last executing test programs: 2.546387237s ago: executing program 1 (id=4920): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000300), r3) sendmsg$IEEE802154_LLSEC_ADD_KEY(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)={0x14, r4, 0x1, 0x70bd2d, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x4084}, 0x8000) close(r2) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r5, 0x0, 0x2e, &(0x7f0000000340)={0x3, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @loopback}}}, 0x108) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[], 0x1c}}, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x3261e) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000009, 0x12, r6, 0x0) getsockopt$inet_buf(r5, 0x0, 0x30, &(0x7f0000000340)=""/225, &(0x7f0000000180)=0xe1) bpf$ENABLE_STATS(0x20, 0x0, 0x0) close(r2) sendmsg$DEVLINK_CMD_RATE_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)={0x3c, r1, 0x1, 0x0, 0x0, {0x34}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x73}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x3c}}, 0x0) 2.264211234s ago: executing program 1 (id=4924): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=@ipv4_getnexthop={0x20, 0x6a, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@NHA_ID={0x8}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x3c1, 0x3, 0x12a0, 0x1100, 0x18c, 0x203, 0x0, 0x19030000, 0x11d0, 0x2e0, 0x2e0, 0x11d0, 0x2e0, 0x7fffffe, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, [0x0, 0x0, 0xff, 0xff], [0x7fffffff, 0xff000000, 0xff000000, 0xff000000], 'bond_slave_1\x00', 'bond0\x00', {}, {}, 0x84, 0x7, 0x2, 0x55}, 0x300, 0x10d8, 0x1100, 0x0, {0x1000000}, [@common=@unspec=@cgroup1={{0x1030}, {0x1, 0x7d, 0x1, 0x1, './cgroup.cpu/syz1\x00', 0xfffffffc, {0x3}}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x1, 0x9, 0x74c}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x1300) 2.031440115s ago: executing program 1 (id=4928): r0 = socket(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010002000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000058000000090a010400000000000000000100000008000a40000000000900020073797a31000000000900010073797a300000000008000540000000041c000980100002800c00018008000140000000020800014000000003"], 0x364}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000040)={'vcan0\x00', 0x0}) poll(0x0, 0x0, 0x200) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x40, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r4, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r5, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800010000000000fedbdf251d01060008000900", @ANYRES32=r2, @ANYBLOB="08000a00f1"], 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x1) 1.760307151s ago: executing program 2 (id=4935): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) writev(r1, &(0x7f0000000100), 0x0) bind$alg(r0, &(0x7f0000000280)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha256)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000006100), 0x49f, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r5 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(r5, 0x0, &(0x7f0000000000)=0x0) bind$nfc_llcp(r4, &(0x7f0000001040)={0x27, r6, 0xffffffffffffffff, 0x5, 0x0, 0x0, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3c}, 0x60) r7 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r7, &(0x7f0000000080)={0x27, r6, 0x0, 0x3, 0x0, 0x5, "750538440ff92fe2aaf1beea7cdcc151042cd9893bc31f80716a120d8be6d7f81cd81ec275000386e7255f0669b740a5418d69d00000d51de08a00ee1d9a34", 0x400000011}, 0x60) bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000000440)={0x27, r6, 0x1, 0x7, 0x45, 0x2, "5e0f0e923eb04179b8b2adaec2827ce9b7e8884f96b7d85bdb4e776ea36e446a40cc95355e52cac90beb5deab0e03bd8306a12e9c74b5f978f9681e7048d89", 0x13}, 0x60) setsockopt$packet_int(r3, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xfffffffd, 0x0, 0x8}, 0x1c) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000700)={'vlan1\x00', 0x0}) r10 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r10, &(0x7f0000000340)="80ca3953f8", 0x5, 0x8040, &(0x7f0000000200)={0x11, 0x8100, r9, 0x1, 0xd8, 0x6, @local}, 0x14) sendmsg$NFT_BATCH(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a09040000000000000000020000000900020073797a32000000000900010073797a300000000070000000080a01010000000000000000020000000900010073797a30000000000900020073797a32000000002c00058008000140000000000800024000000000080001400000000608000140000000f9080001400000005c080009"], 0xc4}}, 0x0) r11 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f00000008c0)={'\x00', 0x0}) sendmsg$nl_route(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@bridge_newneigh={0x30, 0x1c, 0x200, 0x70bd29, 0x25dfdbfe, {0x7, 0x0, 0x0, r12, 0x40, 0xba, 0x6}, [@NDA_DST_IPV6={0x14, 0x1, @private0}]}, 0x30}, 0x1, 0x0, 0x0, 0x44}, 0x4040000) r13 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000740)={r13, &(0x7f0000000540)="3a541667169ac514f1560100ba00000000000000000000645cbd202e227d369d6d157b0fce88af0fab8c7462fcbd9cdeddf28ab0a033b3234e46c2fd45880e9841a32883b502a94ad04fccda40a795d22b9845283d3bdf52ac42161cd62eadc783b5d4fa9dee335ed08569075916cb68ea6a3dcfafecd1ba6539a8d73e389a5cb9bf05c9adc7a1461173ce6beb13d65a946f2df3ecef10191d706f9af620e8", &(0x7f00000004c0)=""/109, 0x18}, 0x20) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=@newtfilter={0x2c, 0x2c, 0x308, 0x5, 0x25dfdbff, {0x0, 0x0, 0x0, r12, {0xc, 0xfff1}, {0x1, 0xc}, {0x2, 0xfff2}}, [@TCA_RATE={0x6, 0x5, {0x7, 0x9}}]}, 0x2c}}, 0x800) 1.57952346s ago: executing program 4 (id=4937): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x2d, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000100)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000140)=0x18) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={r3, 0x48, &(0x7f0000000180)=[@in6={0xa, 0x4e24, 0x8, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, 0x8}, @in6={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @multicast2}, 0x3}, @in={0x2, 0x4e20, @empty}]}, &(0x7f0000000240)=0x10) bind$xdp(r1, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) connect$qrtr(r1, &(0x7f0000000300)={0x2d, 0x1, 0x4001}, 0xc) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)=ANY=[@ANYBLOB="68000000100001002cbd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="a821000000000000140003006e657464657673696d3000000000000034001680300001802c000c801400010007000000440b00000600000088a8000014"], 0x68}, 0x1, 0x0, 0x0, 0x4048001}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f0000000040)={0x1d, r4}, 0x10) 1.455876381s ago: executing program 4 (id=4941): bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x0, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x0, 0x3, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$packet(0x11, 0x3, 0x300) (async) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r2, 0x107, 0x5, 0x0, 0x0) epoll_create(0x2) (async) epoll_create(0x2) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000580)={'team_slave_0\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r0, r3, 0x25, 0x0, @void}, 0x10) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000001500)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0xfffffffc, 0x0, 0x0, 0x3, 0x1, 0x2}}) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000d00)={0x0, 0x0}, 0x8) r5 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000200)=r4, 0x2) bpf$LINK_DETACH(0x22, &(0x7f0000000040)=r5, 0x4) 1.323484795s ago: executing program 2 (id=4942): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e}, 0x94) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x0) sendmsg$inet(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x24000041) r1 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = epoll_create1(0x0) sendfile(r3, r1, &(0x7f0000000140)=0x6, 0x276f) 1.3230429s ago: executing program 1 (id=4943): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000a40)=@allocspi={0x100, 0x16, 0x1, 0x0, 0x0, {{{@in=@loopback, @in6=@ipv4={'\x00', '\xff\xff', @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0xee01}, {@in6=@remote, 0x0, 0x33}, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, {}, {}, {}, 0x400}, 0x0, 0x5dfe}, [@proto={0x5, 0x19, 0x2b}]}, 0x100}}, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000000040)={r1, 0xc, 0xdf, 0xfffffffffffffffa}) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f00000002c0)=0x0) sendmsg$nl_route(r4, &(0x7f00000003c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)=@setlink={0x30, 0x13, 0x2, 0x70bd2c, 0x25dfdbff, {0x0, 0x0, 0x0, r3, 0x20, 0x20000}, [@IFLA_NET_NS_PID={0x8, 0x13, r5}, @IFLA_EXT_MASK={0x8, 0x1d, 0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x4054814}, 0x4000010) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="a4390400000600001400350070696d3672656730000000000000000008000a00", @ANYRES32=r3, @ANYBLOB="ef1b473f340fce3facb64028de69ac1b7cd46f76bcf6c0a4afcebc61660584629fa27b87e7aa2898edb47f30e130c7f9f77ed9eba7a52c55a249db3f43546f36c6e50562e0892365c009c43d7d3b7ef83ac2bce2db64aa13a2c7b518171b"], 0x3c}}, 0x8000) 1.277411286s ago: executing program 4 (id=4945): r0 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$bt_hci(r0, 0x0, 0x2, &(0x7f0000000000)=""/239, &(0x7f0000000100)=0xef) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_QOS_MAP(r1, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)={0x90, r2, 0x100, 0x7fff, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x1, 0xc}}}}, [@NL80211_ATTR_QOS_MAP={0x10, 0xc7, {[{0x81, 0x6}, {0x7f, 0x3}], "1020707948ca9cf0"}}, @NL80211_ATTR_QOS_MAP={0x14, 0xc7, {[{0x8, 0x5}, {0x0, 0x4}, {0x0, 0x6}, {0x1, 0x6}], "93d5cfac792321e2"}}, @NL80211_ATTR_QOS_MAP={0x1e, 0xc7, {[{0xf8, 0x3}, {0xfd}, {0x2, 0x7}, {0xff, 0x2}, {0x9, 0x1}, {0x9, 0x1}, {0xff}, {0x5a, 0x1}, {0x2, 0x3}], "72cb5e7ca97822f1"}}, @NL80211_ATTR_QOS_MAP={0x24, 0xc7, {[{0x5, 0x5}, {0x7, 0x3}, {0x0, 0x5}, {0x10}, {0x52, 0x7}, {0x4, 0x3}, {0x0, 0x2}, {}, {0x48, 0x4}, {0x8, 0x1}, {0x6, 0x7}, {0x3, 0x5}], "ad1ef9cb43b39c4f"}}]}, 0x90}, 0x1, 0x0, 0x0, 0x4}, 0x24000040) (async) r4 = accept4$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000003c0)={'macvtap0\x00', 0x100}) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r1, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x44, 0x0, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r5}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x7}, @MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x11}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}]}, 0x44}, 0x1, 0x0, 0x0, 0x4040000}, 0x800) (async) socket$unix(0x1, 0x5, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000580), r1) sendmsg$MPTCP_PM_CMD_GET_ADDR(r6, &(0x7f0000000640)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000600)={&(0x7f00000005c0)={0x38, r7, 0x800, 0x70bd2d, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x7}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x40408c1) (async) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_DELETE(r8, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x3c, 0x2, 0x2, 0x801, 0x0, 0x0, {0x1, 0x0, 0x5}, [@CTA_EXPECT_ZONE={0x6, 0x7, 0x1, 0x0, 0x4}, @CTA_EXPECT_FLAGS={0x8}, @CTA_EXPECT_TUPLE={0x18, 0x2, 0x0, 0x1, [@CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x3}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x2f}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40844}, 0x20040044) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ifreq(r9, 0x8935, &(0x7f0000000780)={'nicvf0\x00', @ifru_ivalue=0x3}) (async) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000000800), r6) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r6, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x3c, r10, 0x8, 0x70bd2a, 0x25dfdbff, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20008000}, 0x8002) (async) r11 = socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000940)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_UPDATE_FT_IES(r11, &(0x7f0000000a00)={&(0x7f0000000900)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000009c0)={&(0x7f0000000980)={0x28, r2, 0x8, 0x70bd28, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r12}, @val={0xc, 0x99, {0x4d87, 0x3c}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x40002}, 0x20000000) (async) sendmsg$NL80211_CMD_SET_QOS_MAP(r6, &(0x7f0000000b00)={&(0x7f0000000a40)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000ac0)={&(0x7f0000000a80)={0x38, r2, 0x200, 0x70bd2b, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x8, 0x1}}}}, [@NL80211_ATTR_QOS_MAP={0x18, 0xc7, {[{0xe4, 0x7}, {0x2}, {0x8, 0x2}, {0x7, 0x4}, {0x4, 0x5}, {0x13, 0x3}], "18cca6b181d93fdf"}}]}, 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x40080) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000b80), r1) sendmsg$TIPC_NL_SOCK_GET(r13, &(0x7f0000000c80)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000c40)={&(0x7f0000000bc0)={0x58, r14, 0x1, 0x70bd2b, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x44, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x80000001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x2}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x8080}, 0x20040041) r15 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r15, 0x84, 0x16, &(0x7f0000000cc0)={0x1, [0x1]}, 0x6) ioctl$sock_inet6_SIOCDELRT(r9, 0x890c, &(0x7f0000000d00)={@private2, @empty, @private0, 0x7fff, 0x7, 0x0, 0x500, 0x8def, 0x40024, r5}) (async) setsockopt$IP6T_SO_SET_REPLACE(r9, 0x29, 0x40, &(0x7f0000000e00)=@mangle={'mangle\x00', 0x1f, 0x6, 0x528, 0x1a0, 0x290, 0x1a0, 0xd0, 0x0, 0x458, 0x458, 0x458, 0x458, 0x458, 0x6, &(0x7f0000000d80), {[{{@ipv6={@mcast1, @loopback, [0xff000000, 0xffffff00, 0x0, 0xffffff00], [0xff, 0x0, 0x0, 0xff], 'vcan0\x00', 'veth1_macvtap\x00', {0xff}, {}, 0x6, 0xa, 0x4, 0x24}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@local, @empty, [0xff000000, 0xff, 0xffffff00, 0xff], [0x0, 0xff, 0xffffff, 0xff], 'veth0_macvtap\x00', 'geneve0\x00', {}, {}, 0x73, 0x7, 0x2, 0x8}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@private2, @dev={0xfe, 0x80, '\x00', 0xd}, [0xff000000, 0xff000000, 0xffffff, 0xff000000], [0x0, 0xff000000, 0xff, 0xffffffff], 'batadv0\x00', 'veth0_to_batadv\x00', {}, {}, 0x67, 0xc0, 0x3, 0x1}, 0x0, 0xa8, 0xf0}, @SNPT={0x48, 'SNPT\x00', 0x0, {@ipv4=@rand_addr=0x64010101, @ipv4=@multicast2, 0x0, 0x36, 0xff}}}, {{@ipv6={@mcast1, @empty, [0xffffff00, 0xff0000ff, 0xff, 0xffffff00], [0xffffff00, 0xffffffff, 0xffffff00, 0xff], 'veth1_to_bond\x00', '\x00', {}, {0xff}, 0x6, 0x8, 0x3, 0x3c}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x8}}]}, @unspec=@CHECKSUM={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @local}, [0x0, 0x0, 0x0, 0xffffffff], [0x0, 0xffffff00, 0xffffffff, 0xffffff00], 'vlan0\x00', 'veth1_virt_wifi\x00', {}, {0xff}, 0x89, 0x9, 0x3, 0x28}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x588) 1.182646081s ago: executing program 2 (id=4947): ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000001240)={0xffffffffffffffff, &(0x7f0000001140)='+&@\'\x00', 0x280500, &(0x7f0000001180)={@_ha_fsid={[0x1, 0x100]}, {0x3, 0x9, 0x1, 0xa}}, 0x9, &(0x7f00000011c0)={@_ha_fsid}, &(0x7f0000001200)}) bpf$PROG_LOAD(0x5, &(0x7f0000001280)={0x7, 0x6, &(0x7f00000005c0)=ANY=[@ANYBLOB="05000000000000007111b600000000008510000002000000850000002a00000095000000000000009500a505000000008d8d72a4d2b0e866647a5563580154525990a711faae6b5efa82c515c097c645d4a49869490531e6fc004371de6a0e2aeb39db28a841fee433ca770c6799b28945ba973ff15b71d81a48f65b229efa31eb19c4d6945c8db59bf97ce0d74761c6ededcdebebfcd90759bd2cfe8b4253a9468fe5b0759b99a37a189ddd91f7bf447837"], &(0x7f0000000000)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000000)={'bridge0\x00', 0x0}) (async) r1 = socket(0x2, 0x80805, 0x0) getsockopt$bt_hci(r1, 0x84, 0x80, &(0x7f0000000000)=""/4102, &(0x7f0000001080)=0x1006) (async) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@struct]}}, 0x0, 0x26}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800"/24], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d) (async) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f00000000c0)={'gretap0\x00', 0x0, 0x10, 0x1, 0x10, 0x4, {{0x1b, 0x4, 0x0, 0x7, 0x6c, 0xffff, 0x0, 0xd, 0x29, 0x0, @private=0xa010100, @private=0xa010101, {[@timestamp={0x44, 0x10, 0xcb, 0x0, 0x0, [0x8, 0x73f923f6, 0x3]}, @ssrr={0x89, 0x27, 0x94, [@private=0x8077, @remote, @rand_addr=0x64010100, @dev={0xac, 0x14, 0x14, 0x19}, @dev={0xac, 0x14, 0x14, 0x44}, @remote, @private=0xa010102, @private=0xa010102, @local]}, @end, @timestamp={0x44, 0x14, 0x45, 0x0, 0x2, [0x7ff, 0x679, 0xfffffff4, 0x58]}, @generic={0x83, 0x9, "33d52910b4f04c"}, @noop]}}}}}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000006301530000000000950000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(r5, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newtfilter={0x38, 0x2c, 0xd27, 0x2, 0x0, {0x0, 0x0, 0x0, r6, {0x5, 0x9}, {}, {0x1c, 0xfff1}}, [@filter_kind_options=@f_u32={{0x8}, {0xc, 0x2, [@TCA_U32_DIVISOR={0x8, 0x4, 0x93}]}}]}, 0x38}}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r7, &(0x7f00000002c0), 0x40000000000009f, 0x0) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x14, 0x16, 0x1, 0x0, 0x0, {0x1c}}, 0x14}}, 0x0) (async) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="500000002700010000000000000000000a000100"], 0x50}, 0x1, 0x0, 0x0, 0x2000c0c0}, 0x0) (async) getsockopt$bt_hci(r9, 0x0, 0x2, &(0x7f00000010c0)=""/27, &(0x7f0000001100)=0x1b) (async) r10 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0200000004000000050000000100000000010000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000e1000000000000"], 0x48) (async) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r11, 0x29, 0x4a, 0x0, 0x0) (async) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000016c0)={0x6, 0xf, &(0x7f0000001040)=ANY=[@ANYBLOB="1800000000000000000000000000000018210000", @ANYRES32=r10, @ANYRESOCT=r11], &(0x7f0000000040)='GPL\x00'}, 0x94) sendmsg$MPTCP_PM_CMD_ANNOUNCE(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x50, r3, 0x20, 0x70bd27, 0x25dfdbff, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xc0000000}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x3}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x1c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r4}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}]}]}, 0x50}}, 0x811) 1.127998197s ago: executing program 4 (id=4948): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb010018000000000000007c0000007c00000002000000000000000000000e0000000000000000000000000600000d00000000000000000000000000000000000000000000000000000000000000000000000003000000fdfffffffeffffff0000000000000000000000070000000000000000000000090000000000000000000000090400000000000000000000090600000001"], 0x0, 0x96}, 0x28) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f00000005c0)={0x0, "74eb12c53c75bb9eaf4d2bc63ccc7d4f"}) ioctl$BTRFS_IOC_RESIZE(r0, 0x50009403, &(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYBLOB='\x00\x00\x00\x00', @ANYRESDEC=r1, @ANYBLOB="3a423f28b7f06d6178"]) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYRES16=r0], 0x0, 0x26, 0x0, 0xffffffff, 0x40008}, 0x28) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000500)={0x6, 0x7, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000851000000300000018000000", @ANYRES32, @ANYBLOB="000000000000000095000000000000009500000000000000"], &(0x7f0000000280)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x22, '\x00', 0x0, 0x25, r2, 0x8, 0x0, 0x0, 0x10, &(0x7f00000004c0), 0x2}, 0x94) 1.044193674s ago: executing program 2 (id=4949): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = socket(0x10, 0x803, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB="240000004000070130bdf000fedbdf25027c0000040025800c0008000200000000000000"], 0x24}, 0x1, 0x0, 0x0, 0x4c090}, 0x20008014) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f00000001c0)={@empty, @local, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5, 0xb, 0x3, 0x400, 0xffffffffffff35e5, 0x2400003, r4}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'bond0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0xa, 0x2, @TCA_CBS_PARMS={0x18}}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xd3f, 0x70bd25, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x2, 0x4}, {0x0, 0x9}, {0xf, 0x9}}, [@filter_kind_options=@f_route={{0xa}, {0x14, 0x2, [@TCA_ROUTE4_IIF={0x8, 0x4, r3}, @TCA_ROUTE4_FROM={0x8, 0x3, 0xe6}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x20040054) 1.026835735s ago: executing program 1 (id=4950): bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)=@udp, 0x1}, 0x20) r0 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r0, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x5, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b708000000000000a50a000000000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000004300000095"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000000500)={@broadcast, @broadcast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) 975.763656ms ago: executing program 4 (id=4951): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_PMK(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb4, r0, 0x300, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r1}, @val={0xc, 0x99, {0x6, 0x37}}}}, [@NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "b1b67dd49d381090fa258d9b726cdf6f"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "4a724fbd32cecda3ec343482b16124c5"}, @NL80211_ATTR_PMK={0x14, 0xfe, "1c747f86912713082060b8d36ce21180"}, @NL80211_ATTR_PMK={0x14, 0xfe, "15bedc24b65b4fe7fdf2d17c1613ed61"}, @NL80211_ATTR_PMK={0x14, 0xfe, "e4e2bc325eece306d44678cf01ad6b7e"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "36b2f0e2f8635b07a5ec032d4911593f"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "c8e585ecf6d697d61b887f9bdbe4cdc3"}]}, 0xb4}, 0x1, 0x0, 0x0, 0x800}, 0x4800) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000200), 0x8) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r2, &(0x7f0000000380)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f00000002c0)={0x48, r3, 0x8, 0x70bd2b, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x400d0}, 0x4800) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup/syz0\x00', 0x200002, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), r2) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(r4, 0x4058587a, &(0x7f0000000580)={{r4, &(0x7f0000000440)='wlan0\x00', 0x2041, &(0x7f0000000480)={@align=0x7fff, {0x5f4e, 0xa, 0xa, 0x8}}, 0x6, &(0x7f00000004c0), &(0x7f0000000500)=0x1000}, {[0xfffffff9, 0x5, 0x6, 0x2]}, 0x101, 0x5, &(0x7f0000000540)=""/5}) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r5, &(0x7f00000006c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x8800092}, 0xc, &(0x7f0000000680)={&(0x7f0000000640)={0x40, 0x1410, 0x8, 0x70bd26, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x3}, @RDMA_NLDEV_ATTR_STAT_AUTO_MODE_MASK={0x8}, @RDMA_NLDEV_ATTR_STAT_MODE={0x8}, @RDMA_NLDEV_ATTR_RES_LQPN={0x8}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @RDMA_NLDEV_ATTR_STAT_RES={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x884}, 0x0) accept4$packet(r5, &(0x7f0000000700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000740)=0x14, 0x80000) sendmsg$NL80211_CMD_GET_STATION(r2, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000880)={&(0x7f00000007c0)={0xb8, r0, 0x100, 0x70bd2c, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0xf, 0xe}}}}, [@NL80211_ATTR_STA_SUPPORT_P2P_PS={0x5, 0xe4, 0x1}, @NL80211_ATTR_STA_TX_POWER={0x6, 0x114, 0xfffe}, @NL80211_ATTR_STA_EXT_CAPABILITY={0x7e, 0xac, "2b8c8ae9b1e01f8e1eb0f150c401f69d73bc434c3c750c401eee411f7147bf62d7cc0ee815bdbe01c92f10e4fcdaa8ede6167042d2a35eb1a18569d0b2304c2f0eefee8e50657b6fe08707265aabd54312590d7b97e37a9633fcbdf08cb5f1adc898504a358735b62c55036c208d0964567b72cf7c4fdfbed48c"}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0x2db}]}, 0xb8}, 0x1, 0x0, 0x0, 0x8001}, 0x20000001) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f0000000900)) sendmsg$NL80211_CMD_SET_PMK(r2, &(0x7f0000000a80)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x2008}, 0xc, &(0x7f0000000a40)={&(0x7f0000000980)={0x88, r0, 0x60a, 0x70bd28, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x3, 0x65}}}}, [@NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "2cbcf38be0c567f6a6300d642e46b1c5"}, @NL80211_ATTR_PMK={0x14, 0xfe, "0a90d50479ed57fa736c264d105a2014"}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "f59062702a7acd159afa6867b42ab3c5"}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_PMKR0_NAME={0x14, 0x102, "c143ac627192a4160a115c13486b5827"}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) sendmsg$NL80211_CMD_STOP_P2P_DEVICE(r2, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x20, r0, 0x200, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x7, 0x32}}}}, ["", "", "", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x24044891}, 