.343492][T31302] xt_HMARK: spi-set and port-set can't be combined [ 697.348348][T31293] syzkaller0: entered allmulticast mode [ 697.361445][T31293] tipc: Resetting bearer [ 697.438766][T23738] tipc: Resetting bearer [ 697.482233][T31299] tipc: Resetting bearer [ 697.945059][T31334] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.7054'. [ 699.126854][T31299] tipc: Disabling bearer [ 699.147532][ T5884] tipc: Node number set to 2207308327 [ 699.148139][T31329] netlink: 256 bytes leftover after parsing attributes in process `syz.1.7055'. [ 699.281842][T31342] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7056'. [ 699.311428][T31350] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7060'. [ 699.311450][T31348] netlink: 'syz.2.7058': attribute type 4 has an invalid length. [ 699.752101][T31372] nbd3: detected capacity change from 0 to 127 [ 699.848943][ T5816] block nbd3: Receive control failed (result -104) [ 700.182313][T31406] netlink: 'syz.0.7076': attribute type 11 has an invalid length. [ 700.199285][T31406] netlink: 'syz.0.7076': attribute type 4 has an invalid length. [ 700.218466][T31406] netlink: 'syz.0.7076': attribute type 5 has an invalid length. [ 700.219351][T31412] syzkaller0: entered promiscuous mode [ 700.242250][T31412] syzkaller0: entered allmulticast mode [ 700.260614][T31406] netlink: 'syz.0.7076': attribute type 6 has an invalid length. [ 700.277718][T31415] __nla_validate_parse: 5 callbacks suppressed [ 700.277732][T31415] netlink: 44 bytes leftover after parsing attributes in process `syz.1.7078'. [ 700.293062][T31406] netlink: 199748 bytes leftover after parsing attributes in process `syz.0.7076'. [ 700.560656][T31430] syzkaller0: entered allmulticast mode [ 700.569974][T31430] syzkaller0 (unregistering): left allmulticast mode [ 700.613605][T31434] syzkaller0: entered promiscuous mode [ 700.619181][T31434] syzkaller0: entered allmulticast mode [ 700.688171][T31444] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7086'. [ 700.702093][T31444] openvswitch: netlink: Duplicate key (type 32). [ 700.743169][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 700.751218][ C1] lec:lec_tx_timeout: lec0 [ 700.808597][T31449] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 700.817783][T31447] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 700.988773][T31468] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7092'. [ 701.012701][T31462] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7090'. [ 701.062405][ T5816] block nbd4: Receive control failed (result -1) [ 701.358376][T31486] netlink: 'syz.2.7099': attribute type 4 has an invalid length. [ 701.375308][T31486] netlink: 224 bytes leftover after parsing attributes in process `syz.2.7099'. [ 701.427196][T31493] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7102'. [ 701.586767][T31498] bond5: option min_links: invalid value (18446744073709551614) [ 701.594729][T31498] bond5: option min_links: allowed values 0 - 2147483647 [ 701.603143][T31498] bond5 (unregistering): Released all slaves [ 701.621539][T31508] xt_CT: You must specify a L4 protocol and not use inversions on it [ 701.740094][T31517] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 701.811673][T31524] netlink: 'syz.0.7108': attribute type 1 has an invalid length. [ 701.880650][T31524] bond1: entered promiscuous mode [ 701.885842][T31524] bond1: entered allmulticast mode [ 701.901655][T31524] 8021q: adding VLAN 0 to HW filter on device bond1 [ 701.982829][T31532] macvlan2: entered promiscuous mode [ 701.988447][T31532] macvlan2: entered allmulticast mode [ 702.170911][T31545] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7116'. [ 702.309592][T31559] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 702.421260][T31559] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 702.460835][T31571] syzkaller0: entered promiscuous mode [ 702.468379][T31571] syzkaller0: entered allmulticast mode [ 702.476061][T31575] bond0: option ad_select: unable to set because the bond device is up [ 702.524923][T31559] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 702.630845][T31559] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 702.676996][T31583] pim6reg1: entered promiscuous mode [ 702.682405][T31583] pim6reg1: entered allmulticast mode [ 702.733251][T31589] hsr_slave_0: hsr_addr_subst_dest: Unknown node [ 702.739744][T31589] hsr_slave_1: hsr_addr_subst_dest: Unknown node [ 702.812670][T23741] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 702.836627][T23741] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 702.860755][T23737] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 702.885162][T23737] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 703.151344][T31610] netlink: 'syz.1.7132': attribute type 12 has an invalid length. [ 703.654840][T31636] netlink: 'syz.1.7138': attribute type 21 has an invalid length. [ 703.668314][T31636] netlink: 132 bytes leftover after parsing attributes in process `syz.1.7138'. [ 703.796684][T31656] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7141'. [ 703.825876][T31657] netlink: 'syz.4.7143': attribute type 1 has an invalid length. [ 703.834395][T31657] netlink: 'syz.4.7143': attribute type 2 has an invalid length. [ 704.897211][T31736] validate_nla: 1 callbacks suppressed [ 704.897231][T31736] netlink: 'syz.4.7166': attribute type 1 has an invalid length. [ 704.947957][T31736] netlink: 'syz.4.7166': attribute type 2 has an invalid length. [ 704.997823][T31736] netlink: 'syz.4.7166': attribute type 1 has an invalid length. [ 705.034632][T31745] netlink: 'syz.2.7169': attribute type 3 has an invalid length. [ 705.046388][T31736] netlink: 'syz.4.7166': attribute type 3 has an invalid length. [ 705.203181][T31749] bond4: entered promiscuous mode [ 705.209499][T31749] 8021q: adding VLAN 0 to HW filter on device bond4 [ 705.245695][T31749] 8021q: adding VLAN 0 to HW filter on device bond4 [ 705.256381][T31749] bond4: (slave sit1): The slave device specified does not support setting the MAC address [ 705.268213][T31749] bond4: (slave sit1): Error -95 calling set_mac_address [ 705.515968][T31776] €Â: renamed from syzkaller0 [ 705.533877][T31776] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 705.852327][T31802] sch_tbf: peakrate 3778698283874150449 is lower than or equals to rate 13451177520072710982 ! [ 705.901384][T31807] syzkaller0: entered promiscuous mode [ 705.907192][T31807] syzkaller0: entered allmulticast mode [ 705.918113][T31807] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 706.146768][T31813] syzkaller0: entered promiscuous mode [ 706.152318][T31813] syzkaller0: entered allmulticast mode [ 706.165224][T31815] tipc: Enabling of bearer rejected, failed to enable media [ 706.319042][T31820] __nla_validate_parse: 9 callbacks suppressed [ 706.319063][T31820] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7191'. [ 706.495800][T31832] IPv6: addrconf: prefix option has invalid lifetime [ 706.505673][T31832] netlink: 'syz.1.7197': attribute type 10 has an invalid length. [ 706.552630][T31832] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 706.737918][T31850] netlink: 28 bytes leftover after parsing attributes in process `syz.4.7202'. [ 706.782662][T31850] IPVS: Error connecting to the multicast addr [ 706.799514][T31850] SET target dimension over the limit! [ 706.970267][T31871] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7208'. [ 706.989566][T31871] netlink: 28 bytes leftover after parsing attributes in process `syz.2.7208'. [ 707.028978][T31871] syzkaller0: entered promiscuous mode [ 707.054851][T31871] syzkaller0: entered allmulticast mode [ 707.067490][T31874] syzkaller0: entered promiscuous mode [ 707.082045][T31874] syzkaller0: entered allmulticast mode [ 707.190767][T31877] syzkaller0: entered promiscuous mode [ 707.197625][T31877] syzkaller0: entered allmulticast mode [ 707.457978][T31895] tc_dump_action: action bad kind [ 707.745888][T31917] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7217'. [ 710.383700][T31918] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7216'. [ 710.393409][T31933] bond0: (slave gre0): Error: Device type is different from other slaves [ 710.618847][T23737] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x1 [ 710.723561][T31972] netlink: 28 bytes leftover after parsing attributes in process `syz.0.7226'. [ 710.753917][T31978] lo: entered promiscuous mode [ 710.784571][T31978] tunl0: entered promiscuous mode [ 710.810706][T31978] gre0: entered promiscuous mode [ 710.853756][T31978] gretap0: entered promiscuous mode [ 710.871038][T31978] erspan0: entered promiscuous mode [ 710.896729][T31978] ip_vti0: entered promiscuous mode [ 710.914508][T31978] ip6_vti0: entered promiscuous mode [ 710.915038][T31984] sctp: [Deprecated]: syz.2.7230 (pid 31984) Use of struct sctp_assoc_value in delayed_ack socket option. [ 710.915038][T31984] Use struct sctp_sack_info instead [ 710.923493][T31978] sit0: entered promiscuous mode [ 710.951136][T31978] ip6tnl0: entered promiscuous mode [ 710.959707][T31978] ip6gre0: entered promiscuous mode [ 710.970395][T31978] syz_tun: entered promiscuous mode [ 710.998428][T31978] ip6gretap0: entered promiscuous mode [ 711.009597][T31978] bridge0: port 2(bridge_slave_1) entered disabled state [ 711.017824][T31978] bridge0: port 1(bridge_slave_0) entered disabled state [ 711.026747][T31978] bridge0: entered promiscuous mode [ 711.037073][T31978] vcan0: entered promiscuous mode [ 711.043622][T31978] bond0: entered promiscuous mode [ 711.048795][T31978] bond_slave_0: entered promiscuous mode [ 711.051176][T31990] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7231'. [ 711.055912][T31978] bond_slave_1: entered promiscuous mode [ 711.077901][T31978] team0: entered promiscuous mode [ 711.083839][T31978] team_slave_0: entered promiscuous mode [ 711.089922][T31978] team_slave_1: entered promiscuous mode [ 711.099751][T31978] dummy0: entered promiscuous mode [ 711.106862][T31978] nlmon0: entered promiscuous mode [ 711.114734][T31978] caif0: entered promiscuous mode [ 711.120717][T31978] batadv0: entered promiscuous mode [ 711.130007][T31978] vxcan0: entered promiscuous mode [ 711.138140][T31978] vxcan1: entered promiscuous mode [ 711.144886][T31978] veth0: entered promiscuous mode [ 711.154607][T31978] veth1: entered promiscuous mode [ 711.164063][T31978] wg0: entered promiscuous mode [ 711.171180][T31978] wg1: entered promiscuous mode [ 