0xc000) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r2, &(0x7f0000000d00)={&(0x7f0000000bc0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000c00)={0x88, r0, 0x10, 0x70bd2c, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_CSA_IES={0x2c, 0xb9, 0x0, 0x1, [@NL80211_ATTR_CSA_C_OFF_BEACON={0x8, 0xba, [0x0, 0x8]}, @NL80211_ATTR_CSA_C_OFF_PRESP={0x12, 0xbb, [0x6, 0x5, 0x6b, 0x1, 0x5, 0x4, 0x2]}, @NL80211_ATTR_CSA_C_OFF_PRESP={0xc, 0xbb, [0x5, 0x2b, 0x19, 0xff]}]}, @chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x5}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0xd}, @NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0x75}, @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}, @chandef_params=[@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16f3}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xb}], @NL80211_ATTR_CH_SWITCH_BLOCK_TX={0x4}]}, 0x88}, 0x1, 0x0, 0x0, 0x4040}, 0x48000) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_NEIGHBORS(r7, &(0x7f0000000e40)={&(0x7f0000000d40)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000e00)={&(0x7f0000000d80)={0x54, 0x0, 0x200, 0x70bd2b, 0x25dfdbfe, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x4}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x2}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x1}, @BATADV_ATTR_GW_MODE={0x5, 0x33, 0xf1221926171614bf}, @BATADV_ATTR_ELP_INTERVAL={0x8, 0x3a, 0x6}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0xdd}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x81) sendmsg$NL80211_CMD_AUTHENTICATE(r2, &(0x7f0000000f40)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000f00)={&(0x7f0000000ec0)={0x30, r0, 0x1, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @void}}, [@NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x4}, @key_params=[@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}], @NL80211_ATTR_MAC={0xa}]}, 0x30}, 0x1, 0x0, 0x0, 0x20040080}, 0x408c0) r8 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001280)={0x18, 0x23, &(0x7f0000000f80)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x695}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7fff}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r2}}, @ldst={0x3, 0x0, 0x6, 0x6, 0x5, 0x80}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x4}, @cb_func={0x18, 0x5, 0x4, 0x0, 0x6}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xe5}}, @generic={0x1, 0x5, 0x9, 0x9, 0x7}]}, &(0x7f00000010c0)='syzkaller\x00', 0x3, 0x83, &(0x7f0000001100)=""/131, 0x41100, 0x2, '\x00', r6, 0x0, r5, 0x8, 0x0, 0x0, 0x10, &(0x7f00000011c0)={0x1, 0x6, 0x9, 0x6}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000001200), &(0x7f0000001240)=[{0x4, 0x5, 0x8, 0x8}], 0x10, 0x400}, 0x94) ioctl$OCFS2_IOC_UNRESVSP(r8, 0x40305829, &(0x7f0000001340)={0x1, 0x0, 0x9, 0xffffffff, 0x7, 0x3}) bpf$OBJ_GET_PROG(0x7, &(0x7f00000013c0)=@generic={&(0x7f0000001380)='./file0\x00'}, 0x18) setsockopt$bt_hci_HCI_FILTER(r5, 0x0, 0x2, &(0x7f0000001400)={0x7f, [0xace, 0x4], 0x2}, 0x10) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000001440), 0x2, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000001480), r7) r9 = syz_genetlink_get_family_id$team(&(0x7f0000001500), r5) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000001540)={0x0, @local, @multicast2}, &(0x7f0000001580)=0xc) getsockopt$inet6_mreq(r5, 0x29, 0x1b, &(0x7f00000015c0)={@mcast1, 0x0}, &(0x7f0000001600)=0x14) sendmsg$TEAM_CMD_NOOP(r7, &(0x7f0000002580)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000002540)={&(0x7f0000001ac0)={0xa70, r9, 0x200, 0x70bd29, 0x25dfdbfd, {}, [{{0x8, 0x1, r6}, {0xec, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xfffffffe}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x8000}}}]}}, {{0x8, 0x1, r6}, {0x194, 0x2, 0x0, 0x1, [{0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r6}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7fff}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0x1d50ef6a}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x400000}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x4}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r10}}}, {0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r6}, {0x168, 0x2, 0x0, 0x1, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x6}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r6}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}]}}, {{0x8, 0x1, r6}, {0x1a4, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r6}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x1}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r11}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}]}}, {{0x8, 0x1, r6}, {0x44, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0xc}}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0x124, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x9}}}, {0x38, 0x1, @notify_peers_interval={{0x24}, {0x5}, {0x8, 0x4, 0xc1e}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24}, {0x5}, {0x8, 0x4, 0xa}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8, 0x4, r6}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0xfff}}}]}}, {{0x8}, {0x124, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r6}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x3}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r6}, {0x17c, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x4c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x19, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @enabled={{{0x24}, {0x5}, {0x4}}, {0x8, 0x6, r6}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8, 0x4, r6}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24}, {0x5}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r6}, {0x80, 0x2, 0x0, 0x1, [{0x3c, 0x1, @lb_tx_method={{0x24}, {0x5}, {0x9, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x4}}, {0x8}}}]}}]}, 0xa70}, 0x1, 0x0, 0x0, 0x4}, 0x0) 840.204702ms ago: executing program 4 (id=4954): r0 = socket$inet_sctp(0x2, 0x1, 0x84) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000300)="9e", 0x1, 0x0, &(0x7f0000000380)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x23, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) socket$inet6(0xa, 0x2, 0x0) socket$netlink(0x10, 0x3, 0xf) socket$netlink(0x10, 0x3, 0xc) socket$can_bcm(0x1d, 0x2, 0x2) socket$inet_icmp_raw(0x2, 0x3, 0x1) epoll_create1(0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r3, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r1], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, 0x0, 0x0, 0x20044010, &(0x7f0000000180)={0x11, 0x1, r3, 0x1, 0x12, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}, 0x14) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @icmp={{0x7, 0x4, 0x2, 0x9, 0x30, 0x6b, 0x0, 0x8a, 0x1, 0x0, @remote, @remote, {[@ssrr={0x89, 0x3, 0x2e}, @lsrr={0x83, 0x3, 0x48}]}}, @timestamp_reply={0xe, 0x0, 0x0, 0x1, 0x8, 0x99f, 0x10000, 0x2}}}}}, 0x0) 804.367991ms ago: executing program 3 (id=4955): r0 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0x2, 0x7}, {0x0, 0x9}, {0xffff, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8848}, @TCA_FLOWER_KEY_MPLS_TC={0x5, 0x45, 0x2}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4010}, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_LP_INTERVAL={0x8}, @IFLA_BOND_MIN_LINKS={0x8}]}}}]}, 0x44}}, 0x0) 703.029851ms ago: executing program 2 (id=4957): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x9, 0x4, 0x6, 0x80}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000017c0)={r0, &(0x7f0000001700), &(0x7f0000001780), 0x3}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x0, 0x3, 0x0, 0x0}, 0x90) r2 = socket$inet6(0xa, 0x1, 0x8010800000000084) sendmmsg$inet6(r2, &(0x7f0000000040)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @private0={0xfc, 0x0, '\x00', 0xfd}}, 0x1c, &(0x7f0000000600)=[{&(0x7f00000000c0)='/', 0x1}], 0x1}}, {{&(0x7f0000000400)={0xa, 0x0, 0x0, @private0}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000d00)='[', 0x1}], 0x1}}], 0x2, 0x4008040) r3 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'veth1_virt_wifi\x00', 0x0}) setsockopt$inet6_mreq(r3, 0x29, 0x1b, &(0x7f0000000000)={@remote, r4}, 0x14) setsockopt$inet6_mreq(r3, 0x29, 0x1c, &(0x7f0000000040)={@remote, r4}, 0x14) r5 = socket$netlink(0x10, 0x3, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(0xffffffffffffffff, 0x28, 0x0, &(0x7f0000000ac0)=0x10001, 0x8) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r2) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000580)={r1, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000180)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x5, &(0x7f00000001c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x97, &(0x7f0000000240)=[{}, {}, {}, {}, {}, {}], 0x30, 0x10, &(0x7f0000000280), &(0x7f0000000300), 0x8, 0x5a, 0x8, 0x8, &(0x7f0000000440)}}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000700)={'vlan1\x00', 0x0}) r8 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r8, &(0x7f0000000340)="80ca3953f8", 0x5, 0x8040, &(0x7f0000000200)={0x11, 0x8100, r7, 0x1, 0xd8, 0x6, @local}, 0x14) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f00000005c0)={'batadv_slave_1\x00'}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000700)={'gre0\x00', &(0x7f0000000640)={'tunl0\x00', 0x0, 0x8, 0x20, 0x855a, 0x2, {{0x1f, 0x4, 0x0, 0xd, 0x7c, 0x67, 0x0, 0x6, 0x2f, 0x0, @private=0xa010102, @remote, {[@timestamp={0x44, 0x24, 0x5e, 0x0, 0xb, [0x7fff, 0x2, 0xdf0, 0x2, 0x1a5f1e76, 0x6, 0x800, 0x3]}, @rr={0x7, 0x13, 0xc2, [@local, @remote, @multicast2, @rand_addr=0x64010101]}, @timestamp_prespec={0x44, 0x24, 0x46, 0x3, 0xe, [{@dev={0xac, 0x14, 0x14, 0x3c}, 0x10}, {@multicast1, 0x10}, {@private=0xa010101, 0x7}, {@dev={0xac, 0x14, 0x14, 0x26}, 0x2}]}, @rr={0x7, 0xb, 0xa4, [@multicast2, @remote]}]}}}}}) r9 = socket(0x10, 0x3, 0x0) r10 = socket$nl_route(0x10, 0x3, 0x0) r11 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r11) getsockname$packet(r11, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11ffffffff000000", @ANYRES32=r12, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000005840)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x48, 0x24, 0x5820a61ca228651, 0x0, 0x0, {0x0, 0x0, 0x0, r12, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x2, 0x8}}]}}]}, 0x48}}, 0x0) r13 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r13, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000026c0)=@newtfilter={0x70, 0x28, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r12, {0x10}, {0x9}, {0xfff1, 0xb}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x38, 0x2, [@TCA_CGROUP_ACT={0x34, 0x1, [@m_skbmod={0x30, 0x16, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0x22, 0x2}}]}, 0x70}, 0x1, 0x0, 0x0, 0x4810}, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r0, 0x89f2, &(0x7f0000000880)={'gretap0\x00', &(0x7f0000000740)={'tunl0\x00', 0x0, 0x80, 0x80, 0x8, 0x1, {{0x39, 0x4, 0x1, 0x2, 0xe4, 0x65, 0x0, 0x7, 0x29, 0x0, @rand_addr=0x64010100, @remote, {[@timestamp_prespec={0x44, 0x1c, 0x64, 0x3, 0x9, [{@dev={0xac, 0x14, 0x14, 0x3f}, 0x2}, {@dev={0xac, 0x14, 0x14, 0x1a}}, {@multicast1, 0x9}]}, @cipso={0x86, 0x41, 0x2, [{0x0, 0xa, "aa47c283d995201a"}, {0x7, 0xc, "9ecc75b3295bc3040b72"}, {0x5, 0x11, "db658a8110c887c366233ce7ad3102"}, {0x6, 0x4, "761e"}, {0x0, 0x10, "915b3c2fde43572b7934e177cf42"}]}, @ssrr={0x89, 0x13, 0x49, [@private=0xa010100, @broadcast, @multicast1, @local]}, @ssrr={0x89, 0x13, 0x3d, [@empty, @private=0xa010102, @multicast2, @dev={0xac, 0x14, 0x14, 0x29}]}, @timestamp={0x44, 0x18, 0xdd, 0x0, 0x4, [0x914, 0xfffffff8, 0x19f3, 0x3c85, 0x74dc]}, @end, @lsrr={0x83, 0x1f, 0x69, [@multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, @empty, @private=0xa010101, @empty]}, @generic={0x86, 0x3, '\n'}, @ra={0x94, 0x4}, @lsrr={0x83, 0xb, 0xc4, [@empty, @rand_addr=0x64010100]}]}}}}}) 619.251376ms ago: executing program 2 (id=4958): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0xa, 0x2, 0x11) socket$rxrpc(0x21, 0x2, 0x2) r0 = socket$kcm(0x2b, 0x1, 0x0) socket$inet6(0xa, 0x5, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x2, 0x3, 0xfffffffffffffffd, 0x100000000000000, 0x0, 0x0, 0x98ce}, 0x0, &(0x7f0000000240)={0x3ff, 0x0, 0xffffbffffffffffe, 0x9, 0x0, 0x0, 0x100000007fffffff}, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x43}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x2000c08d) shutdown(r0, 0x1) 550.137948ms ago: executing program 0 (id=4959): bpf$ENABLE_STATS(0x20, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000002c0)={'syztnl2\x00', &(0x7f0000000240)={'ip6_vti0\x00', 0x0, 0x2f, 0x4, 0x7, 0x401, 0x68, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7800, 0x10, 0x9, 0x3}}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000dc0)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x20040011}, 0x20004080) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="4c00000010001fff00"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c00128009000100626f6e64000000001c0002800500010004002000080020"], 0x4c}}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), r3) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000440)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x64, r4, 0x300, 0x70bd26, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xe}, @NL80211_ATTR_SSID={0x1f, 0x34, @random="039db69060003229151faf3a7d44f3ffd9225353ffb50ceac570f1"}, @NL80211_ATTR_VHT_CAPABILITY={0x10, 0x9d, {0x8, {0x100, 0x94, 0x1, 0x1000}}}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x7}, @NL80211_ATTR_AUTH_TYPE={0x8, 0x35, 0x4}]}, 0x64}}, 0x0) sendmsg$802154_dgram(r2, &(0x7f0000000cc0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)="05000000b92ba9e375f3d5a1fc0751577daff448fb417eb76377c3075661e57f6a1ad88443faf85a902e03e4c4e68c258b10a733e428ae2cd65cf9e52e6a23541f4bc6970df209050bf052c6624effea5f1e99ad3d96ed78ff3f524af2c90d5643d563b4f469a937cccad6efa449da086721a42a6616eb56afdf6e1e977964a59a007754d9a22bf26ddb67fb3cd24af531bb3a42a0532ff51473993bd4fb62b7fae1a02f982796fe3df1f080196ff1db13e62950561bf6330ce41dde70f59450a43a0e5678b45689b989d46e9e242cc89f34cd04c4e22e5cc1f1035c5010fd47be95ca79f9a85bf56011d8397d00"/253, 0xfd}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000280)) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) getsockopt$bt_BT_RCVMTU(r6, 0x112, 0xd, 0x0, &(0x7f0000000040)) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f0000001680)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000f0ffffff7a0af0ff0000002079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950001000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f85db47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5b787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f37f3e2c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b9243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fb4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da2022f23daec61854f640f701db0276652f6c74f20675eb781925441578e93046aaddea8ec4ca37f71c2710a7e58ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eee46eb20c20bb82aa31771cd379ec83554cea5e6539d85b980e358d81f2f2653c4d9818708e27c89b552d7fcd116bce9c764c714c9402c21d181aac59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749efd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002157a3609b6fd9843ee19ec647249a9375de5858818f3c2432e6ced4380217ac51a84a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952283a1f4e3842edb3d42c8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd809269f816fa748b20ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f9289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f05714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847a11921f97eba0ea14c4fed9a71eedb97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc30935455f6de5b64bcdfaf8ac04ce96c421e5dbc85e168d3559ab13df98163e39e4065e65a2f43412535d6f7c09830f3a086535bd07820e690d2755768612bb7330a8b285f2585892eaff1889a61ee0c2a6d1831d41805707bb43991d40feb5dd0700"/2728], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000040), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r7, 0x108, 0xe, 0x0, &(0x7f0000000340)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0xfeff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f00000003c0)=r7, 0xfffffe22) 451.107003ms ago: executing program 3 (id=4960): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[], 0x48) r1 = socket$kcm(0x10, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x50}}, 0x24000044) r3 = socket$kcm(0x29, 0x2, 0x0) recvmsg$kcm(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000640)}, 0x0) (async) recvmsg$kcm(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000640)}, 0x0) write$cgroup_subtree(r1, &(0x7f0000001ec0)=ANY=[@ANYBLOB="004000003a00913a74067388481f9c0e0a"], 0xfe33) (async) write$cgroup_subtree(r1, &(0x7f0000001ec0)=ANY=[@ANYBLOB="004000003a00913a74067388481f9c0e0a"], 0xfe33) r4 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x89f1, &(0x7f0000000340)={'gre0\x00', &(0x7f0000000240)=@ethtool_cmd={0x2f, 0x80000000, 0x0, 0x9, 0x12, 0x3, 0x3, 0xfc, 0x2, 0xff, 0x0, 0x9, 0x6, 0xff, 0x0, 0x5}}) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) (async) connect$pppl2tp(r5, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x8, 0x0, 0x1003, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}}}, 0x32) r7 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) (async) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000440), 0xffffffffffffffff) sendmsg$L2TP_CMD_SESSION_GET(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000300)={0x30, r8, 0x801, 0x70bd29, 0x0, {0x7}, [@L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0x9}, @L2TP_ATTR_IFNAME={0x14}]}, 0x30}}, 0x0) sendmmsg$inet(r5, &(0x7f0000003940)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4000004) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000700000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r10, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f0000000480)={0x2, 0x3, 0x0, 0x9, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x6c, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_x_nat_t_port={0x1, 0x15, 0x4e20}, @sadb_x_nat_t_type={0x1, 0x14, 0x3}]}, 0x60}}, 0x0) r11 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r9) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r3, 0xc0096616, &(0x7f00000001c0)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}) (async) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r3, 0xc0096616, &(0x7f00000001c0)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}) socket$qrtr(0x2a, 0x2, 0x0) (async) r12 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000002c0)={'dvmrp1\x00', 0x100}) r13 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000e80), r13) (async) r14 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e80), r13) ioctl$sock_SIOCGIFINDEX_802154(r13, 0x8933, &(0x7f0000001600)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r13, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={&(0x7f00000006c0)={0x28, r14, 0x1, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r15}, @NL802154_ATTR_SEC_LEVEL={0xc, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0x2}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x4010}, 0x4000080) getpeername$qrtr(r12, &(0x7f0000000000), &(0x7f0000000040)=0xc) (async) getpeername$qrtr(r12, &(0x7f0000000000), &(0x7f0000000040)=0xc) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r9, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000180)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010326bd6000000000002d9300000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x20040814) (async) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r9, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000180)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r11, @ANYBLOB="010326bd6000000000002d9300000c000180080001"], 0x20}, 0x1, 0x0, 0x0, 0x10}, 0x20040814) 389.446506ms ago: executing program 3 (id=4961): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(anubis))\x00'}, 0x58) (async) bind$alg(r3, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(anubis))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) (async) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r4, 0x89b0, &(0x7f0000000540)={'macvlan0\x00', @random="00009e0c1100"}) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYRESOCT=r3, @ANYRES32=0x0, @ANYBLOB="0000000000000000200012800c0001006d6163766c616e00100002800a0009000180c2000003000008000500", @ANYRES32=r1], 0x48}}, 0x0) ioctl$SIOCGSTAMP(r4, 0x8906, &(0x7f0000000180)) 380.476812ms ago: executing program 0 (id=4962): r0 = socket$pppoe(0x18, 0x1, 0x0) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000080)={0x18, 0x0, {0x2, @local, 'veth1_virt_wifi\x00'}}, 0x1e) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r1, 0x84009422, &(0x7f00000000c0)={0x0, 0x0, {0x0, @struct, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct, 0x0}, {0x0, @struct}}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r1, 0xc400941d, &(0x7f00000004c0)={r2, 0x29, 0x101, 0x1}) ioctl$BTRFS_IOC_LOGICAL_INO_V2(r0, 0xc038943b, &(0x7f0000000900)={0x1, 0x28, '\x00', 0x1, &(0x7f00000008c0)=[0x0, 0x0, 0x0, 0x0, 0x0]}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r3, &(0x7f0000000a40)={&(0x7f0000000940)={0x10, 0x0, 0x0, 0x24000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000980)={0x48, 0xd, 0x6, 0x201, 0x0, 0x0, {0x7, 0x0, 0x1}, [@IPSET_ATTR_TYPENAME={0x10, 0x3, 'bitmap:port\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x48}, 0x1, 0x0, 0x0, 0x20008011}, 0x14000805) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r4, &(0x7f0000000e80)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000e40)={&(0x7f0000000ac0)={0x358, 0x14, 0x2, 0x70bd28, 0x25dfdbfd, {0x10, 0xa}, [@INET_DIAG_REQ_BYTECODE={0x65, 0x1, "6338ff1d14a57f42b9784d443b3b177468be159d4bdcde74140a031b5112668d550e6f179151d3fb0336f7b2f6eea531784c5ab654d5303a4cc1e859e5b9663445a8bf211232ac719f640eb1976f2c6d9739e0467f0e307b0079e5415217a35aec"}, @INET_DIAG_REQ_BYTECODE={0x9c, 0x1, "3f5b10486f6433c0a5f38583cc0b71d41ff6c2cfa24f16ad24252e3de5647986c40b0351021908a02e1bd3d818f779e1d10a7f20ea875e76f624578e9d6832b1735d89b301d6c8a82eea5a08263a99a7ac811a42b798bea8ab11eae4ac556577d86e4850cfb9ea1e4a20acdd6e2be5beaa5d75af6d7e64b1a27bcb268699ffc5b51c55abc086ec1b1976d1d33f5de9419a5f4595ff8f6ac7"}, @INET_DIAG_REQ_BYTECODE={0x63, 0x1, "c8aaaafdf7347d2181ce4991ecf2193d929c615844fd15c0bc5b4195135c606bbcab349624ec8f46ce9aebf31505894b5f924b1544cc161268ce264e4b9c7da0c65d0821031abbb6f5c18c7656ce89197769efa5b0fd740f3600489f044196"}, @INET_DIAG_REQ_BYTECODE={0x30, 0x1, "3a085eeb2c7325eea83283280a7ffdd3a284e91939cbe05c131dfa27ff5fea114404cec47058d8ee68437f2b"}, @INET_DIAG_REQ_BYTECODE={0x90, 0x1, "fbb76e1dd071a13c59f965a8305a56090011933a1a3660be7ebe915f379c086ce8c997236322b16f78a7b6decfbc525f8ebfc0c39f5e133683eb42553c5767f39d9948b74b3c8c1f4cbedc245566b95cc254bb99601f08c84fc584b5eb43e5e39ed05bb93a22aa840621fd66b12457819302680fa49309532fcca04a3efeb56c1f8ebc0b0d6b0bf32264fc1a"}, @INET_DIAG_REQ_BYTECODE={0x4e, 0x1, "0003fed519ff9c5654f109bbb4d2b006d332bdad057c0e3f0c6ed970cb8643a03b191dc6508fa2adb2ffca74fa9ae5845625c47674e22f99ba2267f2f538af27aa6806b5a28d739652e1"}, @INET_DIAG_REQ_BYTECODE={0xc9, 0x1, "7882829506398356230db6f48699738e4bb1183b1268f32a624c21d26a29bd34f9b50098107b752b9ce9eb56f174fc28250657b1b7204b89756521169ca920a46c7ffed6bc4c8c17fdec707f0b6da0a96f8aa9e7eebce04dc6ada09f5fa2763be4e5f1dd4478af09b04d598e5a81fb3ec8638b245584992e8fe7a4755040ba384bdff1efbd71fb0039e13e9f44bcab47ff46144348e51dadcd7e80f4dcf0403bad79f9893f5fb8a7a40f938fce6f573ed9ddb7ebda37d9e00e599053ed543f0eec7bce245b"}]}, 0x358}, 0x1, 0x0, 0x0, 0x1}, 0x41) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000ec0), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_BSS(r6, &(0x7f0000001000)={&(0x7f0000000f00)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000f40)={0x58, r5, 0x100, 0x70bd2c, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0xb, 0x3}}}}, [@NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0xf}, @NL80211_ATTR_BSS_SHORT_PREAMBLE={0x5, 0x1d, 0xa}, @NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0xa5}, @NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0x1}, @NL80211_ATTR_AP_ISOLATE={0x5, 0x60, 0x5}, @NL80211_ATTR_BSS_SHORT_PREAMBLE={0x5, 0x1d, 0x8}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0x4}]}, 0x58}, 0x1, 0x0, 0x0, 0x8064}, 0x8080) getsockopt$X25_QBITINCL(r4, 0x106, 0x1, &(0x7f0000001040), &(0x7f0000001080)=0x4) r7 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000010c0), 0x1, 0x0) write$tcp_congestion(r7, &(0x7f0000001100)='bic\x00', 0x4) r8 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000001140)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r8, 0x6, 0x1f, &(0x7f0000001180), 0x3) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000001200)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r6, &(0x7f00000012c0)={&(0x7f00000011c0), 0xc, &(0x7f0000001280)={&(0x7f0000001240)={0x28, r5, 0x4, 