711.178549][T31978] wg2: entered promiscuous mode [ 711.186568][T31978] veth0_to_bridge: entered promiscuous mode [ 711.196882][T31978] veth1_to_bridge: entered promiscuous mode [ 711.207422][T31978] veth0_to_bond: entered promiscuous mode [ 711.216164][T31978] veth1_to_bond: entered promiscuous mode [ 711.227525][T31978] veth0_to_team: entered promiscuous mode [ 711.240776][T31978] veth1_to_team: entered promiscuous mode [ 711.251188][T31978] veth0_to_batadv: entered promiscuous mode [ 711.259521][T31978] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 711.267843][T31978] batadv_slave_0: entered promiscuous mode [ 711.276303][T31978] veth1_to_batadv: entered promiscuous mode [ 711.286499][T31978] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 711.294442][T31978] batadv_slave_1: entered promiscuous mode [ 711.302620][T31978] xfrm0: entered promiscuous mode [ 711.310855][T31978] veth0_to_hsr: entered promiscuous mode [ 711.320648][T31978] veth1_to_hsr: entered promiscuous mode [ 711.332496][T31978] hsr0: entered promiscuous mode [ 711.339809][T31978] veth1_virt_wifi: entered promiscuous mode [ 711.349227][T31978] veth0_virt_wifi: entered promiscuous mode [ 711.357597][T31978] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 711.370096][T31978] tipc: Resetting bearer [ 711.380086][T31978] vlan0: entered promiscuous mode [ 711.386992][T31978] vlan1: entered promiscuous mode [ 711.392532][T31978] macvlan0: entered promiscuous mode [ 711.400716][T31978] macvlan1: entered promiscuous mode [ 711.408668][T31978] ipvlan0: entered promiscuous mode [ 711.414664][T31978] ipvlan1: entered promiscuous mode [ 711.425727][T31978] macvtap0: entered promiscuous mode [ 711.433498][T31978] macsec0: entered promiscuous mode [ 711.441093][T31978] geneve0: entered promiscuous mode [ 711.452130][T31978] geneve1: entered promiscuous mode [ 711.467955][T31978] mac80211_hwsim hwsim69 wlan0: entered promiscuous mode [ 711.481238][T31978] mac80211_hwsim hwsim70 wlan1: entered promiscuous mode [ 711.491527][T31978] pim6reg527: entered promiscuous mode [ 711.499547][T31978] bridge1: entered promiscuous mode [ 711.510540][T31978] ipip0: entered promiscuous mode [ 711.516136][T31978] mac80211_hwsim hwsim74 wlan2: entered promiscuous mode [ 711.523504][T31978] veth2: entered promiscuous mode [ 711.528712][T31978] veth3: entered promiscuous mode [ 711.541015][T31978] netdevsim netdevsim0 eth0: entered promiscuous mode [ 711.549740][T31978] netdevsim netdevsim0 eth1: entered promiscuous mode [ 711.557446][T31978] netdevsim netdevsim0 eth2: entered promiscuous mode [ 711.564967][T31978] netdevsim netdevsim0 eth3: entered promiscuous mode [ 711.588874][T31985] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 711.596808][T31985] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 711.635477][T13789] ip6_vti0 speed is unknown, defaulting to 1000 [ 711.637545][T31996] FAULT_INJECTION: forcing a failure. [ 711.637545][T31996] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 711.644343][T13789] syz2: Port: 1 Link DOWN [ 711.658333][T31996] CPU: 1 UID: 0 PID: 31996 Comm: syz.4.7232 Not tainted syzkaller #0 PREEMPT(full) [ 711.658359][T31996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 711.658370][T31996] Call Trace: [ 711.658377][T31996] [ 711.658385][T31996] dump_stack_lvl+0xe8/0x150 [ 711.658413][T31996] should_fail_ex+0x412/0x560 [ 711.658441][T31996] _copy_from_user+0x2d/0xb0 [ 711.658460][T31996] ___sys_sendmsg+0x1c6/0x360 [ 711.658479][T31996] ? __lock_acquire+0x6b5/0x2cf0 [ 711.658502][T31996] ? __pfx____sys_sendmsg+0x10/0x10 [ 711.658553][T31996] ? __fget_files+0x2a/0x420 [ 711.658570][T31996] ? __fget_files+0x3a0/0x420 [ 711.658599][T31996] __x64_sys_sendmsg+0x1bd/0x2a0 [ 711.658622][T31996] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 711.658651][T31996] ? __pfx_ksys_write+0x10/0x10 [ 711.658682][T31996] do_syscall_64+0x14d/0xf80 [ 711.658703][T31996] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 711.658720][T31996] ? trace_irq_disable+0x37/0x100 [ 711.658738][T31996] ? clear_bhb_loop+0x40/0x90 [ 711.658758][T31996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 711.658774][T31996] RIP: 0033:0x7f550e39c629 [ 711.658796][T31996] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 711.658811][T31996] RSP: 002b:00007f550f238028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 711.658830][T31996] RAX: ffffffffffffffda RBX: 00007f550e615fa0 RCX: 00007f550e39c629 [ 711.658842][T31996] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 711.658854][T31996] RBP: 00007f550f238090 R08: 0000000000000000 R09: 0000000000000000 [ 711.658864][T31996] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 711.658874][T31996] R13: 00007f550e616038 R14: 00007f550e615fa0 R15: 00007ffefd6f2ab8 [ 711.658903][T31996] [ 711.934817][T32000] netlink: 'syz.2.7234': attribute type 3 has an invalid length. [ 711.942722][T32000] netlink: 'syz.2.7234': attribute type 1 has an invalid length. [ 712.018340][T32006] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 712.029547][T23742] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 712.057348][T23742] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 712.067481][T13787] ip6_vti0 speed is unknown, defaulting to 1000 [ 712.067529][T23742] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 712.108974][T23742] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 712.125925][T32018] netlink: 'syz.0.7239': attribute type 10 has an invalid length. [ 712.156378][T32019] netlink: 'syz.0.7239': attribute type 10 has an invalid length. [ 712.290901][T32025] netlink: 'syz.2.7242': attribute type 5 has an invalid length. [ 712.332217][T32032] netlink: 'syz.4.7243': attribute type 1 has an invalid length. [ 712.415624][T32038] FAULT_INJECTION: forcing a failure. [ 712.415624][T32038] name failslab, interval 1, probability 0, space 0, times 0 [ 712.486789][T32038] CPU: 1 UID: 0 PID: 32038 Comm: syz.3.7246 Not tainted syzkaller #0 PREEMPT(full) [ 712.486815][T32038] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 712.486827][T32038] Call Trace: [ 712.486834][T32038] [ 712.486843][T32038] dump_stack_lvl+0xe8/0x150 [ 712.486870][T32038] should_fail_ex+0x412/0x560 [ 712.486898][T32038] should_failslab+0xa8/0x100 [ 712.486923][T32038] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 712.486945][T32038] ? __alloc_skb+0x186/0x7d0 [ 712.486963][T32038] ? __alloc_skb+0x1d0/0x7d0 [ 712.486979][T32038] ? __local_bh_enable_ip+0xd0/0x130 [ 712.487003][T32038] __alloc_skb+0x1d0/0x7d0 [ 712.487027][T32038] netlink_sendmsg+0x5d4/0xb40 [ 712.487054][T32038] ? __pfx_netlink_sendmsg+0x10/0x10 [ 712.487075][T32038] ? aa_sock_msg_perm+0xf1/0x1b0 [ 712.487098][T32038] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 712.487122][T32038] ? __pfx_netlink_sendmsg+0x10/0x10 [ 712.487139][T32038] ____sys_sendmsg+0xa68/0xad0 [ 712.487160][T32038] ? __might_fault+0xaf/0x130 [ 712.487185][T32038] ? __pfx_____sys_sendmsg+0x10/0x10 [ 712.487215][T32038] ? import_iovec+0x73/0xa0 [ 712.487236][T32038] ___sys_sendmsg+0x2a5/0x360 [ 712.487256][T32038] ? __lock_acquire+0x6b5/0x2cf0 [ 712.487279][T32038] ? __pfx____sys_sendmsg+0x10/0x10 [ 712.487332][T32038] ? __fget_files+0x2a/0x420 [ 712.487349][T32038] ? __fget_files+0x3a0/0x420 [ 712.487374][T32038] __x64_sys_sendmsg+0x1bd/0x2a0 [ 712.487397][T32038] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 712.487424][T32038] ? __pfx_ksys_write+0x10/0x10 [ 712.487478][T32038] do_syscall_64+0x14d/0xf80 [ 712.487500][T32038] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 712.487516][T32038] ? trace_irq_disable+0x37/0x100 [ 712.487534][T32038] ? clear_bhb_loop+0x40/0x90 [ 712.487554][T32038] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 712.487570][T32038] RIP: 0033:0x7ff7c599c629 [ 712.487586][T32038] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 712.487600][T32038] RSP: 002b:00007ff7c6860028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 712.487616][T32038] RAX: ffffffffffffffda RBX: 00007ff7c5c15fa0 RCX: 00007ff7c599c629 [ 712.487628][T32038] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 712.487639][T32038] RBP: 00007ff7c6860090 R08: 0000000000000000 R09: 0000000000000000 [ 712.487650][T32038] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 712.487660][T32038] R13: 00007ff7c5c16038 R14: 00007ff7c5c15fa0 R15: 00007ffdc5befed8 [ 712.487686][T32038] [ 712.970679][T32068] Cannot find add_set index 2 as target [ 712.993978][T32068] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7253'. [ 713.012338][T32067] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7254'. [ 713.785679][T32111] sctp: [Deprecated]: syz.0.7266 (pid 32111) Use of int in max_burst socket option deprecated. [ 713.785679][T32111] Use struct sctp_assoc_value instead [ 714.003875][T32120] netlink: 'syz.4.7269': attribute type 1 has an invalid length. [ 714.026628][T32119] netlink: 'syz.4.7269': attribute type 1 has an invalid length. [ 714.608929][T32142] netlink: 'syz.3.7277': attribute type 21 has an invalid length. [ 714.695970][T32145] netlink: 56 bytes leftover after parsing attributes in process `syz.2.7279'. [ 714.768176][T32145] bond5 (unregistering): Released all slaves [ 714.814278][T32158] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7283'. [ 715.010614][T32166] netlink: 'syz.2.7286': attribute type 2 has an invalid length. [ 715.036163][T32166] netlink: 100 bytes leftover after parsing attributes in process `syz.2.7286'. [ 715.044136][T32169] netlink: 388 bytes leftover after parsing attributes in process `syz.0.7285'. [ 715.154922][T32174] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7290'. [ 715.168359][T32175] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 715.169475][T32172] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7289'. [ 715.297543][T32183] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7294'. [ 715.310145][T32183] netlink: 4 bytes leftover after parsing attributes in process `syz.2.7294'. [ 715.402231][T32191] bridge_slave_1: left allmulticast mode [ 715.409283][T32191] bridge_slave_1: left promiscuous mode [ 715.417068][T32191] bridge0: port 2(bridge_slave_1) entered disabled state [ 715.426670][T32191] bridge_slave_0: left allmulticast mode [ 715.432319][T32191] bridge_slave_0: left promiscuous mode [ 715.438382][T32191] bridge0: port 1(bridge_slave_0) entered disabled state [ 715.612532][T32198] FAULT_INJECTION: forcing a failure. [ 