0x70bd2d, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r9}, @val={0xc, 0x99, {0x1, 0x38}}}}, ["", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0xa1}, 0x1) r10 = syz_genetlink_get_family_id$smc(&(0x7f0000001340), r6) sendmsg$SMC_PNETID_ADD(r6, &(0x7f0000001440)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000001400)={&(0x7f0000001380)={0x64, r10, 0x200, 0x70bd28, 0x25dfdbff, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_NAME={0x9, 0x1, 'syz2\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x4004000}, 0x24004010) ioctl$BTRFS_IOC_SYNC(r4, 0x9408, 0x0) r11 = syz_genetlink_get_family_id$tipc(&(0x7f00000014c0), r6) sendmsg$TIPC_CMD_GET_LINKS(r6, &(0x7f0000001580)={&(0x7f0000001480)={0x10, 0x0, 0x0, 0x1010}, 0xc, &(0x7f0000001540)={&(0x7f0000001500)={0x24, r11, 0x300, 0x70bd29, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0x9}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x98}, 0x20000800) ioctl$BTRFS_IOC_TREE_SEARCH(r8, 0xd0009411, &(0x7f00000015c0)={{0x0, 0x2, 0x0, 0xfffffffffffffbff, 0x56, 0x3ff, 0x0, 0xf, 0x8, 0x5, 0x7fff, 0xf8b6, 0x9, 0x7, 0x4}}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r1, 0xc0709411, &(0x7f00000025c0)={{r12, 0x7, 0x8, 0x3ff, 0x6, 0xbc8, 0xb6, 0x4, 0x5, 0x5, 0x8, 0xe07, 0x8000, 0x4, 0x2}, 0x10, [0x0, 0x0]}) sendmsg$ETHTOOL_MSG_DEBUG_SET(0xffffffffffffffff, &(0x7f0000002800)={&(0x7f0000002640)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000027c0)={&(0x7f0000002780)={0x20, 0x0, 0x400, 0x70bd25, 0x25dfdbfb, {}, [@ETHTOOL_A_DEBUG_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4080) 257.765654ms ago: executing program 3 (id=4963): ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f0000000180)={0xffffffffffffffff, &(0x7f0000000040)='}\x00', 0x80080, &(0x7f00000000c0)={@_ha_fsid={[0x3, 0x401]}, {0x1, 0x2, 0x5, 0xffffffffffff0bcb}}, 0x0, &(0x7f0000000100)={@_ha_fsid}, &(0x7f0000000140)=0x1}) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000001c0)=0x5, 0x4) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x40107447, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x4e}]}) (async) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r2, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e21, 0x10, @private2={0xfc, 0x2, '\x00', 0x1}, 0x80000069}, @in6={0xa, 0x4e21, 0xaf8d, @local, 0xc}], 0x38) (async) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x32}}], 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000940)=@base={0x7, 0x4, 0x8000, 0x9}, 0x48) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0175de31562ee4cbcf19670d69f036c8a11c46eca735f77bf525ebc0b780d8f419f47a3d4f427f83bc239e6ce6f658a3892361594a52f2645570e2f570b6cba26e9d69c9ca151efebea654739daff38a"], 0x48) (async) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001e00)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000480000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6939fc404000000c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a3449abe802f5ab3e89cf6cfdffffffb8580218ce740068720000074e8b1715807ea0ca469e46968eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000000000000005335000000143ea70c2ab40c7cb70c943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a33e680846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2200af6c7784a1975fa807de38a3a61e44a9ecab19bdfb15a32a4fd67ce446adb431d07db79240acaf091231b986e77d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061629d1822f720ec23812770d72c700a44e113d17088fdd00600000f7889b8c7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f747c08f4010586903500000000000000000000be34cf652e28e700000000000000b24478a78a0f9d640dd782ac0cbc46903243d0d0f4bc7f253d0500000032daaf281c450e64c33aac8ff7e7d1c94c450503009688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0000f5e1671bc5eb7739daa7820a91cb0e732df2ae1d39c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b4cbaf5a6b649dd5f13cd776e6c7c4b5c4b0de20e033b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13e434aae9df81ecaf5f744f22f2e45afe2c9e8632276cffe5f1fc215c0797d0244cf1ce269d10525745caaa3f77d1b80116cb9a384002421d898913c45a9ac091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c045a17e9a61c3b064e679508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2434ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd911e0e5f00019be25b5910a3193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f5513662809073710937ed0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c68549e9da89ad4218cea744b332ab232a09cf1ec375627074ce2d3d7619936768a84a1465fff4eedba55955434f132ab7b8840558b3f918d675a79907a72a8252cd3fbaea5d3006a03507838231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68196c7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f27859946e72f80bb1c9cfcde57b79625e2979fe689a5a246cbbdf6ad488f43f46b2536f175f46dfb27d522946727024de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546eb7c32dbecb18a308a0004be94dfab28c2a51dc856df00000000000000000000dfa4c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5d00f26126d4cf2c73e5f94030000000000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d0e68d7eef5d32d5fcc7923d7544fa492aa38717481c55e86dcd7816ad8940bd1995369d89ae6eadeb9117e8b94ab422c8d62fc9dfffeb13b4858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1ef90ed4cb9fe6d19b11d4d38239d318016e622b9683b7e46be64dc097982e23462392a0cd05afb2e060fd42ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1af45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5c81aebc0cada819895b377d6cf0a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9573abb0a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b14952139bd4bdbccc5e334c49584655c4fce8c5bb7c54664aef6d78429d358aa54b4b49926c4be9ee4659153d9f9f5d07cc4efdab2c5f4503148d0255d0b748366dafe042d78479c21d832e1431ed6d646d13e8e7230300920a5642bbed1dee9b46b6f02e572024ccf3c8edd82660e5d74c52be71d780c300000000d0267ac40d1130a9000000000045f50812a1a0530b02baed19f4c977ac0d397ed6371ec589bf5943690250bdfa5b676d5d53d2ab3aeee1a6910c1a33b6c06c93386768f8b1bb27ec31cffbd4f5c7b0c2e14e4fc6c2f089ab08567254e93780afdddefb3f0d2143ad73c0bf2467859049d46dc5aa91f918a307e7dcaaccd6cbe66e8a04d201392a487f681f82528a800e27d65200ae10e1b5d39a29d8a2c8ed2dfa77e21249b45806733e674a9e8e72ad1cb0d3bfadb00a18a5008ea1e4c8fb93d311f52a476c576a3f65c9bdd4e4b870aed4cb9906a8aa25986e6e30be249d9911114b42b2fb51168e56000a62b794c193f7797ebeb7f8b91c70b6e720af06ecfcfb89a2d5a25f"], &(0x7f0000000140)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r4, 0x18000000000002a0, 0x160, 0x0, &(0x7f0000000380)="b9e403c6630d698cb8a00b04339c", 0x0, 0x7ec, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) write$bt_hci(r1, &(0x7f0000000000)=ANY=[], 0x6) (async) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b0001006261746164760000", @ANYRES32, @ANYBLOB="08001f0004"], 0x44}}, 0x0) 256.641373ms ago: executing program 0 (id=4964): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xfffa}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x10, 0x3}, @TCA_FQ_PLIMIT={0x8, 0x1, 0x6}, @TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x4}]}}]}, 0x48}}, 0x0) 216.867861ms ago: executing program 3 (id=4965): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x20, r1, 0xb03, 0x0, 0x0, {}, [@TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8}]}]}, 0x20}}, 0x0) r2 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) r3 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f00000001c0)="39000000140081ae0000dc676f97daf01e2357f9ffffffffffffff0521018701546fabca1b4e8a06a6580e88370200c54c1960b89c40ebb373", 0x39}], 0x1}, 0x0) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="02180000180000000000000000000000030005000000000002000000e000000200000000000000000800120000000000000000000000000010000000000000000000000000000000ff010000000000000000000000000001fe8000000000000000000000000000aa030006000000000002004374ffffffff000000000000000008001900000000000a00", @ANYRESDEC], 0xc0}}, 0x0) 160.053196ms ago: executing program 0 (id=4966): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_ENCODED_READ(0xffffffffffffffff, 0x80809440, &(0x7f00000005c0)={&(0x7f0000000580)=[{&(0x7f00000001c0)="6e2ac4ad9c10c518cced32999267a8c652494c5ff35f64c24d912bc279fdaa67b10a7f38b80ae06c910e89bcb90a2741a6b1f85c797d8ff29b14e7fe7f65e97e3a40419d6e3ab556a796da68ff019a9244208c6baaabad7bf50e37836bf1a651ac9a3df03af36e435c2c05a509d99bcf259da24e57986e3e217e7c1be92fe41a4a9e153ef5a3ebdab326935a4e8c381df372d3e5801fc32533b21a0c36425c5abb5d0f7fc762f86b3a65e4f060ec5ee89ed4746c0b222f69500316c9d56eb0d10aded471ff7b446038e38300b5dbb032b8254048e2d1f413d9df047f05a6dcdcddc4d536ea5ef32feedb09dbaffb2731f20ecccce8551efaadc24e", 0xfb}, {&(0x7f00000002c0)="9311c5379eb3c3beaefd1399fb8d1823fac407139a711b2677a52f8dff716b0b3fed0527f58186fe1d193fcc1fc0d523b64e80df2b5e5e52eac7ea59d4b4fd926b5b6f24cf0ede4c1d648d10795d23f1fe6a73ab06e7d8704d10b97c5ad920b339f243bf6a4b4ca08d980fa41f473b33cd2e5cc48c24a794304dfbf978ffce7e4cb64e7e7f2702f537dda14454b5", 0x8e}, {&(0x7f0000000380)="cd8fb399b7ee6d4c43df292a72517a726ad79d7574e859dd22e62d1d710df84c468fac63c82f56042a58d7cfa17579b57f11904f4cea79120829ab718c0df009af1903dc3de97ba2e64703b0a3c1b411ff7465f37ac0064cd6a7bda4687688907705bdcc94006e351d0384d45cb3426a5a617e2078320e728f6b9071492dfef86c8e0cae8438b790cecc4605a091c8421e45fcb901697e5a24b60ed59eb10eb2419d5b1fcee64a17e7ecd949e0a0042162751dcffbbefcf0fc1ad40f931c1d59fbe9da22162438414aa7ffaf65239bec6d943859a3f79e8919feec15ec41c97a8c3b901f5dabb163db293b679944e59a", 0xf0}, {&(0x7f0000000480)="fc442f8800c25c85b5310af5bff36746dbf8a592e7d2f18943d31a0f8a2a0dd05107f1a4c3f4dab9922974eb0cb78a64091f1f96d4d2311db08962b449f9e1cd9c9dbb9e9960565d7dd87a1048da1db3dea7e458b73487a6c65bbbf20b534e2f42d2e0d455550cdb5dfe30f9d10571484a739a842c8088c1c9daabd2e24bd5153c93f6f8da6f83e7743448122a082ed6ea2b9b6177c292815946b7ddd0024a637eadff7d17c9b25046ba7c41fafa4485459cd25d923403bb8dda448eea900672920a2cd97a06c3f6b5f8dbc836137141eab751dcf69dbf68edfa22b0", 0xdc}], 0x4, 0xff, 0x0, 0xffffffffffffff80, 0x1, 0x5, 0x5, 0x4}) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)={0x4c, r1, 0x1, 0x2, 0x25dfdbfb, {0x41}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x87}}]}, 0x4c}}, 0x0) write(r0, &(0x7f00000000c0)="020000002e34ce6af0fea710262a0559a31d6cb81b7837354d0ca570ac6d8967df16c0123fbd4a31e92bc7e25e100bbdb57c7e8d9412aab9a3182e21de1a99dfe77fc7c52a40d961342d7e1e1581d39fd49b75657625719980f571c6a63b02135b63d4c3ffb7b43858b07a4abfe1f6e2ea94ae100fb8c7dc870b18f1e7b75a7cdfb89c4bfa2874721a7e59e185b49d9f6f6323d5380a22c0e98868faa1af77a95805c05a6e75441b9afe4869d97d4777f9fe68777c27a1e6cacd20c0fe364f42accd3977237ae293e3c464f783ea9a29df07bfc984d729d495f85220ce336ca503b01f2480f5a566f76333ac11de489e3fa3a602af55", 0x5) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) ioctl$BTRFS_IOC_ENCODED_READ(0xffffffffffffffff, 0x80809440, &(0x7f00000005c0)={&(0x7f0000000580)=[{&(0x7f00000001c0)="6e2ac4ad9c10c518cced32999267a8c652494c5ff35f64c24d912bc279fdaa67b10a7f38b80ae06c910e89bcb90a2741a6b1f85c797d8ff29b14e7fe7f65e97e3a40419d6e3ab556a796da68ff019a9244208c6baaabad7bf50e37836bf1a651ac9a3df03af36e435c2c05a509d99bcf259da24e57986e3e217e7c1be92fe41a4a9e153ef5a3ebdab326935a4e8c381df372d3e5801fc32533b21a0c36425c5abb5d0f7fc762f86b3a65e4f060ec5ee89ed4746c0b222f69500316c9d56eb0d10aded471ff7b446038e38300b5dbb032b8254048e2d1f413d9df047f05a6dcdcddc4d536ea5ef32feedb09dbaffb2731f20ecccce8551efaadc24e", 0xfb}, {&(0x7f00000002c0)="9311c5379eb3c3beaefd1399fb8d1823fac407139a711b2677a52f8dff716b0b3fed0527f58186fe1d193fcc1fc0d523b64e80df2b5e5e52eac7ea59d4b4fd926b5b6f24cf0ede4c1d648d10795d23f1fe6a73ab06e7d8704d10b97c5ad920b339f243bf6a4b4ca08d980fa41f473b33cd2e5cc48c24a794304dfbf978ffce7e4cb64e7e7f2702f537dda14454b5", 0x8e}, {&(0x7f0000000380)="cd8fb399b7ee6d4c43df292a72517a726ad79d7574e859dd22e62d1d710df84c468fac63c82f56042a58d7cfa17579b57f11904f4cea79120829ab718c0df009af1903dc3de97ba2e64703b0a3c1b411ff7465f37ac0064cd6a7bda4687688907705bdcc94006e351d0384d45cb3426a5a617e2078320e728f6b9071492dfef86c8e0cae8438b790cecc4605a091c8421e45fcb901697e5a24b60ed59eb10eb2419d5b1fcee64a17e7ecd949e0a0042162751dcffbbefcf0fc1ad40f931c1d59fbe9da22162438414aa7ffaf65239bec6d943859a3f79e8919feec15ec41c97a8c3b901f5dabb163db293b679944e59a", 0xf0}, {&(0x7f0000000480)="fc442f8800c25c85b5310af5bff36746dbf8a592e7d2f18943d31a0f8a2a0dd05107f1a4c3f4dab9922974eb0cb78a64091f1f96d4d2311db08962b449f9e1cd9c9dbb9e9960565d7dd87a1048da1db3dea7e458b73487a6c65bbbf20b534e2f42d2e0d455550cdb5dfe30f9d10571484a739a842c8088c1c9daabd2e24bd5153c93f6f8da6f83e7743448122a082ed6ea2b9b6177c292815946b7ddd0024a637eadff7d17c9b25046ba7c41fafa4485459cd25d923403bb8dda448eea900672920a2cd97a06c3f6b5f8dbc836137141eab751dcf69dbf68edfa22b0", 0xdc}], 0x4, 0xff, 0x0, 0xffffffffffffff80, 0x1, 0x5, 0x5, 0x4}) (async) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000000100), 0xffffffffffffffff) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)={0x4c, r1, 0x1, 0x2, 0x25dfdbfb, {0x41}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x87}}]}, 0x4c}}, 0x0) (async) write(r0, &(0x7f00000000c0)="020000002e34ce6af0fea710262a0559a31d6cb81b7837354d0ca570ac6d8967df16c0123fbd4a31e92bc7e25e100bbdb57c7e8d9412aab9a3182e21de1a99dfe77fc7c52a40d961342d7e1e1581d39fd49b75657625719980f571c6a63b02135b63d4c3ffb7b43858b07a4abfe1f6e2ea94ae100fb8c7dc870b18f1e7b75a7cdfb89c4bfa2874721a7e59e185b49d9f6f6323d5380a22c0e98868faa1af77a95805c05a6e75441b9afe4869d97d4777f9fe68777c27a1e6cacd20c0fe364f42accd3977237ae293e3c464f783ea9a29df07bfc984d729d495f85220ce336ca503b01f2480f5a566f76333ac11de489e3fa3a602af55", 0x5) (async) 142.592808ms ago: executing program 0 (id=4967): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f0000000100)={'syztnl0\x00', 0x0, 0x0, 0x10, 0x3, 0x8, {{0xb, 0x4, 0x0, 0x4, 0x2c, 0x68, 0x0, 0x8, 0x0, 0x0, @private=0xa010101, @broadcast, {[@lsrr={0x83, 0xb, 0xb5, [@broadcast, @remote]}, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0x7, 0xe0, [@loopback]}]}}}}}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$IP6T_SO_GET_ENTRIES(r2, 0x29, 0x41, &(0x7f0000000000)={'security\x00', 0x8, "8263811d4fb9acee"}, &(0x7f0000000080)=0x2c) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@ipv6_deladdrlabel={0x64, 0x49, 0x200, 0x70bd29, 0x25dfdbff, {0xa, 0x0, 0x78, 0x0, r1, 0x7}, [@IFAL_LABEL={0x8, 0x2, 0x2}, @IFAL_ADDRESS={0x14, 0x1, @mcast1}, @IFAL_LABEL={0x8, 0x2, 0x1}, @IFAL_LABEL={0x8, 0x2, 0xc}, @IFAL_ADDRESS={0x14, 0x1, @empty}, @IFAL_LABEL={0x8, 0x2, 0x2}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x42) 132.190777ms ago: executing program 3 (id=4968): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000006ffc)=0x4000000000000200, 0xe50fb6c50bc849c9) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x19, 0x16, &(0x7f0000001100)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0x8}, 0x94) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000240), r2) sendmsg$NLBL_CIPSOV4_C_ADD(r2, &(0x7f0000000200)={0x0, 0x9000000, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000100000008000100040000002c0004800500030080ff00000500030080ffffff05000380ff0000000400030080ffffff0500030080ffffff0800020003"], 0x50}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001a80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000003c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000002120000000090a030b0000000000000000050000070900010073797a3100000000540400000b0a05000000000000000000070000093400098008000140000000080800014000000009200002801c0001800800014000000600080001400000407708000140fffffff8080007400000001608030980e40002804400018008000140000000000800014000000007080001400000000108000140000006c40800014000007dfb08000140000001010800014000000001080001400000cb6e340001800800014000000002080001400000000208000140fffffc000800014000000800080001400000000408000140000000052c000180080001400000000808000140ffffffff08001840000000ff080001400000001008000140000000093c000180080001400c0000000800014000000002080001400000000408000140000004130800014000000009080001400000000c08000140000000013c0102801c000180080001400000057c080001400000000208000140800000000c00018008000140000000030c000180080001400000000344000180080001400000010d080001400000000008000140000000090800014000000fff080001400000000008100140000000060800014000007fff0800014000000006240001800800014000004ca708000140000061a908000140000000050800014000000a781400018008000140ffffffff0800014000000006440001800800014000010001080001400000000408000140800000010800014000000ac5080001400000000008000140fffff0000800014000000c3108000140000000804400018008000140000000030800014000003b4b08000140000000040800014000000005080001400000040008000140000000080800014000000005080001400000000908000140000000c5b400028014000180080001400021c20008000140000000054400018008000140ffffffff0800014003a66d57080001400000000508000140000008000800014000000006080001400000000308000140ffffff0b080001400100000034000180080001400000000408000140ffffffff0800014000000006080001400000000608000140000000010800014000000ea12400018008000140000001000800014000000009080001400c000000080001400000000808000140000005f00800014000000002100002800c0001800800014000000008080001400000ffff08000f4000000005080006400000000008000440000000030900010073797a3000000000090002"], 0x944}, 0x1, 0x0, 0x0, 0x50}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in=@private, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}}}, &(0x7f0000000440)=0xe8) r7 = getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000480)={{{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@remote}}, &(0x7f0000000640)=0xe8) r9 = gettid() syz_open_procfs$namespace(r9, &(0x7f00000000c0)='ns/net\x00') sendmsg$nl_generic(r5, &(0x7f0000000780)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000740)={&(0x7f00000007c0)=ANY=[@ANYBLOB="800100004000200026bd7000fbdbdf250800000008003d00", @ANYRES32=r1, @ANYBLOB="1600c900277d2b2e5b21282b26272d282b7b2d5d26000000604ab85a33f90b5840576fe976dc69f5bad83ebbcc59346e8584dd63852f8b9cb25ea40c9f876f2c893a1990aa710930a3aa01b072d4da184d4729f0739ee37be9ee88b0ad1d699fe9eefb2db4f040a92fb6904bb2f239e32905ce6bddbb8631b4a1b544468b8aca8dcfc6c21db75f5d05ce248048543af03e5e2475e156ac08003e00", @ANYRES32=r6, @ANYBLOB='\b\x00]\x00', @ANYRES32=r7, @ANYBLOB="b3003480b8da3dff8d5af16054f2461a54fc0408007d00", @ANYRES32=r8, @ANYBLOB="a419f8ddd5dc7da9479daa5eb70b89e80be06acac4d1da1404cd7e0316ca71001e883bba85cf1fbe3836588068dc6e90d22a74db96ecfecccf9038102d190dffad1c5afaae628ff0ac1dcece3c8205768a6ed0fade62a6d9f78f94f871c03263bf0f8cbff628bb71d17576d2405e26baf603a23591ae49bae7ad52f984746c41ae8fd19dd6d495c906e08050ed020bfcd7df0400b28004002b800008008c0052613ba071d4b05e70206b3606eac746cd1c12c070557a234fbd13266acec4996d467873c61dce2a849bf14da13a47ba0b5708dacfda9434b82247924a1bf1ffedae99163f6f77af03a7c1e2cae588720e36a5cad66bc12fc9f25c69ea6fa0e92a52c8f1236b7106a22de46fdc77aaf8ceb7cc71103733940b775dde0000000039d9bd80481d7f43e80e6638c3c35cb9e5c7eba50213ccf403abe3a7165e37a970930e3053d4c1e1392a22c3cae38e18a5974913908c3061ee763d2361d28b82bfbb643799b4f78c67817e8cf5f0d3b0bc695db6632a9510c4f7dd1a4d21f4a55f92ebf5edd7a3aeea24e7b45756709e9abf3d6539579d453e6ae81dd0fb64a425", @ANYRES32=r9, @ANYBLOB='\x00'], 0x180}, 0x1, 0x0, 0x0, 0x8840}, 0x40000) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690add", 0x4}], 0x1, 0x1) setsockopt$inet6_tcp_int(r10, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r10, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r10, 0x6, 0x1f, &(0x7f00000002c0), 0x3) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r10, 0x6, 0x14, &(0x7f0000000100)=0x1, 0x4) sendmsg$NFNL_MSG_CTHELPER_NEW(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x40041}, 0xc040445) setsockopt$inet6_tcp_TLS_TX(r10, 0x11a, 0x2, &(0x7f0000000000)=@gcm_256={{0x303, 0x36}, "00000007e4008000", "8b3de2aabc000000000000000d00000000000000000000080000000000000800", "e73400", "000080c32a00"}, 0x38) sendmsg$nl_generic(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000005c0)=ANY=[@ANYRES8=r0, @ANYRES8=r9, @ANYRES16=r9], 0x34}}, 0x24048055) r11 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r11, 0x0, 0x19, 0x0, 0x0) ioctl$sock_ifreq(r4, 0x8994, &(0x7f0000000080)={'pim6reg1\x00', @ifru_data=&(0x7f0000000040)="b269ff360ebba55866c681259d9fd19efd2a17542f6624da21dd6f606326745b"}) ioctl$XFS_IOC_GETBMAPA(r5, 0xc020582c, &(0x7f0000000140)={0x7ff, 0x7, 0xfffffffffffffff5, 0x3ff, 0x3ff}) 47.929508ms ago: executing program 0 (id=4969): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x14, 0x1, 0x4, 0x201, 0x0, 0x0, {0x7}}, 0x14}}, 0x2000000) pipe(&(0x7f0000000180)={0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r1) (async) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x4000002, 0x3032, 0xffffffffffffffff, 0x2a1cf000) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x0, 0x13, r3, 0x0) (async) mmap(&(0x7f0000691000/0x4000)=nil, 0x4000, 0x3, 0x28011, r2, 0xc6e9f000) (async) mmap(&(0x7f0000d8c000/0x1000)=nil, 0x1000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x7000000, 0x6e073, r3, 0x100000000) (async) r4 = socket$packet(0x11, 0x2, 0x300) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) (async) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x10448) (async) r5 = socket$pptp(0x18, 0x1, 0x2) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r5, 0xc0096616, &(0x7f0000000140)) (async) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r4, 0x0) (async) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) accept4(r0, &(0x7f0000000080)=@phonet, &(0x7f0000000100)=0x80, 0x0) 0s ago: executing program 1 (id=4970): r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040), 0x10) r1 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SFACILITIES(r1, 0x891d, 0x0) listen(r0, 0x0) r2 = accept4$unix(r0, 0x0, 0x0, 0x0) accept4(r0, 0x0, 0x0, 0x80800) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275c, 0x0) ioctl$FS_IOC_FSSETXATTR(r6, 0x401c5820, &(0x7f00000001c0)={0x1adbc, 0x1004, 0x0, 0x7, 0x1}) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000006c0)={0x1b, 0x0, 0x0, 0x7, 0x0, r3, 0x8, '\x00', r5, 0xffffffffffffffff, 0x2, 0x4, 0x4}, 0x50) r8 = bpf$ITER_CREATE(0x21, &(0x7f0000000780)={r2}, 0x8) setsockopt$CAN_RAW_LOOPBACK(r8, 0x65, 0x3, &(0x7f00000004c0)=0x1, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000880)={0x6, 0x3, &(0x7f00000003c0)=@raw=[@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffd}, @initr0={0x18, 0x0, 0x0, 0x0, 0x90, 0x0, 0x0, 0x0, 0x34}], &(0x7f0000000400)='syzkaller\x00', 0x80, 0xf7, &(0x7f0000000540)=""/247, 0x40f00, 0xb, '\x00', r5, 0x25, r6, 0x8, &(0x7f0000000640)={0x3, 0x3}, 0x8, 0x10, &(0x7f0000000680)={0x5, 0xd, 0x6, 0x5}, 0x10, 0x0, 0x0, 0x6, &(0x7f00000007c0)=[r3, r3, r7, r8], &(0x7f0000000800)=[{0x0, 0x2, 0xc, 0x7}, {0x0, 0x4, 0x0, 0x2}, {0x3, 0x3, 0x5}, {0x5, 0x5, 0x4, 0x5}, {0x3, 0x3, 0xfffffffe, 0xa}, {0x4, 0x3, 0x7, 0xc}], 0x10, 0x1}, 0x94) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x38, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0xc, 0x2, [@TCA_HHF_NON_HH_WEIGHT={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) r9 = syz_genetlink_get_family_id$gtp(&(0x7f0000000080), r0) sendmsg$GTP_CMD_ECHOREQ(r4, &(0x7f00000002c0)={&(0x7f0000000000), 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x30, r9, 0x400, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_I_TEI={0x8}, @GTPA_PEER_ADDR6={0x14, 0xb, @loopback}]}, 0x30}, 0x1, 0x0, 0x0, 0x40004}, 0x20004896) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000d80)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021"], 0x0, 0x1, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x59, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, r10, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000000000000000000000000000711218000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r11, 0x2000000, 0xe, 0xffffffffffffff94, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) kernel console output (not intermixed with test programs): 'syz.1.3240': attribute type 1 has an invalid length. [ 433.890708][T17791] 8021q: adding VLAN 0 to HW filter on device bond13 [ 433.952912][T17797] bond13: (slave geneve3): making interface the new active one [ 433.974789][T17797] bond13: (slave geneve3): Enslaving as an active interface with an up link [ 433.992922][T11969] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.009521][T11969] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.047920][T11969] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.076344][T11969] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 434.373961][ T5638] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 434.391144][ T5638] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 434.402008][ T5638] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 434.410597][ T5638] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 434.423707][ T5638] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 434.710134][T17817] 8021q: adding VLAN 0 to HW filter on device bond2 [ 434.744283][T17817] bond0: (slave bond2): Enslaving as an active interface with an up link [ 434.780026][T17827] ip6t_REJECT: ECHOREPLY is not supported [ 434.804393][T17827] x_tables: ip6_tables: REJECT target: only valid in filter table, not ° [ 434.824948][T17817] 