715.612532][T32198] name failslab, interval 1, probability 0, space 0, times 0 [ 715.628740][T32198] CPU: 0 UID: 0 PID: 32198 Comm: syz.2.7298 Not tainted syzkaller #0 PREEMPT(full) [ 715.628765][T32198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 715.628776][T32198] Call Trace: [ 715.628784][T32198] [ 715.628792][T32198] dump_stack_lvl+0xe8/0x150 [ 715.628818][T32198] should_fail_ex+0x412/0x560 [ 715.628846][T32198] should_failslab+0xa8/0x100 [ 715.628871][T32198] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 715.628893][T32198] ? __alloc_skb+0x1d0/0x7d0 [ 715.628910][T32198] ? __local_bh_enable_ip+0xd0/0x130 [ 715.628934][T32198] __alloc_skb+0x1d0/0x7d0 [ 715.628948][T32198] ? netlink_ack_tlv_len+0x6c/0x210 [ 715.628966][T32198] netlink_ack+0x146/0xa50 [ 715.628976][T32198] ? __pfx_genl_rcv_msg+0x10/0x10 [ 715.629001][T32198] netlink_rcv_skb+0x2b6/0x4b0 [ 715.629014][T32198] ? __pfx_genl_rcv_msg+0x10/0x10 [ 715.629031][T32198] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 715.629045][T32198] ? genl_rcv+0x19/0x40 [ 715.629081][T32198] ? down_read+0x272/0x2e0 [ 715.629101][T32198] ? genl_rcv+0xd/0x40 [ 715.629122][T32198] genl_rcv+0x28/0x40 [ 715.629139][T32198] netlink_unicast+0x80f/0x9b0 [ 715.629169][T32198] ? __pfx_netlink_unicast+0x10/0x10 [ 715.629191][T32198] ? netlink_sendmsg+0x650/0xb40 [ 715.629215][T32198] ? skb_put+0x11b/0x210 [ 715.629235][T32198] netlink_sendmsg+0x813/0xb40 [ 715.629258][T32198] ? __pfx_netlink_sendmsg+0x10/0x10 [ 715.629274][T32198] ? aa_sock_msg_perm+0xf1/0x1b0 [ 715.629291][T32198] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 715.629315][T32198] ? __pfx_netlink_sendmsg+0x10/0x10 [ 715.629329][T32198] ____sys_sendmsg+0xa68/0xad0 [ 715.629350][T32198] ? __might_fault+0xaf/0x130 [ 715.629374][T32198] ? __pfx_____sys_sendmsg+0x10/0x10 [ 715.629402][T32198] ? import_iovec+0x73/0xa0 [ 715.629423][T32198] ___sys_sendmsg+0x2a5/0x360 [ 715.629443][T32198] ? __lock_acquire+0x6b5/0x2cf0 [ 715.629465][T32198] ? __pfx____sys_sendmsg+0x10/0x10 [ 715.629523][T32198] ? __fget_files+0x2a/0x420 [ 715.629540][T32198] ? __fget_files+0x3a0/0x420 [ 715.629567][T32198] __x64_sys_sendmsg+0x1bd/0x2a0 [ 715.629592][T32198] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 715.629622][T32198] ? __pfx_ksys_write+0x10/0x10 [ 715.629655][T32198] do_syscall_64+0x14d/0xf80 [ 715.629677][T32198] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 715.629693][T32198] ? trace_irq_disable+0x37/0x100 [ 715.629712][T32198] ? clear_bhb_loop+0x40/0x90 [ 715.629733][T32198] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 715.629750][T32198] RIP: 0033:0x7fea8e39c629 [ 715.629767][T32198] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 715.629782][T32198] RSP: 002b:00007fea8f335028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 715.629801][T32198] RAX: ffffffffffffffda RBX: 00007fea8e615fa0 RCX: 00007fea8e39c629 [ 715.629815][T32198] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 [ 715.629826][T32198] RBP: 00007fea8f335090 R08: 0000000000000000 R09: 0000000000000000 [ 715.629838][T32198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 715.629847][T32198] R13: 00007fea8e616038 R14: 00007fea8e615fa0 R15: 00007ffe922ad9e8 [ 715.629873][T32198] [ 716.383734][T32228] veth5: entered promiscuous mode [ 716.642397][T32244] 8021q: adding VLAN 0 to HW filter on device bond3 [ 716.680321][T32244] bond2: (slave bond3): making interface the new active one [ 716.711189][T32244] bond2: (slave bond3): Enslaving as an active interface with an up link [ 716.733764][T32248] bond_slave_1: entered promiscuous mode [ 716.739767][T32248] bond_slave_1: left promiscuous mode [ 716.760403][T32244] 8021q: adding VLAN 0 to HW filter on device bond2 [ 717.044325][T32277] bond5: entered promiscuous mode [ 717.049933][T32277] 8021q: adding VLAN 0 to HW filter on device bond5 [ 717.118478][T32280] Cannot find add_set index 0 as target [ 717.134061][T32277] 8021q: adding VLAN 0 to HW filter on device bond5 [ 717.173878][T32277] bond5: (slave sit1): The slave device specified does not support setting the MAC address [ 717.191211][T32277] bond5: (slave sit1): Error -95 calling set_mac_address [ 717.247031][T32292] vcan0: tx address claim with different name [ 717.687964][T32324] validate_nla: 3 callbacks suppressed [ 717.687983][T32324] netlink: 'syz.2.7335': attribute type 21 has an invalid length. [ 718.177603][T32352] tipc: Enabled bearer , priority 0 [ 718.187804][T32352] syzkaller0: entered promiscuous mode [ 718.215426][T32352] syzkaller0: entered allmulticast mode [ 718.226559][T32355] __nla_validate_parse: 18 callbacks suppressed [ 718.226579][T32355] netlink: 212328 bytes leftover after parsing attributes in process `syz.1.7347'. [ 718.239012][T32352] tipc: Resetting bearer [ 718.254561][T32355] netlink: Unknown conntrack attr (type=2304, max=9) [ 718.262222][T32351] tipc: Resetting bearer [ 718.323813][T32351] tipc: Disabling bearer [ 718.366525][T32359] netlink: 'syz.2.7346': attribute type 3 has an invalid length. [ 718.599788][T32375] wg1: entered promiscuous mode [ 718.610869][T32375] wg1: entered allmulticast mode [ 718.617513][T32377] netlink: 16 bytes leftover after parsing attributes in process `syz.4.7350'. [ 718.625053][T32374] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7350'. [ 718.676037][T32374] netlink: 44 bytes leftover after parsing attributes in process `syz.4.7350'. [ 718.693097][T32374] netlink: 43 bytes leftover after parsing attributes in process `syz.4.7350'. [ 718.711962][T32374] netlink: 'syz.4.7350': attribute type 6 has an invalid length. [ 718.731287][T32374] netlink: 'syz.4.7350': attribute type 5 has an invalid length. [ 718.750345][T32374] netlink: 43 bytes leftover after parsing attributes in process `syz.4.7350'. [ 718.769646][T32379] netlink: 156 bytes leftover after parsing attributes in process `syz.3.7352'. [ 719.487348][T32422] IPVS: set_ctl: invalid protocol: 8 172.30.1.3:20004 [ 719.516604][T32429] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7370'. [ 719.700316][T32440] RDS: rds_bind could not find a transport for ::ffff:100.1.1.1, load rds_tcp or rds_rdma? [ 719.730832][T32440] netlink: 224 bytes leftover after parsing attributes in process `syz.4.7373'. [ 719.881765][T32454] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7374'. [ 719.969047][T32462] Cannot find del_set index 3 as target [ 720.114250][T32476] delete_channel: no stack [ 720.127446][T32476] syzkaller0: entered promiscuous mode [ 720.144365][T32476] syzkaller0: entered allmulticast mode [ 720.855810][T32531] team0 (unregistering): Port device team_slave_0 removed [ 720.869859][T32538] openvswitch: netlink: Flow actions attr not present in new flow. [ 720.885771][T32531] team0 (unregistering): Port device team_slave_1 removed [ 720.913797][T32538] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 721.095426][T32551] xt_bpf: check failed: parse error [ 721.103629][T32554] vcan0: tx address claim with dest, not broadcast [ 721.256664][T32557] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 721.406256][T32572] netlink: 'syz.1.7411': attribute type 2 has an invalid length. [ 721.710482][T32593] bond0: option ad_select: unable to set because the bond device is up [ 722.212564][T32641] tipc: Enabled bearer , priority 0 [ 722.248346][T32641] syzkaller0: entered promiscuous mode [ 722.254074][T32641] syzkaller0: entered allmulticast mode [ 722.292044][T32647] bond5: option fail_over_mac: invalid value (16) [ 722.316357][T32647] bond5 (unregistering): Released all slaves [ 722.379577][T32656] netlink: 'syz.4.7432': attribute type 1 has an invalid length. [ 722.402074][T32656] netlink: 'syz.4.7432': attribute type 8 has an invalid length. [ 722.491272][T32650] tipc: Resetting bearer [ 722.535352][T32650] tipc: Disabling bearer [ 722.670465][T32673] netlink: 'syz.0.7439': attribute type 1 has an invalid length. [ 722.864407][T32695] netlink: 'syz.3.7446': attribute type 1 has an invalid length. [ 722.919593][T32695] 8021q: adding VLAN 0 to HW filter on device bond5 [ 723.029213][T32710] xt_CT: You must specify a L4 protocol and not use inversions on it [ 723.085390][T32718] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'syz0' [ 723.196912][T32729] netlink: 'syz.2.7455': attribute type 1 has an invalid length. [ 723.204484][T32733] netlink: 'syz.0.7456': attribute type 3 has an invalid length. [ 723.213968][T32726] syzkaller0: entered promiscuous mode [ 723.219437][T32726] syzkaller0: entered allmulticast mode [ 723.224826][T32729] netlink: 'syz.2.7455': attribute type 1 has an invalid length. [ 723.234019][T32729] __nla_validate_parse: 19 callbacks suppressed [ 723.234033][T32729] netlink: 228 bytes leftover after parsing attributes in process `syz.2.7455'. [ 723.339346][T32735] netlink: 'syz.2.7458': attribute type 1 has an invalid length. [ 723.449130][T32745] bond6: entered promiscuous mode [ 723.460508][T32745] bond6: entered allmulticast mode [ 723.484519][T32745] 8021q: adding VLAN 0 to HW filter on device bond6 [ 723.502079][T32752] bridge3: trying to set multicast query interval above maximum, setting to 8640000 (86400000ms) [ 723.516433][T32756] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 723.525198][T32737] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7457'. [ 723.568673][T32735] bridge0: entered promiscuous mode [ 723.574533][T32735] bridge0: entered allmulticast mode [ 723.580599][T32735] bond6: (slave bridge0): Enslaving as a backup interface with an up link [ 723.663137][T23739] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 723.734519][ T301] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 723.783105][T23739] bond6: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 723.851918][ T309] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7468'. [ 723.877689][ T309] 8021q: adding VLAN 0 to HW filter on device bond7 [ 723.898221][ T309] 8021q: adding VLAN 0 to HW filter on device bond7 [ 723.905322][ T309] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 723.916641][ T309] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 724.515216][ T317] netlink: 'syz.2.7470': attribute type 2 has an invalid length. [ 724.559411][ T320] netlink: 44 bytes leftover after parsing attributes in process `syz.2.7471'. [ 724.659533][ T325] bond7 (unregistering): Released all slaves [ 726.343471][T32755] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 726.420090][ T338] syzkaller0: entered promiscuous mode [ 726.427399][ T338] syzkaller0: entered allmulticast mode [ 726.534713][ T346] netlink: 16 bytes leftover after parsing attributes in process `syz.2.7479'. [ 726.560719][ T351] vcan0: tx address claim with different name [ 726.600658][T23738] dummy0: left allmulticast mode [ 726.613034][T23738] dummy0: left promiscuous mode [ 726.628355][T23738] bridge0: port 3(dummy0) entered disabled state [ 726.666340][T23738] .: left allmulticast mode [ 726.670981][T23738] .: left promiscuous mode [ 726.685602][T23738] bridge0: port 2(.) entered disabled state [ 726.731354][T23738] bridge_slave_0: left allmulticast mode [ 726.742356][ T373] netlink: 'syz.1.7484': attribute type 2 has an invalid length. [ 726.743939][T23738] bridge_slave_0: left promiscuous mode [ 726.762361][ T373] netlink: 244 bytes leftover after parsing attributes in process `syz.1.7484'. [ 726.775194][T23738] bridge0: port 1(bridge_slave_0) entered disabled state [ 726.877118][T23738] bond5 (unregistering): (slave ip6erspan0): Releasing active interface [ 726.891877][ T380] netlink: 10 bytes leftover after parsing attributes in process `syz.4.7485'. [ 726.942976][ T381] netlink: 'syz.4.7485': attribute type 24 has an invalid length. [ 727.237869][T23738] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 727.248606][T23738] bond_slave_0: left promiscuous mode [ 727.254591][T23738] bond_slave_0: left allmulticast mode [ 727.261188][T23738] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 727.270468][T23738] bond_slave_1: left promiscuous mode [ 727.276088][T23738] bond_slave_1: left allmulticast mode [ 727.281845][T23738] bond0 (unregistering): Released all slaves [ 727.292679][T23738] bond1 (unregistering): Released all slaves [ 727.305803][T23738] bond2 (unregistering): Released all slaves [ 727.319324][T23738] bond3 (unregistering): Released all slaves [ 727.333844][T23738] bond4 (unregistering): Released all slaves [ 727.348883][T23738] bond5 (unregistering): Released all slaves [ 727.414890][ T384] syzkaller0: entered promiscuous mode [ 727.420415][ T384] syzkaller0: entered allmulticast mode [ 727.508117][T23738] tipc: Disabling bearer [ 727.529403][T23738] tipc: Left network mode [ 727.567168][ T392] netlink: 'syz.0.7486': attribute type 12 has an invalid length. [ 727.570374][ T398] netlink: 'syz.1.7489': attribute type 1 has an invalid length. [ 727.611662][ T398] netlink: 16179 bytes leftover after parsing attributes in process `syz.1.7489'. [ 727.713977][T23738] IPVS: stopping backup sync thread 21826 ... [ 727.718623][ T408] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7491'. [ 727.748485][ T398] tipc: Started in network mode [ 727.759233][ T398] tipc: Node identity 567f3fa5d364, cluster identity 4711 [ 727.802396][ T398] tipc: Enabled bearer , priority 0 [ 727.809679][ T408] netlink: 12 bytes leftover after parsing attributes in process `syz.0.7491'. [ 727.834571][ T402] syzkaller0: entered promiscuous mode [ 727.840081][ T402] syzkaller0: entered allmulticast mode [ 727.931739][ T398] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 727.987121][ T398] tipc: Resetting bearer [ 728.034591][ T393] tipc: Resetting bearer [ 728.075443][ T393] tipc: Disabling bearer [ 728.510486][ T458] __nla_validate_parse: 4 callbacks suppressed [ 728.510506][ T458] netlink: 32 bytes leftover after parsing attributes in process `syz.2.7504'. [ 728.527275][ T460] netlink: 'syz.4.7503': attribute type 10 has an invalid length. [ 728.554320][ T460] netlink: 40 bytes leftover after parsing attributes in process `syz.4.7503'. [ 728.571345][ T460] dummy0: entered promiscuous mode [ 728.588207][ T460] bridge0: port 3(dummy0) entered blocking state [ 728.607486][ T460] bridge0: port 3(dummy0) entered disabled state [ 728.620841][ T460] dummy0: entered allmulticast mode [ 728.657506][ T460] dummy0: left allmulticast mode [ 728.663589][ T460] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 728.733653][ T470] xt_hashlimit: size too large, truncated to 1048576 [ 728.748758][ T472] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7508'. [ 728.805281][ T476] netlink: 20 bytes leftover after parsing attributes in process `syz.2.7510'. [ 728.839391][ T465] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7508'. [ 728.967964][T23738] hsr_slave_0: left promiscuous mode [ 728.980410][T23738] hsr_slave_1: left promiscuous mode [ 729.000170][T23738] pimreg (unregistering): left allmulticast mode [ 729.387676][ T491] netlink: 'syz.4.7513': attribute type 1 has an invalid length. [ 729.395854][ T491] netlink: 4 bytes leftover after parsing attributes in process `syz.4.7513'. [ 729.405523][ T472] syzkaller0: entered promiscuous mode [ 729.411188][ T472] syzkaller0: entered allmulticast mode [ 729.441935][ T492] netlink: 'syz.4.7513': attribute type 1 has an invalid length. [ 729.785606][ T2484] block nbd3: Possible stuck request ffff888026178000: control (read@0,1024B). Runtime 30 seconds [ 729.798465][ T2484] block nbd3: Possible stuck request ffff888026178200: control (read@1024,1024B). Runtime 30 seconds [ 729.811835][ T2484] block nbd3: Possible stuck request ffff888026178400: control (read@2048,1024B). Runtime 30 seconds [ 729.823415][ T2484] block nbd3: Possible stuck request ffff888026178600: control (read@3072,1024B). Runtime 30 seconds [ 729.915158][ T512] IPVS: set_ctl: invalid protocol: 50 172.20.20.187:20004 [ 730.027058][T23738] IPVS: stop unused estimator thread 0... [ 730.095728][ T531] netlink: 'syz.0.7525': attribute type 39 has an invalid length. [ 730.230414][ T537] syzkaller0: entered promiscuous mode [ 730.236151][ T537] syzkaller0: entered allmulticast mode [ 730.245713][ T537] 0: reclassify loop, rule prio 0, protocol 800 [ 730.361827][ T539] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.7529'. [ 730.363654][ T547] Cannot find del_set index 4 as target [ 730.588637][ T561] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 730.605740][ T563] openvswitch: netlink: Message has 8 unknown bytes. [ 730.612552][ T563] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 730.914008][ T587] Cannot find add_set index 0 as target [ 730.927656][ T581] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7544'. [ 731.008978][ T581] 8021q: adding VLAN 0 to HW filter on device bond8 [ 731.044615][ T598] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7549'. [ 731.165552][ T608] xt_socket: unknown flags 0x50 [ 731.195846][ T611] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7553'. [ 731.267071][T23742] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 731.456595][T23742] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 731.478146][T23742] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 731.492303][T23742] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 731.569462][ T626] Cannot find del_set index 3 as target [ 731.697785][ T640] ip6gre1: entered allmulticast mode [ 731.867325][ T652] bond9: Unable to set peer notification delay as MII monitoring is disabled [ 731.903406][ T652] bond9 (unregistering): Released all slaves [ 731.942171][ T662] netlink: 'syz.2.7565': attribute type 10 has an invalid length. [ 731.987748][ T662] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 732.084227][ T679] netlink: 'syz.2.7571': attribute type 9 has an invalid length. [ 732.143494][ T684] netlink: 'syz.1.7572': attribute type 6 has an invalid length. [ 732.181333][ T687] syzkaller1: entered promiscuous mode [ 732.187340][ T687] syzkaller1: entered allmulticast mode [ 732.225927][ T689] vcan0: tx address claim with different name [ 732.540320][ T707] syzkaller0: entered promiscuous mode [ 732.548736][ T704] netlink: set zone limit has 4 unknown bytes [ 732.553172][ T707] syzkaller0: entered allmulticast mode [ 732.574478][ T707] tipc: Enabled bearer , priority 0 [ 732.720107][ T721] can: request_module (can-proto-3) failed. [ 732.795321][ T729] syzkaller1: entered promiscuous mode [ 732.801327][ T729] syzkaller1: entered allmulticast mode [ 732.868419][ T729] bridge0: entered allmulticast mode [ 733.135030][ T748] netlink: 'syz.1.7593': attribute type 1 has an invalid length. [ 733.189883][ T749] netlink: 'syz.3.7595': attribute type 4 has an invalid length. [ 733.205445][ T748] IPVS: set_ctl: invalid protocol: 135 0.0.0.0:20004 [ 733.399312][ T706] tipc: Resetting bearer [ 733.461614][ T706] tipc: Disabling bearer [ 733.474776][ T773] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 733.491712][ T772] syzkaller1: entered promiscuous mode [ 733.504089][ T776] netlink: 'syz.3.7603': attribute type 1 has an invalid length. [ 733.512195][ T772] syzkaller1: entered allmulticast mode [ 733.678822][ T791] syzkaller1: entered promiscuous mode [ 733.701585][ T791] syzkaller1: entered allmulticast mode [ 733.762651][ T793] __nla_validate_parse: 14 callbacks suppressed [ 733.762678][ T793] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7608'. [ 733.810850][ T797] netlink: 'syz.3.7609': attribute type 33 has an invalid length. [ 733.830990][ T797] netlink: 152 bytes leftover after parsing attributes in process `syz.3.7609'. [ 734.155027][ T821] netlink: 20 bytes leftover after parsing attributes in process `syz.3.7617'. [ 734.202476][ T821] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7617'. [ 734.212262][ T821] netlink: 'syz.3.7617': attribute type 7 has an invalid length. [ 734.220266][ T821] netlink: 16 bytes leftover after parsing attributes in process `syz.3.7617'. [ 734.248514][ T821] gretap0: entered promiscuous mode [ 734.258893][ T821] gretap0: left promiscuous mode [ 734.376881][ T832] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7622'. [ 734.699615][ T856] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7629'. [ 734.748453][ T862] netlink: 4 bytes leftover after parsing attributes in process `syz.0.7631'. [ 734.758464][ T856] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 734.789756][ T867] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7629'. [ 734.869326][ T862] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 734.880571][ T862] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 734.891768][ T862] bond0 (unregistering): Released all slaves [ 734.922810][ T866] pimreg: entered allmulticast mode [ 735.011194][ T878] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7635'. [ 735.232414][ T900] netlink: 'syz.2.7642': attribute type 29 has an invalid length. [ 735.463310][ T912] syzkaller0: entered promiscuous mode [ 735.468824][ T912] syzkaller0: entered allmulticast mode [ 735.806622][ T942] Cannot find del_set index 3 as target [ 736.136527][ T964] sctp: [Deprecated]: syz.4.7657 (pid 964) Use of int in max_burst socket option deprecated. [ 736.136527][ T964] Use struct sctp_assoc_value instead [ 736.346418][ T974] syzkaller0: entered promiscuous mode [ 736.353932][ T974] syzkaller0: entered allmulticast mode [ 736.414784][ T977] netlink: 'syz.0.7664': attribute type 1 has an invalid length. [ 736.705238][ T1003] netlink: 'syz.3.7671': attribute type 6 has an invalid length. [ 737.010990][ T1039] sctp: [Deprecated]: syz.2.7678 (pid 1039) Use of struct sctp_assoc_value in delayed_ack socket option. [ 737.010990][ T1039] Use struct sctp_sack_info instead [ 737.415594][ T1079] sctp: [Deprecated]: syz.4.7688 (pid 1079) Use of struct sctp_assoc_value in delayed_ack socket option. [ 737.415594][ T1079] Use struct sctp_sack_info instead [ 739.734131][ T1008] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 739.762996][ T1089] __nla_validate_parse: 20 callbacks suppressed [ 739.763015][ T1089] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7691'. [ 739.875237][ T1094] openvswitch: netlink: ERSPAN option length err (len 256, max 255). [ 739.931804][ T1100] netlink: 44 bytes leftover after parsing attributes in process `syz.1.7696'. [ 739.948666][ T1101] netlink: 'syz.3.7692': attribute type 1 has an invalid length. [ 739.974321][ T1091] syzkaller0: entered promiscuous mode [ 739.980464][ T1091] syzkaller0: entered allmulticast mode [ 739.992661][ T1100] bridge0: port 2(bridge_slave_1) entered disabled state [ 740.000032][ T1100] bridge0: port 1(bridge_slave_0) entered disabled state [ 740.022856][ T1105] netlink: 'syz.1.7696': attribute type 1 has an invalid length. [ 740.045750][ T1105] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7696'. [ 740.101773][ T1109] netlink: 'syz.0.7698': attribute type 10 has an invalid length. [ 741.918257][ T1147] netlink: 'syz.2.7705': attribute type 1 has an invalid length. [ 741.962515][ T1152] netlink: 16215 bytes leftover after parsing attributes in process `syz.1.7706'. [ 742.040424][ T1147] 8021q: adding VLAN 0 to HW filter on device bond7 [ 742.080943][ T1163] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7708'. [ 742.110899][ T1165] netlink: 'syz.4.7709': attribute type 1 has an invalid length. [ 742.119232][ T1165] netlink: 'syz.4.7709': attribute type 1 has an invalid length. [ 742.128180][ T1165] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7709'. [ 742.154568][ T1168] netlink: 48 bytes leftover after parsing attributes in process `syz.3.7708'. [ 742.176958][ T1165] geneve5: entered promiscuous mode [ 742.471546][ T1195] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 742.528152][ T1197] netlink: 'syz.4.7718': attribute type 1 has an invalid length. [ 742.536490][ T1197] netlink: 212 bytes leftover after parsing attributes in process `syz.4.7718'. [ 742.606791][ T1205] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 743.191698][ T1234] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7728'. [ 743.327819][ T1238] Cannot find del_set index 3 as target [ 743.407112][ T1243] team0: Device gtp2 is up. Set it down before adding it as a team port [ 743.417757][ T1245] netlink: 'syz.4.7732': attribute type 2 has an invalid length. [ 743.559201][ T1252] openvswitch: netlink: IPv4 tunnel dst address is zero [ 743.659224][ T1260] vcan0: tx address claim with dest, not broadcast [ 743.673685][ T1262] netlink: 24 bytes leftover after parsing attributes in process `syz.3.7737'. [ 743.830217][ T1273] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 744.119063][ T1300] vcan0: tx address claim with dest, not broadcast [ 744.260008][ T1313] netlink: 'syz.0.7754': attribute type 178 has an invalid length. [ 744.468908][ T1322] --map-set only usable from mangle table [ 744.567219][ T1333] vcan0: tx address claim with different name [ 744.852582][ T1361] IPVS: persistence engine module ip_vs_pe_À not found [ 745.009788][ T1374] vcan0: tx address claim with different name [ 745.095663][ T1380] __nla_validate_parse: 4 callbacks suppressed [ 745.095682][ T1380] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7776'. [ 745.118559][ T1380] netlink: 28 bytes leftover after parsing attributes in process `syz.3.7776'. [ 745.146087][ T1380] syzkaller0: entered promiscuous mode [ 745.151597][ T1380] syzkaller0: entered allmulticast mode [ 745.227914][ T1388] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7780'. [ 745.250297][ T1388] sock: sock_timestamping_bind_phc: sock not bind to device [ 745.402234][ T1393] syzkaller1: entered promiscuous mode [ 745.420421][ T1393] syzkaller1: entered allmulticast mode [ 745.675468][ T1413] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 745.777917][ T1436] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7791'. [ 745.800538][ T1436] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7791'. [ 745.844273][ T1438] openvswitch: netlink: Unknown key attributes 2 [ 745.844886][ T1441] syzkaller0: entered promiscuous mode [ 745.883372][ T1441] syzkaller0: entered allmulticast mode [ 745.902767][ T1438] tc_dump_action: action bad kind [ 746.010149][ T1450] syzkaller0: entered promiscuous mode [ 746.015797][ T1450] syzkaller0: entered allmulticast mode [ 746.071100][ T1452] netlink: 'syz.2.7797': attribute type 1 has an invalid length. [ 746.257799][ T1464] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7802'. [ 746.288722][ T1464] netlink: 20 bytes leftover after parsing attributes in process `syz.1.7802'. [ 747.070309][ T1297] lec:lec_start_xmit: lec0:No lecd attached [ 752.663071][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5590 ms [ 752.671093][ C1] lec:lec_tx_timeout: lec0 [ 758.834243][T20156] lec:lec_start_xmit: lec0:No lecd attached [ 759.863353][ T2484] block nbd3: Possible stuck request ffff888026178000: control (read@0,1024B). Runtime 60 seconds [ 759.874137][ T2484] block nbd3: Possible stuck request ffff888026178200: control (read@1024,1024B). Runtime 60 seconds [ 759.885126][ T2484] block nbd3: Possible stuck request ffff888026178400: control (read@2048,1024B). Runtime 60 seconds [ 759.896279][ T2484] block nbd3: Possible stuck request ffff888026178600: control (read@3072,1024B). Runtime 60 seconds [ 760.850947][ T5187] udevd[5187]: worker [30695] /devices/virtual/block/nbd3 is taking a long time [ 763.842982][ C1] lec0: NETDEV WATCHDOG: CPU: 1: transmit queue 0 timed out 5010 ms [ 763.851079][ C1] lec:lec_tx_timeout: lec0 [ 770.463822][ T1471] netlink: 76 bytes leftover after parsing attributes in process `syz.0.7803'. [ 770.475063][ T1471] netlink: 16 bytes leftover after parsing attributes in process `syz.0.7803'. [ 770.494333][ T1471] netlink: 32 bytes leftover after parsing attributes in process `syz.0.7803'. [ 770.496483][ T1475] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7805'. [ 770.512126][ T1471] gretap1: entered promiscuous mode [ 770.519254][ T1471] gretap1: entered allmulticast mode [ 770.522614][ T1475] netlink: 96 bytes leftover after parsing attributes in process `syz.2.7805'. [ 770.569202][ T1483] Dead loop on virtual device ip6_vti0, fix it urgently! [ 770.605910][ T1485] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7809'. [ 770.656411][ T1491] netlink: 'syz.1.7808': attribute type 9 has an invalid length. [ 770.799887][ T1498] bridge6: entered promiscuous mode [ 770.816279][ T1498] bridge6: entered allmulticast mode [ 770.834043][ T1507] netlink: 132 bytes leftover after parsing attributes in process `syz.3.7811'. [ 770.909001][ T1503] 8021q: adding VLAN 0 to HW filter on device bond0 [ 770.936862][ T1503] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 771.034615][ T1503] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 771.051938][ T1503] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 771.069041][ T1503] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 771.089973][ T1503] veth0_vlan: left promiscuous mode [ 771.099015][ T1503] veth0_vlan: entered promiscuous mode [ 771.115084][ T1503] veth1_macvtap: left promiscuous mode [ 771.122103][ T1503] veth0_macvtap: left promiscuous mode [ 771.129035][ T1503] veth0_macvtap: entered promiscuous mode [ 771.135861][ T1503] veth1_macvtap: entered promiscuous mode [ 771.146678][ T1503] batman_adv: batadv0: Interface activated: netdevsim0 [ 771.158234][ T1503] 8021q: adding VLAN 0 to HW filter on device bond1 [ 771.198143][ T1503] gretap1: entered promiscuous mode [ 771.208608][ T1503] 8021q: adding VLAN 0 to HW filter on device bond6 [ 771.218684][ T1503] 8021q: adding VLAN 0 to HW filter on device bond7 [ 771.235943][T23741] bridge0: port 1(bridge_slave_0) entered blocking state [ 771.243078][T23741] bridge0: port 1(bridge_slave_0) entered listening state [ 771.252107][T23741] bridge0: port 2(bridge_slave_1) entered blocking state [ 771.259281][T23741] bridge0: port 2(bridge_slave_1) entered listening state [ 771.298527][T23741] bond3: (slave veth0_to_bond): link status definitely up, 10000 Mbps full duplex [ 771.308305][T23741] bond3: (slave veth0_to_bond): making interface the new active one [ 771.325242][T23741] bond3: active interface up! [ 771.370661][T13784] IPVS: starting estimator thread 0... [ 771.476023][ T1540] netlink: 'syz.1.7824': attribute type 2 has an invalid length. [ 771.478911][T13787] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 771.484133][ T1535] IPVS: using max 34 ests per chain, 81600 per kthread [ 771.657272][ T1557] netlink: 28 bytes leftover after parsing attributes in process `syz.1.7830'. [ 771.681064][ T1556] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 771.783381][T13784] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 771.977395][ T1577] netlink: 212360 bytes leftover after parsing attributes in process `syz.0.7835'. [ 772.127395][ T1583] netlink: 'syz.1.7840': attribute type 1 has an invalid length. [ 772.206383][ T1592] netlink: 'syz.4.7842': attribute type 9 has an invalid length. [ 772.227276][ T1592] netlink: 'syz.4.7842': attribute type 11 has an invalid length. [ 772.233117][ T1583] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7840'. [ 772.259301][ T1588] 8021q: adding VLAN 0 to HW filter on device bond5 [ 772.259981][ T1592] netlink: 'syz.4.7842': attribute type 12 has an invalid length. [ 772.270620][ T1588] bond4: (slave bond5): making interface the new