8021q: adding VLAN 0 to HW filter on device bond3 [ 434.839684][T17817] bond0: (slave bond3): Enslaving as an active interface with an up link [ 434.985293][T17817] 8021q: adding VLAN 0 to HW filter on device bond4 [ 435.007558][T17817] bond0: (slave bond4): Enslaving as an active interface with an up link [ 435.040729][T17817] 8021q: adding VLAN 0 to HW filter on device bond5 [ 435.049801][T17817] bond0: (slave bond5): Enslaving as an active interface with an up link [ 435.177406][T17817] 8021q: adding VLAN 0 to HW filter on device bond6 [ 435.208308][T17817] bond0: (slave bond6): Enslaving as an active interface with an up link [ 435.334417][T17817] 8021q: adding VLAN 0 to HW filter on device bond7 [ 435.378397][T17817] bond0: (slave bond7): Enslaving as an active interface with an up link [ 435.409976][T17864] netlink: 'syz.3.3255': attribute type 2 has an invalid length. [ 435.448449][T17817] 8021q: adding VLAN 0 to HW filter on device bond8 [ 435.462534][T17868] netlink: zone id is out of range [ 435.483280][T17817] bond0: (slave bond8): Enslaving as an active interface with an up link [ 435.492114][T17868] netlink: zone id is out of range [ 435.511205][T17868] netlink: zone id is out of range [ 435.591747][T17868] netlink: zone id is out of range [ 435.631314][T17875] netlink: 'syz.2.3257': attribute type 1 has an invalid length. [ 435.637263][T17868] netlink: zone id is out of range [ 435.716060][T17881] ip6t_REJECT: TCP_RESET illegal for non-tcp [ 435.848275][T17810] wlan1 speed is unknown, defaulting to 1000 [ 435.864032][T17889] openvswitch: netlink: Actions may not be safe on all matching packets [ 435.880671][T17810] vxcan1 speed is unknown, defaulting to 1000 [ 436.015548][T17898] netlink: 'syz.0.3261': attribute type 3 has an invalid length. [ 436.076726][T17899] netlink: 'syz.4.3260': attribute type 1 has an invalid length. [ 436.096063][T17899] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 436.103338][T17899] IPv6: NLM_F_CREATE should be set when creating new route [ 436.110643][T17899] IPv6: NLM_F_CREATE should be set when creating new route [ 436.272780][T17905] tipc: Enabling of bearer rejected, failed to enable media [ 436.484286][T17913] __nla_validate_parse: 72 callbacks suppressed [ 436.484305][T17913] netlink: 256 bytes leftover after parsing attributes in process `syz.0.3266'. [ 436.507583][ T5638] Bluetooth: hci2: command tx timeout [ 436.517574][T17810] lo speed is unknown, defaulting to 1000 [ 437.001503][T17948] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 437.072035][T17951] netlink: 104 bytes leftover after parsing attributes in process `syz.4.3275'. [ 437.099487][T17951] veth0_to_bridge: entered promiscuous mode [ 437.200921][T17950] veth0_to_bridge: left promiscuous mode [ 437.271165][T17964] netlink: 'syz.2.3278': attribute type 23 has an invalid length. [ 437.373655][T17810] bridge0: port 1(bridge_slave_0) entered blocking state [ 437.396400][T17810] bridge0: port 1(bridge_slave_0) entered disabled state [ 437.403796][T17810] bridge_slave_0: entered allmulticast mode [ 437.412473][T17810] bridge_slave_0: entered promiscuous mode [ 437.448931][T17810] bridge0: port 2(bridge_slave_1) entered blocking state [ 437.462018][T17810] bridge0: port 2(bridge_slave_1) entered disabled state [ 437.477119][T17810] bridge_slave_1: entered allmulticast mode [ 437.486247][T17810] bridge_slave_1: entered promiscuous mode [ 437.497927][T17970] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3279'. [ 437.558336][T17810] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 437.584248][T17810] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 437.681307][T17982] netlink: 'syz.3.3283': attribute type 1 has an invalid length. [ 437.723749][T17982] netlink: 240 bytes leftover after parsing attributes in process `syz.3.3283'. [ 437.738905][T17982] netlink: 'syz.3.3283': attribute type 1 has an invalid length. [ 437.813155][T17987] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3286'. [ 437.828392][T17810] team0: Port device team_slave_0 added [ 437.853132][T17810] team0: Port device team_slave_1 added [ 437.994859][T17996] lo: entered promiscuous mode [ 438.020784][T17996] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 438.053174][T17810] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 438.061525][T17810] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 438.096857][T17810] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 438.110690][T17810] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 438.117734][T17810] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 438.130162][T18004] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3287'. [ 438.143736][T17810] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 438.174741][T18006] netlink: 'syz.4.3290': attribute type 2 has an invalid length. [ 438.234898][T18008] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3291'. [ 438.489313][T17810] hsr_slave_0: entered promiscuous mode [ 438.501639][T17810] hsr_slave_1: entered promiscuous mode [ 438.513813][T17810] debugfs: 'hsr0' already exists in 'hsr' [ 438.520893][T17810] Cannot create hsr debugfs directory [ 438.585931][ T5638] Bluetooth: hci2: command tx timeout [ 438.755704][T18033] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 438.859025][T18043] netlink: 'syz.0.3300': attribute type 1 has an invalid length. [ 438.867987][T18043] netlink: 'syz.0.3300': attribute type 2 has an invalid length. [ 438.888078][T17810] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 438.923795][T18045] netlink: 'syz.0.3300': attribute type 1 has an invalid length. [ 438.940873][T18045] netlink: 'syz.0.3300': attribute type 2 has an invalid length. [ 438.950277][T18047] netlink: 'syz.2.3301': attribute type 2 has an invalid length. [ 438.958603][T18047] netlink: 244 bytes leftover after parsing attributes in process `syz.2.3301'. [ 439.043221][T17810] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.164019][T18053] netlink: 'syz.2.3304': attribute type 21 has an invalid length. [ 439.193601][T18053] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3304'. [ 439.233267][T17810] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.263625][T18060] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3307'. [ 439.279077][T18055] netlink: 'syz.0.3305': attribute type 29 has an invalid length. [ 439.438090][T17810] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 439.685090][T18067] syzkaller1: entered promiscuous mode [ 439.700529][T18067] syzkaller1: entered allmulticast mode [ 440.309776][T17810] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 440.320720][T17810] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 440.329942][T17810] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 440.366690][T17810] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 440.374636][T17810] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 440.387947][T17810] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 440.406364][T17810] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 440.442232][T17810] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 440.491388][T18123] nbd: socks must be embedded in a SOCK_ITEM attr [ 440.666027][ T5638] Bluetooth: hci2: command tx timeout [ 440.668207][T17810] 8021q: adding VLAN 0 to HW filter on device bond0 [ 440.688923][T18135] openvswitch: netlink: Actions may not be safe on all matching packets [ 440.770716][T17810] 8021q: adding VLAN 0 to HW filter on device team0 [ 440.790429][T11965] bridge0: port 1(bridge_slave_0) entered blocking state [ 440.797639][T11965] bridge0: port 1(bridge_slave_0) entered forwarding state [ 440.823936][T11965] bridge0: port 2(bridge_slave_1) entered blocking state [ 440.831181][T11965] bridge0: port 2(bridge_slave_1) entered forwarding state [ 441.189719][ T30] audit: type=1804 audit(1783139475.698:75): pid=18151 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.3333" name="/newroot/67/cgroup.controllers" dev="tmpfs" ino=361 res=1 errno=0 [ 441.260407][ T30] audit: type=1800 audit(1783139475.708:76): pid=18151 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3333" name="cgroup.controllers" dev="tmpfs" ino=361 res=0 errno=0 [ 442.050179][T18198] netlink: 'syz.2.3345': attribute type 17 has an invalid length. [ 442.085985][T18198] __nla_validate_parse: 4 callbacks suppressed [ 442.086001][T18198] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3345'. [ 442.135703][T18198] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3345'. [ 442.141064][T17810] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 442.180587][T18198] gretap0: entered promiscuous mode [ 442.188712][T18198] gretap0: left promiscuous mode [ 442.211516][T18211] netlink: 'syz.0.3348': attribute type 1 has an invalid length. [ 442.257912][T18216] netlink: 'syz.3.3349': attribute type 21 has an invalid length. [ 442.268507][T18216] netlink: 128 bytes leftover after parsing attributes in process `syz.3.3349'. [ 442.299893][T18211] bond2: entered promiscuous mode [ 442.307939][T18211] 8021q: adding VLAN 0 to HW filter on device bond2 [ 442.358248][T18216] netlink: 3 bytes leftover after parsing attributes in process `syz.3.3349'. [ 442.542192][T17810] veth0_vlan: entered promiscuous mode [ 442.580845][T17810] veth1_vlan: entered promiscuous mode [ 442.650712][T17810] veth0_macvtap: entered promiscuous mode [ 442.686311][T17810] veth1_macvtap: entered promiscuous mode [ 442.734777][T17810] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 442.756698][ T5638] Bluetooth: hci2: command tx timeout [ 442.791385][T17810] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 442.819970][T18237] netlink: 684 bytes leftover after parsing attributes in process `syz.2.3357'. [ 442.824726][T15083] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.856722][T15083] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.947082][T15083] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 442.993156][T15083] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 443.329748][T18259] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3362'. [ 443.332659][T18262] netlink: 56 bytes leftover after parsing attributes in process `syz.3.3363'. [ 443.351307][ T8733] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 443.354180][T18259] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3362'. [ 443.362716][ T8733] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 443.387700][T18260] workqueue: Failed to create a rescuer kthread for wq "bond12": -EINTR [ 443.494651][ T8733] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 443.520800][ T8733] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 443.562989][T18272] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3366'. [ 443.613847][T18272] xt_CT: You must specify a L4 protocol and not use inversions on it [ 443.642630][T18275] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3242'. [ 443.791913][T18280] tipc: Started in network mode [ 443.804805][T18280] tipc: Node identity 0a1be2bedd98, cluster identity 4711 [ 443.813365][T18280] tipc: Enabled bearer , priority 0 [ 443.905054][T18280] syzkaller0: entered promiscuous mode [ 443.917885][T18280] syzkaller0: entered allmulticast mode [ 443.928134][T18288] netlink: 'syz.1.3370': attribute type 1 has an invalid length. [ 443.937031][T18280] tipc: Resetting bearer [ 443.943625][T18288] netlink: 'syz.1.3370': attribute type 2 has an invalid length. [ 443.969690][T18284] bridge0: port 2(bridge_slave_1) entered disabled state [ 443.979794][T18284] bridge0: port 1(bridge_slave_0) entered disabled state [ 444.020851][T18279] tipc: Resetting bearer [ 444.351975][T18293] nbd: nbd4 already in use [ 444.366484][T18293] block nbd4: NBD_DISCONNECT [ 444.373152][T18293] block nbd4: Send disconnect failed -32 [ 444.403927][T18293] block nbd4: shutting down sockets [ 444.484825][ C1] blk_print_req_error: 128 callbacks suppressed [ 444.484849][ C1] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 444.500418][ C1] buffer_io_error: 138 callbacks suppressed [ 444.500435][ C1] Buffer I/O error on dev nbd4, logical block 0, async page read [ 444.541233][ C0] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 444.551067][ C0] Buffer I/O error on dev nbd4, logical block 1, async page read [ 444.558890][ C0] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 444.568024][ C0] Buffer I/O error on dev nbd4, logical block 2, async page read [ 444.575819][ C0] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 444.584935][ C0] Buffer I/O error on dev nbd4, logical block 3, async page read [ 444.596815][ T25] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 444.606081][ T25] Buffer I/O error on dev nbd4, logical block 0, async page read [ 444.614564][ T25] I/O error, dev nbd4, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 444.623991][ T25] Buffer I/O error on dev nbd4, logical block 1, async page read [ 444.632089][ T25] I/O error, dev nbd4, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 444.641331][ T25] Buffer I/O error on dev nbd4, logical block 2, async page read [ 444.649237][ T25] I/O error, dev nbd4, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 444.659103][ T25] Buffer I/O error on dev nbd4, logical block 3, async page read [ 444.692438][T16164] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 444.703364][T16164] Buffer I/O error on dev nbd4, logical block 0, async page read [ 444.712705][T16164] Buffer I/O error on dev nbd4, logical block 1, async page read [ 444.728495][T16164] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 444.765148][ T5643] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 444.789938][ T8170] ldm_validate_partition_table(): Disk read failed. [ 444.797825][ T5643] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 444.811154][ T8170] Dev nbd4: unable to read RDB block 0 [ 444.816854][ T5643] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 444.830202][ T5643] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 444.841402][ T5643] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 444.853894][ T8170] nbd4: unable to read partition table [ 444.926671][ T8170] ldm_validate_partition_table(): Disk read failed. [ 444.935111][ T8170] Dev nbd4: unable to read RDB block 0 [ 444.945096][ T8170] nbd4: unable to read partition table [ 445.068451][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 446.351235][ T25] block nbd6: Possible stuck request ffff8880275ee000: control (read@0,1024B). Runtime 30 seconds [ 446.356820][ C0] bridge0: port 1(bridge_slave_0) entered forwarding state [ 446.369195][ C0] bridge0: topology change detected, propagating [ 446.373391][ T25] block nbd6: Possible stuck request ffff8880275ee1c0: control (read@1024,1024B). Runtime 30 seconds [ 446.375966][ C0] bridge0: port 2(bridge_slave_1) entered forwarding state [ 446.387005][ T25] block nbd6: Possible stuck request ffff8880275ee380: control (read@2048,1024B). Runtime 30 seconds [ 446.393610][ C0] bridge0: topology change detected, propagating [ 446.412417][ T25] block nbd6: Possible stuck request ffff8880275ee540: control (read@3072,1024B). Runtime 30 seconds [ 446.924998][T18279] tipc: Disabling bearer [ 446.940894][T18288] ipvlan2: entered allmulticast mode [ 446.946419][T18288] batadv_slave_1: entered allmulticast mode [ 446.954110][T18288] batman_adv: batadv0: Adding interface: ipvlan2 [ 446.960534][T18288] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 446.991964][T18288] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 446.992420][ T5638] Bluetooth: hci0: command tx timeout [ 447.003993][T18288] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 447.023069][T18288] batman_adv: batadv0: Interface activated: ipvlan2 [ 447.041448][ T188] tipc: Node number set to 3615744702 [ 447.460996][T18301] wlan1 speed is unknown, defaulting to 1000 [ 447.513292][T18301] vxcan1 speed is unknown, defaulting to 1000 [ 447.912509][T18350] openvswitch: netlink: Duplicate key (type 6). [ 447.998350][T18354] __nla_validate_parse: 3 callbacks suppressed [ 447.998369][T18354] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3385'. [ 448.151230][T18301] lo speed is unknown, defaulting to 1000 [ 448.231658][T18368] syzkaller0: entered promiscuous mode [ 448.240083][T18369] netlink: 'syz.0.3391': attribute type 13 has an invalid length. [ 448.248786][T18368] syzkaller0: entered allmulticast mode [ 448.254492][T18369] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3391'. [ 448.418273][T18377] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 448.449032][T18377] netlink: 'syz.2.3394': attribute type 3 has an invalid length. [ 448.476593][T18377] netlink: 666 bytes leftover after parsing attributes in process `syz.2.3394'. [ 448.735547][T18391] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3398'. [ 448.750656][T18391] netlink: 'syz.0.3398': attribute type 1 has an invalid length. [ 448.760125][T18391] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3398'. [ 448.916883][T18405] netlink: 'syz.1.3400': attribute type 7 has an invalid length. [ 448.931055][T18301] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.945635][T18301] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.963356][T18301] bridge_slave_0: entered allmulticast mode [ 448.989333][T18301] bridge_slave_0: entered promiscuous mode [ 449.044991][T18301] bridge0: port 2(bridge_slave_1) entered blocking state [ 449.066077][ T5638] Bluetooth: hci0: command tx timeout [ 449.074464][T18301] bridge0: port 2(bridge_slave_1) entered disabled state [ 449.095376][T18301] bridge_slave_1: entered allmulticast mode [ 449.116603][T18301] bridge_slave_1: entered promiscuous mode [ 449.228854][T18301] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 449.261611][T18301] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 449.379205][T18301] team0: Port device team_slave_0 added [ 449.409208][T18301] team0: Port device team_slave_1 added [ 449.511225][T18301] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 449.530646][T18301] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 449.591834][T18430] netlink: 'syz.4.3407': attribute type 32 has an invalid length. [ 449.610458][T18301] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 449.640010][T18301] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 449.647513][T18301] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 449.679249][T18301] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 449.771762][T18440] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3410'. [ 449.888173][T18301] hsr_slave_0: entered promiscuous mode [ 449.905443][T18301] hsr_slave_1: entered promiscuous mode [ 449.912198][T18301] debugfs: 'hsr0' already exists in 'hsr' [ 449.920187][T18301] Cannot create hsr debugfs directory [ 450.110561][T18453] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 450.143457][T18453] gretap1: default qdisc (pfifo_fast) fail, fallback to noqueue [ 450.152070][T18453] gretap1: entered promiscuous mode [ 450.158400][T18453] gretap1: entered allmulticast mode [ 450.202140][T18459] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3415'. [ 450.376534][T18466] netlink: 5 bytes leftover after parsing attributes in process `syz.4.3415'. [ 450.426601][T18472] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3420'. [ 450.625127][T18301] netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 450.672655][T18301] netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 450.693862][T18482] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3424'. [ 451.120174][T18301] netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 451.139935][T18301] netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 451.150352][ T5638] Bluetooth: hci0: command tx timeout [ 451.268031][T18301] netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 451.320562][T18301] netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 451.550860][T18301] netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 451.631370][T18301] netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 256 - 0 [ 451.897836][T18538] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 452.270332][T18555] netlink: 'syz.0.3434': attribute type 12 has an invalid length. [ 452.312078][T18555] netlink: 'syz.0.3434': attribute type 11 has an invalid length. [ 452.435421][T18301] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 452.479940][T18301] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 452.494654][T18301] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 452.533654][T18301] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 452.563996][T18301] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 452.615730][T18301] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 452.632595][T18301] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 452.673029][T18301] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 452.989241][T18301] 8021q: adding VLAN 0 to HW filter on device bond0 [ 453.046405][T18301] 8021q: adding VLAN 0 to HW filter on device team0 [ 453.094053][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 453.101319][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 453.171752][T15083] bridge0: port 2(bridge_slave_1) entered blocking state [ 453.179025][T15083] bridge0: port 2(bridge_slave_1) entered forwarding state [ 453.237044][ T5638] Bluetooth: hci0: command tx timeout [ 453.543742][T18613] xt_socket: unknown flags 0x8 [ 454.024540][T18633] tipc: Failed to remove unknown binding: 66,0,0/0:3484366794/3484366796 [ 454.076382][T18633] tipc: Failed to remove unknown binding: 66,0,0/0:3484366794/3484366795 [ 454.081560][T18636] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 454.138456][T18633] tipc: Failed to remove unknown binding: 66,0,0/0:3484366794/3484366796 [ 454.149872][T18638] __nla_validate_parse: 5 callbacks suppressed [ 454.149889][T18638] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3454'. [ 454.171810][T18633] tipc: Failed to remove unknown binding: 66,0,0/0:3484366794/3484366795 [ 454.516900][T18659] sctp: [Deprecated]: syz.0.3460 (pid 18659) Use of int in maxseg socket option. [ 454.516900][T18659] Use struct sctp_assoc_value instead [ 454.539557][T18657] rdma_rxe: rxe_newlink: failed to add vxcan1 [ 454.553237][T18301] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 454.688667][T18301] veth0_vlan: entered promiscuous mode [ 454.718280][T18301] veth1_vlan: entered promiscuous mode [ 454.762581][T18301] veth0_macvtap: entered promiscuous mode [ 454.773595][T18301] veth1_macvtap: entered promiscuous mode [ 454.800401][T18673] netlink: 'syz.4.3463': attribute type 16 has an invalid length. [ 454.802753][T18301] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 454.822155][T18301] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 454.841795][T18673] netlink: 'syz.4.3463': attribute type 3 has an invalid length. [ 454.853360][T15083] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.875090][T18673] netlink: 132 bytes leftover after parsing attributes in process `syz.4.3463'. [ 454.887239][T15083] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.917490][T15083] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.941608][T15083] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 454.942517][T18678] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3464'. [ 454.996253][T18677] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3465'. [ 455.036465][T18673] x_tables: ip_tables: icmp match: only valid for protocol 1 [ 455.164482][T15072] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 455.177052][T18685] netlink: 'syz.2.3467': attribute type 13 has an invalid length. [ 455.187224][T15072] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 455.504634][T11965] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 455.541232][T11965] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 455.597758][T18692] wlan1 speed is unknown, defaulting to 1000 [ 455.660924][T18692] vxcan1 speed is unknown, defaulting to 1000 [ 455.725418][T18704] xt_addrtype: ipv6 does not support BROADCAST matching [ 455.927329][T18709] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3473'. [ 456.095988][T18715] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 456.186600][T18716] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3475'. [ 456.232269][T18717] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3477'. [ 456.332659][T11965] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x80 [ 456.366616][T18692] lo speed is unknown, defaulting to 1000 [ 457.007980][T18755] netlink: 'syz.0.3486': attribute type 39 has an invalid length. [ 457.070389][T18756] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3486'. [ 457.294438][T18766] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3488'. [ 457.296175][T18756] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3486'. [ 457.793212][T18778] netlink: 'syz.1.3494': attribute type 1 has an invalid length. [ 