active one [ 772.282606][ T1588] bond4: (slave bond5): Enslaving as an active interface with an up link [ 772.313372][T23738] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 772.339850][ T1583] 8021q: adding VLAN 0 to HW filter on device bond4 [ 772.365825][ T1592] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 772.456893][ T1592] macsec2: entered promiscuous mode [ 772.786586][ T1609] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 773.420908][T23736] bond19 (unregistering): (slave gretap3): Releasing active interface [ 773.549524][T23736] bond4 (unregistering): (slave geneve2): Releasing active interface [ 773.817086][T23736] bond17 (unregistering): (slave bridge4): Releasing backup interface [ 773.825607][T23736] bridge4 (unregistering): left promiscuous mode [ 773.858934][T23736] ` (unregistering): (slave bridge_slave_1): Releasing backup interface [ 773.869555][T23736] ` (unregistering): Released all slaves [ 773.879930][T23736] bond1 (unregistering): Released all slaves [ 773.892745][T23736] bond2 (unregistering): Released all slaves [ 773.910141][T23736] bond3 (unregistering): (slave vcan1): Releasing backup interface [ 773.920041][T23736] bond3 (unregistering): Released all slaves [ 773.935275][T23736] bond4 (unregistering): Released all slaves [ 773.949876][T23736] bond5 (unregistering): Released all slaves [ 773.962445][T23736] bond6 (unregistering): Released all slaves [ 773.980119][T23736] bond7 (unregistering): (slave veth5): Releasing active interface [ 773.996203][T23736] bond7 (unregistering): Released all slaves [ 774.009817][T23736] bond0 (unregistering): Released all slaves [ 774.022519][T23736] bond8 (unregistering): Released all slaves [ 774.039435][T23736] bond9 (unregistering): Released all slaves [ 774.054719][T23736] bond10 (unregistering): Released all slaves [ 774.069970][T23736] bond11 (unregistering): Released all slaves [ 774.086453][T23736] bond12 (unregistering): Released all slaves [ 774.101704][T23736] bond13 (unregistering): Released all slaves [ 774.116866][T23736] bond14 (unregistering): Released all slaves [ 774.132677][T23736] bond15 (unregistering): Released all slaves [ 774.171957][T23736] bond16 (unregistering): Released all slaves [ 774.186037][T23736] bond17 (unregistering): Released all slaves [ 774.198865][T23736] bond18 (unregistering): Released all slaves [ 774.211624][T23736] bond19 (unregistering): Released all slaves [ 774.230232][T23736] bond20 (unregistering): Released all slaves [ 774.244097][ T1612] macsec0: entered allmulticast mode [ 774.292087][ T1619] veth1_macvtap: entered allmulticast mode [ 774.329078][ T1619] macsec0: left promiscuous mode [ 774.347330][ T1619] macsec0: left allmulticast mode [ 774.360722][ T1619] veth1_macvtap: left allmulticast mode [ 774.476856][T23737] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 774.495818][T23737] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 774.532354][T23736] tipc: Disabling bearer [ 774.600191][T23736] tipc: Left network mode [ 774.715040][ T1659] ip6_tunnel: non-ECT from 0000:0000:0000:0000:0000:ffff:7f00:0001 with DS=0xb [ 774.853348][ T1666] ip6t_srh: unknown srh match flags 4000 [ 774.963131][ T5820] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 775.027164][ T1683] netlink: 'syz.2.7868': attribute type 26 has an invalid length. [ 775.030513][ T1689] bridge0: port 3(syz_tun) entered blocking state [ 775.056904][ T1689] bridge0: port 3(syz_tun) entered disabled state [ 775.083354][ T1689] syz_tun: entered allmulticast mode [ 775.103494][ T1696] sctp: [Deprecated]: syz.3.7872 (pid 1696) Use of int in maxseg socket option. [ 775.103494][ T1696] Use struct sctp_assoc_value instead [ 775.120428][ T1689] syz_tun: entered promiscuous mode [ 775.161972][ T1691] netdevsim netdevsim2 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 775.203397][ T1691] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 775.257892][ T1691] netdevsim netdevsim2 eth3 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 775.458661][ T1691] netdevsim netdevsim2 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 775.475623][ T1691] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 775.503241][ T1691] netdevsim netdevsim2 eth2 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 775.569929][ T1691] netdevsim netdevsim2 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 775.593870][ T1691] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 775.633908][ T1691] netdevsim netdevsim2 eth1 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 775.748513][ T1691] netdevsim netdevsim2 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 775.748924][ T1734] Cannot find add_set index 0 as target [ 775.760003][ T1735] netlink: 'syz.4.7882': attribute type 33 has an invalid length. [ 775.783274][ T1735] __nla_validate_parse: 8 callbacks suppressed [ 775.783290][ T1735] netlink: 152 bytes leftover after parsing attributes in process `syz.4.7882'. [ 775.800486][ T1691] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 775.805359][ T1736] netlink: 'syz.4.7882': attribute type 2 has an invalid length. [ 775.827229][ T1691] netdevsim netdevsim2 eth0 (unregistering): unset [1, 1] type 2 family 0 port 19999 - 0 [ 776.078787][T23737] netdevsim netdevsim2 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 776.087482][T23737] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 19999 - 0 [ 776.115255][T23737] netdevsim netdevsim2 eth0: set [1, 1] type 2 family 0 port 6081 - 0 [ 776.301001][T23737] netdevsim netdevsim2 eth1: set [0, 0] type 1 family 0 port 8472 - 0 [ 776.311665][T23737] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 19999 - 0 [ 776.332719][T23737] netdevsim netdevsim2 eth1: set [1, 1] type 2 family 0 port 6081 - 0 [ 776.525388][T23737] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 776.536041][T23737] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 19999 - 0 [ 776.545018][T23737] netdevsim netdevsim2 eth2: set [1, 1] type 2 family 0 port 6081 - 0 [ 776.577833][ T1768] bond10: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 776.597043][ T1768] bond10: (slave lo): Enslaving as an active interface with an up link [ 776.608164][ T1768] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 776.637484][T23737] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 776.657029][T23737] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 19999 - 0 [ 776.687591][T23737] netdevsim netdevsim2 eth3: set [1, 1] type 2 family 0 port 6081 - 0 [ 776.740081][T23736] hsr_slave_0: left promiscuous mode [ 776.755868][T23736] hsr_slave_1: left promiscuous mode [ 776.855973][T23736] vlan0: left allmulticast mode [ 776.856825][ T1789] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7898'. [ 776.874088][T23736] veth0_vlan: left allmulticast mode [ 776.882697][ T1789] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7898'. [ 776.887439][T23736] vlan0: left promiscuous mode [ 776.916202][T23736] veth1_macvtap: left promiscuous mode [ 776.928034][T23736] veth0_macvtap: left promiscuous mode [ 776.950346][T23736] veth1_vlan: left promiscuous mode [ 776.973225][T23736] veth0_vlan: left promiscuous mode [ 777.980250][ T1793] lo speed is unknown, defaulting to 1000 [ 777.991984][ T1833] netlink: 'syz.2.7905': attribute type 21 has an invalid length. [ 778.018451][ T1833] IPv6: NLM_F_CREATE should be specified when creating new route [ 778.036858][ T1833] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 778.044138][ T1833] IPv6: NLM_F_CREATE should be set when creating new route [ 778.051420][ T1833] IPv6: NLM_F_CREATE should be set when creating new route [ 778.058673][ T1833] IPv6: NLM_F_CREATE should be set when creating new route [ 778.341105][ T1855] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7912'. [ 778.382038][T23736] IPVS: stop unused estimator thread 0... [ 778.495784][ T1859] netlink: 'syz.3.7913': attribute type 21 has an invalid length. [ 778.513690][ C0] ip6_tunnel: ip6gretap0 xmit: Local address not yet configured! [ 778.638486][ T1859] bond6: option lacp_rate: mode dependency failed, not supported in mode broadcast(3) [ 778.661475][ T1859] bond6 (unregistering): Released all slaves [ 778.761275][ T1878] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7917'. [ 778.781708][ T1793] ip6_vti0 speed is unknown, defaulting to 1000 [ 778.809302][ T1873] pimreg3: entered allmulticast mode [ 779.248488][ T1913] netlink: 'syz.4.7930': attribute type 10 has an invalid length. [ 779.260200][ T1912] syzkaller0: entered allmulticast mode [ 779.288843][ T1903] siw: device registration error -23 [ 779.385255][ T1921] netlink: 12 bytes leftover after parsing attributes in process `syz.4.7932'. [ 779.421329][ T1924] netlink: 56 bytes leftover after parsing attributes in process `syz.2.7931'. [ 779.447991][ T1924] netlink: 12 bytes leftover after parsing attributes in process `syz.2.7931'. [ 779.462219][ T1924] netlink: 31 bytes leftover after parsing attributes in process `syz.2.7931'. [ 779.474723][ T1924] netlink: 'syz.2.7931': attribute type 3 has an invalid length. [ 779.483253][ T1924] netlink: 'syz.2.7931': attribute type 2 has an invalid length. [ 779.491144][ T1924] netlink: 31 bytes leftover after parsing attributes in process `syz.2.7931'. [ 779.745340][ T1945] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_cmd_wq": -EINTR [ 780.318328][ T1978] sctp: [Deprecated]: syz.4.7945 (pid 1978) Use of struct sctp_assoc_value in delayed_ack socket option. [ 780.318328][ T1978] Use struct sctp_sack_info instead [ 780.329446][ T1976] netlink: 'syz.3.7944': attribute type 10 has an invalid length. [ 780.471826][ T1990] Bluetooth: hci1: too big key_count value 32778 [ 780.615779][ T1982] syzkaller0: entered promiscuous mode [ 780.621419][ T1982] syzkaller0: entered allmulticast mode [ 782.112638][ T2020] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 782.149273][ T2020] netlink: 'syz.0.7954': attribute type 9 has an invalid length. [ 782.164479][ T2023] xt_cluster: you have exceeded the maximum number of cluster nodes (2048 > 32) [ 782.174079][ T2023] netlink: 'syz.4.7955': attribute type 1 has an invalid length. [ 782.202969][ T2020] netlink: 'syz.0.7954': attribute type 11 has an invalid length. [ 782.210834][ T2020] netlink: 'syz.0.7954': attribute type 12 has an invalid length. [ 782.249397][ T2020] __nla_validate_parse: 3 callbacks suppressed [ 782.249413][ T2020] netlink: 199280 bytes leftover after parsing attributes in process `syz.0.7954'. [ 782.314132][ T2033] bond11: (slave vxcan3): The slave device specified does not support setting the MAC address [ 782.327586][ T2035] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7959'. [ 782.336545][ T2033] bond11: (slave vxcan3): Setting fail_over_mac to active for active-backup mode [ 782.339478][ T2033] bond11: (slave vxcan3): making interface the new active one [ 782.354710][ T2033] bond11: (slave vxcan3): Enslaving as an active interface with an up link [ 782.394422][ T2042] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 782.401687][ T2042] IPv6: NLM_F_CREATE should be set when creating new route [ 782.408999][ T2042] IPv6: NLM_F_CREATE should be set when creating new route [ 782.433521][ T2035] batadv0: entered allmulticast mode [ 782.466324][ T2047] nbd: nbd4 already in use [ 782.779136][ T2068] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7970'. [ 782.845463][ T2072] syzkaller0: entered promiscuous mode [ 782.851112][ T2072] syzkaller0: entered allmulticast mode [ 783.007689][ T2081] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7974'. [ 783.026292][ T2081] netlink: 8 bytes leftover after parsing attributes in process `syz.0.7974'. [ 783.081920][ T2084] netlink: 4 bytes leftover after parsing attributes in process `syz.3.7976'. [ 783.226628][ T2097] netlink: 92 bytes leftover after parsing attributes in process `syz.1.7979'. [ 783.226732][ T2093] lo speed is unknown, defaulting to 1000 [ 783.287649][ T2099] netlink: 'syz.3.7980': attribute type 2 has an invalid length. [ 783.470119][ T2108] netlink: 12 bytes leftover after parsing attributes in process `syz.3.7982'. [ 783.491443][ T2107] netlink: 4 bytes leftover after parsing attributes in process `syz.1.7983'. [ 783.614710][ T2109] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 783.619769][ T2093] ip6_vti0 speed is unknown, defaulting to 1000 [ 783.635123][ T2109] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 783.655197][ T2113] sctp: [Deprecated]: syz.2.7985 (pid 2113) Use of int in max_burst socket option. [ 783.655197][ T2113] Use struct sctp_assoc_value instead [ 783.846068][ T2125] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7988'. [ 784.103042][ T2127] bridge0: port 1(bridge_slave_0) entered disabled state [ 784.331007][ T2127] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 784.363120][ T2127] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 784.539088][ T2127] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 784.555850][ T2127] batman_adv: batadv0: Interface deactivated: ipvlan3 [ 784.698557][ T671] lo speed is unknown, defaulting to 1000 [ 784.706306][ T671] syz0: Port: 1 Link DOWN [ 784.737027][T23741] netdevsim netdevsim3 eth0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 784.763514][T23741] netdevsim netdevsim3 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 784.772945][T23741] netdevsim netdevsim3 eth1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 784.781289][T23741] netdevsim netdevsim3 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 784.792783][ T671] lo speed is unknown, defaulting to 1000 [ 784.828647][T23741] netdevsim netdevsim3 eth2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 784.848770][T23741] netdevsim netdevsim3 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 784.879546][T23742] netdevsim netdevsim3 eth3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 784.903318][T23742] netdevsim netdevsim3 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 785.019052][ T2153] netlink: 'syz.3.7995': attribute type 16 has an invalid length. [ 785.125404][ T2151] xt_time: unknown flags 0xf4 [ 785.190183][ T2164] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 786.713731][ T2270] netlink: 'syz.3.8027': attribute type 1 has an invalid length. [ 787.097745][ T2293] 8021q: adding VLAN 0 to HW filter on device bond6 [ 787.281553][ T2317] __nla_validate_parse: 8 callbacks suppressed [ 787.281571][ T2317] netlink: 48 bytes leftover after parsing attributes in process `syz.0.8037'. [ 787.333532][ T2317] netlink: 36 bytes leftover after parsing attributes in process `syz.0.8037'. [ 787.709731][ T2347] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8045'. [ 787.736095][ T2349] IPVS: sync thread started: state = BACKUP, mcast_ifn = vcan0, syncid = 0, id = 0 [ 787.811315][ T2353] IPVS: length: 239 != 24 [ 787.892610][ T2360] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8051'. [ 787.910130][ T2359] netlink: 'syz.2.8050': attribute type 1 has an invalid length. [ 787.940805][ T2360] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8051'. [ 787.951265][ T2359] netlink: 96 bytes leftover after parsing attributes in process `syz.2.8050'. [ 787.978294][ T2359] netlink: 1 bytes leftover after parsing attributes in process `syz.2.8050'. [ 787.988354][ T2359] netlink: 658 bytes leftover after parsing attributes in process `syz.2.8050'. [ 788.077577][ T2373] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8055'. [ 788.090222][ T2373] netlink: 40 bytes leftover after parsing attributes in process `syz.3.8055'. [ 788.460454][T23741] nci: nci_extract_activation_params_nfc_dep: unsupported activation_rf_tech_and_mode 0x1 [ 788.475078][ T2403] netlink: 'syz.1.8061': attribute type 21 has an invalid length. [ 789.185530][ T2433] IPVS: set_ctl: invalid protocol: 29 100.1.1.1:39186 [ 789.625939][ T2431] IPv6: NLM_F_CREATE should be specified when creating new route [ 789.953785][ T2484] block nbd3: Possible stuck request ffff888026178000: control (read@0,1024B). Runtime 90 seconds [ 789.964718][ T2484] block nbd3: Possible stuck request ffff888026178200: control (read@1024,1024B). Runtime 90 seconds [ 789.976817][ T2484] block nbd3: Possible stuck request ffff888026178400: control (read@2048,1024B). Runtime 90 seconds [ 789.988130][ T2484] block nbd3: Possible stuck request ffff888026178600: control (read@3072,1024B). Runtime 90 seconds [ 790.300000][ T2499] netlink: 'syz.1.8083': attribute type 1 has an invalid length. [ 790.324606][ T2485] [ 790.326963][ T2485] ====================================================== [ 790.327882][ T2499] bond6: entered promiscuous mode [ 790.333973][ T2485] WARNING: possible circular locking dependency detected [ 790.333986][ T2485] syzkaller #0 Not tainted [ 790.333997][ T2485] ------------------------------------------------------ [ 790.334006][ T2485] syz.0.8081/2485 is trying to acquire lock: [ 790.334017][ T2485] ffff88802602abc0 (&q->elevator_lock){+.+.}-{4:4}, at: elevator_change+0x1b3/0x450 [ 790.334065][ T2485] [ 790.334065][ T2485] but task is already holding lock: [ 790.334073][ T2485] ffff88802602a680 (&q->q_usage_counter(io)#54){++++}-{0:0}, at: elevator_change+0x198/0x450 [ 790.334123][ T2485] [ 790.334123][ T2485] which lock already depends on the new lock. [ 790.334123][ T2485] [ 790.334130][ T2485] [ 790.334130][ T2485] the existing dependency chain (in reverse order) is: [ 790.334138][ T2485] [ 790.334138][ T2485] -> #6 (&q->q_usage_counter(io)#54){++++}-{0:0}: [ 790.334172][ T2485] blk_alloc_queue+0x546/0x680 [ 790.334191][ T2485] __blk_mq_alloc_disk+0x197/0x390 [ 790.334213][ T2485] nbd_dev_add+0x499/0xb50 [ 790.334229][ T2485] nbd_init+0x168/0x1f0 [ 790.334250][ T2485] do_one_initcall+0x250/0x840 [ 790.334273][ T2485] do_initcall_level+0x104/0x190 [ 790.334293][ T2485] do_initcalls+0x59/0xa0 [ 790.334310][ T2485] kernel_init_freeable+0x2a6/0x3d0 [ 790.340426][ T2499] 8021q: adding VLAN 0 to HW filter on device bond6 [ 790.346316][ T2485] kernel_init+0x1d/0x1d0 [ 790.346341][ T2485] ret_from_fork+0x51e/0xb90 [ 790.346360][ T2485] ret_from_fork_asm+0x1a/0x30 [ 790.346382][ T2485] [ 790.346382][ T2485] -> #5 (fs_reclaim){+.+.}-{0:0}: [ 790.346409][ T2485] fs_reclaim_acquire+0x71/0x100 [ 790.346431][ T2485] kmem_cache_alloc_node_noprof+0x4a/0x690 [ 790.346452][ T2485] __alloc_skb+0x1d0/0x7d0 [ 790.346470][ T2485] tcp_stream_alloc_skb+0x3f/0x580 [ 790.346491][ T2485] tcp_sendmsg_locked+0x131c/0x5430 [ 790.346513][ T2485] tcp_sendmsg+0x2f/0x50 [ 790.346534][ T2485] sock_write_iter+0x421/0x550 [ 790.346559][ T2485] vfs_write+0x61d/0xb90 [ 790.346579][ T2485] ksys_write+0x150/0x270 [ 790.346599][ T2485] do_syscall_64+0x14d/0xf80 [ 790.346623][ T2485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 790.346641][ T2485] [ 790.346641][ T2485] -> #4 (sk_lock-AF_INET){+.+.}-{0:0}: [ 790.346671][ T2485] lock_sock_nested+0x48/0x100 [ 790.346687][ T2485] inet_shutdown+0x6a/0x390 [ 790.346711][ T2485] nbd_mark_nsock_dead+0x2e9/0x560 [ 790.346740][ T2485] recv_work+0x1bf4/0x1d00 [ 790.346759][ T2485] process_scheduled_works+0xaec/0x17a0 [ 790.346778][ T2485] worker_thread+0xa50/0xfc0 [ 790.346797][ T2485] kthread+0x388/0x470 [ 790.592168][ T2485] ret_from_fork+0x51e/0xb90 [ 790.597286][ T2485] ret_from_fork_asm+0x1a/0x30 [ 790.602566][ T2485] [ 790.602566][ T2485] -> #3 (&nsock->tx_lock){+.+.}-{4:4}: [ 790.610205][ T2485] __mutex_lock+0x19f/0x1300 [ 790.615322][ T2485] nbd_queue_rq+0x37b/0x1100 [ 790.620440][ T2485] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 790.626492][ T2485] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 790.633330][ T2485] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 790.639818][ T2485] blk_mq_run_hw_queue+0x348/0x4f0 [ 790.645431][ T2485] blk_mq_dispatch_list+0xd16/0xe10 [ 790.651134][ T2485] blk_mq_flush_plug_list+0x48d/0x570 [ 790.657009][ T2485] __blk_flush_plug+0x3ed/0x4d0 [ 790.662365][ T2485] __submit_bio+0x28d/0x580 [ 790.667373][ T2485] submit_bio_noacct_nocheck+0x2f4/0xa20 [ 790.673510][ T2485] block_read_full_folio+0x599/0x830 [ 790.679303][ T2485] filemap_read_folio+0x137/0x3b0 [ 790.684837][ T2485] do_read_cache_folio+0x358/0x590 [ 790.690458][ T2485] read_part_sector+0xb6/0x2b0 [ 790.695723][ T2485] adfspart_check_ICS+0xa5/0xa40 [ 790.701166][ T2485] bdev_disk_changed+0x7ba/0x1550 [ 790.706708][ T2485] blkdev_get_whole+0x380/0x510 [ 790.712061][ T2485] bdev_open+0x31e/0xd30 [ 790.716803][ T2485] blkdev_open+0x470/0x610 [ 790.721723][ T2485] do_dentry_open+0x785/0x14e0 [ 790.726993][ T2485] vfs_open+0x3b/0x340 [ 790.731561][ T2485] path_openat+0x2e08/0x3860 [ 790.736653][ T2485] do_file_open+0x23e/0x4a0 [ 790.741675][ T2485] do_sys_openat2+0x113/0x200 [ 790.746855][ T2485] __x64_sys_openat+0x138/0x170 [ 790.752210][ T2485] do_syscall_64+0x14d/0xf80 [ 790.757306][ T2485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 790.763707][ T2485] [ 790.763707][ T2485] -> #2 (&cmd->lock){+.