459.088259][T18716] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 459.408625][T18800] __nla_validate_parse: 4 callbacks suppressed [ 459.408644][T18800] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3498'. [ 459.447647][T18800] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3498'. [ 459.985642][T18803] veth0_macvtap: entered allmulticast mode [ 460.010207][T18803] A link change request failed with some changes committed already. Interface veth0_macvtap may have been left with an inconsistent configuration, please check. [ 460.263134][T18845] netlink: 'syz.0.3505': attribute type 27 has an invalid length. [ 460.283818][T18845] netlink: 'syz.0.3505': attribute type 4 has an invalid length. [ 460.297200][T18845] netlink: 132 bytes leftover after parsing attributes in process `syz.0.3505'. [ 460.700930][T18871] netlink: 'syz.1.3511': attribute type 6 has an invalid length. [ 461.574210][T18887] xt_addrtype: ipv6 does not support BROADCAST matching [ 461.740389][T18896] tipc: Started in network mode [ 461.756066][T18896] tipc: Node identity ac14142f, cluster identity 4711 [ 461.782867][T18896] tipc: New replicast peer: 0.0.0.0 [ 461.797865][T18896] tipc: Enabled bearer , priority 10 [ 461.829064][T18898] tipc: Enabling of bearer rejected, already enabled [ 461.861768][T18897] syzkaller0: entered promiscuous mode [ 461.864403][T18904] netlink: 'syz.4.3522': attribute type 1 has an invalid length. [ 461.892591][T18897] syzkaller0: entered allmulticast mode [ 461.992581][T18919] openvswitch: netlink: IP tunnel dst address not specified [ 462.024875][T18904] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3522'. [ 462.048922][T18909] 8021q: adding VLAN 0 to HW filter on device bond2 [ 462.062827][T18909] bond1: (slave bond2): making interface the new active one [ 462.082614][T18909] bond1: (slave bond2): Enslaving as an active interface with an up link [ 462.143996][T18917] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 462.175538][T18904] 8021q: adding VLAN 0 to HW filter on device bond1 [ 462.613148][T18958] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3535'. [ 462.821987][T18919] Bluetooth: hci0: Opcode 0x0c20 failed: -4 [ 462.907987][T17776] tipc: Node number set to 2886997039 [ 462.978230][T18975] netdevsim netdevsim0 netdevsim0: entered promiscuous mode [ 463.489131][T19002] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 463.837972][T19023] x_tables: duplicate entry at hook 1 [ 463.853965][T19023] netlink: 'syz.1.3556': attribute type 1 has an invalid length. [ 463.910896][T19025] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3557'. [ 463.920557][T19025] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3557'. [ 464.019962][T19030] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3558'. [ 464.036119][ T5638] Bluetooth: hci0: command 0x0c20 tx timeout [ 464.242832][T19037] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3561'. [ 464.263212][T19039] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3562'. [ 464.331584][T19043] xt_nat: multiple ranges no longer supported [ 464.352421][T19037] syzkaller0: entered promiscuous mode [ 464.364582][T19037] syzkaller0: entered allmulticast mode [ 464.709715][T19068] netlink: 4304 bytes leftover after parsing attributes in process `syz.3.3569'. [ 464.751062][T19072] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3573'. [ 464.889315][T19082] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3575'. [ 465.138481][T19097] Bluetooth: MGMT ver 1.23 [ 465.143189][T19097] Bluetooth: hci1: expected 19 bytes, got 2 bytes [ 465.151417][T19096] netlink: 1196 bytes leftover after parsing attributes in process `syz.1.3580'. [ 465.215366][T19100] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3581'. [ 465.293644][T19104] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 465.491997][T19114] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3587'. [ 465.537745][T19114] netlink: 6 bytes leftover after parsing attributes in process `syz.1.3587'. [ 465.600520][T19119] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3590'. [ 465.617189][T19117] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3588'. [ 466.002260][T19146] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3595'. [ 466.092046][T19152] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_team, syncid = 4, id = 0 [ 466.194391][T19160] netlink: 'syz.3.3600': attribute type 83 has an invalid length. [ 466.212696][T19161] netlink: 'syz.3.3600': attribute type 83 has an invalid length. [ 466.439149][T19176] tipc: Started in network mode [ 466.455425][T19176] tipc: Node identity 3e27f3c98d0d, cluster identity 4711 [ 466.477575][T19176] tipc: Enabled bearer , priority 0 [ 466.535165][T19182] xt_hashlimit: size too large, truncated to 1048576 [ 466.591749][T19176] syzkaller0: entered promiscuous mode [ 466.603533][T19176] syzkaller0: entered allmulticast mode [ 466.618291][T19176] tipc: Resetting bearer [ 466.643073][T19185] ip6_vti0: Master is either lo or non-ether device [ 467.171003][T18681] hid-generic 0005:07C0:100E.0003: unknown main item tag 0x0 [ 467.201204][T18681] hid-generic 0005:07C0:100E.0003: hidraw0: BLUETOOTH HID vc3.36 Device [syz0] on aa:aa:aa:aa:aa:aa [ 467.402028][T19212] netlink: 'syz.1.3610': attribute type 1 has an invalid length. [ 469.330204][T11969] tipc: Resetting bearer [ 469.340391][T19175] tipc: Resetting bearer [ 471.155256][T19175] tipc: Disabling bearer [ 471.171225][T19198] syzkaller1: entered promiscuous mode [ 471.177314][T19198] syzkaller1: entered allmulticast mode [ 471.279914][T18681] tipc: Node number set to 3005936585 [ 471.481301][T19225] __nla_validate_parse: 35 callbacks suppressed [ 471.481320][T19225] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3614'. [ 471.534690][T19227] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3613'. [ 471.575664][T19231] netlink: 10 bytes leftover after parsing attributes in process `syz.1.3615'. [ 471.621588][T19230] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 471.626631][T19236] netlink: 112 bytes leftover after parsing attributes in process `syz.2.3617'. [ 471.643110][T19237] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3618'. [ 471.692568][T19237] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 471.779543][T19240] netlink: 44 bytes leftover after parsing attributes in process `syz.1.3620'. [ 471.810382][T19237] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 471.812785][T19240] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3620'. [ 471.933997][T19244] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3619'. [ 472.040761][T19257] xt_HMARK: proto mask must be zero with L3 mode [ 472.055478][T19257] netlink: zone id is out of range [ 472.061848][T19257] netlink: del zone limit has 4 unknown bytes [ 472.107952][T19266] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3625'. [ 472.131474][T19266] netlink: 27 bytes leftover after parsing attributes in process `syz.1.3625'. [ 472.340041][T19277] netlink: 'syz.1.3628': attribute type 1 has an invalid length. [ 472.461059][T19277] bond3: entered promiscuous mode [ 472.466709][T19277] 8021q: adding VLAN 0 to HW filter on device bond3 [ 472.503201][T19273] netlink: 'syz.1.3628': attribute type 2 has an invalid length. [ 472.517966][T19283] vlan3: entered promiscuous mode [ 472.538782][T19283] bridge0: entered promiscuous mode [ 472.784036][T19255] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 473.080251][T19318] bridge0: port 4(veth1_to_bridge) entered blocking state [ 473.102700][T19318] bridge0: port 4(veth1_to_bridge) entered disabled state [ 473.126322][T19318] veth1_to_bridge: entered allmulticast mode [ 473.137209][T19318] veth1_to_bridge: entered promiscuous mode [ 473.154783][T19318] bridge0: adding interface veth1_to_bridge with same address as a received packet (addr:aa:aa:aa:aa:aa:1c, vlan:0) [ 473.170871][T19318] bridge0: port 4(veth1_to_bridge) entered blocking state [ 473.178167][T19318] bridge0: port 4(veth1_to_bridge) entered forwarding state [ 473.212980][T19319] veth3: entered promiscuous mode [ 473.291008][T19325] dvmrp0: entered allmulticast mode [ 473.498999][T19341] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input6 [ 473.626955][T19348] syzkaller0: entered promiscuous mode [ 473.642532][T19348] syzkaller0: entered allmulticast mode [ 473.699137][T19350] xt_hashlimit: invalid rate [ 473.791844][T19358] x_tables: duplicate underflow at hook 2 [ 474.344228][T19392] bond0: entered promiscuous mode [ 474.352105][T19392] bond_slave_0: entered promiscuous mode [ 474.373520][T19392] bond_slave_1: entered promiscuous mode [ 474.388058][T19392] batadv0: entered promiscuous mode [ 474.401787][T19392] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 474.411861][T19392] bond0: left promiscuous mode [ 474.417359][T19392] bond_slave_0: left promiscuous mode [ 474.423020][T19392] bond_slave_1: left promiscuous mode [ 474.431943][T19392] batadv0: left promiscuous mode [ 474.617618][T19405] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 474.669299][T19405] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 474.778183][T19406] erspan0: entered promiscuous mode [ 474.997715][T19425] netlink: 'syz.2.3672': attribute type 17 has an invalid length. [ 475.031871][T19427] bond0: option ad_select: unable to set because the bond device is up [ 475.392360][T19445] x_tables: ip_tables: TCPOPTSTRIP target: only valid in mangle table, not security [ 475.435392][T19449] netlink: 'syz.2.3682': attribute type 3 has an invalid length. [ 475.460177][T19449] netlink: 'syz.2.3682': attribute type 12 has an invalid length. [ 475.474640][T19449] netlink: 'syz.2.3682': attribute type 29 has an invalid length. [ 475.792606][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 476.118255][T19488] veth0: entered promiscuous mode [ 476.377441][T19487] veth0: left promiscuous mode [ 476.444736][ T25] block nbd6: Possible stuck request ffff8880275ee000: control (read@0,1024B). Runtime 60 seconds [ 476.456082][ T25] block nbd6: Possible stuck request ffff8880275ee1c0: control (read@1024,1024B). Runtime 60 seconds [ 476.467254][ T25] block nbd6: Possible stuck request ffff8880275ee380: control (read@2048,1024B). Runtime 60 seconds [ 476.478983][ T25] block nbd6: Possible stuck request ffff8880275ee540: control (read@3072,1024B). Runtime 60 seconds [ 476.512349][T19505] netlink: 'syz.0.3696': attribute type 12 has an invalid length. [ 476.535612][T19460] infiniband syz0: set down [ 476.545920][T19460] infiniband syz0: added ipvlan0 [ 476.567072][T19460] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 476.582318][T19460] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 476.600324][T19460] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 476.840247][T19460] RDS/IB: syz0: added [ 476.858178][T19526] xt_TPROXY: Can be used only with -p tcp or -p udp [ 476.866235][T19460] smc: adding ib device syz0 with port count 1 [ 476.885216][T19460] smc: ib device syz0 port 1 has no pnetid [ 476.911933][T19526] syzkaller0: entered promiscuous mode [ 476.924623][T19526] syzkaller0: entered allmulticast mode [ 477.042247][T19536] netlink: 'syz.2.3706': attribute type 1 has an invalid length. [ 477.075457][T19535] netlink: 'syz.2.3706': attribute type 1 has an invalid length. [ 477.235089][T19545] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 477.521114][T19562] __nla_validate_parse: 61 callbacks suppressed [ 477.521136][T19562] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3714'. [ 477.559132][T19562] netlink: 'syz.2.3714': attribute type 16 has an invalid length. [ 477.572473][T19562] netlink: 'syz.2.3714': attribute type 17 has an invalid length. [ 477.602697][T19565] xt_policy: output policy not valid in PREROUTING and INPUT [ 477.683189][T19562] virt_wifi0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 477.724442][T19562] ip6erspan0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 477.938941][T19576] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3719'. [ 477.942901][T19583] xt_TPROXY: Can be used only with -p tcp or -p udp [ 477.961857][T19586] Bluetooth: MGMT ver 1.23 [ 477.975552][T19586] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3722'. [ 478.004503][T19586] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3722'. [ 478.028634][T19583] syzkaller0: entered promiscuous mode [ 478.038441][T19583] syzkaller0: entered allmulticast mode [ 478.174971][T19590] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3723'. [ 478.212327][T19590] IPv6: sit1: Disabled Multicast RS [ 478.227131][T19590] sit1: entered allmulticast mode [ 478.466445][T19601] team0: Device gtp0 is up. Set it down before adding it as a team port [ 478.689794][T19607] netlink: 'syz.2.3728': attribute type 10 has an invalid length. [ 478.691052][T19609] netlink: 56 bytes leftover after parsing attributes in process `syz.0.3729'. [ 478.751053][T19609] bond3 (unregistering): Released all slaves [ 478.781361][T19607] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 478.788498][T19613] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3730'. [ 478.840388][T19607] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 478.987294][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 479.006322][T19596] Bluetooth: hci0: Opcode 0x080f failed: -4 [ 479.403285][T19637] syzkaller0: entered promiscuous mode [ 479.419211][T19637] syzkaller0: entered allmulticast mode [ 479.431245][T19641] xt_TPROXY: Can be used only with -p tcp or -p udp [ 479.545587][T19641] syzkaller0: entered promiscuous mode [ 479.562735][T19641] syzkaller0: entered allmulticast mode [ 479.950371][T19665] bridge0: port 2(bridge_slave_1) entered disabled state [ 479.958045][T19665] bridge0: port 1(bridge_slave_0) entered disabled state [ 480.257825][T19685] syzkaller0: entered promiscuous mode [ 480.267176][ T5638] Bluetooth: hci0: command 0x0c20 tx timeout [ 480.286295][T19685] syzkaller0: entered allmulticast mode [ 480.341113][T19672] netlink: 256 bytes leftover after parsing attributes in process `syz.4.3746'. [ 480.400345][T19672] netlink: 'syz.4.3746': attribute type 9 has an invalid length. [ 480.446246][T19694] xt_TPROXY: Can be used only with -p tcp or -p udp [ 480.533745][T19695] netlink: 'syz.1.3753': attribute type 22 has an invalid length. [ 480.567192][T19695] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3753'. [ 480.603795][T19702] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3754'. [ 480.620331][T19694] syzkaller0: entered promiscuous mode [ 480.639517][T19694] syzkaller0: entered allmulticast mode [ 480.814668][ T14] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 480.831587][ T14] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 480.882680][ T14] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 480.902748][ T14] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 480.983860][ T8724] netdevsim netdevsim1 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 481.019517][ T8724] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 481.324460][T19736] xt_CT: You must specify a L4 protocol and not use inversions on it [ 481.347907][T19738] erspan0: entered allmulticast mode [ 481.441511][T19742] xt_hashlimit: size too large, truncated to 1048576 [ 481.512783][T19743] 0ŖX¹¦Dö»: renamed from gretap0 (while UP) [ 481.557094][T19743] 0ŖX¹¦Dö»: entered allmulticast mode [ 481.587106][T19747] xt_TPROXY: Can be used only with -p tcp or -p udp [ 481.645129][T19747] syzkaller0: entered promiscuous mode [ 481.657774][T19747] syzkaller0: entered allmulticast mode [ 482.346011][ T5638] Bluetooth: hci0: command 0x0c20 tx timeout [ 482.597419][T19793] netlink: 'syz.2.3780': attribute type 11 has an invalid length. [ 482.615190][T19793] netlink: 'syz.2.3780': attribute type 11 has an invalid length. [ 482.624160][T19793] __nla_validate_parse: 5 callbacks suppressed [ 482.624174][T19793] netlink: 228 bytes leftover after parsing attributes in process `syz.2.3780'. [ 483.064960][T19826] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3788'. [ 483.285447][T19839] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3791'. [ 483.647243][T19855] xt_TPROXY: Can be used only with -p tcp or -p udp [ 483.686690][T19855] syzkaller0: entered promiscuous mode [ 483.694325][T19855] syzkaller0: entered allmulticast mode [ 484.060913][T19876] netlink: 'syz.3.3805': attribute type 1 has an invalid length. [ 484.098242][T19876] Cannot find add_set index 0 as target [ 484.135327][T19888] netlink: 'syz.3.3805': attribute type 1 has an invalid length. [ 484.232171][T19890] syzkaller0: entered promiscuous mode [ 484.246015][T19890] syzkaller0: entered allmulticast mode [ 484.523558][T19915] xt_TPROXY: Can be used only with -p tcp or -p udp [ 484.583562][T19915] syzkaller0: entered promiscuous mode [ 484.592335][T19915] syzkaller0: entered allmulticast mode [ 484.614792][T19920] Dead loop on virtual device ip6_vti0 (net 289), fix it urgently! [ 484.631957][T19922] rdma_rxe: rxe_newlink: failed to add bridge_slave_0 [ 484.720822][T19924] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3818'. [ 484.734667][T19924] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3818'. [ 484.964091][T19940] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3821'. [ 484.973594][T19940] netlink: 128 bytes leftover after parsing attributes in process `syz.0.3821'. [ 485.001843][T19940] netlink: 476 bytes leftover after parsing attributes in process `syz.0.3821'. [ 485.049851][T19940] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3821'. [ 485.133463][T19945] netlink: 'syz.4.3823': attribute type 2 has an invalid length. [ 485.172116][T19945] xt_CHECKSUM: unsupported CHECKSUM operation 68 [ 485.288881][T19951] sctp_setsockopt_delayed_ack: 55 callbacks suppressed [ 485.288900][T19951] sctp: [Deprecated]: syz.1.3826 (pid 19951) Use of struct sctp_assoc_value in delayed_ack socket option. [ 485.288900][T19951] Use struct sctp_sack_info instead [ 485.460162][T19964] netlink: 168 bytes leftover after parsing attributes in process `syz.0.3830'. [ 485.566314][T19973] xt_TPROXY: Can be used only with -p tcp or -p udp [ 485.664755][T19973] syzkaller0: entered promiscuous mode [ 485.695620][T19973] syzkaller0: entered allmulticast mode [ 486.181986][T20013] gretap1: entered promiscuous mode [ 486.205094][T20013] batman_adv: batadv0: Adding interface: gretap1 [ 486.222097][T20013] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 486.257770][T20013] batman_adv: batadv0: Not using interface gretap1 (retrying later): interface not active [ 486.428423][T20026] batadv0: Caught tx_queue_len zero misconfig [ 486.806600][T20000] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 487.138204][T20038] netlink: 'syz.2.3846': attribute type 1 has an invalid length. [ 487.747593][T20065] netlink: 'syz.4.3854': attribute type 1 has an invalid length. [ 487.806552][T20065] bond4: entered promiscuous mode [ 487.817079][T20065] 8021q: adding VLAN 0 to HW filter on device bond4 [ 487.838195][T20069] __nla_validate_parse: 9 callbacks suppressed [ 487.838212][T20069] netlink: 112 bytes leftover after parsing attributes in process `syz.4.3854'. [ 487.886902][T20069] 8021q: adding VLAN 0 to HW filter on device bond4 [ 487.900999][T20069] bond4: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 487.913059][T20069] bond4: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 487.939411][T20069] bond4: (slave ip6gre1): making interface the new active one [ 487.950195][T20069] ip6gre1: entered promiscuous mode [ 487.960380][T20076] netlink: 'syz.4.3854': attribute type 24 has an invalid length. [ 487.969484][T20069] bond4: (slave ip6gre1): Enslaving as an active interface with an up link [ 488.112410][T20081] netlink: 'syz.4.3858': attribute type 2 has an invalid length. [ 490.263029][T20045] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 490.273329][T20062] netlink: 'syz.0.3853': attribute type 2 has an invalid length. [ 490.543697][T20107] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3865'. [ 490.554773][T20103] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3864'. [ 490.568992][T20103] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3864'. [ 490.605200][T20104] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3862'. [ 490.621956][T20103] netlink: 576 bytes leftover after parsing attributes in process `syz.1.3864'. [ 491.667176][T20159] netlink: 'syz.0.3878': attribute type 21 has an invalid length. [ 491.686668][T20159] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3878'. [ 491.792130][T20159] netlink: 'syz.0.3878': attribute type 21 has an invalid length. [ 491.815485][T20159] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3878'. [ 492.273873][T20191] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3888'. [ 492.296824][T20191] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3888'. [ 492.322904][T20191] netlink: 'syz.0.3888': attribute type 14 has an invalid length. [ 492.360752][T20191] netlink: 'syz.0.3888': attribute type 13 has an invalid length. [ 494.613102][T20219] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3893'. [ 495.081806][T20237] netlink: 'syz.0.3899': attribute type 21 has an invalid length. [ 495.423703][T20258] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3902'. [ 495.922003][T20303] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3911'. [ 495.979713][T20303] 8021q: adding VLAN 0 to HW filter on device macsec1 [ 495.987330][T18681] netdevsim netdevsim2 netdevsim0: entered promiscuous mode [ 495.998671][T20307] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 496.094774][T20318] veth0_to_bridge: Caught tx_queue_len zero misconfig [ 496.287052][T20328] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3918'. [ 496.320391][T20328] netlink: 44 bytes leftover after parsing attributes in process `syz.2.3918'. [ 496.330215][T20328] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3918'. [ 498.359940][T20263] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 498.703182][T20364] x_tables: duplicate underflow at hook 2 [ 498.943611][T20377] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.3929'. [ 498.943634][T20376] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.3929'. [ 499.046141][T20381] openvswitch: netlink: Unexpected mask (mask=8000, allowed=10048) [ 499.208891][T20386] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3931'. [ 499.741350][T20408] bridge2: trying to set multicast query interval below minimum, setting to 100 (1000ms) [ 499.772968][T20408] ip6tnl0: Caught tx_queue_len zero misconfig [ 499.796540][T20412] netlink: 36 bytes leftover after parsing attributes in process `syz.3.3940'. [ 499.847966][T20415] netlink: 'syz.0.3941': attribute type 1 has an invalid length. [ 499.883975][T20415] netlink: 240 bytes leftover after parsing attributes in process `syz.0.3941'. [ 499.912260][T20415] netlink: 'syz.0.3941': attribute type 1 has an invalid length. [ 500.164151][T20428] bridge_slave_1: left allmulticast mode [ 500.187308][T20428] bridge_slave_1: left promiscuous mode [ 500.205390][T20428] bridge0: port 2(bridge_slave_1) entered disabled state [ 500.248131][T20436] netlink: 'syz.1.3945': attribute type 7 has an invalid length. [ 500.276036][T20428] bridge_slave_0: left allmulticast mode [ 500.286685][T20428] bridge_slave_0: left promiscuous mode [ 500.294512][T20428] bridge0: port 1(bridge_slave_0) entered disabled state [ 500.345314][T20441] netlink: 'syz.0.3946': attribute type 21 has an invalid length. [ 500.533486][T20441] netlink: 156 bytes leftover after parsing attributes in process `syz.0.3946'. [ 500.730957][T20448] syzkaller1: entered promiscuous mode [ 500.750738][T20448] syzkaller1: entered allmulticast mode [ 500.772899][T20450] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3950'. [ 500.779431][T20453] syzkaller0: entered promiscuous mode [ 500.788928][T20453] syzkaller0: entered allmulticast mode [ 501.063563][T20462] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3952'. [ 502.329333][T20498] netlink: 11 bytes leftover after parsing attributes in process `syz.2.3961'. [ 502.377701][T20484] bridge0: port 2(bridge_slave_1) entered disabled state [ 502.385463][T20484] bridge0: port 1(bridge_slave_0) entered disabled state [ 502.392175][T20502] netlink: 'syz.2.3961': attribute type 16 has an invalid length. [ 502.413508][T20502] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3961'. [ 502.489742][T20484] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 502.530933][T20499] syzkaller1: tun_chr_ioctl cmd 1074025678 [ 502.552317][T20499] syzkaller1: group set to 0 [ 502.585150][T20502] veth0_macvtap: entered allmulticast mode [ 502.626681][T20508] pim6reg: entered allmulticast mode [ 502.701843][T20513] netlink: 24 bytes leftover after parsing attributes in process `syz.1.3965'. [ 502.737644][T20515] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3966'. [ 502.773038][T20515] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3966'. [ 502.784651][T20517] block nbd4: Unsupported socket: should be TCP or UNIX. [ 503.142657][T20535] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 503.174490][ T997] IPVS: starting estimator thread 0... [ 503.186921][T20538] netlink: 'syz.3.3973': attribute type 7 has an invalid length. [ 503.221869][T20538] netlink: 'syz.3.3973': attribute type 8 has an invalid length. [ 503.279203][T20543] IPVS: using max 32 ests per chain, 76800 per kthread [ 503.495301][T20558] netlink: 'syz.1.3979': attribute type 12 has an invalid length. [ 503.531941][T20558] xfrm0: mtu less than device minimum [ 503.570465][T20558] openvswitch: netlink: Message has 8 unknown bytes. [ 503.586335][T20558] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 503.686859][T20567] IPVS: set_ctl: invalid protocol: 98 224.0.0.2:20002 [ 504.073737][T20580] syzkaller0: entered promiscuous mode [ 504.089284][T20580] syzkaller0: entered allmulticast mode [ 504.112226][T20585] netlink: 'syz.0.3988': attribute type 29 has an invalid length. [ 504.116643][T20588] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 504.210398][T20588] batman_adv: batadv0: Interface deactivated: ipvlan2 [ 504.244931][T20588] batman_adv: batadv0: Removing interface: ipvlan2 [ 504.285612][T20599] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 504.304714][T20588] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 506.458891][T20596] __nla_validate_parse: 7 callbacks suppressed [ 506.458909][T20596] netlink: 830 bytes leftover after parsing attributes in process `syz.1.3989'. [ 506.523981][ T25] block nbd6: Possible stuck request ffff8880275ee000: control (read@0,1024B). Runtime 90 seconds [ 506.538072][ T25] block nbd6: Possible stuck request ffff8880275ee1c0: control (read@1024,1024B). Runtime 90 seconds [ 506.549516][ T25] block nbd6: Possible stuck request ffff8880275ee380: control (read@2048,1024B). Runtime 90 seconds [ 506.560845][ T25] block nbd6: Possible stuck request ffff8880275ee540: control (read@3072,1024B). Runtime 90 seconds [ 506.562308][T20621] netlink: 'syz.4.3995': attribute type 2 has an invalid length. [ 506.613628][T20621] netlink: 100 bytes leftover after parsing attributes in process `syz.4.3995'. [ 506.872469][T20637] lo: Caught tx_queue_len zero misconfig [ 507.009640][T20646] netlink: 9 bytes leftover after parsing attributes in process `syz.1.4002'. [ 507.043588][T20646] netlink: 9 bytes leftover after parsing attributes in process `syz.1.4002'. [ 507.218835][T20658] openvswitch: netlink: Geneve opt len 1 is not a multiple of 4. [ 507.381923][T20669] sctp: [Deprecated]: syz.2.4009 (pid 20669) Use of int in maxseg socket option. [ 507.381923][T20669] Use struct sctp_assoc_value instead [ 507.409782][T20670] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4010'. [ 507.436462][T20670] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4010'. [ 507.504317][T20674] netlink: 'syz.4.4012': attribute type 1 has an invalid length. [ 507.522960][T20675] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 507.593653][T20677] syzkaller0: entered promiscuous mode [ 507.609104][T20677] syzkaller0: entered allmulticast mode [ 507.737455][T20690] openvswitch: netlink: IP tunnel dst address not specified [ 507.843154][T20695] netlink: 'syz.0.4018': attribute type 1 has an invalid length. [ 507.869655][T20690] pim6reg: entered allmulticast mode [ 507.984686][T20695] 8021q: adding VLAN 0 to HW filter on device bond3 [ 508.131021][T20709] netlink: 36 bytes leftover after parsing attributes in process `syz.1.4023'. [ 508.162621][T20692] veth9: entered allmulticast mode [ 508.203668][T20692] bond3: (slave veth9): Enslaving as an active interface with a down link [ 508.265328][T20700] bond3: (slave veth0_to_bond): making interface the new active one [ 508.279227][T20700] veth0_to_bond: entered promiscuous mode [ 508.301738][T20700] bond3: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 508.390313][T20695] bond3: entered promiscuous mode [ 508.405499][T20695] bond3: entered allmulticast mode [ 508.412221][T20695] veth0_to_bond: entered allmulticast mode [ 508.469393][T20727] tipc: Enabled bearer , priority 0 [ 508.678218][T20719] syzkaller0: entered promiscuous mode [ 508.705019][T20719] syzkaller0: entered allmulticast mode [ 508.724881][T20719] tipc: Resetting bearer [ 508.884149][ T34] tipc: Resetting bearer [ 508.895684][T20718] tipc: Resetting bearer [ 509.286238][T20767] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 509.569606][T20778] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 511.120168][T20718] tipc: Disabling bearer [ 511.260118][T20781] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4039'. [ 511.278727][T20782] netlink: 244 bytes leftover after parsing attributes in process `syz.1.4038'. [ 511.354644][T20789] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4041'. [ 511.639059][T20810] __nla_validate_parse: 1 callbacks suppressed [ 511.639077][T20810] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4048'. [ 511.639833][ T8731] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 511.645451][T20810] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4048'. [ 511.684527][T20800] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 511.736926][T20817] netlink: 32 bytes leftover after parsing attributes in process `syz.3.4047'. [ 511.961833][T20823] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4052'. [ 512.044252][T20827] vlan1: entered promiscuous mode [ 512.060856][T20827] bridge0: entered promiscuous mode [ 512.111848][T20823] IPv6: sit1: Disabled Multicast RS [ 512.140879][T20823] sit1: entered allmulticast mode [ 512.157191][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 512.169507][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 512.182313][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 512.194066][T20835] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4057'. [ 512.194454][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 512.215376][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 512.218197][T20835] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4057'. [ 512.227503][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 512.227671][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 512.227824][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 512.227963][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 512.883096][T20863] netlink: 'syz.3.4060': attribute type 1 has an invalid length. [ 513.053529][T20863] bond1: entered promiscuous mode [ 513.088706][T20863] 8021q: adding VLAN 0 to HW filter on device bond1 [ 513.163983][T20875] netlink: 'syz.0.4062': attribute type 4 has an invalid length. [ 513.234405][T20876] netlink: 'syz.0.4062': attribute type 4 has an invalid length. [ 513.355261][T20863] 8021q: adding VLAN 0 to HW filter on device bond1 [ 513.365170][T20863] bond1: (slave vti0): The slave device specified does not support setting the MAC address [ 513.382155][T20863] bond1: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 513.421254][T20863] bond1: (slave vti0): making interface the new active one [ 513.429573][T20863] vti0: entered promiscuous mode [ 513.457690][T20863] bond1: (slave vti0): Enslaving as an active interface with an up link [ 513.994197][T20896] netlink: 'syz.3.4065': attribute type 1 has an invalid length. [ 514.070185][T20896] 8021q: adding VLAN 0 to HW filter on device bond3 [ 514.087600][T20896] bond2: (slave bond3): making interface the new active one [ 514.098161][T20896] bond2: (slave bond3): Enslaving as an active interface with an up link [ 514.122674][T20897] bond2: (slave gretap2): Enslaving as a backup interface with an up link [ 514.137368][T20896] netlink: 'syz.3.4065': attribute type 1 has an invalid length. [ 514.145387][T20896] netlink: 16119 bytes leftover after parsing attributes in process `syz.3.4065'. [ 514.270944][T20902] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap3 [ 514.291879][T20902] gretap3: default qdisc (pfifo_fast) fail, fallback to noqueue [ 514.300835][T20902] gretap3: entered promiscuous mode [ 514.308136][T20902] gretap3: entered allmulticast mode [ 514.565832][ C0] net_ratelimit: 11277 callbacks suppressed [ 514.565934][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 514.584070][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 514.596210][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 514.608465][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 514.620771][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 514.633530][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 514.645701][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 514.657972][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 514.670289][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 514.682550][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 515.324175][T20845] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 515.971743][T20922] xt_AUDIT: Audit type out of range (valid range: 0..2) [ 515.980552][T20926] netlink: 'syz.2.4073': attribute type 1 has an invalid length. [ 516.281267][T20926] 8021q: adding VLAN 0 to HW filter on device bond10 [ 516.478071][T20935] 8021q: adding VLAN 0 to HW filter on device bond4 [ 516.538722][T20935] bond0: (slave bond4): Enslaving as an active interface with an up link [ 517.605563][T20970] netdevsim netdevsim4: Direct firmware load for  failed with error -2 [ 517.662646][T20970] netdevsim netdevsim4: Falling back to sysfs fallback for:  [ 517.750701][T20972] netlink: 'syz.1.4081': attribute type 83 has an invalid length. [ 517.824261][T20966] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4079'. [ 517.901041][T20975] netlink: 556 bytes leftover after parsing attributes in process `syz.3.4082'. [ 517.912429][T20973] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4081'. [ 517.972685][T20976] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4082'. [ 518.033873][T20972] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4081'. [ 518.489232][T20980] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4083'. [ 518.550717][T20972] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4081'. [ 518.861906][T20965] netlink: 'syz.0.4080': attribute type 21 has an invalid length. [ 518.979813][T20965] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 519.084338][T20993] Cannot find add_set index 0 as target [ 519.230048][T20996] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4087'. [ 519.576007][ C0] net_ratelimit: 25875 callbacks suppressed [ 519.576028][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 519.594222][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 519.606368][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 519.618627][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 519.630943][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 519.643193][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 519.655354][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 519.667608][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 519.679926][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 519.692206][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 519.752204][T21011] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4091'. [ 520.575625][T21032] xt_TPROXY: Can be used only with -p tcp or -p udp [ 521.329445][T21052] sch_fq: defrate 0 ignored. [ 521.501399][T21064] netlink: 4 bytes leftover after parsing attributes in process `syz.3.4101'. [ 522.003040][T21071] IPVS: ip_vs_edit_dest(): server weight less than zero [ 522.024564][T16805] IPVS: starting estimator thread 0... [ 522.136465][T21074] IPVS: using max 35 ests per chain, 84000 per kthread [ 522.789531][T21097] bridge0: port 2(bridge_slave_1) entered disabled state [ 522.890958][ T34] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0xa3 [ 522.917265][T21106] xt_TPROXY: Can be used only with -p tcp or -p udp [ 523.981152][T21125] geneve2: entered promiscuous mode [ 524.104840][T21133] __nla_validate_parse: 3 callbacks suppressed [ 524.104859][T21133] netlink: 52 bytes leftover after parsing attributes in process `syz.4.4120'. [ 524.239250][T21139] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4121'. [ 524.305255][T21137] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4121'. [ 524.585874][ C0] net_ratelimit: 26902 callbacks suppressed [ 524.585893][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 524.604019][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 524.616256][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 524.628487][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 524.640792][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 524.652968][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 524.665212][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 524.677461][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 524.689647][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 524.701912][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 524.736556][T21153] netlink: 'syz.4.4125': attribute type 1 has an invalid length. [ 524.884189][T21160] xt_TPROXY: Can be used only with -p tcp or -p udp [ 524.976728][T21153] bond5: entered promiscuous mode [ 524.982740][T21153] 8021q: adding VLAN 0 to HW filter on device bond5 [ 525.155809][ C0] sched: DL replenish lagged too much [ 525.355616][T21170] xt_l2tp: v2 sid > 0xffff: 1114112 [ 525.458839][T21092] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 526.238528][T21192] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4134'. [ 526.310358][T21192] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4134'. [ 526.351145][T21195] xt_NFQUEUE: number of queues (62232) out of range (got 67565) [ 526.722722][T21204] xt_TPROXY: Can be used only with -p tcp or -p udp [ 526.889179][T21209] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4141'. [ 526.978092][T21209] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4141'. [ 528.090026][T21228] veth3: entered promiscuous mode [ 528.141414][T21228] veth3: entered allmulticast mode [ 528.246925][T21243] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4150'. [ 528.309863][T21240] batadv2: entered allmulticast mode [ 528.638153][T21257] netlink: 232 bytes leftover after parsing attributes in process `syz.0.4152'. [ 528.713005][T21258] netlink: 232 bytes leftover after parsing attributes in process `syz.0.4152'. [ 529.334817][T21280] xt_TPROXY: Can be used only with -p tcp or -p udp [ 529.595793][ C0] net_ratelimit: 28891 callbacks suppressed [ 529.595813][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 529.613913][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 529.626137][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 529.638440][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 529.650584][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 529.662846][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 529.675080][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 529.687222][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 529.699459][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 529.711612][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 530.206389][T21305] __nla_validate_parse: 1 callbacks suppressed [ 530.206407][T21305] netlink: 72 bytes leftover after parsing attributes in process `syz.1.4164'. [ 530.298386][T21305] nbd: couldn't find a device at index 0 [ 531.045132][T21318] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4170'. [ 531.081300][T21318] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4170'. [ 532.914886][T21309] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4166'. [ 532.941915][ T4993] udevd[4993]: worker [8424] /devices/virtual/block/nbd6 is taking a long time [ 532.970051][T21309] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4166'. [ 533.519713][T21346] netlink: 'syz.0.4173': attribute type 2 has an invalid length. [ 533.790602][T21346] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4173'. [ 533.975049][T21351] netlink: 44 bytes leftover after parsing attributes in process `syz.3.4176'. [ 534.279406][T21320] Bluetooth: hci5: command 0x0406 tx timeout [ 534.293060][T21351] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4176'. [ 534.433273][T21363] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4180'. [ 534.605940][ C0] net_ratelimit: 28112 callbacks suppressed [ 534.605960][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 534.624160][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 534.636455][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 534.648696][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 534.660942][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 534.673171][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 534.685323][ C0] bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 534.697581][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 534.709859][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 534.722104][ C0] bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) [ 534.852719][T21374] netlink: 33 bytes leftover after parsing attributes in process `syz.2.4182'. [ 534.875680][T21375] netdevsim netdevsim3: Direct firmware load for  failed with error -2 [ 534.899455][T21375] netdevsim netdevsim3: Falling back to sysfs fallback for:  [ 534.919951][T21374] netlink: 'syz.2.4182': attribute type 21 has an invalid length. [ 535.508193][T21394] xt_hashlimit: size too large, truncated to 1048576 [ 535.560563][T21393] __nla_validate_parse: 6 callbacks suppressed [ 535.560581][T21393] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4190'. [ 535.827944][T21387] bridge0: port 3(syz_tun) entered disabled state [ 535.939980][T21387] bridge0: port 4(veth1_to_bridge) entered disabled state [ 535.947469][T21387] bridge0: port 2(bridge_slave_1) entered disabled state [ 535.955006][T21387] bridge0: port 1(bridge_slave_0) entered disabled state [ 536.179443][T21387] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 536.198326][T21387] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 536.299461][T21398] geneve2: entered promiscuous mode [ 536.305040][T21398] geneve2: entered allmulticast mode [ 536.311848][T21401] netlink: 44 bytes leftover after parsing attributes in process `syz.0.4192'. [ 536.323200][T21406] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 536.326702][T21407] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4194'. [ 536.395519][T15072] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 536.415139][T15072] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.449292][T15072] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 536.468374][T15072] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 536.480018][T15072] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.493468][T15072] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 536.512219][T21426] syzkaller1: entered promiscuous mode [ 536.541879][T21426] syzkaller1: entered allmulticast mode [ 536.570262][T15072] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 536.589837][ T25] block nbd6: Possible stuck request ffff8880275ee000: control (read@0,1024B). Runtime 120 seconds [ 536.600776][ T25] block nbd6: Possible stuck request ffff8880275ee1c0: control (read@1024,1024B). Runtime 120 seconds [ 536.612956][ T25] block nbd6: Possible stuck request ffff8880275ee380: control (read@2048,1024B). Runtime 120 seconds [ 536.614503][T15072] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.624531][ T25] block nbd6: Possible stuck request ffff8880275ee540: control (read@3072,1024B). Runtime 120 seconds [ 536.653804][T21433] netlink: 64 bytes leftover after parsing attributes in process `syz.1.4201'. [ 536.692982][T15072] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 536.734712][T15072] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 536.744621][T15072] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 536.764934][T15072] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 536.781365][T21429] IPv6: sit1: Disabled Multicast RS [ 536.802607][ T188] IPVS: starting estimator thread 0... [ 536.918620][T21442] IPVS: using max 33 ests per chain, 79200 per kthread [ 537.224607][T21462] x_tables: duplicate underflow at hook 2 [ 537.271263][T21462] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4210'. [ 537.357034][T21469] netlink: 'syz.3.4211': attribute type 12 has an invalid length. [ 537.410811][T21468] netlink: 'syz.4.4213': attribute type 1 has an invalid length. [ 537.590332][T21474] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 537.750398][T21492] veth0: Caught tx_queue_len zero misconfig [ 538.006387][T21513] bond12: (slave erspan0): Device is not bonding slave [ 538.014155][T21513] bond12: option active_slave: invalid value (erspan0) [ 538.062468][T21513] bond12 (unregistering): Released all slaves [ 538.641431][T21548] Cannot find add_set index 3 as target [ 538.654053][T21546] sit0: Master is either lo or non-ether device [ 538.882910][T21556] tunl0: Caught tx_queue_len zero misconfig [ 538.916856][T21557] netlink: 'syz.0.4236': attribute type 8 has an invalid length. [ 539.005519][T21555] tun0: tun_chr_ioctl cmd 1074025675 [ 539.032265][T21555] tun0: persist disabled [ 539.139006][T21568] ipt_ECN: cannot use operation on non-tcp rule [ 539.306351][ T5643] Bluetooth: hci4: command 0x0406 tx timeout [ 539.923175][T21610] xt_nat: multiple ranges no longer supported [ 540.002837][T21615] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4254'. [ 540.029830][T21615] netlink: 13 bytes leftover after parsing attributes in process `syz.4.4254'. [ 540.201982][T21615] veth7: entered promiscuous mode [ 540.304723][T21639] netlink: 12 bytes leftover after parsing attributes in process `syz.0.4258'. [ 540.418748][T21646] netlink: 104 bytes leftover after parsing attributes in process `syz.4.4263'. [ 540.468786][T21646] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4263'. [ 540.685380][T21658] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4267'. [ 540.719216][T21658] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4267'. [ 540.768645][T21658] netlink: 'syz.4.4267': attribute type 2 has an invalid length. [ 540.969761][T21687] netlink: 96 bytes leftover after parsing attributes in process `syz.4.4274'. [ 541.170313][T21700] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4277'. [ 541.183642][T21700] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4277'. [ 541.193648][T21700] netlink: 'syz.4.4277': attribute type 15 has an invalid length. [ 541.235356][T21690] netlink: 44 bytes leftover after parsing attributes in process `syz.2.4275'. [ 541.251483][T15082] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 256 - 0 [ 541.266594][T21700] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4277'. [ 541.285890][T21700] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4277'. [ 541.288876][T15082] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 256 - 0 [ 541.305404][T21700] netlink: 'syz.4.4277': attribute type 15 has an invalid length. [ 541.308723][T15082] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 256 - 0 [ 541.330359][T15082] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 256 - 0 [ 543.791560][T21669] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 544.086526][T21732] sch_tbf: burst 2 is lower than device syzkaller0 mtu (1500) ! [ 544.124773][T21732] syzkaller0: entered promiscuous mode [ 544.136891][T21732] syzkaller0: entered allmulticast mode [ 544.262992][T21743] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4287'. [ 544.420576][T21755] vlan2: entered promiscuous mode [ 544.427543][T21756] xt_TPROXY: Can be used only with -p tcp or -p udp [ 544.427589][T21755] bridge0: entered promiscuous mode [ 544.462027][T21756] syzkaller0: entered promiscuous mode [ 544.467892][T21758] netlink: 'syz.1.4293': attribute type 1 has an invalid length. [ 544.476436][T21756] syzkaller0: entered allmulticast mode [ 544.512988][T21759] bond4: Unable to set up delay as MII monitoring is disabled [ 544.523922][T21759] bond4 (unregistering): Released all slaves [ 544.574850][T21764] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4294'. [ 544.590838][T21758] workqueue: Failed to create a rescuer kthread for wq "bond4": -EINTR [ 544.693589][T21768] netlink: 'syz.4.4295': attribute type 1 has an invalid length. [ 544.712877][T21768] netlink: 'syz.4.4295': attribute type 3 has an invalid length. [ 545.362698][T21802] netlink: 'syz.0.4306': attribute type 16 has an invalid length. [ 545.392253][T21802] netlink: 'syz.0.4306': attribute type 3 has an invalid length. [ 545.551521][T21813] syzkaller0: entered promiscuous mode [ 545.557958][T21813] syzkaller0: entered allmulticast mode [ 545.562998][T21816] netlink: 'syz.2.4312': attribute type 11 has an invalid length. [ 545.568831][T21813] net_ratelimit: 6902 callbacks suppressed [ 545.568849][T21813] 0: reclassify loop, rule prio 0, protocol 800 [ 545.889178][T21837] netlink: 'syz.1.4317': attribute type 11 has an invalid length. [ 546.537283][T21872] __nla_validate_parse: 10 callbacks suppressed [ 546.537301][T21872] netlink: 28 bytes leftover after parsing attributes in process `syz.3.4327'. [ 547.070166][T21906] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4337'. [ 547.231644][ T8733] tipc: Subscription rejected, illegal request [ 547.302450][T21924] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4345'. [ 547.383604][T21934] openvswitch: netlink: Tunnel attr 3 has unexpected len 8 expected 1 [ 547.428949][T21938] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4346'. [ 547.546586][T21947] syzkaller1: tun_chr_ioctl cmd 1074025677 [ 547.558822][T21947] syzkaller1: Linktype set failed because interface is up [ 547.765496][T21954] nbd: nbd1 already in use [ 547.775584][T21954] block nbd1: NBD_DISCONNECT [ 547.782633][T21954] block nbd1: Send disconnect failed -32 [ 547.792734][T21954] block nbd1: shutting down sockets [ 547.858848][T21959] nbd: nbd3 already in use [ 547.870462][T21959] block nbd3: NBD_DISCONNECT [ 547.880417][T21959] block nbd3: Send disconnect failed -32 [ 547.887970][T21959] block nbd3: shutting down sockets [ 548.007533][T21965] netlink: 16 bytes leftover after parsing attributes in process `syz.3.4358'. [ 548.017883][T15082] pim6reg: left allmulticast mode [ 548.027621][T15082] pimreg3: left allmulticast mode [ 548.338888][T15082] bond13 (unregistering): (slave ip6gretap1): Releasing backup interface [ 548.372983][T21983] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 548.613493][T15082] bond0 (unregistering): (slave gretap1): Releasing active interface [ 548.615402][T21993] netlink: 'syz.0.4366': attribute type 18 has an invalid length. [ 548.623014][T15082] gretap1 (unregistering): left allmulticast mode [ 548.656979][T15082] bond7 (unregistering): (slave gretap2): Releasing backup interface [ 548.786345][T15082] .