+.}-{4:4}: [ 790.770899][ T2485] __mutex_lock+0x19f/0x1300 [ 790.775995][ T2485] nbd_queue_rq+0xc6/0x1100 [ 790.780998][ T2485] blk_mq_dispatch_rq_list+0xa70/0x1910 [ 790.787048][ T2485] __blk_mq_sched_dispatch_requests+0xdcc/0x1600 [ 790.793879][ T2485] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 790.800361][ T2485] blk_mq_run_hw_queue+0x348/0x4f0 [ 790.805975][ T2485] blk_mq_dispatch_list+0xd16/0xe10 [ 790.811674][ T2485] blk_mq_flush_plug_list+0x48d/0x570 [ 790.817547][ T2485] __blk_flush_plug+0x3ed/0x4d0 [ 790.822903][ T2485] __submit_bio+0x28d/0x580 [ 790.827940][ T2485] submit_bio_noacct_nocheck+0x2f4/0xa20 [ 790.834526][ T2485] block_read_full_folio+0x599/0x830 [ 790.840339][ T2485] filemap_read_folio+0x137/0x3b0 [ 790.845880][ T2485] do_read_cache_folio+0x358/0x590 [ 790.851515][ T2485] read_part_sector+0xb6/0x2b0 [ 790.856800][ T2485] adfspart_check_ICS+0xa5/0xa40 [ 790.862255][ T2485] bdev_disk_changed+0x7ba/0x1550 [ 790.867786][ T2485] blkdev_get_whole+0x380/0x510 [ 790.873143][ T2485] bdev_open+0x31e/0xd30 [ 790.877890][ T2485] blkdev_open+0x470/0x610 [ 790.882810][ T2485] do_dentry_open+0x785/0x14e0 [ 790.888089][ T2485] vfs_open+0x3b/0x340 [ 790.892670][ T2485] path_openat+0x2e08/0x3860 [ 790.897787][ T2485] do_file_open+0x23e/0x4a0 [ 790.902812][ T2485] do_sys_openat2+0x113/0x200 [ 790.907999][ T2485] __x64_sys_openat+0x138/0x170 [ 790.913355][ T2485] do_syscall_64+0x14d/0xf80 [ 790.918456][ T2485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 790.924856][ T2485] [ 790.924856][ T2485] -> #1 (set->srcu){.+.+}-{0:0}: [ 790.931971][ T2485] __synchronize_srcu+0xca/0x3e0 [ 790.937415][ T2485] elevator_switch+0x1e8/0x7a0 [ 790.942682][ T2485] elevator_change+0x2cc/0x450 [ 790.947954][ T2485] elevator_set_default+0x36c/0x430 [ 790.953678][ T2485] blk_register_queue+0x34e/0x3f0 [ 790.959209][ T2485] __add_disk+0x677/0xd50 [ 790.964044][ T2485] add_disk_fwnode+0xfb/0x480 [ 790.969224][ T2485] nbd_dev_add+0x72c/0xb50 [ 790.974142][ T2485] nbd_init+0x168/0x1f0 [ 790.978802][ T2485] do_one_initcall+0x250/0x840 [ 790.984071][ T2485] do_initcall_level+0x104/0x190 [ 790.989514][ T2485] do_initcalls+0x59/0xa0 [ 790.994348][ T2485] kernel_init_freeable+0x2a6/0x3d0 [ 791.000048][ T2485] kernel_init+0x1d/0x1d0 [ 791.004877][ T2485] ret_from_fork+0x51e/0xb90 [ 791.009973][ T2485] ret_from_fork_asm+0x1a/0x30 [ 791.015243][ T2485] [ 791.015243][ T2485] -> #0 (&q->elevator_lock){+.+.}-{4:4}: [ 791.023046][ T2485] __lock_acquire+0x15a5/0x2cf0 [ 791.028423][ T2485] lock_acquire+0x106/0x330 [ 791.033432][ T2485] __mutex_lock+0x19f/0x1300 [ 791.038531][ T2485] elevator_change+0x1b3/0x450 [ 791.043794][ T2485] elevator_set_none+0xb5/0x140 [ 791.049148][ T2485] blk_mq_update_nr_hw_queues+0x5e7/0x1ae0 [ 791.055458][ T2485] nbd_start_device+0x17f/0xb10 [ 791.060809][ T2485] nbd_genl_connect+0x165b/0x1cf0 [ 791.066335][ T2485] genl_family_rcv_msg_doit+0x22a/0x330 [ 791.072388][ T2485] genl_rcv_msg+0x61c/0x7a0 [ 791.077393][ T2485] netlink_rcv_skb+0x232/0x4b0 [ 791.082656][ T2485] genl_rcv+0x28/0x40 [ 791.087145][ T2485] netlink_unicast+0x80f/0x9b0 [ 791.092442][ T2485] netlink_sendmsg+0x813/0xb40 [ 791.097716][ T2485] ____sys_sendmsg+0xa68/0xad0 [ 791.102984][ T2485] ___sys_sendmsg+0x2a5/0x360 [ 791.108162][ T2485] __x64_sys_sendmsg+0x1bd/0x2a0 [ 791.113613][ T2485] do_syscall_64+0x14d/0xf80 [ 791.118709][ T2485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.125101][ T2485] [ 791.125101][ T2485] other info that might help us debug this: [ 791.125101][ T2485] [ 791.135308][ T2485] Chain exists of: [ 791.135308][ T2485] &q->elevator_lock --> fs_reclaim --> &q->q_usage_counter(io)#54 [ 791.135308][ T2485] [ 791.149028][ T2485] Possible unsafe locking scenario: [ 791.149028][ T2485] [ 791.156464][ T2485] CPU0 CPU1 [ 791.161807][ T2485] ---- ---- [ 791.167154][ T2485] lock(&q->q_usage_counter(io)#54); [ 791.172514][ T2485] lock(fs_reclaim); [ 791.178996][ T2485] lock(&q->q_usage_counter(io)#54); [ 791.186878][ T2485] lock(&q->elevator_lock); [ 791.191449][ T2485] [ 791.191449][ T2485] *** DEADLOCK *** [ 791.191449][ T2485] [ 791.199595][ T2485] 6 locks held by syz.0.8081/2485: [ 791.204857][ T2485] #0: ffffffff8fc2c4f0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 791.213027][ T2485] #1: ffffffff8fc2c308 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0 [ 791.221995][ T2485] #2: ffff8880260e21d0 (&set->update_nr_hwq_lock){++++}-{4:4}, at: blk_mq_update_nr_hw_queues+0xad/0x1ae0 [ 791.233379][ T2485] #3: ffff8880260e20d8 (&set->tag_list_lock){+.+.}-{4:4}, at: blk_mq_update_nr_hw_queues+0xc0/0x1ae0 [ 791.244322][ T2485] #4: ffff88802602a680 (&q->q_usage_counter(io)#54){++++}-{0:0}, at: elevator_change+0x198/0x450 [ 791.254921][ T2485] #5: ffff88802602a6b8 (&q->q_usage_counter(queue)#38){+.+.}-{0:0}, at: elevator_change+0x198/0x450 [ 791.265782][ T2485] [ 791.265782][ T2485] stack backtrace: [ 791.271649][ T2485] CPU: 0 UID: 0 PID: 2485 Comm: syz.0.8081 Not tainted syzkaller #0 PREEMPT(full) [ 791.271668][ T2485] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 791.271678][ T2485] Call Trace: [ 791.271685][ T2485] [ 791.271693][ T2485] dump_stack_lvl+0xe8/0x150 [ 791.271714][ T2485] print_circular_bug+0x2e1/0x300 [ 791.271734][ T2485] check_noncircular+0x12e/0x150 [ 791.271755][ T2485] __lock_acquire+0x15a5/0x2cf0 [ 791.271778][ T2485] ? elevator_change+0x1b3/0x450 [ 791.271793][ T2485] lock_acquire+0x106/0x330 [ 791.271807][ T2485] ? elevator_change+0x1b3/0x450 [ 791.271828][ T2485] __mutex_lock+0x19f/0x1300 [ 791.271847][ T2485] ? elevator_change+0x1b3/0x450 [ 791.271864][ T2485] ? rcu_is_watching+0x15/0xb0 [ 791.271882][ T2485] ? elevator_change+0x1b3/0x450 [ 791.271898][ T2485] ? __pfx___mutex_lock+0x10/0x10 [ 791.271917][ T2485] ? enable_work+0x17f/0x230 [ 791.271935][ T2485] ? lockdep_hardirqs_on+0x7a/0x110 [ 791.271956][ T2485] ? __cancel_work_sync+0xf7/0x110 [ 791.271974][ T2485] ? blk_mq_cancel_work_sync+0xa5/0xe0 [ 791.271993][ T2485] elevator_change+0x1b3/0x450 [ 791.272010][ T2485] elevator_set_none+0xb5/0x140 [ 791.272025][ T2485] ? __pfx_elevator_set_none+0x10/0x10 [ 791.272042][ T2485] ? xa_load+0x1db/0x210 [ 791.272063][ T2485] blk_mq_update_nr_hw_queues+0x5e7/0x1ae0 [ 791.272086][ T2485] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 791.272105][ T2485] ? kernfs_add_one+0x477/0x5c0 [ 791.272125][ T2485] ? __pfx_blk_mq_update_nr_hw_queues+0x10/0x10 [ 791.272148][ T2485] ? sysfs_add_file_mode_ns+0x259/0x300 [ 791.272167][ T2485] nbd_start_device+0x17f/0xb10 [ 791.272183][ T2485] ? device_create_file+0xf4/0x1b0 [ 791.272199][ T2485] nbd_genl_connect+0x165b/0x1cf0 [ 791.272217][ T2485] ? __pfx_nbd_genl_connect+0x10/0x10 [ 791.272234][ T2485] ? rcu_is_watching+0x15/0xb0 [ 791.272252][ T2485] ? __nla_parse+0x40/0x60 [ 791.272266][ T2485] ? genl_family_rcv_msg_attrs_parse+0x1c9/0x2a0 [ 791.272289][ T2485] genl_family_rcv_msg_doit+0x22a/0x330 [ 791.272310][ T2485] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 791.272332][ T2485] ? __lock_acquire+0x6b5/0x2cf0 [ 791.272350][ T2485] genl_rcv_msg+0x61c/0x7a0 [ 791.272369][ T2485] ? __pfx_genl_rcv_msg+0x10/0x10 [ 791.272386][ T2485] ? __pfx_nbd_genl_connect+0x10/0x10 [ 791.272404][ T2485] netlink_rcv_skb+0x232/0x4b0 [ 791.272419][ T2485] ? __pfx_genl_rcv_msg+0x10/0x10 [ 791.272436][ T2485] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 791.272450][ T2485] ? genl_rcv+0x19/0x40 [ 791.272472][ T2485] ? down_read+0x272/0x2e0 [ 791.272490][ T2485] ? genl_rcv+0xd/0x40 [ 791.272507][ T2485] genl_rcv+0x28/0x40 [ 791.272522][ T2485] netlink_unicast+0x80f/0x9b0 [ 791.272545][ T2485] ? __pfx_netlink_unicast+0x10/0x10 [ 791.272565][ T2485] ? netlink_sendmsg+0x650/0xb40 [ 791.272587][ T2485] netlink_sendmsg+0x813/0xb40 [ 791.272605][ T2485] ? __pfx_netlink_sendmsg+0x10/0x10 [ 791.272620][ T2485] ? aa_sock_msg_perm+0xf1/0x1b0 [ 791.272640][ T2485] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 791.272661][ T2485] ? __pfx_netlink_sendmsg+0x10/0x10 [ 791.272674][ T2485] ____sys_sendmsg+0xa68/0xad0 [ 791.272697][ T2485] ? __pfx_____sys_sendmsg+0x10/0x10 [ 791.272717][ T2485] ? import_iovec+0x73/0xa0 [ 791.272733][ T2485] ___sys_sendmsg+0x2a5/0x360 [ 791.272750][ T2485] ? __lock_acquire+0x6b5/0x2cf0 [ 791.272766][ T2485] ? __pfx____sys_sendmsg+0x10/0x10 [ 791.272786][ T2485] ? futex_wake+0x4ac/0x580 [ 791.272812][ T2485] ? __fget_files+0x2a/0x420 [ 791.272827][ T2485] ? __fget_files+0x3a0/0x420 [ 791.272847][ T2485] __x64_sys_sendmsg+0x1bd/0x2a0 [ 791.272871][ T2485] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 791.272900][ T2485] ? rcu_is_watching+0x15/0xb0 [ 791.272927][ T2485] do_syscall_64+0x14d/0xf80 [ 791.272952][ T2485] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.272972][ T2485] ? trace_irq_disable+0x37/0x100 [ 791.272995][ T2485] ? clear_bhb_loop+0x40/0x90 [ 791.273016][ T2485] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 791.273036][ T2485] RIP: 0033:0x7fc08eb9c629 [ 791.273055][ T2485] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 791.273072][ T2485] RSP: 002b:00007fc08f998028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 791.273092][ T2485] RAX: ffffffffffffffda RBX: 00007fc08ee15fa0 RCX: 00007fc08eb9c629 [ 791.273107][ T2485] RDX: 0000000000000000 RSI: 00002000000005c0 RDI: 0000000000000004 [ 791.273119][ T2485] RBP: 00007fc08ec32b39 R08: 0000000000000000 R09: 0000000000000000 [ 791.273129][ T2485] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 791.273139][ T2485] R13: 00007fc08ee16038 R14: 00007fc08ee15fa0 R15: 00007ffef6f206a8 [ 791.273157][ T2485] [ 791.726615][ T2499] 8021q: adding VLAN 0 to HW filter on device bond6 [ 791.739092][ T2499] bond6: (slave vti1): The slave device specified does not support setting the MAC address [ 791.749387][ T2499] bond6: (slave vti1): Setting fail_over_mac to active for active-backup mode [ 791.763954][ T2499] bond6: (slave vti1): making interface the new active one [ 791.771190][ T2499] vti1: entered promiscuous mode [ 791.777215][ T2499] bond6: (slave vti1): Enslaving as an active interface with an up link [ 791.802765][ T5139] block nbd5: Receive control failed (result -32) [ 791.803221][ T2510] block nbd5: Receive control failed (result -32) [ 791.809288][ T5139] block nbd5: Receive control failed (result -32) [ 791.816367][ T2510] block nbd5: Receive control failed (result -32) [ 791.822085][ T5816] block nbd5: Receive control failed (result -32)