` (unregistering): Released all slaves [ 548.796973][T15082] bond1 (unregistering): Released all slaves [ 548.812099][T15082] bond2 (unregistering): Released all slaves [ 548.838938][T15082] bond3 (unregistering): Released all slaves [ 548.853410][T15082] bond4 (unregistering): Released all slaves [ 548.871694][T15082] bond5 (unregistering): Released all slaves [ 548.896605][T15082] bond0 (unregistering): Released all slaves [ 548.913144][T15082] bond6 (unregistering): Released all slaves [ 548.929278][T15082] bond7 (unregistering): (slave bond8): Releasing backup interface [ 548.938462][T15082] bond7 (unregistering): Released all slaves [ 548.969715][T15082] bond8 (unregistering): Released all slaves [ 548.988199][T15082] bond9 (unregistering): Released all slaves [ 549.002911][T15082] bond10 (unregistering): Released all slaves [ 549.023166][T15082] bond11 (unregistering): Released all slaves [ 549.043620][T15082] bond12 (unregistering): (slave ): Releasing active interface [ 549.062164][T15082] bond12 (unregistering): Released all slaves [ 549.076680][T15082] bond13 (unregistering): Released all slaves [ 549.091084][T15082] bond14 (unregistering): Released all slaves [ 549.115441][T15082] bond15 (unregistering): Released all slaves [ 549.195459][ T1162] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 549.239337][ T1162] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 549.263353][T21997] netlink: 44 bytes leftover after parsing attributes in process `syz.4.4367'. [ 549.313699][ T1162] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 549.355398][ T1162] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 549.553553][T21320] Bluetooth: hci1: command 0x0406 tx timeout [ 549.602923][T22012] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 549.650544][T22011] team0: Device ipvlan3 failed to register rx_handler [ 549.928128][T15082] tipc: Disabling bearer [ 549.957881][T15082] tipc: Left network mode [ 550.177941][ T30] audit: type=1804 audit(1783139584.688:77): pid=22033 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.4379" name="/newroot/139/cgroup.controllers" dev="tmpfs" ino=726 res=1 errno=0 [ 550.252547][ T30] audit: type=1800 audit(1783139584.688:78): pid=22033 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.4379" name="cgroup.controllers" dev="tmpfs" ino=726 res=0 errno=0 [ 550.306714][T22035] nbd: couldn't find a device at index 0 [ 550.367683][T22043] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4383'. [ 550.455094][T22037] bond4: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 550.495911][ T5643] Bluetooth: hci2: link tx timeout [ 550.507506][ T5643] Bluetooth: hci2: killing stalled connection 11:aa:aa:aa:aa:aa [ 550.543286][T22037] bond4 (unregistering): Released all slaves [ 550.873744][T22047] bond5: option all_slaves_active: invalid value (222) [ 550.892798][T22047] bond5 (unregistering): Released all slaves [ 551.301894][ T5643] block nbd1: Receive control failed (result -32) [ 551.350742][T22078] bond4: entered promiscuous mode [ 551.382717][T22078] bond4: entered allmulticast mode [ 551.390359][T22078] 8021q: adding VLAN 0 to HW filter on device bond4 [ 551.555030][T22090] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4393'. [ 551.595341][T22090] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4393'. [ 551.622009][T22090] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4393'. [ 551.651102][T22100] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4393'. [ 551.677054][T22093] syzkaller0: entered promiscuous mode [ 551.683437][T22093] syzkaller0: entered allmulticast mode [ 552.015229][T22110] bridge3: entered promiscuous mode [ 552.026464][T22110] bridge3: entered allmulticast mode [ 552.390551][T22128] netlink: 'syz.0.4404': attribute type 1 has an invalid length. [ 552.441382][T22128] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4404'. [ 552.592349][ C1] ip6_tunnel: ip6tnl1 xmit: Local address not yet configured! [ 552.600708][ C1] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 552.616653][ T5638] Bluetooth: hci2: command 0x0406 tx timeout [ 552.802277][T22144] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4404'. [ 552.850747][T22144] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4404'. [ 553.112995][T22170] Cannot find del_set index 4 as target [ 553.198362][T22173] netlink: 'syz.4.4409': attribute type 58 has an invalid length. [ 553.258377][T22173] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4409'. [ 553.633930][T15082] hsr_slave_0: left promiscuous mode [ 553.662235][T15082] hsr_slave_1: left promiscuous mode [ 553.757466][T15082] veth1_macvtap: left promiscuous mode [ 553.791291][T15082] veth0_macvtap: left promiscuous mode [ 553.819838][T15082] veth1_vlan: left promiscuous mode [ 554.361682][T22236] netlink: 4552 bytes leftover after parsing attributes in process `syz.2.4421'. [ 554.383602][T22236] netlink: 4552 bytes leftover after parsing attributes in process `syz.2.4421'. [ 554.775656][ T8733] smbdirect: ib_dev[syś2] removed [ 554.801136][ T5288] veth1_vlan: left promiscuous mode [ 554.994567][T22243] RDS: rds_bind could not find a transport for ::ffff:172.30.0.5, load rds_tcp or rds_rdma? [ 555.584729][T15082] IPVS: stop unused estimator thread 0... [ 556.084889][T22298] syzkaller1: entered promiscuous mode [ 556.104254][T22298] syzkaller1: entered allmulticast mode [ 556.689550][T22330] netlink: 'syz.3.4448': attribute type 7 has an invalid length. [ 556.900176][T22342] __nla_validate_parse: 3 callbacks suppressed [ 556.900195][T22342] netlink: 24 bytes leftover after parsing attributes in process `syz.3.4452'. [ 557.352161][T22371] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4460'. [ 557.373104][T22371] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4460'. [ 557.394021][T22371] netlink: 'syz.1.4460': attribute type 3 has an invalid length. [ 557.461569][T22376] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 557.606973][T22385] xt_TPROXY: Can be used only with -p tcp or -p udp [ 557.732081][T22391] netlink: 'syz.3.4466': attribute type 10 has an invalid length. [ 557.742916][T22388] bond0: (slave bond_slave_0): Releasing backup interface [ 557.760236][T22388] bond0: (slave bond_slave_1): Releasing backup interface [ 557.789327][T22388] team0: Port device team_slave_0 removed [ 557.810977][T22388] team0: Port device team_slave_1 removed [ 557.821495][T22388] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 557.830018][T22388] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 557.838952][T22388] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 557.860924][T22391] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 557.878490][T22391] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 558.301621][T22417] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4474'. [ 558.361439][T22379] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 558.821420][T22440] xt_cgroup: path and classid specified [ 558.964503][T22447] netlink: 'syz.1.4487': attribute type 1 has an invalid length. [ 559.022775][T22456] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4490'. [ 559.079092][T22447] bond5: (slave geneve2): making interface the new active one [ 559.170606][T22447] bond5: (slave geneve2): Enslaving as an active interface with an up link [ 559.183673][ T8726] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 559.188119][T22464] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4492'. [ 559.194292][ T8726] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 559.212720][T15082] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 559.222057][T22447] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4487'. [ 559.374365][T22447] 8021q: adding VLAN 0 to HW filter on device bond5 [ 559.391220][T22447] syz.1.4487 (22447) used greatest stack depth: 18432 bytes left [ 559.405678][T22473] bond0: entered promiscuous mode [ 559.425487][T22473] bond_slave_0: entered promiscuous mode [ 559.433772][T22473] bond_slave_1: entered promiscuous mode [ 559.439815][T22473] bond2: entered promiscuous mode [ 559.445222][T22473] bond3: entered promiscuous mode [ 559.469224][T22473] bond4: entered promiscuous mode [ 559.484604][T22473] bond5: entered promiscuous mode [ 559.496947][T22473] bond6: entered promiscuous mode [ 559.513482][T22473] bond7: entered promiscuous mode [ 559.525986][T22473] bond8: entered promiscuous mode [ 559.532825][T22473] batadv0: entered promiscuous mode [ 559.570396][T22473] bond0: left promiscuous mode [ 559.582927][T22473] bond_slave_0: left promiscuous mode [ 559.595049][T22473] bond_slave_1: left promiscuous mode [ 559.602870][T22473] bond2: left promiscuous mode [ 559.608252][T22473] bond3: left promiscuous mode [ 559.613622][T22473] bond4: left promiscuous mode [ 559.619145][T22473] bond5: left promiscuous mode [ 559.624044][T22473] bond6: left promiscuous mode [ 559.630542][T22473] bond7: left promiscuous mode [ 559.635453][T22473] bond8: left promiscuous mode [ 559.640560][T22473] batadv0: left promiscuous mode [ 559.659993][T22474] bond0: entered promiscuous mode [ 559.667821][T22474] bond_slave_0: entered promiscuous mode [ 559.684843][T22474] bond_slave_1: entered promiscuous mode [ 559.692765][T22474] bond2: entered promiscuous mode [ 559.698755][T22474] bond3: entered promiscuous mode [ 559.704020][T22474] bond4: entered promiscuous mode [ 559.710262][T22474] bond5: entered promiscuous mode [ 559.716012][T22474] bond6: entered promiscuous mode [ 559.721892][T22474] bond7: entered promiscuous mode [ 559.735050][T22474] bond8: entered promiscuous mode [ 559.740917][T22474] batadv0: entered promiscuous mode [ 559.748227][T22474] bond0: left promiscuous mode [ 559.753097][T22474] bond_slave_0: left promiscuous mode [ 559.762004][T22474] bond_slave_1: left promiscuous mode [ 559.768544][T22474] bond2: left promiscuous mode [ 559.773522][T22474] bond3: left promiscuous mode [ 559.779100][T22474] bond4: left promiscuous mode [ 559.784339][T22474] bond5: left promiscuous mode [ 559.792589][T22474] bond6: left promiscuous mode [ 559.799228][T22474] bond7: left promiscuous mode [ 559.804284][T22474] bond8: left promiscuous mode [ 559.810541][T22474] batadv0: left promiscuous mode [ 559.853002][ T5812] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 560.113584][T22500] netlink: 'syz.4.4504': attribute type 62 has an invalid length. [ 560.158016][T22503] openvswitch: netlink: IP tunnel dst address not specified [ 560.311488][T22514] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4508'. [ 560.607170][T22536] netlink: 76 bytes leftover after parsing attributes in process `syz.3.4514'. [ 560.811781][T22551] team0: Device ipvlan2 is already an upper device of the team interface [ 560.906798][ T5812] ip6_tunnel: ip6gretap0: Local routing loop detected! [ 561.111244][T22570] netlink: 208 bytes leftover after parsing attributes in process `syz.1.4521'. [ 561.658473][T22572] x_tables: (null)_tables: NFQUEUE.1 target: invalid size 8 (kernel) != (user) 16 [ 563.311339][T22517] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 563.480215][T22585] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4525'. [ 563.501193][T22583] veth1_macvtap: left promiscuous mode [ 563.517701][T22583] macsec0: entered promiscuous mode [ 563.522976][T22583] macsec0: entered allmulticast mode [ 563.533409][T22588] veth1_macvtap: entered promiscuous mode [ 563.541078][T22588] veth1_macvtap: entered allmulticast mode [ 563.553986][T22588] macsec0: left promiscuous mode [ 563.560102][T22588] macsec0: left allmulticast mode [ 563.565292][T22588] veth1_macvtap: left allmulticast mode [ 563.574859][T22591] bridge_slave_1: entered promiscuous mode [ 563.692791][T22604] syzkaller1: entered promiscuous mode [ 563.705091][T22607] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4529'. [ 563.730838][T22604] syzkaller1: entered allmulticast mode [ 563.746720][T22604] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4530'. [ 564.002194][T22624] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4535'. [ 564.285690][T22642] sctp: [Deprecated]: syz.2.4542 (pid 22642) Use of int in max_burst socket option deprecated. [ 564.285690][T22642] Use struct sctp_assoc_value instead [ 564.542271][T22653] bond6: entered promiscuous mode [ 564.595915][T22653] bond6: entered allmulticast mode [ 564.607452][T22653] 8021q: adding VLAN 0 to HW filter on device bond6 [ 564.766433][T22680] netlink: 16 bytes leftover after parsing attributes in process `syz.0.4552'. [ 565.363951][T22718] netlink: 56 bytes leftover after parsing attributes in process `syz.3.4562'. [ 565.522832][T22731] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4565'. [ 566.674774][ T25] block nbd6: Possible stuck request ffff8880275ee000: control (read@0,1024B). Runtime 150 seconds [ 566.688538][ T25] block nbd6: Possible stuck request ffff8880275ee1c0: control (read@1024,1024B). Runtime 150 seconds [ 566.700555][ T25] block nbd6: Possible stuck request ffff8880275ee380: control (read@2048,1024B). Runtime 150 seconds [ 566.711656][ T25] block nbd6: Possible stuck request ffff8880275ee540: control (read@3072,1024B). Runtime 150 seconds [ 566.742436][T22773] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4574'. [ 567.855360][ T8726] netdevsim netdevsim1 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 567.881366][ T8726] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 567.901330][ T8726] netdevsim netdevsim1 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 567.922172][T22790] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4577'. [ 567.935194][ T8726] netdevsim netdevsim1 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 567.957641][ T8726] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 567.970801][ T8726] netdevsim netdevsim1 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 567.982624][ T8726] netdevsim netdevsim1 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 567.992810][ T8726] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 568.003851][ T8726] netdevsim netdevsim1 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 568.016719][T22790] netlink: 'syz.1.4577': attribute type 3 has an invalid length. [ 568.030808][T22725] wlan1 speed is unknown, defaulting to 1000 [ 568.067936][T22725] vxcan1 speed is unknown, defaulting to 1000 [ 568.236856][T22801] xt_cgroup: path and classid specified [ 568.368313][T22810] batadv2: entered allmulticast mode [ 568.439549][T22819] netlink: 80 bytes leftover after parsing attributes in process `syz.1.4582'. [ 568.723992][T22830] netlink: 'syz.3.4587': attribute type 1 has an invalid length. [ 568.905394][T22830] 8021q: adding VLAN 0 to HW filter on device bond4 [ 569.072293][T22844] vlan2: entered allmulticast mode [ 569.090732][T22844] bond0: entered allmulticast mode [ 569.098811][T22844] bond_slave_0: entered allmulticast mode [ 569.104661][T22844] bond_slave_1: entered allmulticast mode [ 569.385426][T22854] netlink: 32 bytes leftover after parsing attributes in process `syz.4.4592'. [ 569.421074][T22866] openvswitch: netlink: Missing key (keys=40, expected=100) [ 569.478617][T22868] xt_socket: unknown flags 0x50 [ 569.834486][T22885] veth1_to_batadv: Caught tx_queue_len zero misconfig [ 571.116787][T22945] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4616'. [ 571.120081][T22946] netlink: 'syz.4.4617': attribute type 1 has an invalid length. [ 571.146786][T22946] netlink: 'syz.4.4617': attribute type 3 has an invalid length. [ 571.154819][T22946] netlink: 224 bytes leftover after parsing attributes in process `syz.4.4617'. [ 571.169174][T22947] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4615'. [ 571.195533][T22945] netlink: 'syz.1.4616': attribute type 1 has an invalid length. [ 571.204002][T22945] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4616'. [ 571.666586][T22966] syzkaller1: entered promiscuous mode [ 571.687445][T22966] syzkaller1: entered allmulticast mode [ 572.162505][T22999] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4632'. [ 572.220612][T23009] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4634'. [ 572.246675][T22999] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4632'. [ 572.279543][T23009] 8021q: adding VLAN 0 to HW filter on device bond5 [ 572.324549][T23012] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4637'. [ 572.366346][T23012] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4637'. [ 572.534200][T23025] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input7 [ 572.668801][T23035] netlink: 'syz.1.4640': attribute type 17 has an invalid length. [ 573.151870][ T14] bridge_slave_0: left allmulticast mode [ 573.165006][ T14] bridge_slave_0: left promiscuous mode [ 573.184604][ T14] bridge0: port 1(bridge_slave_0) entered disabled state [ 573.508833][ T14] bond7 (unregistering): (slave gretap2): Releasing active interface [ 573.643581][ T14] bond1 (unregistering): Released all slaves [ 573.659652][ T14] bond2 (unregistering): Released all slaves [ 573.674767][ T14] bond0 (unregistering): (slave bond3): Releasing active interface [ 573.686402][ T14] bond0 (unregistering): Released all slaves [ 573.702903][ T14] bond3 (unregistering): Released all slaves [ 573.729352][ T14] bond4 (unregistering): Released all slaves [ 573.754855][ T14] bond5 (unregistering): Released all slaves [ 573.780759][ T14] bond6 (unregistering): Released all slaves [ 573.797361][ T14] bond7 (unregistering): Released all slaves [ 573.812975][ T14] bond8 (unregistering): Released all slaves [ 573.831937][ T14] bond9 (unregistering): Released all slaves [ 573.845711][ T14] bond10 (unregistering): Released all slaves [ 573.863722][ T14] bond11 (unregistering): Released all slaves [ 573.884216][T23084] netlink: zone id is out of range [ 573.890863][T23084] netlink: zone id is out of range [ 573.899152][T23084] netlink: zone id is out of range [ 573.904472][T23084] netlink: zone id is out of range [ 573.910215][T23084] netlink: zone id is out of range [ 573.919734][T23084] netlink: zone id is out of range [ 573.925038][T23072] lo: left promiscuous mode [ 573.932271][T23084] netlink: zone id is out of range [ 573.952786][T23084] netlink: zone id is out of range [ 574.092394][T23072] bridge0: port 1(bridge_slave_0) entered disabled state [ 574.222609][T23072] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 574.378217][ T14] tipc: Disabling bearer [ 574.394193][ T14] tipc: Left network mode [ 574.868658][T23110] syzkaller0: entered promiscuous mode [ 574.891965][T23110] syzkaller0: entered allmulticast mode [ 574.950184][T23122] __nla_validate_parse: 2 callbacks suppressed [ 574.950203][T23122] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4666'. [ 575.061992][T23124] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 575.101077][T23121] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 575.111753][T23120] nbd3: detected capacity change from 0 to 63 [ 575.178174][T21320] block nbd3: Receive control failed (result -104) [ 575.540843][T23153] tunl0: entered promiscuous mode [ 575.574307][T23153] netlink: 'syz.1.4675': attribute type 4 has an invalid length. [ 575.587997][T23153] netlink: 9 bytes leftover after parsing attributes in process `syz.1.4675'. [ 576.263592][T23188] syzkaller0: entered promiscuous mode [ 576.333203][T23188] syzkaller0: entered allmulticast mode [ 576.611610][T23211] xt_hashlimit: size too large, truncated to 1048576 [ 576.693017][T23212] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4690'. [ 576.894539][T23216] RDS: rds_bind could not find a transport for fe80::, load rds_tcp or rds_rdma? [ 576.925001][T23216] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4692'. [ 577.909937][T23244] bond0: entered promiscuous mode [ 577.921048][T23244] batadv0: entered promiscuous mode [ 577.929064][T23244] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 577.942354][T23244] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 577.955708][T23244] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 577.963513][T23244] bond0: left promiscuous mode [ 577.969166][T23244] batadv0: left promiscuous mode [ 577.985603][T23259] syzkaller0: entered promiscuous mode [ 577.991795][T23259] syzkaller0: entered allmulticast mode [ 578.105512][T23270] netlink: 'syz.2.4704': attribute type 1 has an invalid length. [ 578.273942][T23270] bond13: entered promiscuous mode [ 578.301543][T23270] 8021q: adding VLAN 0 to HW filter on device bond13 [ 578.333802][T23281] netlink: 'syz.3.4706': attribute type 3 has an invalid length. [ 578.361803][T23274] bond13: (slave bridge7): making interface the new active one [ 578.370922][T23274] bridge7: entered promiscuous mode [ 578.378615][T23274] bond13: (slave bridge7): Enslaving as an active interface with an up link [ 578.621650][ T14] IPVS: stop unused estimator thread 0... [ 578.732565][T23294] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4710'. [ 578.924203][T23300] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4713'. [ 579.047234][T23307] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4714'. [ 579.122382][T23310] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4716'. [ 579.170891][T23313] syzkaller0: entered promiscuous mode [ 579.177529][T23313] syzkaller0: entered allmulticast mode [ 579.394506][T23327] netlink: 808 bytes leftover after parsing attributes in process `syz.2.4721'. [ 579.424977][T23330] netlink: 808 bytes leftover after parsing attributes in process `syz.2.4721'. [ 579.722768][T23349] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 579.763367][T23349] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 579.878253][T23349] netdevsim netdevsim0 netdevsim0: left promiscuous mode [ 580.095647][T23349] bond2: left promiscuous mode [ 580.133891][T23349] bond3: left promiscuous mode [ 580.149242][T23349] bond3: left allmulticast mode [ 580.157705][T23349] veth0_to_bond: left allmulticast mode [ 580.169044][T23349] veth9: left allmulticast mode [ 580.179560][T23349] geneve2: left promiscuous mode [ 580.209142][ T14] netdevsim netdevsim0 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 580.221840][ T14] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.231642][ T14] netdevsim netdevsim0 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 580.244910][ T14] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.254231][ T14] netdevsim netdevsim0 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 580.263505][ T14] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.278760][T23361] syzkaller0: entered promiscuous mode [ 580.296639][T23361] syzkaller0: entered allmulticast mode [ 580.312003][T23379] syzkaller0: entered promiscuous mode [ 580.331847][T23379] syzkaller0: entered allmulticast mode [ 580.350571][ T14] netdevsim netdevsim0 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 580.361583][ T14] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 580.586215][T21320] Bluetooth: hci2: command 0x0406 tx timeout [ 580.658568][T23410] netlink: 'syz.3.4741': attribute type 4 has an invalid length. [ 580.681600][T23409] netlink: 'syz.3.4741': attribute type 4 has an invalid length. [ 580.700869][T23406] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4740'. [ 580.719181][T23406] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 580.783709][T23417] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4744'. [ 580.897599][T23417] tipc: Started in network mode [ 580.916929][T23417] tipc: Node identity e2ea417f70ec, cluster identity 4711 [ 580.934473][T23417] tipc: Enabled bearer , priority 0 [ 580.957628][T23423] netlink: 'syz.4.4746': attribute type 2 has an invalid length. [ 580.988814][T23417] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 581.008206][T23428] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 581.099881][T23416] tipc: Disabling bearer [ 581.109086][T23436] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci2/hci2:200/input8 [ 581.137146][T23438] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4750'. [ 581.398471][T23456] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4758'. [ 581.591780][T23467] netlink: 300 bytes leftover after parsing attributes in process `syz.1.4761'. [ 581.611889][T23468] netlink: 'syz.0.4760': attribute type 1 has an invalid length. [ 581.661846][T23468] 8021q: adding VLAN 0 to HW filter on device bond5 [ 581.685354][T23468] bond3: (slave veth0_to_bond): Releasing active interface [ 581.711925][T23468] veth0_to_bond: left promiscuous mode [ 581.745022][T23468] bond5: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 581.771523][T23474] macvlan2: entered promiscuous mode [ 581.777113][T23474] macvlan2: entered allmulticast mode [ 581.783316][T23474] bond5: entered promiscuous mode [ 581.792480][T23474] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 581.801180][T23474] bond5: (slave macvlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 581.829603][T23480] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4765'. [ 581.837782][T23473] netlink: 'syz.2.4763': attribute type 1 has an invalid length. [ 581.841202][T23480] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4765'. [ 581.855392][T23480] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4765'. [ 581.873602][T23474] bond5: left promiscuous mode [ 581.958477][T23485] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 582.009936][T23489] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4769'. [ 582.082707][T23494] netlink: 'syz.0.4770': attribute type 1 has an invalid length. [ 582.091764][T23494] netlink: 'syz.0.4770': attribute type 4 has an invalid length. [ 582.100106][T23494] netlink: 9422 bytes leftover after parsing attributes in process `syz.0.4770'. [ 582.129277][T23497] Cannot find del_set index 0 as target [ 582.224760][T23502] Cannot find del_set index 0 as target [ 582.371795][T23512] nbd: couldn't find a device at index 0 [ 583.080856][T23560] 8021q: VLANs not supported on ip6_vti0 [ 583.424649][T23588] siw: device registration error -23 [ 583.482165][T23593] xt_TCPMSS: Only works on TCP SYN packets [ 583.656480][T23600] netlink: 'syz.1.4799': attribute type 3 has an invalid length. [ 584.183779][T23633] tipc: Started in network mode [ 584.195358][T23633] tipc: Node identity 6e71e3c70651, cluster identity 5 [ 584.226346][T23633] tipc: Enabled bearer , priority 0 [ 584.358512][T23633] syzkaller0: entered promiscuous mode [ 584.375151][T23633] syzkaller0: entered allmulticast mode [ 584.394081][T23633] tipc: Resetting bearer [ 584.593626][T15071] tipc: Resetting bearer [ 584.600700][T23632] tipc: Resetting bearer [ 584.786332][T23669] openvswitch: netlink: Tunnel attr 68 out of range max 16 [ 586.851689][T23632] tipc: Disabling bearer [ 586.865501][T23661] bridge0: the hash_elasticity option has been deprecated and is always 16 [ 586.876393][T23668] macsec0: entered promiscuous mode [ 586.884776][T23668] macsec0: entered allmulticast mode [ 586.898177][T23669] veth1_macvtap: entered allmulticast mode [ 586.923704][T23669] macsec0: left promiscuous mode [ 586.944889][T23669] macsec0: left allmulticast mode [ 586.955353][T23669] veth1_macvtap: left allmulticast mode [ 586.975154][ T29] tipc: Node number set to 1746985927 [ 586.992361][T23672] workqueue: Failed to create a rescuer kthread for wq "bond6": -EINTR [ 587.174921][T15082] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 587.203856][T15082] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 587.240054][T23695] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 587.262590][T23693] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 587.276526][T23695] netlink: 'syz.0.4824': attribute type 1 has an invalid length. [ 588.609042][T23705] veth0_to_team: Caught tx_queue_len zero misconfig [ 588.664133][T15086] netdevsim netdevsim4 netdevsim0: unset [0, 0] type 1 family 0 port 256 - 0 [ 588.704539][T15086] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.747148][ T14] netdevsim netdevsim4 netdevsim1: unset [0, 0] type 1 family 0 port 256 - 0 [ 588.792565][ T14] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.843417][ T14] netdevsim netdevsim4 netdevsim2: unset [0, 0] type 1 family 0 port 256 - 0 [ 588.893864][ T14] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.913698][T23735] xt_hashlimit: size too large, truncated to 1048576 [ 588.924045][ T14] netdevsim netdevsim4 netdevsim3: unset [0, 0] type 1 family 0 port 256 - 0 [ 588.950315][ T14] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 588.999306][T23747] bridge_slave_0 (unregistering): left allmulticast mode [ 589.048872][T23747] bridge_slave_0 (unregistering): left promiscuous mode [ 589.076883][T23747] bridge0: port 1(bridge_slave_0) entered disabled state [ 589.235434][T23752] __nla_validate_parse: 7 callbacks suppressed [ 589.235452][T23752] netlink: 40 bytes leftover after parsing attributes in process `syz.3.4832'. [ 589.364712][T23765] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4836'. [ 589.658002][T23787] netlink: 'syz.2.4843': attribute type 1 has an invalid length. [ 589.689655][T23781] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4840'. [ 589.867949][T23787] 8021q: adding VLAN 0 to HW filter on device bond15 [ 589.902861][T23790] vlan3: entered allmulticast mode [ 589.910343][T23790] veth0_to_bond: entered allmulticast mode [ 589.932368][T23790] bond15: (slave vlan3): Opening slave failed [ 590.041400][T23800] macsec2: entered allmulticast mode [ 590.056759][T23800] bond0: entered allmulticast mode [ 590.071008][T23800] 8021q: adding VLAN 0 to HW filter on device macsec2 [ 590.551900][T23837] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4853'. [ 590.588956][T23837] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4853'. [ 590.650636][T23837] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4853'. [ 590.893840][T23852] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 590.963682][T23852] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 591.212825][T23864] siw: device registration error -23 [ 593.847733][ T14] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.857167][ T14] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.887797][ T14] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.914737][ T14] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 594.147972][T23914] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4864'. [ 594.223171][T23917] netlink: 'syz.4.4866': attribute type 11 has an invalid length. [ 594.256976][T23917] netlink: 'syz.4.4866': attribute type 11 has an invalid length. [ 594.274267][T23917] netlink: 'syz.4.4866': attribute type 11 has an invalid length. [ 594.290873][T23917] netlink: 'syz.4.4866': attribute type 11 has an invalid length. [ 594.312714][T23917] netlink: 'syz.4.4866': attribute type 11 has an invalid length. [ 594.323324][T23920] netlink: 240 bytes leftover after parsing attributes in process `syz.1.4867'. [ 594.338570][T23917] netlink: 'syz.4.4866': attribute type 11 has an invalid length. [ 594.362776][T23917] netlink: 'syz.4.4866': attribute type 11 has an invalid length. [ 594.387449][T23917] netlink: 'syz.4.4866': attribute type 11 has an invalid length. [ 594.407842][T23917] netlink: 'syz.4.4866': attribute type 11 has an invalid length. [ 594.429863][T23917] netlink: 'syz.4.4866': attribute type 11 has an invalid length. [ 594.439572][T23930] syzkaller0: entered promiscuous mode [ 594.446005][T23930] syzkaller0: entered allmulticast mode [ 594.451151][T23932] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 594.863619][T23961] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4878'. [ 594.903182][T23964] tunl0: entered promiscuous mode [ 594.916637][T23964] netlink: 9 bytes leftover after parsing attributes in process `syz.0.4879'. [ 594.938696][T23964] syzkaller0: entered promiscuous mode [ 594.944287][T23964] syzkaller0: entered allmulticast mode [ 594.957065][T23964] netlink: 52 bytes leftover after parsing attributes in process `syz.0.4879'. [ 595.435149][T23982] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4886'. [ 595.691274][T23991] bond6: invalid ARP target 0.0.0.0 specified for addition [ 595.702143][T23991] bond6: option arp_ip_target: invalid value (0) [ 595.711559][T23991] bond6 (unregistering): Released all slaves [ 595.826559][T24002] bond8: entered promiscuous mode [ 595.831767][T24002] bond8: entered allmulticast mode [ 595.839085][T24002] 8021q: adding VLAN 0 to HW filter on device bond8 [ 595.948468][T23976] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 595.967534][T24009] netlink: 33 bytes leftover after parsing attributes in process `syz.4.4892'. [ 595.978871][T24008] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 595.986852][T23976] llcp: nfc_llcp_send_ui_frame: Could not allocate PDU (error=-512) [ 596.010796][T24013] Bluetooth: hci0: Opcode 0x080f failed: -22 [ 596.017117][T24009] netlink: 140 bytes leftover after parsing attributes in process `syz.4.4892'. [ 596.085643][T24009] netlink: 33 bytes leftover after parsing attributes in process `syz.4.4892'. [ 596.567526][T24045] x_tables: duplicate underflow at hook 1 [ 596.608029][T24015] erspan0: entered promiscuous mode [ 596.627151][T24015] erspan0: entered allmulticast mode [ 596.699608][T24050] hsr_slave_0: left promiscuous mode [ 596.717368][T24050] hsr_slave_1: left promiscuous mode [ 596.753267][ T25] block nbd6: Possible stuck request ffff8880275ee000: control (read@0,1024B). Runtime 180 seconds [ 596.764530][ T25] block nbd6: Possible stuck request ffff8880275ee1c0: control (read@1024,1024B). Runtime 180 seconds [ 596.776353][ T25] block nbd6: Possible stuck request ffff8880275ee380: control (read@2048,1024B). Runtime 180 seconds [ 596.787863][ T25] block nbd6: Possible stuck request ffff8880275ee540: control (read@3072,1024B). Runtime 180 seconds [ 596.812231][T15086] nci: nci_add_new_protocol: the target found does not have the desired protocol [ 596.994826][T24073] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4905'. [ 597.342891][T24086] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4912'. [ 599.702879][T24052] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 599.716785][T24060] netlink: 'syz.0.4905': attribute type 11 has an invalid length. [ 599.727447][T24060] __nla_validate_parse: 1 callbacks suppressed [ 599.727464][T24060] netlink: 224 bytes leftover after parsing attributes in process `syz.0.4905'. [ 600.246054][T24178] xt_cgroup: path and classid specified [ 600.504501][T24209] openvswitch: netlink: Unknown key attributes 20 [ 600.617513][T24207] validate_nla: 26 callbacks suppressed [ 600.617531][T24207] netlink: 'syz.3.4931': attribute type 9 has an invalid length. [ 600.731972][T24221] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4935'. [ 600.899503][T24241] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 600.973642][T24246] netlink: 28 bytes leftover after parsing attributes in process `syz.0.4940'. [ 601.116019][T24256] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4943'. [ 601.210572][T24256] 8021q: adding VLAN 0 to HW filter on device bond9 [ 601.250106][T24271] netlink: 12 bytes leftover after parsing attributes in process `syz.3.4946'. [ 601.343020][T21320] block nbd4: Receive control failed (result -107) [ 601.449158][T24279] netlink: 'syz.2.4949': attribute type 8 has an invalid length. [ 601.459230][T24279] netlink: 16 bytes leftover after parsing attributes in process `syz.2.4949'. [ 601.495452][T24279] bond0: Caught tx_queue_len zero misconfig [ 601.505559][T24279] netlink: 6 bytes leftover after parsing attributes in process `syz.2.4949'. [ 601.707509][T24295] bond6: option lp_interval: invalid value (0) [ 601.711632][T24300] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4957'. [ 601.713738][T24295] bond6: option lp_interval: allowed values 1 - 2147483647 [ 601.731689][T24295] bond6 (unregistering): Released all slaves [ 601.821846][T21320] block nbd7: Receive control failed (result -32) [ 601.870543][T24307] netlink: 'syz.0.4959': attribute type 32 has an invalid length. [ 601.879072][T24307] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4959'. [ 601.930812][T24307] bond6: option coupled_control: invalid value (192) [ 601.942215][T24307] bond6 (unregistering): Released all slaves [ 602.134061][T24324] netlink: 8 bytes leftover after parsing attributes in process `syz.3.4963'. [ 602.313866][T24338] netlink: 'syz.3.4968': attribute type 3 has an invalid length. [ 602.433796][T24338] [ 602.436171][T24338] ====================================================== [ 602.443237][T24338] WARNING: possible circular locking dependency detected [ 602.450419][T24338] syzkaller #0 Not tainted [ 602.454947][T24338] ------------------------------------------------------ [ 602.462040][T24338] syz.3.4968/24338 is trying to acquire lock: [ 602.468184][T24338] ffffffff8f3021c8 (crypto_alg_sem){++++}-{4:4}, at: crypto_alg_mod_lookup+0x20e/0x5d0 [ 602.478285][T24338] [ 602.478285][T24338] but task is already holding lock: [ 602.485644][T24338] ffff8880719fd360 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tls_setsockopt+0x393/0x1710 [ 602.495081][T24338] [ 602.495081][T24338] which lock already depends on the new lock. [ 602.495081][T24338] [ 602.505474][T24338] [ 602.505474][T24338] the existing dependency chain (in reverse order) is: [ 602.514487][T24338] [ 602.514487][T24338] -> #8 (sk_lock-AF_INET6){+.+.}-{0:0}: [ 602.522322][T24338] lock_sock_nested+0x41/0x100 [ 602.527680][T24338] inet_shutdown+0x6a/0x390 [ 602.532747][T24338] nbd_mark_nsock_dead+0x2cb/0x550 [ 602.538449][T24338] recv_work+0x1cee/0x1e10 [ 602.543420][T24338] process_scheduled_works+0xa8e/0x14e0 [ 602.549507][T24338] worker_thread+0xa47/0xfb0 [ 602.554609][T24338] kthread+0x388/0x470 [ 602.559187][T24338] ret_from_fork+0x514/0xb70 [ 602.564320][T24338] ret_from_fork_asm+0x1a/0x30 [ 602.569606][T24338] [ 602.569606][T24338] -> #7 (&nsock->tx_lock){+.+.}-{4:4}: [ 602.577242][T24338] __mutex_lock+0x19d/0x1550 [ 602.582452][T24338] nbd_queue_rq+0x373/0x1150 [ 602.587559][T24338] blk_mq_dispatch_rq_list+0x499/0x1990 [ 602.593678][T24338] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 602.600595][T24338] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 602.607094][T24338] blk_mq_run_work_fn+0x16c/0x300 [ 602.612627][T24338] process_scheduled_works+0xa8e/0x14e0 [ 602.618682][T24338] worker_thread+0xa47/0xfb0 [ 602.623782][T24338] kthread+0x388/0x470 [ 602.628363][T24338] ret_from_fork+0x514/0xb70 [ 602.633474][T24338] ret_from_fork_asm+0x1a/0x30 [ 602.638743][T24338] [ 602.638743][T24338] -> #6 (&cmd->lock){+.+.}-{4:4}: [ 602.645942][T24338] __mutex_lock+0x19d/0x1550 [ 602.651044][T24338] nbd_queue_rq+0xc1/0x1150 [ 602.656065][T24338] blk_mq_dispatch_rq_list+0x499/0x1990 [ 602.662123][T24338] __blk_mq_sched_dispatch_requests+0xd36/0x1580 [ 602.668973][T24338] blk_mq_sched_dispatch_requests+0xd7/0x190 [ 602.675470][T24338] blk_mq_run_work_fn+0x16c/0x300 [ 602.681002][T24338] process_scheduled_works+0xa8e/0x14e0 [ 602.687057][T24338] worker_thread+0xa47/0xfb0 [ 602.692164][T24338] kthread+0x388/0x470 [ 602.696744][T24338] ret_from_fork+0x514/0xb70 [ 602.701851][T24338] ret_from_fork_asm+0x1a/0x30 [ 602.707124][T24338] [ 602.707124][T24338] -> #5 (set->srcu){.+.+}-{0:0}: [ 602.714238][T24338] __synchronize_srcu+0xc9/0x2f0 [ 602.719718][T24338] elevator_switch+0x1e8/0x7b0 [ 602.725055][T24338] elevator_change+0x2fa/0x480 [ 602.730330][T24338] elevator_set_default+0x375/0x440 [ 602.736045][T24338] blk_register_queue+0x3f3/0x4e0 [ 602.741670][T24338] __add_disk+0x6cb/0xe30 [ 602.746524][T24338] add_disk_fwnode+0xfb/0x4b0 [ 602.751719][T24338] nbd_dev_add+0x733/0xb60 [ 602.756657][T24338] nbd_init+0x15f/0x1e0 [ 602.761453][T24338] do_one_initcall+0x250/0x870 [ 602.766737][T24338] do_initcall_level+0x10a/0x1a0 [ 602.772190][T24338] do_initcalls+0x59/0xa0 [ 602.777026][T24338] kernel_init_freeable+0x29d/0x3e0 [ 602.782750][T24338] kernel_init+0x1d/0x1d0 [ 602.787603][T24338] ret_from_fork+0x514/0xb70 [ 602.792715][T24338] ret_from_fork_asm+0x1a/0x30 [ 602.797993][T24338] [ 602.797993][T24338] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 602.805823][T24338] __mutex_lock+0x19d/0x1550 [ 602.810941][T24338] elevator_change+0x1af/0x480 [ 602.816217][T24338] elevator_set_none+0xb5/0x140 [ 602.821583][T24338] blk_mq_update_nr_hw_queues+0x5ef/0x19f0 [ 602.827902][T24338] nbd_start_device+0x189/0xb30 [ 602.833265][T24338] nbd_genl_connect+0x1597/0x1c10 [ 602.838809][T24338] genl_family_rcv_msg_doit+0x233/0x340 [ 602.844952][T24338] genl_rcv_msg+0x614/0x7a0 [ 602.849961][T24338] netlink_rcv_skb+0x226/0x4a0 [ 602.855274][T24338] genl_rcv+0x28/0x40 [ 602.859762][T24338] netlink_unicast+0x7bb/0x940 [ 602.865039][T24338] netlink_sendmsg+0x813/0xb40 [ 602.870331][T24338] sock_sendmsg_nosec+0x13a/0x180 [ 602.875962][T24338] ____sys_sendmsg+0x54e/0x850 [ 602.881253][T24338] ___sys_sendmsg+0x2a5/0x360 [ 602.886439][T24338] __x64_sys_sendmsg+0x1b1/0x290 [ 602.891888][T24338] do_syscall_64+0x174/0x580 [ 602.897069][T24338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.903494][T24338] [ 602.903494][T24338] -> #3 (&q->q_usage_counter(io)#51){++++}-{0:0}: [ 602.912101][T24338] blk_alloc_queue+0x544/0x690 [ 602.917377][T24338] __blk_mq_alloc_disk+0x194/0x390 [ 602.922999][T24338] nbd_dev_add+0x494/0xb60 [ 602.927928][T24338] nbd_init+0x15f/0x1e0 [ 602.932596][T24338] do_one_initcall+0x250/0x870 [ 602.937871][T24338] do_initcall_level+0x10a/0x1a0 [ 602.943318][T24338] do_initcalls+0x59/0xa0 [ 602.948153][T24338] kernel_init_freeable+0x29d/0x3e0 [ 602.953866][T24338] kernel_init+0x1d/0x1d0 [ 602.958705][T24338] ret_from_fork+0x514/0xb70 [ 602.963815][T24338] ret_from_fork_asm+0x1a/0x30 [ 602.969096][T24338] [ 602.969096][T24338] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 602.976295][T24338] fs_reclaim_acquire+0x71/0x100 [ 602.981781][T24338] __kmalloc_cache_noprof+0x61/0x660 [ 602.987583][T24338] cryptomgr_notify+0x85/0x920 [ 602.992921][T24338] notifier_call_chain+0x1a5/0x3d0 [ 602.998544][T24338] blocking_notifier_call_chain+0x6a/0x90 [ 603.004776][T24338] crypto_alg_mod_lookup+0x390/0x5d0 [ 603.010574][T24338] crypto_alloc_tfm_node+0x135/0x3e0 [ 603.016370][T24338] public_key_verify_signature+0x242/0x9e0 [ 603.022762][T24338] x509_check_for_self_signed+0x326/0x430 [ 603.029003][T24338] x509_cert_parse+0x622/0x7a0 [ 603.034712][T24338] x509_key_preparse+0x64/0x6d0 [ 603.040072][T24338] asymmetric_key_preparse+0xb9/0x1b0 [ 603.045954][T24338] __key_create_or_update+0x3a9/0xa80 [ 603.051906][T24338] key_create_or_update+0x42/0x60 [ 603.057445][T24338] x509_load_certificate_list+0x13d/0x280 [ 603.063702][T24338] load_builtin_regdb_keys+0xae/0xe0 [ 603.069606][T24338] regulatory_init_db+0x30/0x290 [ 603.075073][T24338] do_one_initcall+0x250/0x870 [ 603.080356][T24338] do_initcall_level+0x10a/0x1a0 [ 603.085807][T24338] do_initcalls+0x59/0xa0 [ 603.090656][T24338] kernel_init_freeable+0x29d/0x3e0 [ 603.096366][T24338] kernel_init+0x1d/0x1d0 [ 603.101208][T24338] ret_from_fork+0x514/0xb70 [ 603.106313][T24338] ret_from_fork_asm+0x1a/0x30 [ 603.111591][T24338] [ 603.111591][T24338] -> #1 ((crypto_chain).rwsem){++++}-{4:4}: [ 603.119657][T24338] down_read+0x4a/0x330 [ 603.124334][T24338] blocking_notifier_call_chain+0x54/0x90 [ 603.130564][T24338] __crypto_register_alg+0x31f/0x3b0 [ 603.136358][T24338] crypto_register_alg+0x44a/0x820 [ 603.141975][T24338] do_one_initcall+0x250/0x870 [ 603.147254][T24338] do_initcall_level+0x10a/0x1a0 [ 603.152702][T24338] do_initcalls+0x59/0xa0 [ 603.157542][T24338] kernel_init_freeable+0x29d/0x3e0 [ 603.163249][T24338] kernel_init+0x1d/0x1d0 [ 603.168082][T24338] ret_from_fork+0x514/0xb70 [ 603.173187][T24338] ret_from_fork_asm+0x1a/0x30 [ 603.178466][T24338] [ 603.178466][T24338] -> #0 (crypto_alg_sem){++++}-{4:4}: [ 603.186012][T24338] __lock_acquire+0x1520/0x2cf0 [ 603.191406][T24338] lock_acquire+0x106/0x350 [ 603.196422][T24338] down_write+0x96/0x200 [ 603.201179][T24338] crypto_alg_mod_lookup+0x20e/0x5d0 [ 603.206982][T24338] crypto_alloc_tfm_node+0x135/0x3e0 [ 603.212789][T24338] tls_set_sw_offload+0xa2b/0x1770 [ 603.218412][T24338] tls_setsockopt+0x10c5/0x1710 [ 603.223768][T24338] do_sock_setsockopt+0x17c/0x1b0 [ 603.229306][T24338] __x64_sys_setsockopt+0x13d/0x1b0 [ 603.235018][T24338] do_syscall_64+0x174/0x580 [ 603.240118][T24338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 603.246520][T24338] [ 603.246520][T24338] other info that might help us debug this: [ 603.246520][T24338] [ 603.256728][T24338] Chain exists of: [ 603.256728][T24338] crypto_alg_sem --> &nsock->tx_lock --> sk_lock-AF_INET6 [ 603.256728][T24338] [ 603.269752][T24338] Possible unsafe locking scenario: [ 603.269752][T24338] [ 603.277242][T24338] CPU0 CPU1 [ 603.282659][T24338] ---- ---- [ 603.288128][T24338] lock(sk_lock-AF_INET6); [ 603.292622][T24338] lock(&nsock->tx_lock); [ 603.299543][T24338] lock(sk_lock-AF_INET6); [ 603.306555][T24338] lock(crypto_alg_sem); [ 603.310875][T24338] [ 603.310875][T24338] *** DEADLOCK *** [ 603.310875][T24338] [ 603.319063][T24338] 1 lock held by syz.3.4968/24338: [ 603.324200][T24338] #0: ffff8880719fd360 (sk_lock-AF_INET6){+.+.}-{0:0}, at: tls_setsockopt+0x393/0x1710 [ 603.333953][T24338] [ 603.333953][T24338] stack backtrace: [ 603.339833][T24338] CPU: 0 UID: 0 PID: 24338 Comm: syz.3.4968 Not tainted syzkaller #0 PREEMPT(full) [ 603.339864][T24338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 603.339891][T24338] Call Trace: [ 603.339948][T24338] [ 603.339961][T24338] dump_stack_lvl+0xe8/0x150 [ 603.339987][T24338] print_circular_bug+0x2e1/0x300 [ 603.340004][T24338] check_noncircular+0x12e/0x150 [ 603.340029][T24338] __lock_acquire+0x1520/0x2cf0 [ 603.340059][T24338] ? crypto_alg_mod_lookup+0x20e/0x5d0 [ 603.340086][T24338] lock_acquire+0x106/0x350 [ 603.340104][T24338] ? crypto_alg_mod_lookup+0x20e/0x5d0 [ 603.340131][T24338] down_write+0x96/0x200 [ 603.340152][T24338] ? crypto_alg_mod_lookup+0x20e/0x5d0 [ 603.340173][T24338] ? __pfx_down_write+0x10/0x10 [ 603.340198][T24338] ? __init_swait_queue_head+0xa8/0x150 [ 603.340229][T24338] ? crypto_larval_alloc+0x1bf/0x290 [ 603.340251][T24338] crypto_alg_mod_lookup+0x20e/0x5d0 [ 603.340273][T24338] crypto_alloc_tfm_node+0x135/0x3e0 [ 603.340298][T24338] tls_set_sw_offload+0xa2b/0x1770 [ 603.340326][T24338] tls_setsockopt+0x10c5/0x1710 [ 603.340345][T24338] ? __pfx_tls_setsockopt+0x10/0x10 [ 603.340363][T24338] ? __fget_files+0x2a/0x420 [ 603.340393][T24338] ? aa_sock_opt_perm+0xff/0x1a0 [ 603.340436][T24338] ? sock_common_setsockopt+0x36/0xc0 [ 603.340454][T24338] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 603.340472][T24338] do_sock_setsockopt+0x17c/0x1b0 [ 603.340495][T24338] __x64_sys_setsockopt+0x13d/0x1b0 [ 603.340516][T24338] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 603.340532][T24338] do_syscall_64+0x174/0x580 [ 603.340551][T24338] ? trace_irq_disable+0x3b/0x140 [ 603.340585][T24338] ? clear_bhb_loop+0x40/0x90 [ 603.340601][T24338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 603.340617][T24338] RIP: 0033:0x7f1d7a59de59 [ 603.340656][T24338] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 603.340669][T24338] RSP: 002b:00007f1d7b551028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 603.340714][T24338] RAX: ffffffffffffffda RBX: 00007f1d7a825fa0 RCX: 00007f1d7a59de59 [ 603.340725][T24338] RDX: 0000000000000002 RSI: 000000000000011a RDI: 000000000000000a [ 603.340734][T24338] RBP: 00007f1d7a633e6f R08: 0000000000000038 R09: 0000000000000000 [ 603.340743][T24338] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 603.340752][T24338] R13: 00007f1d7a826038 R14: 00007f1d7a825fa0 R15: 00007ffe6695fef8 [ 603.340770][T24338] [ 605.707436][T16164] block nbd3: Possible stuck request ffff8880274a7000: control (read@0,1024B). Runtime 30 seconds [ 605.719126][T16164] block nbd3: Possible stuck request ffff8880274a71c0: control (read@1024,3072B). Runtime 30 seconds [ 606.752503][ T4993] udevd[4993]: worker [8424] /devices/virtual/block/nbd6 timeout; kill it [ 606.761144][ T4993] udevd[4993]: seq 21410 '/devices/virtual/block/nbd6' killed